What Is the PSD3 Timeline, and What Changes for Safeguarding?

Key takeaways

• PSD3, a directive, and the Payment Services Regulation (PSR) will replace PSD2 and the second E-Money Directive, folding e-money institutions into the payment institution framework.
• The Commission proposed them on 28 June 2023, Parliament adopted its position on 23 April 2024, and political agreement was reached on 27 November 2025.
• The Council's final compromise text of PSD3 is dated 17 April 2026; the rules apply only after publication in the Official Journal and the set periods after entry into force.
• Article 9 of the agreed PSD3 text keeps segregation or insurance, allows safeguarding accounts at central banks, asks firms to avoid concentration risk and requires users to be told how their funds are protected.
• The EBA must draft technical standards on safeguarding within one year of entry into force, and existing institutions get transitional periods.

What are the key facts on PSD3?

PSD3 and the PSR are the EU's replacement for PSD2 and EMD2, with the safeguarding rules placed in the PSD3 directive.

What is the PSD3 timeline?

The proposal dates from June 2023, political agreement from November 2025, and the final texts from April 2026.

We could not confirm publication in the Official Journal on the date checked. Publication matters because every later date, transposition, application and transition, is counted from entry into force. Firms should check EUR-Lex for the final references and dates rather than relying on estimates.

The steps between political agreement and publication are procedural but take time: the agreed texts are checked by lawyer-linguists in every official language, confirmed by the Council's committee of permanent representatives, adopted by Parliament in plenary and by the Council, and signed by both presidents. Only then is the text published and the clock for entry into force started.

How are PSD3 and the PSR divided?

PSD3 covers authorisation, supervision and safeguarding; the PSR covers conduct rules and applies directly.

PSD3 is a directive that each Member State transposes into national law. It covers access to the activity, authorisation, capital, governance and safeguarding of users' funds, and it repeals PSD2 and the E-Money Directive. The PSR is a regulation, directly applicable without transposition, covering transparency, rights and obligations, fraud prevention, open banking and payment execution. E-money services become a category of payment service under PSD3, so e-money and payment institutions operate under one licensing framework. Our guide to PSD2 safeguarding explains the current position.

What changes for safeguarding under Article 9?

The two methods stay, but central bank accounts, concentration risk and user information are new.

The recitals add that safeguarded funds should correspond to users' claims, including where net settlement reduces the funds received, and that the EBA should also develop standards on segregation and reconciliation for funds held through designated settlement systems. Our article on EU EMI safeguarding by country shows how national practice differs today, and our guide to DNB safeguarding shows one national model in detail.

What happens to existing licences?

Existing payment and e-money institutions get transitional periods, with a longer one for firms that used the e-money waiver.

Recitals 69 and 70 of the compromise text describe transitional arrangements for institutions already authorised under PSD2 and EMD2, with a longer period for institutions that benefited from the waiver in Article 9 of the E-Money Directive. The exact periods run from entry into force and will be fixed by the published text. Firms should plan the information they will need to show their national authority that they meet the new requirements, including a description of safeguarding measures, which Article 3(3)(d) makes part of every authorisation application.

Because PSD3 is a directive, the safeguarding rules a firm actually follows will be in its home Member State's transposing law, read with the EBA standards. Groups with institutions in several Member States should expect the transposing laws to arrive at different times within the transposition window, and should track each one separately.

How does PSD3 compare with the UK regime?

The UK moved first and further, with daily reconciliation, monthly reporting and annual audits in force since 7 May 2026.

UK payment and e-money firms now operate under CASS 15, which already requires daily internal and external reconciliations and the monthly safeguarding return. PSD3 tightens the EU model but leaves reconciliation detail to EBA standards. Groups with UK and EU entities will run two related regimes, and should build one daily reconciliation that serves both.

The differences are mostly in reporting and assurance. The UK requires a monthly return and an annual safeguarding audit by rule; the PSD3 text leaves reporting to national authorities and technical detail to the EBA. A group that designs its controls to the UK standard will usually meet the EU requirements on reconciliation and records, but must still meet each Member State's reporting format and the PSD3 rules on concentration and user disclosure.

