Home › Services › PSD3 Re-authorisation

Keep your EU licence through PSD3

Every EU payment and e-money institution must show its regulator that it meets PSD3 within 27 months of entry into force. We prepare the gap analysis, the evidence and the file, country by country.

How we can help you

PSD3 replaces PSD2 and the Second E-Money Directive. E-money institutions become payment institutions authorised for e-money issuance, safeguarding moves to the next business day for all funds, capital adds up by service, and a winding-up plan joins the file. Institutions that show compliance in time are treated as authorised; those that do not must stop the services concerned.

Gap analysis

Your arrangements tested against PSD3 and the regulator's own expectations, with each gap rated and assigned an owner and a date, ready for the board.

Service list and capital

Every activity mapped to the PSD3 service list, passports aligned, and initial capital and own funds recalculated with a three-year projection.

Safeguarding

Next business day timing for e-money, a second safeguarding bank where needed, user information and the reconciliation evidence regulators read first.

Winding-up plan

A plan that suits your size and model, with triggers, severe scenarios, dependencies and a tested process for returning customer funds.

Governance and DORA evidence

Governance, internal control, incident and continuity arrangements described once and cross-referenced to your DORA documentation.

The re-authorisation file

The complete file in the format your regulator asks for, indexed to evidence, with questions answered until the decision.

Read more

Each regulator will run its own process. The MFSA has already set written expectations; the Central Bank of Ireland, DNB, the Bank of Lithuania, BaFin, the ACPR and the Central Bank of Cyprus have each published priorities that shape what their files will need.

Country guides: Lithuania, Ireland, the Netherlands, Malta, Germany, France, Cyprus.

See also: PSD3 re-authorisation: what every EU payment institution and EMI must do

How we help

  1. AssessGap analysis against PSD3, the PSR and your regulator's stated priorities.
  2. DecideService list, capital, real presence and any structural change agreed with the board.
  3. BuildSafeguarding, winding-up plan, governance and AML evidence brought up to the new standard.
  4. FileThe re-authorisation file submitted and supported through to the decision.

What you receive

DeliverableWhat it containsWho relies on it
Gap analysisEach PSD3 requirement, your current arrangement, a rating and the action to close itBoard, regulator
Implementation planActions, owners, dates and reporting, approved by the boardBoard, regulator
Capital projectionPSD3 initial capital and own funds over three years, reconciled to audited accountsBoard, regulator, auditors
Winding-up planTriggers, scenarios, dependencies, customer repayment and costsRegulator, administrators
Re-authorisation fileThe complete submission, indexed to evidenceRegulator

Get in touch

Tell us where you are and where you want to be.

[email protected]
+44 7563 115980 (phone and WhatsApp)

Further detail

Questions

Which institutions need PSD3 re-authorisation?

Every payment institution and e-money institution authorised under PSD2 or the Second E-Money Directive in the EU. Each must show its regulator that it meets PSD3 within 27 months of entry into force.

When does the 27 month period start?

On entry into force, 20 days after PSD3 is published in the Official Journal. The Council adopted its first reading position on 29 October 2026, and Parliament's plenary approval is expected around the end of 2026.

Do e-money institutions keep their licence?

E-money institutions become payment institutions authorised for e-money issuance. They keep operating during the transition and are treated as authorised once their regulator confirms they meet PSD3.

What goes into the file?

The information PSD3 lists for authorisation, including the service list, business plan, capital, safeguarding, governance and ICT arrangements, AML controls and a winding-up plan.

Which countries do you cover?

All EU and EEA member states. We have published country guides for Lithuania, Ireland, the Netherlands, Malta, Germany, France and Cyprus.

From the blog

All articles