PSD3 re-authorisation: what every EU payment institution and EMI must do, and when

By Harry Khan, Founder · Published 8 November 2026 · Last reviewed 8 November 2026

Why existing licences must be confirmed again

PSD3, the third Payment Services Directive, replaces both PSD2 and the second E-Money Directive (EMD2). Licences granted under those two directives do not carry across on their own. Each payment institution and electronic money institution (EMI) must show its national regulator that it meets the PSD3 requirements, and the regulator must confirm it before the institution is treated as authorised under the new law.

This is not a blank-page application. The institution keeps its existing business and keeps operating during a transition period. But it does have to submit an updated authorisation file, and the regulator reviews it against the new standard. In practice, every EU payment institution and EMI goes through a shortened authorisation process within the same two to three years.

The scale is the reason firms should plan early. Every national regulator in the EU will be receiving these files at the same time, from every institution on its register. Our earlier guide to PSD3 and the Payment Services Regulation covers the conduct and fraud changes; this article covers the authorisation step.

Where PSD3 stands in November 2026

The European Parliament and the Council reached a provisional agreement on the payments package on 27 November 2025. The final compromise texts were published on 23 April 2026. The Council adopted its first reading position on both PSD3 and the Payment Services Regulation (PSR), and published statements confirming it on 29 October 2026.

The remaining steps are formal. Parliament must approve the Council's position in plenary, the texts are then signed and published in the Official Journal of the EU, and they enter into force 20 days after publication. Every deadline in this article runs from that entry into force date.

Because the Council has already adopted its position, the content of the rules is settled. What is not yet fixed is the calendar date on which the clock starts.

Who has to be re-authorised

The re-authorisation applies to every institution that holds a payment institution or EMI authorisation granted under national laws implementing PSD2 or EMD2, in every EU and EEA member state. That includes:

• authorised payment institutions offering any of the PSD2 services, from acquiring and issuing to money remittance;
• EMIs, including those that also provide unrelated payment services;
• payment initiation and account information service providers;
• institutions that benefited from a national waiver, such as waived payment institutions and EMIs, for which the agreed texts provide a longer transition.

UK firms are caught only through their EU subsidiaries. A UK group with an EMI in Lithuania, Ireland or the Netherlands needs that subsidiary to complete the process in its home state. The UK's own reform runs separately through HM Treasury and the FCA.

ATM operators move to a lighter registration regime and are not part of this exercise.

The timeline once PSD3 enters into force

The agreed texts give member states 21 months to transpose PSD3, and the PSR applies directly from the same date. Existing institutions may keep providing their authorised services for up to 27 months after entry into force, provided they show their regulator that they meet the new requirements. A regulator can extend that period by up to three months in exceptional cases.

If entry into force falls in early 2027, the transition would end in spring 2029. That sounds distant, but the regulator must have reviewed the file before the end date, and the EBA standards that define the file arrive about a year in. The practical window for preparing and filing is therefore 2027 and 2028.

What the regulator will ask for

The file follows the authorisation contents in Article 3 of PSD3. Much of it repeats what the institution supplied when it was first authorised, updated to today's business. Several items are new or heavier.

The regulator may treat an institution as authorised without a full submission where it already holds clear evidence that the institution complies. That is a discretion for the regulator, not a right for the firm, and no institution should plan on it.

The winding-up plan deserves early attention. Article 3(3)(r) of PSD3 requires a plan adapted to the size and business model of the institution, covering how customers are repaid and how critical activities carried out by outsourced providers, agents or distributors continue in an orderly exit. Many EU licences granted in the last decade were issued without one.

New initial capital levels

Initial capital is the minimum the institution must hold at all times. PSD3 resets the amounts and, unlike PSD2, adds them together where an institution provides services in more than one band.

An institution that issues e-money and also offers the core payment services adds the two figures: EUR 400,000 under PSD3. Ongoing own funds also change. For e-money, own funds are at least 2% of average outstanding e-money (Method D), and an institution that also offers the core payment services holds the sum of both requirements.

Most established EMIs and payment institutions already hold far more than these minimums. The work is in documenting the calculation correctly, not in raising new money.

Stricter safeguarding

Safeguarding means keeping customer money separate from the institution's own, so that it can be returned if the institution closes. PSD3 tightens the timing and the methods.

• Funds still held at the end of the business day after receipt must be in a separate account at a credit institution or, at that central bank's discretion, a central bank, or invested in secure, liquid, low-risk assets.
• The insurance or comparable guarantee route remains, from an insurer or credit institution outside the group.
• Institutions must try not to hold all customer funds with one credit institution, and must notify the regulator in advance of material changes to their safeguarding arrangements.

For EMIs the change in timing is the most significant. EMD2 allowed up to five business days before funds had to be safeguarded; PSD3 moves that to the end of the following business day. Firms with a single safeguarding bank should start on a second relationship now, given how long account opening takes. Our safeguarding practice arranges and documents these accounts.

What happens to EMIs

PSD3 repeals EMD2. Issuing e-money becomes payment service 8 in Annex I of PSD3, and an EMI becomes a payment institution authorised to provide that service. The e-money rules themselves survive: issuance at par, redemption on request and the ban on paying interest all continue.

The practical consequence is in the scope of the new authorisation. An EMI today often provides acquiring, money remittance or payment transactions under its EMI licence without each being listed as a separate permission. Under PSD3 each of those services must be included in the new authorisation in its own right. An EMI that misses one in its file will not have permission for it after the transition.

EMIs that operate under a national waiver, get a longer transition under the agreed texts, reflecting that they may need to meet the full regime for the first time.

How to plan the re-authorisation

The firms that come through this cleanly will treat it as a project with a date, owned by a named director, rather than a filing done in the final quarter.

Regulators will set their own submission windows and formats, and some will ask institutions to file in batches. Watch for the national notices from the Bank of Lithuania, the Central Bank of Ireland, De Nederlandsche Bank, the MFSA, BaFin, the ACPR and others. Our guides to the Lithuania EMI licence and the Ireland payment institution licence set out how those regulators run authorisation today.

If the deadline is missed

An institution that has not shown compliance by the end of the transition may have its payment services suspended until the regulator has received and verified the outstanding information, and the regulator can withdraw the authorisation. Customers, banking partners and card schemes will see that change on the public register, which is why the timing matters commercially as well as legally.

For groups that would rather not run the process, PSD3 also changes the market for licensed companies. Buyers will look closely at whether a target has completed re-authorisation, and the regulator's approval of a new owner sits alongside it. Our marketplace lists licensed EU payment institutions and EMIs for sale, and our guide to choosing an EU licensing jurisdiction compares the main regulators.

Questions

Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.