Strategy

Losing Your Banking Partner: An Exit Plan for EMIs and PIs

Dmytro Medvid, Founder · October 21, 2026 · 11 min read

Banking partner exit plan for EMIs, shown as linked safeguarding and settlement nodes

Key takeaways

In the EU today, PSD2 Article 36 makes banks give the regulator reasons for refusing a payment institution an account, but sets no minimum notice period for closing one.
In the UK, payment services framework contracts entered into from 28 April 2026 need 90 days' notice and reasons to terminate, but users that are not consumers, micro-enterprises or charities can contract out under regulation 40(7) of the PSRs 2017.
The agreed EU Payment Services Regulation limits refusals and closures to a closed list of grounds, with refusals due within one month and four months' notice for closures, but it will not apply before late 2028.
CASS 15 already requires UK EMIs and payment institutions to consider diversifying their safeguarding banks, and PSD3 asks EU institutions to avoid safeguarding everything with one credit institution.
Direct access to TARGET reduces dependence on a sponsor bank for euro settlement, but those accounts cannot hold safeguarded funds, and no non-bank PSP was connected in production at the end of 2025.

If your bank gives you notice, the law today gives you very little time and almost no say. In the EU, PSD2 makes banks give reasons to the regulator when they refuse a payment institution an account, but says nothing about closing one. In the UK, a 90-day notice rule has applied since April 2026, but many business contracts can opt out of it. The protection most firms are waiting for, the four-month notice period in the EU's Payment Services Regulation, is not law yet and will not apply before 2028. Until then, the only real protection is the one you build yourself: a second banking relationship that is already live and an exit plan you have actually tested.

This guide explains what the rules require now and what changes under the PSR, and sets out how to structure your banking so that losing one partner does not take the business down with it.

Why banks exit EMIs and payment institutions

Banks that hold accounts for e-money and payment institutions inherit the risk of their customers' customers. Most exits come down to a short list of reasons that a bank can explain internally even if it never tells you: the customer base or corridors are outside its risk appetite, your AML controls look stronger on paper than in operation, it cannot map your ownership to individuals, your actual flows have drifted from the business plan you presented at onboarding, or the relationship simply earns too little to justify the compliance cost.

The EBA has documented the pattern. In its January 2022 report on de-risking, the European Banking Authority found that de-risking occurs across the EU and affects payment and e-money institutions specifically. Trade associations told the EBA that some members had been exited by banks they had worked with for eight to ten years, sometimes at one or two months' notice. Some payment institutions that lost their accounts ended up holding and moving large amounts of cash themselves. The EBA also noted that the PSD2 duty on banks to explain themselves covered refusals at onboarding, not closures of existing relationships (Bird & Bird).

The EBA followed up with guidelines on managing ML/TF risk when providing access to financial services (EBA/GL/2023/04), which have applied since November 2023. They ask banks to consider less drastic measures before refusing or exiting a customer, and to document the decision. They are addressed to credit and financial institutions and supervisors; they do not give you a right to keep an account.

What the rules say today

EU: PSD2 Article 36

Article 36 of PSD2 requires credit institutions to give payment institutions access to payment account services on an objective, non-discriminatory and proportionate basis, extensive enough to let them provide payment services unhindered. A bank that rejects a payment institution must give the competent authority duly motivated reasons. Article 36 refers to payment institutions; whether it reaches e-money institutions depends on national implementation.

In practice that leaves three gaps. There is no fixed notice period for closing an account. Nothing requires the reasons to reach you, as opposed to the regulator. And you have no formal appeal. Notice is whatever your account agreement says.

UK: regulation 105 and the new 90-day rule

The UK equivalent is regulation 105 of the Payment Services Regulations 2017. A credit institution that refuses or withdraws payment account services from a payment service provider must notify the FCA and give its reasons (FCA). Unlike Article 36, it covers withdrawals as well as refusals.

