Under PSD3, every EU payment institution and every institution issuing e-money must protect customer funds that are still held at the end of the business day after receipt. The methods are familiar: segregation in a separate account at a credit institution or central bank, investment in secure, liquid, low-risk assets, or an insurance policy or comparable guarantee from outside the group. What changes is the timing for e-money, a duty to manage concentration risk, new information duties to users and an advance notification duty to the regulator.
This article is a working checklist for compliance teams. It assumes the reader knows the PSD2 rules and needs to know what to test, change and evidence before the institution files for PSD3 re-authorisation.
The rule in one table
| Element | PSD3 position | Source |
|---|---|---|
| Timing | Funds held at the end of the business day after receipt are safeguarded | Article 9 |
| Segregation | Not commingled with funds of anyone other than users | Article 9 |
| Where held | Separate account at an EU credit institution or a central bank, or secure liquid low-risk assets | Article 9 |
| Alternative | Insurance policy or comparable guarantee from an unconnected insurer or bank | Article 9 |
| Insulation | Protected under national law against other creditors, especially in insolvency | Article 9 |
| Amount | Equal to users' claims, including where credit lines or net settlement apply | Recital 25 |
| Concentration | Endeavour not to hold all funds with one credit institution; EBA standards to follow | Recital 26 |
| Central bank accounts | At the central bank's discretion; refusal to be justified | Recital 26 |
| User information | Method, location of funds and applicable insolvency law, before contract and before material changes | Recital 24 |
Checklist 1: flows and timing
Start with a map of how money moves. Without it, the timing test cannot be evidenced.
- Every inbound route listed: card acquiring settlements, bank transfers, direct debits, cash through agents, top-ups through distributors.
- Every outbound route listed, with the point at which funds leave the institution's control.
- For each route, the time funds are received and the time they reach the safeguarding account.
- Exceptions identified where funds pass to the payee's provider or a single intermediary before the deadline, which PSD3 treats differently.
- Bank holidays and weekends handled, including in non-euro currencies.
For an EMI moving from five day timing, this map usually shows where batching happens today. The fix is a daily transfer with a defined cut-off, backed by a written procedure and an owner in finance. Test the procedure over a month-end and a bank holiday before relying on it, because those are the days when timing slips. Where an institution receives funds in several currencies, set the cut-off by currency and by bank, and record any day on which the deadline was missed, with the reason and the fix.
Checklist 2: accounts and legal protection
- Each safeguarding account identified, with currency, bank and purpose.
- An acknowledgement letter for each account confirming it holds users' funds and that the bank waives set-off for the institution's own debts.
- Account names and designations consistent with the letters and the policy.
- Legal analysis, for the home member state, of how safeguarded funds are treated in insolvency.
- For investment: a list of approved assets, custody arrangements and a liquidity analysis showing redemptions can be met daily.
- For insurance or guarantee: the provider is outside the group, cover equals the amount owed, and pay-out terms are prompt and unconditional on insolvency.
Checklist 3: reconciliation
The safeguarded amount must equal what the institution owes users. Recital 25 of the Council text makes clear this applies even where an institution uses credit lines or net settlement and so receives less than the gross amount owed.
| Control | Frequency | Evidence |
|---|---|---|
| Internal reconciliation of user balances against the ledger | Daily | Signed reconciliation and break log |
| External reconciliation of the ledger against bank and custody statements | Daily | Statements matched with breaks explained |
| Shortfall top-up from the institution's own funds | Same day | Payment record and approval |
| Excess withdrawal back to operating account | After reconciliation | Approval and calculation |
| Break ageing and escalation | Daily, with weekly review | Ageing report and escalation record |
| Management information to the board | Monthly | Board pack extract |
Breaks that are left open for days are the most common finding in safeguarding reviews. Set an escalation route and keep the log. Where a shortfall is found, top it up from the institution's own funds the same day and record the cause. Where there is an excess, withdraw it only after the reconciliation is signed off, so the account is never left short by a premature transfer. Regulators reading the file will look for both patterns in the records.
