A PSD3 winding-up plan sets out how a payment institution or e-money issuer would leave the market in an orderly way and return customer funds if it had to. Article 3(3)(r) of PSD3 makes it part of the authorisation file for institutions providing any of the payment services in points 1 to 5 of Annex I, or issuing e-money. The plan must be adapted to the institution's size and business model and must provide for the return of safeguarded funds in a disorderly winding-up. The agreed texts also expect continuity of critical activities carried out by outsourced providers, agents or distributors.
Existing institutions need the plan for PSD3 re-authorisation. This article covers what regulators have said, how to structure the plan and how to show it works.
What the text requires
| Requirement | Detail |
|---|---|
| Who | Institutions providing Annex I points 1 to 5, or issuing e-money under point 8 |
| Where | Authorisation file, Article 3(3)(r) |
| Proportionality | Adapted to size and business model |
| Customer funds | Provides for returning safeguarded funds in a disorderly winding-up |
| Third parties | Continuity of critical activities by outsourced providers, agents or distributors |
| Exempt | Payment initiation only and account information only |
The directive does not prescribe a template, and the EBA's technical standards on authorisation, due about 12 months after PSD3 enters into force, may add detail. Until then, regulators are drawing on established wind-down practice.
What regulators have signalled
Malta. The MFSA's Dear CEO letter of June 2026 named the winding-up plan one of five PSD3 focus areas and set eight minimum expectations, including a documented gap analysis and a board-approved implementation plan. It expects firms to aim for compliance from publication.
Ireland. Advisers report that the Central Bank of Ireland is reviewing wind-down plans for whether they can be executed, are backed by adequate resources, return safeguarded funds on time and are realistic about outsourcing. Template plans are unlikely to pass.
Netherlands. De Nederlandsche Bank's 2026 review of exit plans highlighted out-of-date plans, unrealistic timelines for returning funds, underestimated costs and dependencies on group entities and outsourcers.
Institutions licensed in these hubs, through our pages on the Ireland payment institution licence and the Malta EMI licence among others, should assume their plan will be read line by line.
The structure that works
A plan regulators accept usually follows this order:
- Summary. Business model, critical services, the scenarios tested and the conclusion on feasibility.
- Governance. Who owns the plan, who decides to trigger it, and how the board is kept informed.
- Indicators and triggers. Early warning indicators, hard triggers and the decision process for each.
- Scenarios. At least a solvent planned exit and a rapid exit after a sudden shock.
- Financial resources. A month-by-month cash flow for each scenario, with the source of funding.
- Safeguarded funds. The process for identifying users, confirming balances and returning funds, with timings.
- Operational plan. The sequence of steps from stopping new business to final distribution.
- Critical third parties. Banks, card schemes, outsourced providers, agents and distributors, with exit arrangements for each.
- People. Staff needed through the wind-down and retention measures.
- Legal. Interaction with national insolvency law and the protection of safeguarded funds.
- Communication. Messages and timing for users, regulator, banks, staff and partners. Draft the key messages in advance, including the first notice to users and the regulator, so they can be issued within hours of a decision rather than days.
- Testing and maintenance. How the plan has been tested and when it is reviewed.
Indicators, triggers and costs
| Area | Early warning indicator | Trigger for board decision |
|---|---|---|
| Capital | Own funds headroom below an internal target | Headroom below a lower threshold for a set period |
| Liquidity | Cash runway below a set number of months | Runway below the cost of a solvent wind-down |
| Banking | Notice of review from a safeguarding bank | Loss of a safeguarding account without replacement |
| Schemes | Scheme compliance programme opened | Notice of suspension or termination |
| Regulatory | Supervisory findings outstanding | Restriction on new business |
| Commercial | Concentration in one partner rises | Loss of a partner above a set share of revenue |
The cost of a wind-down is the number regulators test hardest. Include staff and retention, outsourced services through the exit period, legal, audit and insolvency practitioner fees, bank and scheme charges, termination payments and the cost of returning funds. Show that resources are available in a stress scenario, not only in normal conditions.
Customer funds: the section read most closely
PSD3 names the return of safeguarded funds in a disorderly winding-up as a required element. The section should evidence that the institution can produce a complete list of users and balances quickly, reconcile it to safeguarded funds, contact users, collect payment details and pay out, with realistic timings for each step. Treat separately users reached only through agents or distributors, dormant accounts, small balances and users in other member states.
Link this section to the safeguarding checklist: daily reconciliation and clear account letters are what make a fast return of funds possible.
Outsourcing and DORA
Critical activities carried out by third parties need specific treatment. For each critical provider, record the service, the contract's termination and cooperation terms, data access rights, and the plan if the provider stops serving the institution. This overlaps with the register of information and exit strategies required under DORA for ICT third parties, so build one evidence set that serves both.
Agents and distributors need particular care because users often deal only with them. For each network, the plan should state who holds the customer relationship and records, how funds collected by the agent or distributor reach the institution and when they become safeguarded, how users are told what to do if the institution winds down, and how the agent or distributor is paid for its cooperation during the exit. Contracts should oblige agents and distributors to provide customer data and stop taking funds on instruction, with sanctions for non-compliance.
Why plans are sent back
From supervisory reviews of exit and wind-down plans to date, a handful of weaknesses account for most plans that regulators return:
- Optimistic timing. The plan assumes customer funds are returned within weeks, without evidence that the institution can produce and reconcile a full list of users and balances that quickly.
- Unfunded costs. The cash flow omits retention, termination or insolvency practitioner costs, or assumes group support that is not committed.
- Generic content. Sections copied from a template refer to services, systems or providers the institution does not use.
- Missing third parties. Agents, distributors or a key processor are absent, or the plan assumes their cooperation without contractual support.
- No owner. The plan sits with compliance and is not owned by the board or senior management.
Groups and intra-group support
Where an institution relies on its group for technology, staff, customer support or funding, the plan has to address what happens if the group cannot or will not continue that support. Intra-group service agreements should include termination assistance, data access and reasonable notice. Funding from the parent should be committed in writing if the plan relies on it, and the cash flow should show the position without it. Regulators will test whether the EU institution could be wound down even if the wider group is under stress at the same time.
A timetable to filing
| Period | Work |
|---|---|
| First half of 2027 | Scope, scenarios, triggers and cash flow model |
| Mid 2027 | Customer funds process, third-party map and contract review |
| Second half of 2027 | Draft plan, desktop test, board approval |
| 2028 | Update for EBA standards and the national notice, then file |
The timetable assumes PSD3 enters into force in early 2027. If publication slips, the order of work stays the same. Institutions that also need to refresh their DORA register, outsourcing agreements or safeguarding arrangements for re-authorisation should run those workstreams alongside the plan, because each depends on the same inventory of critical services and third parties. One inventory, maintained by one owner, avoids three versions that do not agree.
Testing and approval
Test the plan with a desktop exercise led by the board, using a scenario that stresses the weakest points, such as the sudden loss of the main safeguarding bank during a weekend. Record the exercise, findings and changes. Approve the plan at board level, review it at least annually and after material changes, and keep a version history. A plan that has been tested and updated is the strongest evidence of feasibility a regulator can see.
Board minutes should record that directors understood the scenarios, challenged the assumptions and approved the plan. Non-executive directors, where the institution has them, are often asked by regulators about the plan in supervisory meetings, so they should know its main triggers and conclusions. Where the institution is part of a group, the group board should also be aware of the commitments the plan relies on, such as funding or continued services.
Our compliance support team builds and tests PSD3 winding-up plans as part of re-authorisation projects.