How should a firm plan against the timeline?

By counting back from the expected application date and testing today's arrangements, point by point, against Article 9 of the agreed text.

Worked example. An e-money institution holds EUR 210 million of users' funds: EUR 168 million (80%) at one bank, EUR 30 million at a second bank and EUR 12 million in eligible government bonds. Card receipts average EUR 6 million a day and are currently safeguarded on the fifth business day.

The timing change is the largest. With EUR 6 million of card receipts a day, moving from the fifth business day to the next business day means four extra days of receipts, about EUR 24 million, must reach safeguarding accounts sooner, which needs liquidity planning before the rules apply.

What should firms do in each phase?

The work divides into four phases, each triggered by a step in the legislative process.

The EBA's safeguarding standards are due within one year of entry into force, so some operational detail, particularly on concentration and on settlement accounts in designated systems, will arrive part-way through the transition. Firms that already reconcile daily and can show concentration by bank will absorb those standards with little change.

What should EU firms do before PSD3 applies?

These steps reduce the work once the final dates are known.

• Track Official Journal publication and record the resulting transposition, application and transition dates.
• Map current safeguarding against each point in Article 9 of the agreed text.
• Measure concentration of users' funds by credit institution.
• Assess whether a central bank safeguarding account is available and useful.
• Plan for e-money receipts to be safeguarded by the end of the next business day.
• Prepare user disclosures on safeguarding method, location and insolvency law.
• Build daily reconciliation now, ahead of the EBA technical standards.

How does Safeheld help?

Safeheld reconciles users' funds to every safeguarding account and asset daily, by entity and currency, and shows concentration by bank from the same data.

See daily reconciliation.

Frequently asked questions

When was PSD3 agreed?

Parliament and Council reached provisional political agreement on 27 November 2025. The Council's final compromise text of PSD3 is dated 17 April 2026.

When will PSD3 apply?

After formal adoption and publication in the Official Journal, at dates counted from entry into force in the final text. Firms should take the exact dates from EUR-Lex once published.

What is the difference between PSD3 and the PSR?

PSD3 is a directive transposed into national law, covering authorisation, supervision and safeguarding. The PSR is a directly applicable regulation covering conduct rules such as transparency, fraud and open banking.

Can firms safeguard at a central bank under PSD3?

Yes. Article 9 of the agreed text allows a separate safeguarding account at a central bank, at the central bank's discretion.

Does PSD3 limit concentration of safeguarded funds?

It asks institutions to avoid concentration risk, ideally not holding all users' funds with one credit institution, with EBA standards to follow.

Will e-money institutions still exist under PSD3?

E-money services become a type of payment service, and e-money institutions are brought into the payment institution framework, with transitional arrangements for existing licences.

Do firms need to re-apply for a licence under PSD3?

The agreed text gives existing payment and e-money institutions transitional periods to show they meet the new requirements, with a longer period for institutions that used the E-Money Directive waiver. The exact periods will be fixed in the published text.

Does PSD3 apply in the UK?

No. The UK left the EU before PSD3 was agreed and has its own safeguarding regime under CASS 15, in force since 7 May 2026.

References

• Council of the EU, PSD3 final compromise text, ST 8222/26 (17 April 2026, PDF)
• Council of the EU, PSR final compromise text, ST 8221/26 (PDF)
• European Commission, Proposal for a Directive on payment services and electronic money services, COM(2023) 366
• European Commission, Proposal for a Regulation on payment services, COM(2023) 367
• European Parliament, Legislative resolution of 23 April 2024, procedure 2023/0209(COD)
• Directive (EU) 2015/2366 (PSD2)
• Directive 2009/110/EC (EMD2)

About Safeheld

Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. For EU payment and e-money institutions it reconciles users' funds to every safeguarding account daily and measures concentration by bank, ready for the PSD3 requirements as they apply. To discuss your safeguarding operations, contact us at safeheld.com/contact.

This article is general information on EU safeguarding rules and is not legal or regulatory advice.