For non-bank payment service providers (non-bank PSPs, such as payment institutions and electronic money institutions/EMIs), fintechs and merchants, the (currently nearing formal adoption) reform package of the Payment Services Regulation (PSR) and the third Payment Services Directive (PSD3) is not a radically new rulebook. The key questions will not differ materially from those under the current framework: where do funds sit, who controls them, when does a model cross into regulated payment services or e-money, and can familiar exclusions still be relied on?
The package is nevertheless an appropriate moment to reassess whether current structures, contractual arrangements and licensing assumptions still hold. A qualification for this blog is that PSPs offering payment accounts are more affected, but that topic will be addressed in a separate blog. The same applies to payment initiation service providers (PISPs) and account information service providers (AISPs) in the context of the open banking framework.
New EU payments regulation is an evolution, not a reset
When the European Commission published its PSD3 and PSR proposals in June 2023, the aim was not to rebuild EU payments law from scratch, but to modernise PSD2. That remains the right way to read the package.
What is the difference between PSD3 and PSR? PSD3 is the authorisation and supervision framework and will need to be transposed into national laws as it will be a directive. The PSR will be a regulation and therefore the directly applicable rulebook for conduct, transparency and operational requirements.
One structural change does stand out. The separate e-money regime, currently governed by EMD2, is being merged into the broader payments framework, so the historical divide between payment institutions and e-money institutions will disappear. Licensed entities will all be payment institutions and the core service categories remain.
Payment services licence required? The licensing perimeter still starts with ‘possession of funds’
For fintechs, merchants, marketplaces and other intermediated models, the most important question remains: does the structure involve receiving, holding or forwarding client funds in a way that brings the business within the payments perimeter? Or, put more simply: is there possession of funds? If so, there is still a risk of providing regulated payment services.
Businesses sometimes assume that using a licensed payment partner resolves the issue. It may help, but it does not automatically remove regulatory risk if, as a matter of substance, the merchant or platform still possesses funds. That is particularly important when structuring partnerships with PSPs and documenting the underlying contractual model. If an ‘insolvency test’ is not passed, for example because the funds would be deemed to belong to the merchant or platform in case of its insolvency, then the set-up is not PSD2/PSD3 compliant.
The legal analysis remains highly factual and turns on how the flow of funds is actually structured, not on how the arrangement is described in contracts or marketing materials.
Payment services?
The payment services themselves do not materially change under PSD3, but the Annex of PSD2 is updated and reorganised in PSD3.
A separate issue is the qualification of executing payment transactions. There is currently a case pending before the EU Court of Justice (Betaalgarant/DNB) that will most likely shed more light on this (see also (1) Post | LinkedIn). The outcome will be relevant to understand the exact meaning of the current payment service 3 (execution of payment transactions) and in particular whether payment institutions can perform this service.
E-money remains distinct, but the boundary matters
The separate e-money directive disappears under the new architecture and EMIs will all be payment institutions. However, the distinction between a payment service and e-money issuance remains legally significant. For instance, the mere holding of funds on a payment account does not, without more, amount to issuing e-money. Where cards are concerned, the analysis turns on whether the model creates a separate monetary value, issued for payment purposes, that is accepted by persons other than the issuer.
A payments licence can support more than payments alone
Under PSD3, payment institutions may still, within limits, offer services that are closely related to their payment activities. That may include foreign exchange services linked to payment transactions and, potentially, hedging arrangements that serve the payment flow rather than constituting a separate investment activity. This topic is currently also the subject of proceedings before the EU Court of Justice (EUR-Lex – 62025CC0339 – EN – EUR-Lex). A payments licence may also support ancillary credit, but only on strict conditions. Properly structured, the licence can therefore support more than the transfer of funds alone, but only within clear regulatory limits.
Those limits will remain important. A payments licence is not a route into deposit-taking, general lending or general investment services. PSD3 does not materially expand that perimeter.
Limited Network and Commercial Agent exclusions will face more regular supervisory scrutiny
For many technology-enabled models, the most commercially relevant part of PSD3 may be the familiar exclusions.
For the limited network exclusion, the new framework offers some further clarifications, but there is no real gamechanger. It gives more detail on points such as the single limited network concept and online use, while also making clear that reliance on the exclusion remains open to supervisory scrutiny.
For the commercial agent exclusion, the requirements will be that the intermediary must act for one side only and must also have real scope to negotiate or conclude the underlying sale or purchase. That said, any further impact will also depend in practice on the examples and further guidance the EBA is expected to provide.
Firms that have built their analysis on broad readings of these exclusions should therefore expect the debate to continue.
Conclusion
PSD3 and the PSR should not be understood as a radical break with the rules of PSD2 for non-bank PSPs and merchants. They are better seen as a cleaner and more disciplined version of the framework the market already knows. For most payment institutions, EMIs and merchants, the main value lies in greater coherence, not in a materially broader licence perimeter. A qualification is that PSPs offering payment accounts and PISPs/AISPs will see more significant impact under the new framework.
How can BarentsKrans help payment institutions, EMIs and merchants?
For many payment institutions, EMIs and merchants, the immediate task is not a wholesale redesign, but rather a focused reassessment of whether their current structure remains fit for purpose under PSD3 and the PSR. At BarentsKrans, we advise payment institutions, e-money institutions, fintechs, merchants, marketplaces, platforms and other payment market participants on that reassessment.
That may include questions such as:
- For fintechs, merchants, marketplaces and platforms:
- Does your current model involve possession of client funds, and if so, where does the main licensing risk sit?
- Are you correctly relying on the limited network or commercial agent exclusion, also in light of the PSD3 clarifications?
- Does your current set-up with a PSP still work from a payments law perspective?
- Do your contracts, operational flows and safeguarding arrangements reflect the legal reality of the model?
- Should you adapt your current structure now, or wait for further legislative and/or EBA guidance?
- For non-bank PSPs and EMIs:
- Do any ancillary services, such as FX, hedging or short-term credit, remain within the permitted scope of your licence?
- Do your partnership or white-label models still work from a payments law perspective?
- For which services will authorisation be required under PSD3?
- What other impact will PSD3 have, for example on safeguarding requirements, data-sharing for fraud detection purposes and liability for unauthorised transactions?