PSD3 explained

What is PSD3?

PSD3 timeline: when does it apply?

PSD3 vs PSD2: the key changes

Capital, safeguarding and re-authorisation

• Capital. Floors rise for payment institutions and fall for a pure e-money issuer. The catch is the cumulative rule: an institution providing services from more than one band adds the amounts. A Latvian EMI that also executes payments, which is most of them, moves from €350,000 to €400,000.
• Safeguarding. The methods survive: a separate account at a credit institution, secure low-risk assets, or insurance or a guarantee. E-money funds must be safeguarded by the end of the next business day, not within five, and providers should avoid placing all users' funds with one bank. In a market with few banks willing to open safeguarding accounts, that is the practical pinch.
• Winding-up plan. Applicants file a plan for an orderly wind-down, proportionate to size and model, covering critical outsourced activities. Latvia already asks for one from a specialised credit institution; PSD3 extends the idea to the payments sector.
• Re-authorisation. Existing payment and e-money institutions keep their authorisation if, within 27 months of entry into force, they give Latvijas Banka the information needed to assess PSD3 compliance. An institution that does not file, or does not comply, loses its authorisation at the end of the window.

What the PSR changes for customers and providers

• Verification of payee. The payee-name check already required for euro instant payments extends to all credit transfers, with a refund where a failure to verify causes a misdirected payment.
• Impersonation fraud. Where a fraudster poses as the provider and the consumer reports it to the police and the provider, the provider refunds or gives a reasoned refusal. The burden of proving fraud or gross negligence sits with the provider.
• Fraud monitoring. Providers must run transaction monitoring that detects fraud and may share fraud data with other providers under data-protection safeguards.
• Strong customer authentication. Providers must offer an authentication method for customers without a smartphone or with a disability, and SCA may not depend on a single device unless the customer agrees.
• Open banking. Banks run a dedicated interface for third-party providers, and customers get a dashboard to see and withdraw the access they have granted.
• Scope. Exclusions for commercial agents and limited networks are narrowed, so some marketplaces and closed-loop schemes may fall inside the rules.

PSD3 in Latvia, licence by licence

• Payment institutions. Higher capital floor, a winding-up plan at re-authorisation, and the PSR's fraud and payee rules whether or not the licence itself changes.
• E-money institutions. The licence becomes a payment institution licence with e-money on it. A pure issuer needs €250,000; an issuer that also provides payment services needs €400,000. Safeguarding moves to the next business day.
• Registered institutions. The small-institution exemption survives as a Member State option. Whether and how Latvia keeps it is a transposition decision to watch.
• Crypto-asset service providers. A CASP authorised under MiCA that wants to provide payment services can reuse parts of its MiCA file. See our MiCA licence guide.
• Banks. The PSR's conduct rules bind credit institutions too: payee verification, fraud refunds and open-banking interfaces are bank obligations first.

Earlier EU deadlines

How to prepare now

1. 01

   Re-map the licence.

   List every service you hold, apply the cumulative capital rule, and decide whether the e-money line is worth keeping.

2. 02

   Fix safeguarding.

   A second bank, a settlement account or insurance; next-business-day safeguarding for e-money; clear customer disclosure.

3. 03

   Write the winding-up plan.

   Against the actual balance sheet and the actual outsourcing contracts.

4. 04

   Build the fraud stack once.

   Payee verification is due under the Instant Payments Regulation in April 2027 anyway; add monitoring and a refund procedure.

5. 05

   Decide your open-banking position.

   Budget the dedicated interface if you hold accounts; build re-authentication and consent withdrawal if you use them.

6. 06

   Prepare the re-authorisation file.

   Governance, outsourcing register, ICT and DORA evidence, updated policies. File early in the window, not late.

7. 07

   Watch the publication date.

   Every clock in this article starts twenty days after it.

How Nordant helps

• Licensing & Authorisation. PSD3 gap analysis against your licence file, the re-authorisation submission and the regulator's questions.→
• Regulatory Advisory. Which services to keep, what the capital rule costs, and how the PSR changes your product.→
• Legal & Corporate Advisory. Capital increases, shareholder documents, safeguarding and outsourcing agreements.→
• Outsourced Legal Counsel. Senior capacity for the implementation, without a permanent hire.→
• Outsourced Compliance & MLRO. Fraud and AML procedures ready for the PSR and the AML Regulation.→

Common questions

What is PSD3 in simple terms?

The EU's updated law on payment services. It replaces PSD2 and the E-Money Directive with a single licensing regime, and comes with the Payment Services Regulation, which sets the customer-facing rules on fraud, authentication and open banking across the EU.

Is PSD3 in force yet?

No. The texts were agreed in November 2025 and finalised in 2026 but had not been published in the Official Journal at the time of writing. PSD2 remains the law until PSD3 applies.

When will PSD3 apply?

21 months after entry into force, which is twenty days after publication. Verification of payee for all credit transfers and the re-authorisation deadline follow at 27 months.

What is the difference between PSD3 and the PSR?

PSD3 is a directive on licensing and supervision, transposed by each Member State. The PSR is a regulation on conduct, fraud liability, authentication and open banking, applied directly.

What are the PSD3 capital requirements?

€40,000 for money remittance, €50,000 for payment initiation, €150,000 for other payment services and €250,000 for e-money, added together for combinations. E-money plus payment services therefore needs €400,000.

What happens to e-money institutions?

The separate licence disappears. An e-money institution becomes a payment institution authorised for e-money, with next-business-day safeguarding.

Do existing licences stay valid?

Yes, if the institution gives its supervisor evidence of PSD3 compliance within 27 months of entry into force. Otherwise the authorisation lapses.