PSD3 re-authorisation
PSD3 re-authorisation for EU payment and e-money institutions: the gap analysis, the evidence and the file.
Get in touchEvery EU payment and e-money institution must show its regulator that it meets PSD3 within 27 months of entry into force. We prepare the gap analysis, the evidence and the file, country by country.
How we work
- 1Gap analysisWe test current arrangements against PSD3, the PSR and the regulator's stated priorities, rating each gap with an owner and a date.
- 2Board decisionsWe help the board settle the service list, capital, substance in the home country and any structural change.
- 3Build the evidenceWe bring safeguarding, the winding-up plan, governance, DORA and AML evidence up to the new standard.
- 4File and supportWe assemble the re-authorisation file, indexed to evidence, and support the institution through the regulator's questions.
What is included
- PSD3 gap analysisEach applicable requirement, the current arrangement, a rating and the action needed, ready for board approval.
- Implementation planActions, owners, dates and reporting, approved by the board and tracked to completion.
- Capital projectionPSD3 initial capital and own funds over three years, reconciled to the audited accounts.
- Safeguarding reviewNext business day timing, concentration, user information and reconciliation evidence tested against PSD3.
- Winding-up planTriggers, scenarios, dependencies, customer repayment and costs, proportionate to the business.
Who this service is for
- EU payment institutions
- EU e-money institutions
- Account information and payment initiation providers
- Groups with licensed institutions in several member states
Scope in detail
What we do
PSD3 replaces PSD2 and the Second E-Money Directive. Every EU payment institution and e-money institution must show its regulator that it meets the new framework within 27 months of entry into force. Institutions that do are treated as authorised under PSD3. Those that do not must stop the services concerned.
The changes are substantive. E-money institutions become payment institutions authorised for e-money issuance. Safeguarding moves to the next business day for all funds, with new duties on concentration risk and user information. Initial capital adds up by service. And a winding-up plan, providing for the return of safeguarded funds, joins the authorisation file.
Each regulator will run its own process. The MFSA has already set written expectations, and the Central Bank of Ireland, DNB, the Bank of Lithuania, BaFin, the ACPR and the Central Bank of Cyprus have each published priorities that shape what their files will need. We prepare the gap analysis, the evidence and the file to the standard each regulator expects.
Also included
- Re-authorisation fileThe complete submission in the regulator's format, cross-referenced to evidence.
Situations we are asked to help with
- The board needs a documented PSD3 gap analysis and plan
- Safeguarding still relies on five day timing or a single bank
- There is no winding-up plan, or the plan assumes a sale
- The regulator has asked about PSD3 readiness
Further reading
Frequently asked questions
Which institutions need PSD3 re-authorisation?
Every payment institution and e-money institution authorised in the EU under PSD2 or the Second E-Money Directive. Each must show its regulator that it meets PSD3 within 27 months of entry into force.
When does the 27 month period start?
On entry into force, 20 days after publication in the Official Journal. The Council adopted its first reading position on 29 October 2026, and Parliament plenary approval is expected around the end of 2026.
Do e-money institutions keep their licence?
They become payment institutions authorised for e-money issuance. They keep operating during the transition and are treated as authorised once their regulator confirms they meet PSD3.
What goes into the file?
The information PSD3 lists for authorisation, including the service list, business plan, capital, safeguarding, governance and ICT arrangements, AML controls and a winding-up plan.
Which countries do you cover?
All EU and EEA member states, with published checklists for Lithuania, Ireland, the Netherlands, Malta, Germany, France and Cyprus.