[email protected]
+44 7563 115980 (phone and WhatsApp)
In France, payment institutions (établissements de paiement) and e-money institutions (établissements de monnaie électronique) are authorised by the Autorité de contrôle prudentiel et de résolution (ACPR) under the Monetary and Financial Code. PSD3 replaces the EU directives behind both categories, so the Code will be amended and e-money institutions will become payment institutions authorised for e-money issuance. Every existing institution will need to show the ACPR that it meets PSD3 within 27 months of entry into force. Institutions that do are treated as authorised under PSD3. Those that do not must stop the services concerned.
The ACPR has not yet set out its PSD3 process for existing institutions. But it has been precise about what it expects from them today, especially on safeguarding, governance, outsourcing and agents. Those expectations are the best guide to what a French PSD3 file will need. Our PSD3 re-authorisation guide covers the EU-wide process.
The table counts firms with a current French home licence or registration on the EBA Central Register at 30 October 2026, from the Buckingham register of licensed EU payment and e-money firms.
| Firms with a home licence in France | Number |
|---|---|
| E-money institutions | 24 |
| Payment institutions | 83 |
| E-money institutions under a national waiver | 1 |
| Registered account information firms | 10 |
| Firms passporting into at least one other country | 69 |
France has a large and varied sector: acquirers and merchant payment providers, neobanks built on payment or e-money licences, money remitters with agent networks, and a significant group of account information and payment initiation providers. Many French institutions also rely on networks of payment service agents and e-money distributors across France and other member states.
| Step | Timing |
|---|---|
| Council adopts its first reading position on PSD3 and the PSR | 29 October 2026 |
| European Parliament approves the texts in plenary | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| PSD3 applies through national law; the PSR applies directly | 21 months after entry into force |
| Transition for existing institutions ends | 27 months after entry into force, extendable by up to 3 months in exceptional cases |
France will transpose PSD3 by amending the Monetary and Financial Code. The Payment Services Regulation applies directly, so its rules on verification of payee, fraud and open banking do not wait for French law. French commentators expect the PSR and the PSD3 regime to apply around the end of 2027 or into 2028, depending on the date of publication.
At its market meeting for payment and e-money institutions in November 2025, the ACPR set out its safeguarding expectations in detail. Several of them anticipate PSD3.
| ACPR expectation today | What PSD3 adds |
|---|---|
| Any change to the safeguarding arrangement needs prior ACPR authorisation; the ACPR has two months from a complete file | Advance notification of material changes; plan PSD3 changes early to allow for the authorisation step |
| Segregation by the end of the next business day for payment services; for e-money, five business days in general, or next business day for cash and for EMIs also providing payment services | Next business day for all funds, including e-money |
| Instant transfers need safeguarding seven days a week | Instant transfers run around the clock, so institutions offering them should plan for safeguarding seven days a week |
| Segregated accounts with clear rules, no set-off, no pledges and no fees charged to them | Funds insulated from other creditors in insolvency |
| Exact segregation to the euro, with no over or under segregation | Safeguard the amount equal to users' claims |
The ACPR's 2026 work programme also announced controls on how payment and e-money institutions protect customer funds, including asset and liability management. For French EMIs, the main PSD3 change is the move to next business day timing for all e-money, together with concentration risk and user information. Because changes to the arrangement need ACPR authorisation, institutions should plan the new arrangement in time to file it well before the transition ends. Our PSD3 safeguarding rules guide explains the PSD3 rule.
The ACPR's November 2025 presentation also set out its governance expectations: at least two effective managers, the chair of the supervisory body separate from the chief executive unless a derogation applies, stronger supervisory boards with control functions involved, an independent member recommended, and full, formal information flows. Subsidiaries of groups should have local decision-making capacity.
On outsourcing, the ACPR reminded institutions that outsourcing does not transfer responsibility, that it must be told before operational functions are outsourced, and that contracts must allow ACPR on-site access. It noted recurring weaknesses in contract formalisation and monitoring. On agents and distributors, it said their status is often poorly defined and their integration into internal control is often weak. Each of these areas belongs in the PSD3 file: governance and internal control, outsourcing arrangements, and the agents and distributors the institution relies on.