Since 28 April 2026, the Payment Services and Payment Accounts (Contract Termination) (Amendment) Regulations 2025 have also changed termination of indefinite framework contracts for payment services entered into on or after that date. The provider must give at least 90 days' notice, explain the reasons in enough detail for the user to understand them, and tell the user how to complain, including to the ombudsman. There are exceptions: for failed customer due diligence, immigration-law closures, suspected serious crime, regulator or government direction, abusive conduct towards staff and incorrect onboarding information, the bank can give shorter or no notice. Credit and reputational risk are not among them (DLA Piper).

Two caveats matter for EMIs. First, the rule only applies to contracts entered into from 28 April 2026; older contracts keep the previous position, which allowed two months' notice where the contract provided for it. Second, under regulation 40(7) of the PSRs, where the user is not a consumer, micro-enterprise or charity, the parties can agree that the conduct rules in Part 6, including the termination rules, do not apply. Bank agreements with regulated firms often use that opt-out. A small EMI that is itself a micro-enterprise cannot be opted out. Read your own agreement before you assume you have 90 days.

What changes under the Payment Services Regulation

The agreed text of the EU Payment Services Regulation contains a much more specific anti-de-risking provision. Article 32 of the April 2026 compromise text (text reproduced at paymentslaw.eu) says:

Closed list of grounds. A credit institution may refuse to open, or may close, a payment institution's account only where keeping it would breach the AML Regulation (EU) 2024/1624, where there has been a material breach of contract, where requested information or documents have not been provided, or where the payment institution's authorisation has been refused or withdrawn. The same protection extends to agents and to applicants for authorisation.
One month to refuse, with specific reasons. A refusal must be notified to the applicant and to the competent authority without undue delay and no later than one month after a complete application. The reasons must be specific to the risks of that firm's activity, not generic.
Four months' notice to close. Closure must be notified to the payment institution and the competent authority at least four months in advance, with specific reasons, and the decision must consider the institution's ability to keep complying with its safeguarding obligations.
AML carve-out. Where the ground is an AML infringement, the bank only has to say so, without details, and may close on shorter notice.
Appeal. The payment institution can appeal a refusal or closure to its competent authority. The EBA is to draft technical standards on the format of notifications, and authorities may publish aggregate data on refusals and closures.

Because PSD3 folds e-money issuance into the payment institution licence, today's EMIs will be covered as payment institutions (see our guide to PSD3 and the end of the EMI licence).

Timing is the catch. As of today, the Legislative Observatory lists the file as awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026. The PSR applies 21 months after entry into force (Herbert Smith Freehills Kramer). Even if adoption and publication go smoothly, Article 32 protects nobody before late 2028. Article numbers may also change during legal-linguistic revision.

Bank account exits: what protects a payment firm

Criteria
Access standard	Objective, non-discriminatory, proportionate	Objective, non-discriminatory, proportionate	Same, plus a closed list of refusal and closure grounds
Reasons for a refusal	To the regulator	To the FCA	To you and the regulator within one month, firm-specific
Reasons for a closure	Not required by PSD2	To the FCA; to you as well for new contracts since 28 Apr 2026, unless disapplied	To you and the regulator
Minimum notice to close	Per contract	90 days for new contracts since 28 Apr 2026, unless disapplied	4 months; shorter for AML grounds
Appeal	No	No	Yes
In force	Yes	Yes	Not before late 2028

Until the PSR applies, your notice period is whatever your contract says. Plan for the shortest one.

Summary of the rules described in this article; check your own contract and confirm with counsel.

Your safeguarding bank is a single point of failure

For most EMIs the painful exit is not the operating account. It is the bank that holds safeguarded customer funds, especially when the same bank also provides IBANs, SEPA access or card settlement. Lose that bank and you have to move client money, re-paper the account, repoint payment flows and tell customers about new account details, all inside the notice period.

Regulators are moving to make single-bank safeguarding harder to defend:

UK, CASS 15 (since 7 May 2026). CASS 15.6.1R requires due skill, care and diligence in selecting, appointing and reviewing the banks and other third parties that hold relevant funds, and requires firms to consider the need for diversification as part of that due diligence. CASS 15.6.2G says the assessment should focus on the specific legal entity, not its group. CASS 15.6.5R requires a periodic review of whether to diversify further, and adjustments where that is appropriate. Each safeguarding account needs an acknowledgement letter on the FCA template in CASS 15 Annex 1 (CASS 15.7.5R), countersigned by the bank. If you want the insolvency side of the story, our explainer on how UK special administration works shows what happens to safeguarded funds when an EMI fails.
EU, PSD3 (agreed text). Institutions must endeavour not to safeguard all customer funds with a single credit institution (Clifford Chance). Safeguarding at a central bank, at that central bank's discretion, is already possible under PSD2 as amended by the Instant Payments Regulation (ECB), and PSD3 keeps the option.

Do not count on the central bank option in the euro area. When it set its policy on non-bank access to TARGET in July 2024, the Eurosystem said it will not provide accounts to non-bank PSPs for safeguarding users' funds.

Direct access to TARGET: an alternative, not an escape

Since the Instant Payments Regulation amended the Settlement Finality Directive, payment and e-money institutions can take part directly in designated payment systems (EUR-Lex). Since 2025 they have been eligible for accounts in T2 and TIPS, provided they meet the same operational and technical requirements as banks. The account is limited to what the firm needs for the current day's settlement, and it cannot be used for safeguarding (ECB).

Uptake has been slow. According to the ECB's TARGET Services Annual Report 2025, no non-bank PSP was connected to these TARGET services in production at the end of 2025.

Direct access removes your dependence on a sponsor bank for euro settlement. It does not remove the need for a bank to hold safeguarded funds, for an operating account, or for FX and non-euro correspondent services. It is a project measured in quarters, with its own liquidity management and 24/7 operational burden. It is worth evaluating for firms with real euro volume. It is not a quick fix when a bank has just given you notice.

How long does your notice period really give you?

The number that matters is not the notice period. It is the notice period minus the time it takes to open a replacement account, move funds and migrate customers. Plug in your own assumptions.

Bank exit runway

Notice period in your contract(days)

Time to open a new bank account from first contact(weeks)

Time to move funds, repoint flows and notify customers(days)

Second bank already live and tested (1 = yes, 0 = no)

Days needed to replace the bank: 114 days
Buffer (negative means you run out of time): -54 days
Share of the notice period you would use: 190%

Set the second-bank toggle to 1 to see why a live standby relationship matters more than the notice period itself.

Planning aid with hypothetical defaults. Onboarding times vary widely by bank, jurisdiction and risk profile.

With the defaults, a 60-day notice and a 12-week onboarding leave you 54 days short. A standby bank that is already live turns the same notice into a 30-day surplus. That difference is the whole argument of this article.

How to structure banking so one exit is survivable

There is no universal setup, but the firms that get through a bank exit without a crisis usually share a few traits.

Separate the roles. Treat safeguarding, operating funds, scheme or settlement access, and FX as distinct functions, and avoid letting one bank hold all of them. If one bank must, at least know which functions you could move within a week and which would take months.

Keep a second relationship live, not on paper. A signed account that has never moved money is not a fallback. Route a real share of flows through it, reconcile it daily and keep its acknowledgement letter current.

Make your ledger bank-agnostic. If customer balances, IBAN allocation and reconciliation are tied to one bank's account structure, every migration becomes a rebuild. A ledger that treats banks as interchangeable rails lets you move funds and flows without touching customer records. This is the main reason Fyora's platform keeps the ledger, reconciliation and audit log in its own back office, with banks connected through an integrations layer.

Run your bank due diligence as if you were the bank. Most exits follow a periodic review. Keep a current pack with ownership charts to the individuals, your business-wide risk assessment, transaction monitoring statistics and alert closure times, sanctions screening coverage, and an honest description of your customer base and corridors. If your flows have changed since onboarding, tell the bank before its review finds out. Our article on KYC, KYT and risk scoring covers the controls banks typically probe.

Know your contract. Note the notice period, the termination grounds, whether the UK Part 6 opt-out was used, and what happens to safeguarded funds on termination. Diary the acknowledgement letter review, which CASS 15 requires at least annually.

Banking partner exit plan

Map every function each bank provides
Safeguarding, operating account, IBANs or virtual accounts, scheme access, card settlement, FX, correspondent services.
Record notice periods and termination clauses
Including, for UK contracts, whether the regulation 40(7) opt-out disapplies the 90-day rule.
Have a second safeguarding institution live
Acknowledgement letter signed, funds held, daily reconciliation running.
Test a migration on a small segment
Move a cohort of customers or one flow end to end and time it.
Prepare customer communications in advance
New account details, timelines, fraud warnings about fake 'migration' messages.
Pre-draft the regulator notification
What you will tell the FCA or your national authority, and when, if a bank gives notice.
Keep a bank due diligence pack current
Ownership, risk assessment, monitoring metrics, flows by corridor, changes since onboarding.
Assess direct TARGET access if euro volume justifies it
A settlement option, not a safeguarding solution; budget for liquidity and 24/7 operations.

A starting point for your own plan. Progress is saved on this device where browser storage is available.

If you have already received notice

Act in the first week, not the last. Ask the bank in writing for its reasons and for any flexibility on timing. In the UK, check whether your contract falls under the 90-day rule. In the EU, remember the regulator receives refusal reasons under Article 36 and may be willing to engage. Consider telling your competent authority early, and check whether your own notification obligations are triggered: regulators would rather hear about a safeguarding migration from you than discover a gap later. Start parallel onboarding with more than one candidate bank or safeguarding provider, because each will run its own due diligence on its own timetable. Freeze non-essential product changes until the money has moved. And plan the customer migration as carefully as the funds migration; account detail changes give fraudsters an obvious pretext for impersonation scams.

This article explains public rules and agreed draft texts and is not legal advice; check your own contracts and position with counsel and your competent authority.

Our view

The PSR's four-month notice period is a real improvement and the industry should welcome it, but it will not change outcomes much. Four months barely covers a typical onboarding and migration, the AML carve-out lets a bank close faster without explanation, and the rule will not apply for at least two years. A bank that wants to leave will leave.

What actually protects an EMI is architecture: a second live safeguarding relationship, a ledger that does not care which bank sits underneath, and a due diligence pack that answers the questions before the bank asks them. CASS 15 already pushes UK firms in that direction, and PSD3 will push EU firms the same way. Firms that treat multi-banking as a compliance box will do the minimum. Firms that treat it as resilience will be the ones still operating when their bank sends the letter.

If you want help designing a multi-bank setup, or connecting a second banking partner to your existing stack, our engineering team does this work. Tell us what you're building.

FAQ

How much notice must a bank give an EMI before closing its account?

In the EU, PSD2 sets no minimum notice for closing a payment institution's account, so the contract decides. In the UK, framework contracts entered into from 28 April 2026 require at least 90 days' notice with reasons, unless the user is not a consumer, micro-enterprise or charity and has agreed to disapply those rules. Under the agreed EU Payment Services Regulation it will be four months, once it applies.

Can a bank refuse a payment institution an account without giving reasons?

Under PSD2 Article 36 the bank must give duly motivated reasons to the competent authority, not necessarily to the applicant. Under the agreed PSR text, the bank must notify both the applicant and the authority within one month of a complete application, with firm-specific reasons, except that in AML cases it need only state that an infringement would result.

When does the PSR's anti-de-risking rule apply?

The Payment Services Regulation is not yet adopted; the European Parliament lists an indicative plenary date of 14 December 2026. It applies 21 months after entry into force, so Article 32 is unlikely to protect anyone before late 2028.

Can an EMI safeguard customer funds at the ECB or a national central bank?

Since the Instant Payments Regulation amended PSD2, safeguarding at a central bank is allowed where the central bank chooses to offer it, but the Eurosystem has said it will not provide safeguarding accounts to non-bank PSPs. TARGET accounts available to EMIs and payment institutions are for settlement only.

Does CASS 15 require UK firms to use more than one safeguarding bank?

Not in absolute terms. CASS 15.6.1R requires firms to consider the need for diversification as part of their due diligence, and CASS 15.6.5R requires them to review periodically whether to diversify further and to act where that is appropriate.