[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital
PSD3, the third Payment Services Directive, brings payment institutions and electronic money institutions (EMIs) under one safeguarding rule. Customer funds that are still held at the end of the business day after receipt must be protected, either by keeping them separate in an account at a credit institution or central bank, by investing them in secure, liquid, low-risk assets, or by covering them with an insurance policy or comparable guarantee. Institutions must also try to avoid holding all customer funds with one bank, tell users how their money is protected, and notify their regulator in advance of material changes.
For payment institutions the timing is close to what PSD2 already requires. For EMIs it is a real change: the Second E-Money Directive (EMD2) allows funds received for e-money to wait up to five business days before safeguarding. The Council adopted its first reading position on PSD3 on 29 October 2026, so the rules below reflect the settled text. Our PSD3 re-authorisation guide covers the wider process every institution must complete.
Under PSD2, a payment institution safeguards funds received for payment transactions that have not been delivered to the payee or the payee's provider by the end of the business day after receipt. Under EMD2, an EMI safeguards funds received in exchange for e-money no later than five business days after issuance. Both directives allow segregation in a separate account, investment in secure low-risk assets, or an insurance policy or comparable guarantee.
In practice, national implementation has produced different approaches across member states, particularly on which assets count as secure and low-risk, how reconciliation is evidenced, and how insolvency protection works for the safeguarding account. PSD3 does not remove national insolvency law, but it narrows the room for difference elsewhere.
| Point | Today | Under PSD3 |
|---|---|---|
| Timing for EMIs | Up to five business days after issuance | End of the business day after receipt |
| Timing for payment institutions | End of the business day after receipt | Unchanged |
| Methods | Segregation, low-risk assets, insurance or guarantee | Same methods, with central bank accounts named |
| Concentration | No general rule | Endeavour not to hold all funds with one credit institution |
| User information | Varies by member state | Users told the method, location and applicable insolvency law |
| Changes to arrangements | Varies by member state | Material changes notified to the regulator in advance |
| Technical standards | EBA guidelines in places | EBA standards on managing risks to safeguarded funds |
The amount safeguarded must also match what is owed to users. Where an institution uses credit lines or net settlement so that it receives less than the gross amount owed, the recitals make clear that the safeguarded amount still needs to correspond to users' claims.
Article 9 of PSD3 keeps the familiar structure. An institution may:
Whichever method is used, the funds must be insulated under national law in the interest of users against claims of the institution's other creditors, particularly in insolvency. Most EU institutions use segregated bank accounts; investment and insurance are used by a minority, usually larger EMIs.
PSD3 recognises that safeguarded funds can be held at a central bank, at the central bank's discretion, and the recitals say any refusal should be justified. This matters because it gives an alternative to commercial banks, which have been reluctant to offer safeguarding accounts to some payment and crypto firms.
In practice, access is limited. The European Central Bank has indicated that Eurosystem central banks should not offer such accounts to non-bank payment providers and crypto firms, and other central banks may take the same position. Institutions should plan on commercial bank accounts and treat central bank access as a possibility to monitor, not a plan.
PSD3 requires institutions to endeavour not to hold all customer funds with a single credit institution. The European Banking Authority (EBA) will set out when concentration risk must be avoided and how safeguarded funds should be managed. Until those standards are published, the safe reading is that an institution of any meaningful size should hold safeguarded funds at two or more banks.
For many EMIs and payment institutions this is the hardest practical change, because safeguarding accounts are difficult to open. A second account takes months, not weeks, and banks will ask for the same compliance information as the first. Our guide to obtaining a safeguarding account sets out what banks ask for.
EMIs that rely on the five business day allowance, for example to batch transfers into the safeguarding account once or twice a week, will need daily processes. The changes usually include:
EMIs that also provide payment services unrelated to e-money already run the PSD2 timing for those funds, so the change is mainly one of consistency. For e-money tokens issued under MiCA, safeguarding follows MiCA's own rules on reserves. Our guide to the EMI licence under PSD3 explains the wider change for EMIs.
Segregated bank accounts are simple and widely understood, which is why most institutions use them. The other methods suit particular cases. Investment in secure, liquid, low-risk assets, typically short-dated government debt or money market funds approved by the home regulator, can reduce exposure to a single bank and earn a return for the institution, but it needs treasury skill, custody arrangements and daily liquidity management so that redemptions can always be paid.
An insurance policy or bank guarantee removes the need to move funds daily, which helps businesses with very high transaction volumes. The cover must come from an insurer or credit institution outside the group, must be large enough to cover all amounts owed to users, and must pay out promptly on insolvency. Few providers offer it and it is priced accordingly. Under PSD3, the choice of method must be explained to users, so the decision has a customer-facing side as well as a financial one.
Safeguarding only works if the funds are protected from the institution's other creditors when it matters. That protection comes from national law and from the terms of the safeguarding account. Banks usually provide an acknowledgement letter confirming that the account holds funds for the institution's users, that the bank will not use the balance to offset the institution's own debts, and that the account is designated for safeguarding.
Review these letters before re-authorisation. Older letters sometimes refer to the wrong legal basis, omit currencies or accounts opened later, or have never been signed by the bank. Regulators will ask for them, and they are central to the winding-up plan PSD3 also requires.
Article 3(3)(d) of PSD3 requires the authorisation file to describe the measures taken to safeguard user funds. In the Malta Financial Services Authority's June 2026 letter to authorised institutions on PSD3 preparedness, safeguarding was the first of five focus areas, alongside governance, security incidents, business continuity and the winding-up plan. Other regulators are likely to follow the same order of priority.
Expect the regulator to read:
| Evidence | What it should show |
|---|---|
| Safeguarding policy | Method, timing, cut-offs, banks used and how concentration is managed |
| Account letters | Acknowledgement that funds are held for users and protected from other creditors |
| Reconciliations | Daily records, breaks and how they were resolved |
| Audit findings | The most recent external safeguarding review and actions taken |
| Customer terms | The information users receive on how funds are protected |
| Board reporting | How the board oversees safeguarding and receives exceptions |
Firms that hold both an EU licence and a UK licence should note that the UK is running its own safeguarding reforms under the FCA's CASS 15 rules, which are not the same. Our safeguarding service covers both regimes.
We review safeguarding arrangements against the PSD3 text, design the daily process for EMIs moving from five day timing, prepare the safeguarding section of the re-authorisation file and introduce institutions to banks that offer safeguarding accounts. For firms choosing where to hold an EU licence, our Lithuania EMI licence and Ireland EMI licence guides compare how each regulator approaches safeguarding today.
Funds still held at the end of the business day after receipt must be safeguarded. This applies to payment institutions and to institutions issuing e-money.
No. The EMD2 allowance of up to five business days ends when PSD3 applies, and EMIs move to next business day safeguarding.
PSD3 allows it at the central bank's discretion. In practice Eurosystem central banks have indicated they will not offer these accounts to non-bank payment firms, so commercial banks remain the main route.
PSD3 requires institutions to endeavour not to hold all customer funds with a single credit institution. The EBA will set out when concentration risk must be avoided.
Yes. Users must be told the safeguarding method, where funds are held and which insolvency law applies, before they sign up and before material changes.
No. PSD3 applies in the EU and EEA. UK firms follow the FCA's own safeguarding rules.
Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital