PSD3 and PSR explained: status and changes (Nov 2026)

PSD3 (a new Payment Services Directive) and the PSR (a new, directly applicable Payment Services Regulation) are the EU's replacement for PSD2 and the E-Money Directive: they merge e-money institutions into the payment institution regime and add rules on fraud, verification of payee, open banking and fee transparency. As of 3 November 2026 both texts are politically agreed but still going through formal adoption, with no Official Journal publication yet, so PSD2 and the E-Money Directive remain the law in force.

Status as of 3 November 2026

The package has cleared the political stage. What remains is formal adoption by the Council and a second-reading vote in the European Parliament.

The Council documents describe an unusual route: the Council adopts a first-reading position that already contains the deal, and Parliament is expected to approve it at second reading without amendments once lawyer-linguists have finished their checks. We could not confirm from a primary source that the Council vote on 29 October 2026 took place as listed. We found no Official Journal publication as of 3 November 2026 and will update this page when one appears.

When the rules will apply

Application dates and transition periods are set out in the closing articles of the two texts. Those articles were not readable in the public Council documents we opened, and the official dates will only be fixed once the acts are published. The directive's recitals confirm that existing payment institutions and e-money institutions will be allowed to keep operating for "a specified period", with a longer period for e-money institutions that used the small-institution waiver under the old E-Money Directive. Until publication, plan on the basis that PSD2 and EMD2 continue to apply.

Two instruments, two jobs

Sources: Council documents 8220/26, 14794/26 and 14798/26.

Putting the conduct rules in a regulation means one text for the whole EU, with no national transposition, while licensing and supervision stay with national authorities under the directive.

What changes for payment institutions and EMIs

E-money institutions become payment institutions

The biggest structural change is the end of the separate e-money licence. The Council's statement of reasons says the package repeals the E-Money Directive and brings e-money institutions into the updated payment institution authorisation and supervision regime. E-money conduct rules move into the PSR, while authorisation stays in PSD3. Electronic money remains redeemable at par value.

For firms profiled in our EMIs and neobanks hub, this means a new licence category name and, depending on the final transition rules, a re-authorisation or conversion process.

Initial capital

Article 5 of the compromise directive text sets these minimum initial capital levels:

Source: Council document 8222/26, Article 5 (compromise text, 2026). Figures may be renumbered or adjusted in the published act.

Recital 26 explains the logic: money remittance on its own keeps a lower requirement than other payment services (adjusted for inflation), payment initiation alone stays unchanged, and electronic money services get a lower baseline than before. The Commission can update the amounts for inflation through delegated acts.

Own funds and safeguarding

The compromise text keeps three methods for calculating own funds for payment services, with method B (based on payment volume) as the default. E-money activity adds a separate method D charge of 2% of average outstanding electronic money. Supervisors can raise or lower the result by up to 20% depending on the firm's risk management.

Safeguarding is tightened. Client funds must be segregated or covered by insurance or a comparable guarantee. Funds still held at the end of the business day after receipt must sit in a separate account, at a central bank, or in secure, liquid, low-risk assets. Firms are told to avoid concentration risk with a single bank, and clients must be told how their money is protected and which insolvency law applies.

Central bank accounts and payment systems

The directive's recitals acknowledge that payment institutions have struggled to open and keep accounts with banks. The text does not create a right to a bank account, but it allows safeguarding at a central bank at that bank's discretion, with refusals to be justified. Funds held in a settlement account in a designated payment system count as safeguarded if not commingled, and the directive amends the Settlement Finality Directive to improve access.

Licensing process

National authorities must decide on an application within three months of receiving all required information. Firms already authorised as crypto-asset service providers under MiCA get a shorter route that reuses information already filed with their regulator. Acquiring or crossing 20%, 30% or 50% of a payment institution's capital or voting rights requires prior notice to the regulator.

Fraud and verification of payee

The PSR targets authorised push payment fraud and impersonation scams.

Sources: Council documents 8543/26 (recitals 80 to 102) and 8543/26 ADD 1 REV 1.

For firms that move money, these rules shift cost. Verification of payee becomes a standard build item, and impersonation refunds put fraud losses on the PSP unless it can show gross negligence. Our guide to how card payments work covers the card side.

Open banking changes

The PSR keeps open banking data access free of charge and tightens the rules on the bank side:

• Permission dashboard: account providers must let users see and withdraw data access, without discouraging language.
• Dedicated interface: it must perform at least as well as the bank's own customer interface and carry the same data, including full account holder names and standing orders.
• Downtime: planned outages should normally fall between 00:00 and 06:00 local time, with at least one month's notice.
• No obstruction: fraud controls must not discriminate against payment initiation or account information providers, and the Council summary says banks may not put technical barriers in front of authorised third-party providers.

National authorities can exempt a bank from some interface obligations, using criteria to be set in EBA technical standards. See our explainer on open banking payments and the open banking hub.

Strong customer authentication

SCA stays, with adjustments. Business users can agree contractually how SCA applies to them, within Commission standards, and micro-enterprises may be treated like consumers. Technical service providers that fail to support SCA face liability capped at the direct financial loss, up to the transaction amount. The text also clarifies that NFC is a feature of a payment instrument, not an instrument in itself.

Transparency and cash

• ATM operators must show charges before and during a withdrawal and give a record on request.
• Independent ATM deployers that do not hold payment accounts must register and disclose fees.
• Shops may offer cash withdrawals without a purchase, without needing a licence or agent status, provided fees are disclosed.
• E-commerce platforms acting for both buyer and seller without real authority to negotiate are not excluded from scope, which narrows the commercial agent exclusion.
• Device makers and electronic communications providers must give payment providers access to the hardware and software features needed to offer payments (such as NFC) on fair, reasonable and non-discriminatory terms.

What firms can do now

Without published dates, preparation is mostly gap analysis:

• map current licences (PI, EMI, small institution, agent) against the new PI regime and its capital tiers;
• review safeguarding arrangements against the end-of-business-day rule and the concentration point;
• scope a verification of payee service for credit transfers not covered by Regulation 260/2012;
• check the dedicated interface against the performance and dashboard requirements;
• review fraud processes for impersonation refunds and the evidence step before alleging gross negligence;
• watch the EBA mandates, which are due one year after entry into force for safeguarding, guarantees and own funds criteria.

Our guide on payment gateways, PSPs and acquirers explains which roles need which licence today, and how to check a financial licence shows how to confirm a firm's status. ICT and outsourcing duties sit in a separate law, covered in our DORA explainer.

Key terms

• PSD3: the proposed directive on payment services and electronic money services, replacing PSD2 and EMD2.
• PSR: the proposed Payment Services Regulation, directly applicable across the EU.
• Payment institution (PI): a non-bank licensed to provide payment services; under PSD3 it also covers e-money issuance.
• Verification of payee: a check that the payee's account identifier matches their name before a transfer is authorised.
• Spoofing: fraud in which a criminal impersonates the victim's PSP.
• Dedicated interface: the API a bank provides to licensed third parties for account access.
• Safeguarding: protecting client funds so they are kept apart from the firm's own money if it fails.
• Second reading: the stage where Parliament approves or amends the Council's first-reading position.

Information only, not financial or investment advice. Based on compromise texts that may change before publication in the Official Journal.