The PSD3 file relies on DORA for ICT governance, incident handling and business continuity. The ACPR's November 2025 figures showed that 84% of entities had filed their DORA register of information, and that late incident notifications remained common. The ACPR said supervision of DORA would intensify from 2026, including on-site checks for the highest-risk entities.
French institutions also file an annual internal control report with the ACPR by 30 April. The ACPR published its 2026 template for payment and e-money institutions in August 2026. Because the report already covers governance, internal control, outsourcing, AML and safeguarding, a well-prepared report is a strong starting point for the PSD3 gap analysis.
French money remitters and payment institutions often operate through networks of payment service agents, and e-money institutions through distributors. PSD3 keeps the registration of agents and the institution's full responsibility for them. The ACPR has already said agent status is often poorly defined and agents are poorly integrated into internal control, so this area deserves early attention.
For each network, the institution should be able to show the register entries, the selection and fit and proper checks, training, monitoring and audit, and how funds collected by agents become safeguarded. Agents operating in other member states should be covered by the right passport notifications. The winding-up plan should explain how customers who deal only with agents would be repaid, and contracts should oblige agents to cooperate in a wind-down.
France has 10 registered account information firms on the EBA register and several payment institutions authorised for payment initiation. Under PSD3, account information providers continue to hold professional indemnity insurance instead of capital, and payment initiation carries EUR 50,000 of initial capital. The Payment Services Regulation adds direct open banking rules, including dedicated interfaces from account providers and a permission dashboard for users. French providers should review their insurance cover and their bank connections against the new rules.
In France, the Banque de France gives an opinion on payment security when the ACPR assesses an authorisation. Under the Payment Services Regulation, payment security and fraud prevention take a larger place: verification that the payee's name matches the account identifier, fraud data sharing between providers, and refunds in defined cases of impersonation fraud. French commentators have noted that providers that did not carry out the required checks may have to refund customers. Institutions should expect the security and fraud part of their file to be read closely, with the Banque de France involved as it is today.
Capital adds up by service under PSD3: EUR 150,000 for the core payment services and EUR 250,000 for e-money issuance, for example, so a French EMI that also provides card payments and transfers moves to EUR 400,000. Ongoing own funds for e-money remain at 2% of average outstanding e-money. Our PSD3 capital requirements guide has worked examples.
The winding-up plan is new. For French institutions with agent networks, it must show how funds collected by agents reach safeguarded accounts and how customers who deal only with agents would be repaid. Our PSD3 winding-up plan guide covers the contents.
A French supervisory board preparing for PSD3 should be able to answer five questions. Does our safeguarding arrangement meet next business day timing for all funds, and when will we file the change with the ACPR? Do we meet the ACPR's expectations on effective managers and an independent member? Are our outsourcing contracts and agent oversight formalised to the standard the ACPR expects? What will PSD3 capital be over the next three years? And who owns the re-authorisation file, with what timetable? The 2026 internal control report is a good place to record the answers.
Buckingham Capital Consulting has advised payment and e-money firms since 2013 on licensing, compliance and banking, including Own Solutions' EMI licence from the Central Bank of Ireland and FCA authorisations for Nexpay, Orbital and Hryze. We prepare PSD3 gap analyses, safeguarding redesigns, governance reviews and winding-up plans for French payment and e-money institutions. See our France payment institution licence and France EMI licence guides, or contact us to discuss your institution.
They must show the ACPR that they meet PSD3 within 27 months of entry into force. If they do, they are treated as payment institutions authorised for e-money issuance.
Yes. The ACPR requires prior authorisation for changes to the safeguarding arrangement, with a two month response period from a complete file.
Five business days in general, or the next business day for cash and for EMIs that also provide payment services. Under PSD3 it becomes the next business day for all funds.
At least two effective managers, a supervisory body chair separate from the chief executive unless a derogation applies, and involvement of control functions.
By 30 April each year. The ACPR published its 2026 template in August 2026.
Yes. PSD3 will be transposed into French law, while the Payment Services Regulation applies directly.
Get in touch: +44 7563 115980 (phone and WhatsApp) or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)