Checklist 4: concentration and banking resilience
PSD3 requires institutions to endeavour not to hold all customer funds with one credit institution. The EBA will set out when concentration must be avoided and how safeguarded funds should be managed.
- Current exposure by bank, as a share of safeguarded funds.
- A target allocation and a plan to reach it.
- A second safeguarding relationship in place or in progress.
- Credit quality of each bank monitored, with triggers to move funds.
- Contingency if a bank closes the account at short notice.
Central bank accounts are available only at the central bank's discretion. The ECB has indicated that Eurosystem central banks should not offer them to non-bank payment providers and crypto firms, so institutions should plan on commercial banks.
Checklist 5: user information and notifications
PSD3 requires users to be told, before they enter into a contract and before any material change, the safeguarding method used, where funds are held and which member state's insolvency law applies, with where a claim would be raised. Institutions must also notify their regulator in advance of material changes to safeguarding.
- Framework contracts and terms updated with the required information.
- Website and app disclosures consistent with the terms.
- A definition of a material change: new method, new bank, new jurisdiction for funds, new insurer.
- A notification procedure with owner and lead time.
- A record of notifications made.
Checklist 6: governance and audit
- A safeguarding policy approved by the board and reviewed annually.
- A named senior manager responsible for safeguarding.
- An annual external safeguarding review, where required by national rules, scoped against PSD3.
- Findings tracked to closure with board visibility.
- Safeguarding reflected in the winding-up plan, which PSD3 also requires under Article 3(3)(r).
Findings that recur in safeguarding reviews
External safeguarding reviews in the EU and the UK tend to find the same weaknesses. Fixing them before the PSD3 file is submitted is far easier than responding to a regulator's questions afterwards.
- Incomplete flow maps. A product launched after authorisation, such as a new card programme or payout route, is missing from the safeguarding policy.
- Weak acknowledgement letters. Letters are unsigned, refer to the wrong legal basis or do not cover currencies and accounts opened later.
- Stale reconciliations. Breaks remain open for days without escalation, or reconciliations are prepared but not reviewed.
- Mixed funds. Fees owed to the institution are left in the safeguarding account, or operating payments are made from it.
- Gaps for agents and distributors. Funds collected by agents or distributors are not tracked until they reach the institution.
- No board oversight. The board receives no regular information on safeguarding, so it cannot evidence oversight.
A 90 day programme
| Days | Workstream | Output |
|---|---|---|
| 1 to 30 | Flow map, gap analysis against PSD3, review of letters and terms | Gap report with owners |
| 31 to 60 | Daily timing for e-money, reconciliation upgrades, second bank application | Revised procedures and evidence |
| 61 to 90 | Policy rewrite, user information, board paper, scoped external review | Approved policy and file section |
The second bank application usually runs beyond 90 days. Start it on day one.
E-money tokens and card programmes
Institutions issuing e-money tokens under MiCA follow MiCA's own rules for the reserve and safeguarding of funds received for tokens, which differ from PSD3's. Keep the two arrangements and their reconciliations separate, and explain the boundary in both the PSD3 file and the MiCA documentation. For card programmes, check how funds move between the scheme, the processor and the institution, and at what point each balance becomes a user claim that must be safeguarded.
What the regulator will read in the file
Article 3(3)(d) requires the authorisation file to describe the measures taken to safeguard users' funds. The Malta Financial Services Authority's June 2026 Dear CEO letter on PSD3 put safeguarding first among its five focus areas, with governance, security incidents, business continuity and the winding-up plan. Expect regulators to read the policy, the account letters, recent reconciliations, the latest external review, the user terms and board reporting.
A file that shows the controls running, with evidence, is stronger than one that describes them in principle. Firms with entities in both the UK and the EU should keep the two programmes distinct: the FCA's CASS 15 rules are not the same, as our guide to safeguarding requirements by jurisdiction explains. Our safeguarding service runs PSD3 reviews against this checklist.