[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital
Article 3(3)(r) of PSD3 requires an applicant for authorisation that will provide any of the payment services in points 1 to 5 of Annex I, or issue e-money under point 8, to include a winding-up plan in its file. The plan must be adapted to the size and business model of the institution and must provide for the return of safeguarded funds to users if the institution is wound up in a disorderly way. The agreed texts also expect the plan to cover continuity of critical activities carried out by outsourced providers, agents or distributors.
Account information and payment initiation providers are outside this requirement. For everyone else, the plan becomes part of the authorisation file, and existing institutions need it for the re-authorisation that PSD3 requires. Our PSD3 re-authorisation guide explains that process and its timetable.
When a payment institution or EMI stops trading in an unplanned way, customers often wait months to recover their money, even where funds were safeguarded. Administrators need to identify who is owed what, reconcile the safeguarded accounts and deal with outsourced providers and banks that may stop cooperating once fees go unpaid. Several insolvencies of e-money firms in Europe and the UK have shown how long this can take.
A winding-up plan is meant to shorten that process by making the institution think it through in advance: what triggers an exit, how much it costs, who does what, and how customers get their money back. The UK has required wind-down planning for payment and e-money firms for several years, and its experience shapes how EU regulators are approaching the PSD3 requirement.
| Institution | Winding-up plan required |
|---|---|
| Payment institution providing cash, transfers, cards or acquiring (points 1 to 4) | Yes |
| Money remittance (point 5) | Yes |
| Payment initiation only (point 6) | No |
| Account information only (point 7) | No |
| Institution issuing e-money (point 8) | Yes |
| Institution under a national waiver | Depends on the member state's implementing law |
A group with several EU institutions needs a plan for each authorised entity, though they can share structure and group-level analysis.
The Malta Financial Services Authority wrote to authorised institutions in June 2026 setting out its minimum expectations for PSD3. The winding-up plan was one of five focus areas, and the letter expects a proportionate plan that covers returning safeguarded funds in a disorderly wind-up, together with a board-approved gap analysis and implementation plan.
Advisers in Ireland report that the Central Bank of Ireland is reviewing wind-down plans more closely, looking for plans that can actually be executed, are backed by adequate resources, return safeguarded funds on time and are realistic about third-party dependencies. De Nederlandsche Bank's 2026 review of exit plans made similar points, noting that firms tend to underestimate how long and how much a wind-down takes. Generic templates are unlikely to be accepted.
PSD3 itself says little about content, so regulators will look to established practice. A plan that will stand up to review usually covers nine areas:
Triggers tell the board when to start considering an exit, early enough that a solvent and orderly wind-down is still possible. Useful triggers are measurable and reported regularly, for example:
Each trigger should have an owner, a reporting frequency and a defined board response. Triggers set so low that they are never reached until the business is already in difficulty give no warning at all.
The financial resources section is where regulators most often find plans too optimistic. A credible model runs month by month from the decision to wind down to the final distribution, and includes staff costs with retention payments, outsourced provider fees through the exit period, bank and scheme charges, legal and audit fees, the cost of returning funds to users, and any contractual termination costs. It should show where the money comes from: own funds, committed group support or other resources that are actually available in a stress scenario.
Run the model for at least two scenarios, a planned solvent exit and a rapid exit after a sudden shock, and show that the institution can meet the costs in both.
PSD3 specifically requires the plan to provide for the return of safeguarded funds in a disorderly winding-up, so this section is read closely. It should set out how the institution identifies each user and the amount owed, how it reconciles that list against the safeguarded balances, how users are contacted, how they confirm where funds should be sent, and how long each step takes. Users with small balances, dormant accounts and users reached only through agents or distributors need specific treatment.
The best evidence is a recent reconciliation showing that user balances and safeguarded funds match, together with a tested process for producing a full list of users and balances from the institution's systems within a day or two.
The PSD3 text is explicit that critical activities carried out by outsourced providers, agents or distributors are part of the plan. For many institutions this is the most demanding section. A payment institution running a large agent network, or an EMI whose cards are distributed through partners, needs to explain how customers who deal only with the agent or distributor are identified and repaid, and how records held by those third parties will be obtained.
Contracts should support the plan: data access on termination, cooperation during a wind-down, and reasonable notice periods. Where they do not, the plan should say how the gap is managed, and the institution should renegotiate at the next renewal. This links to the outsourcing evidence required under DORA, the EU's Digital Operational Resilience Act.
| Stage | Typical time |
|---|---|
| Scoping, scenarios and triggers | 2 to 3 weeks |
| Cash flow model and resource assessment | 3 to 4 weeks |
| Safeguarded funds and customer repayment process | 2 to 4 weeks |
| Third-party mapping and contract review | 3 to 6 weeks |
| Drafting, board review and approval | 3 to 4 weeks |
| Testing with a desktop exercise | 1 to 2 weeks |
Stages overlap, but a full plan for an established institution usually takes three to five months of elapsed time. With PSD3 re-authorisation running through 2027 and 2028, a start in the first half of 2027 leaves room for testing and revision before filing.
A plan that has never been tested is a document, not a plan. A desktop exercise, in which the board and key staff walk through a scenario such as the loss of the main safeguarding bank, quickly shows whether triggers are realistic, whether the cash flow holds, and whether the customer repayment process can actually be run. Record the exercise, the findings and the changes made: regulators increasingly ask for that evidence.
Review the plan at least annually, and after any material change such as a new product, a new safeguarding bank, a new agent network or a change of control.
Many groups already hold a UK wind-down plan for an FCA-authorised payment or e-money firm. It is a good starting point, but it cannot simply be copied for the EU institution. The EU plan must reflect the EU entity's own safeguarding banks and account letters, the insolvency law of its home member state, its agents and distributors across the EU, and the services in its PSD3 authorisation. Shared group services, such as technology or customer support provided from the UK, should be treated as critical third-party dependencies in the EU plan, with the intra-group agreement reviewed so it supports an orderly exit.
We build winding-up plans for EU payment institutions and EMIs as part of PSD3 re-authorisation, with the cash flow model, the safeguarded funds process, the third-party map and a facilitated desktop test. For institutions choosing or reviewing their EU base, our guides to the Netherlands EMI licence and the Malta EMI licence cover each regulator's current approach.
Yes, for institutions providing the payment services in points 1 to 5 of Annex I or issuing e-money. It is part of the authorisation file under Article 3(3)(r).
Yes. Existing institutions must show they meet PSD3 to keep their authorisation, and the plan is part of what the regulator reviews.
It must suit the institution's size and business model, provide for returning safeguarded funds in a disorderly winding-up and address critical activities carried out by outsourced providers, agents or distributors.
No. The requirement applies to the payment services in points 1 to 5 and to e-money issuance.
Usually three to five months for an established institution, including a cash flow model, third-party review, board approval and testing.
It is a useful starting point, but the EU plan must reflect the EU entity, its safeguarding arrangements, national insolvency law and the PSD3 requirements.
Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital