Regulation

PSD3 and the End of the EMI Licence: What Changes and When

Dmytro Medvid, Founder · October 19, 2026 · 10 min read

Fyora cover: PSD3 and the end of the EMI licence, with a schematic linking EMD2, PSD3, PSR and the Instant Payments Regulation

Key takeaways

As of October 2026, PSD3 and the PSR are politically agreed and the final texts are known, but they have not yet been formally adopted or published in the Official Journal.
Deadlines run from entry into force (20 days after publication): the PSR applies after 21 months, payee-verification rules after 27 months, and member states have 21 months to transpose PSD3.
The separate EMI licence disappears: e-money issuance becomes a payment service and existing institutions must file for PSD3 authorisation within 21 months of entry into force.
The biggest operational change is liability: consumers who are tricked by fraudsters impersonating their provider through its own channels get a full refund unless the provider proves fraud or gross negligence.
Instant payments come first: euro-area PIs and EMIs must send and receive instant euro transfers from 9 April 2027, and verification of payee already applies since 9 October 2025.

PSD3 and the Payment Services Regulation are the biggest rewrite of EU payments law since 2015. As of October 2026 they are still not law: the texts are agreed, but formal adoption and publication in the Official Journal are pending. That gap tempts a lot of EMIs and payment institutions to wait. It shouldn't. The substance is settled, the clock starts 20 days after the texts are published in the Official Journal, and the hardest changes sit in your ledger, your fraud stack and your safeguarding setup, not in your licence certificate.

This guide covers where the package stands, what actually changes for e-money and payment institutions, and what to build while Brussels finishes the paperwork.

Where PSD3 and the PSR stand in October 2026

The Commission proposed the package in June 2023: a directive (PSD3) that governs authorisation and supervision and has to be transposed into national law, and a regulation (the PSR) that applies directly and carries the conduct rules — fraud liability, payee verification, open banking and authentication. CPG's glossary has a good short explanation of the split.

Parliament and Council reached a provisional political agreement on 27 November 2025. The Council circulated the final compromise texts in April 2026 — Council documents 8221/26 (PSR) and 8222/26 (PSD3) — and Parliament's ECON committee approved them on 5 May 2026. According to Bratby Law, as at 7 October 2026 neither instrument had been formally adopted or published, and the European Parliament's legislative train still lists the file as "close to adoption".

PSD3 and PSR: from proposal to application

28 Jun 2023done
Commission proposal
PSD3 (directive) and PSR (regulation) published together.
27 Nov 2025done
Political agreement
Parliament and Council agree the package in trilogue.
Apr 2026done
Final compromise texts
Council documents 8221/26 (PSR) and 8222/26 (PSD3).
5 May 2026done
ECON committee approval
Parliament's committee endorses the agreed texts.
PendingWe are herecurrent
Formal adoption and Official Journal
Plenary and Council adoption, signature, publication. Entry into force 20 days later.
EIF + 21 monthsupcoming
PSR applies, PSD3 transposition deadline
Most conduct rules bite; member states must have transposed PSD3.
EIF + 27 monthsupcoming
Payee verification rules apply
Articles 50 and 57 of the PSR; also the end of the PSD3 transition window for existing licences (filing due by month 21; extendable by up to 3 months).

Legal-linguistic revision can still move details, so treat article numbers and figures below as those of the compromise texts, and check them against the published version when it lands.

The clock starts at publication — model your own deadline

Every operational deadline is counted from entry into force, which is 20 days after publication. Under the compromise texts, the PSR applies 21 months after entry into force, member states have 21 months to transpose PSD3, and the payee-verification provisions follow at 27 months (bankinglaw.be). Use the calculator to see where your deadlines land depending on when publication happens.

When do PSD3 and the PSR bite?

Official Journal publication, months from now(mo)

Entry into force: February 2027
PSR applies and PSD3 transposition deadline: November 2028
Payee verification rules apply: May 2029

Indicative. Entry into force is approximated as one month after publication (the legal rule is 20 days).

Whatever slider position you pick, the answer is the same: the real obligations land in 2028–2029. Vendors and in-house teams need to ship in 2027, because nobody should go live on a regulatory build in the quarter it becomes mandatory.

The end of the separate EMI licence

The headline change: the E-Money Directive (EMD2) is repealed and issuing electronic money becomes one of the listed payment services (Annex I, point 8 of PSD3). Electronic money institutions will no longer hold a separate authorisation; they will be authorised as payment institutions, while the e-money-specific rules on capital, distribution and redeemability are kept (Bratby Law; European Parliament).

EMI today vs payment institution under PSD3

Criteria
Licence	Separate e-money institution authorisation	Payment institution authorised for e-money issuance
Rulebook	Two directives, national gold-plating	One directive + a directly applicable regulation
Existing authorisation	Valid indefinitely	Transition window, then re-authorisation or proof of compliance
Safeguarding	Segregation, insurance or guarantee	Tighter rules, concentration risk, wind-down plans
Impersonation fraud	Largely the customer's loss	Full refund for consumers in defined cases
Payee name check	Euro credit transfers, standard and instant (IPR, since Oct 2025)	All credit transfers, including non-euro (PSR)
Open banking	Interfaces vary in quality	Dedicated interface by default, consent dashboard

The licence label changes once; the liability and safeguarding changes hit your operations every day.

What happens to your current licence

Existing authorisations do not roll over indefinitely. Under the compromise text, existing institutions must submit their application or compliance information within 21 months of entry into force. They may keep operating while the authority assesses it, up to 27 months after entry into force, and the authority can extend this by up to three months in exceptional cases (Clifford Chance; A&L Goodbody). Firms that miss the window risk losing the right to operate (Dudkowiak).

If an institution shows that it already meets the PSD3 requirements, the competent authority can treat it as authorised without a full new application. Commentators read that as a discretion of the authority, not a right (Arthur Cox), so plan to submit the information either way.

In practice this means a re-licensing review somewhere between 2027 and 2029 covering capital, governance and safeguarding. If your documentation is scattered across tools and spreadsheets, that review will hurt.

Capital

Under the April 2026 compromise text, as summarised by A&L Goodbody, initial capital is €40,000 for money remittance (up from €20,000), €50,000 for payment initiation, €150,000 for other core payment services (up from €125,000) and €250,000 for e-money issuance (down from €350,000 under EMD2). Where a firm provides several categories, the amounts are added together rather than the highest one applying. The 2023 proposal had €400,000 for e-money, so read older commentary carefully and confirm against the published text.

The real shift: fraud liability moves onto your balance sheet

For most EMIs the licence change is paperwork. The PSR's fraud provisions are not.

Impersonation ("spoofing") fraud. Article 59 of the compromise text (Bratby Law) requires a provider to refund a consumer in full when a fraudster posing as that provider — using channels attributed to it, such as its name, phone number, email address, website or app — manipulates the consumer into authorising a payment. The consumer must report to the police and notify the provider without undue delay. The provider then has 15 business days to refund or justify a refusal, and can refuse only by proving fraud or gross negligence (bankinglaw.be). A call from an unrelated number from someone merely claiming to be a bank employee is not enough to trigger the refund.

Impersonation fraud refund under the PSR

A fraudster contacts the consumer through a channel that looks like yours — your number, your email, your app thread.
The consumer authorises the payment. Strong customer authentication succeeds; under the PSR that alone does not prove gross negligence.
The consumer files a police report and notifies you without undue delay.
You have 15 business days to refund in full or prove fraud or gross negligence. The burden of proof is yours.

Payee verification for every credit transfer. Article 50 extends the name-against-IBAN check to credit transfers not already covered by the Instant Payments Regulation, and Article 57 makes the payer's provider refund a transfer that was defectively executed because of a failed check, with a right to compensation from whichever provider was responsible (Bratby Law).

Transaction monitoring on both sides. The payer's provider must monitor before executing, and the payee's provider before making funds available. A provider that did not monitor is exposed to liability for the fraudulent transaction (bankinglaw.be).

Why this matters for pricing

key

Refund liability turns fraud from a customer-service problem into a P&L line. Model your expected impersonation losses per 10,000 consumer accounts now, and price products accordingly — before the PSR applies, not after the first claims arrive.

Safeguarding gets stricter — and it is already happening

The package tightens client-fund protection: segregation, permitted safeguarding accounts or an insurance/guarantee option, with explicit attention to concentration risk and a requirement for wind-down plans (Dudkowiak). The compromise text also requires institutions to endeavour not to safeguard all funds with a single credit institution, and moves e-money safeguarding to the end of the business day after receipt (Clifford Chance) — so a single-bank setup is exactly what supervisors will question.

If you also run a UK entity, you are already living this: the FCA's new safeguarding chapter, CASS 15, took effect on 7 May 2026 for authorised payment institutions, e-money institutions and small payment institutions that opt in (FCA Handbook; Regulation Tomorrow). PSD3 does not apply in the UK, and HM Treasury only closed its own consultation on reforming the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 on 6 October 2026 (Bratby Law) — so UK–EU groups should expect two diverging rulebooks.

Instant payments arrive first

PSD3 is not the nearest deadline. Under the Instant Payments Regulation, payment and e-money institutions in the euro area must be able to send and receive instant euro credit transfers from 9 April 2027; in non-euro member states they must receive from 9 April 2027 and send from 9 July 2027. Verification of payee is already mandatory: since 9 October 2025 every euro-area PSP, including PIs and EMIs, must offer it on both standard and instant euro credit transfers (ECB). Instant settlement is a hard real-time requirement on your ledger, your sanctions screening and your fraud checks, and it lands well before the PSR does.

The upside: the same regulation amended the Settlement Finality Directive so payment and e-money institutions can participate in designated payment systems (EUR-Lex), which reduces dependence on sponsor banks over time.

Open banking and authentication

Two smaller but real engineering items:

Open banking. Account-servicing providers must offer a dedicated data-access interface by default (competent authorities can grant exemptions), and users get a permission dashboard to see and revoke access (private.law; Dudkowiak). The wider open-finance regime (FiDA) runs on a separate, slower track.
Strong customer authentication. Two factors from the same category become acceptable if you can show they are independent, and authentication may not depend on a single method or mandatory smartphone ownership (private.law). Customers without a smartphone need a real path.

What to build in the next 12 months

The firms that will handle PSD3 comfortably are the ones that treat it as a product roadmap, not a legal memo. A practical order of work:

PSD3 / PSR readiness checklist

Map your current authorisation to the PSD3 regime
Which services, which capital, which national regulator, and what evidence they already hold.
Diversify safeguarding
At least two safeguarding institutions, documented reconciliation, a tested wind-down plan.
Ship instant payments readiness for 9 April 2027
Real-time ledger, 24/7 screening, and verification of payee (already mandatory for euro transfers since 9 October 2025) wired into the instant flow.
Model impersonation-fraud exposure
Expected refunds per 10,000 consumer accounts; re-price where needed.
Add pre-execution and pre-credit monitoring
Both outgoing and incoming flows, with alert queues and documented decisions.
Lock down your official channels
Verified sender IDs, known phone numbers, in-app messaging customers can trust — spoofing of your channels is now your liability.
Plan an SCA path without a smartphone
Hardware tokens, card readers or other independent factors.
Centralise compliance evidence
One audit trail for onboarding, monitoring and decisions — this is what the re-licensing review will ask for.

If your launch can't wait until the new regime applies, one pragmatic route (private.law) is to apply under the current rules now and design your systems against the April 2026 compromise texts, accepting that you will go through PSD3 re-authorisation within the transition window. Confirm timing with counsel and your national regulator before you decide. Our EMI technology checklist covers the baseline systems, and compliance by design explains why monitoring and audit trails belong inside the platform.

This article summarises public commentary on the compromise texts and is not legal advice; confirm your position with counsel and your national competent authority.

Our view

PSD3 will be remembered for abolishing the EMI licence, but that is the least important thing it does. The package moves fraud losses onto providers and pushes safeguarding away from single-bank setups, and together with the Instant Payments Regulation it makes real-time payments with name checks the default. None of that can be bolted on in the last quarter before the deadline.

That is the reason Fyora's platform keeps onboarding, transaction monitoring, risk scoring and the audit trail in one back office, and why our engineering team builds the jurisdiction-specific pieces around it. If you want to stress-test your stack against PSD3 and the PSR, book a session with us.

Quick check

Under the compromise text, when does the PSR start to apply?
- On publication in the Official Journal
- 21 months after entry into force
- On 9 April 2027
Answer and explanation
21 months after entry into force
Most PSR provisions apply 21 months after entry into force; payee verification follows at 27 months. 9 April 2027 is the Instant Payments Regulation deadline for euro-area PIs and EMIs to send and receive instant euro transfers.
Which of these is enough to trigger a full impersonation-fraud refund?
- A fraudster calls from a random number claiming to be the bank
- A fraudster uses the provider's own phone number or message thread, and the consumer reports to the police and notifies the provider
- Any authorised push payment fraud
Answer and explanation
A fraudster uses the provider's own phone number or message thread, and the consumer reports to the police and notifies the provider
The refund covers impersonation through channels attributed to the provider, for consumers who report to the police and notify the provider promptly.

FAQ

Is PSD3 already in force?

No. As of October 2026 the texts are agreed and approved by Parliament's ECON committee, but formal adoption and publication in the Official Journal are still pending. PSD2 and the E-Money Directive continue to apply until then.

Will EMIs lose their licence under PSD3?

The separate e-money institution licence is abolished and e-money issuance becomes a payment service. Existing EMIs must submit an application or compliance information within 21 months of entry into force and can keep operating while the authority assesses it, up to 27 months (extendable by three months in exceptional cases).

When does the Payment Services Regulation apply?

Under the compromise text, 21 months after entry into force, with the payee-verification provisions (Articles 50 and 57) applying after 27 months. Entry into force is 20 days after publication in the Official Journal.

What is the impersonation fraud refund in the PSR?

If a fraudster poses as a consumer's payment provider using channels attributed to it, such as its phone number, email address, website or app, and the consumer authorises a payment, the provider must refund in full within 15 business days, provided the consumer reported to the police and notified the provider promptly. The provider can refuse only by proving fraud or gross negligence.

How much initial capital will an e-money issuer need under PSD3?

Practitioner summaries of the April 2026 compromise text put it at €250,000 for e-money issuance, down from €350,000 under the E-Money Directive, with amounts for several service categories added together. Confirm against the published text.