PSD3 and PSR are expected to take effect in Q3 2026, with compliance due around mid-2028

The EU’s payments rulebook is heading for its biggest reset since 2015, and payment institutions (PIs) and e-money institutions (EMIs) will have to work through it on a fairly tight clock. The practical issue for high-risk PSPs is not just new rules, but the risk that existing licences and operating models will need reworking while member states transpose PSD3 at different speeds.

1. According to Vixio, the third Payment Services Directive (PSD3) and its companion Payment Services Regulation (PSR) are close to official publication in the EU, with entry into force expected in Q3 2026. That starts a 21-month transition period, which puts the compliance deadline at around mid-2028.
2. The framework is meant to update rules first set nearly a decade ago, when card and digital payments were much less common and non-bank players were still only making their way into the market. PSD3 and PSR build on PSD2’s opening of the sector to FinTechs and EMIs, with the stated aim of improving the reliability of digital payments and leveling the playing field between banks and non-bank providers.
3. One of the bigger structural changes is that EMIs will become a sub-category of PIs instead of being licensed separately under the Second E-Money Directive, which is being repealed. Initial capital requirements also move unevenly: they rise for money remittance and general payment services, fall for EMIs, and firms offering multiple services will need to add the minimums together.
4. Safeguarding rules are getting two new options, including deposit at a central bank, and PIs will no longer be allowed to hold all safeguarded funds with a single credit institution. Fraud liability also changes: under PSD3/PSR, the payment service provider takes the hit for authorised push payment fraud unless it can prove gross negligence or fraudulent intent by the victim. Real-time IBAN and account name verification will also become mandatory before transfers execute.
5. Non-bank PSPs will gain direct access to systems like SEPA without needing a sponsor bank. But there is a catch: because PSD3 is a directive, each member state has to transpose it into national law, so timing can differ across the bloc. PSR will apply uniformly, and if some states lag, firms could end up holding licences under a framework that no longer legally exists once PSD2 is repealed, which complicates reauthorisation and cross-border passporting.

For PSPs operating in high-risk verticals, the sequencing matters as much as the substance. The combination of capital changes, safeguarding limits, fraud-liability shifts, and uneven national transposition means licence structure, banking access, and passporting strategy all need to be checked against the mid-2028 deadline, not against the old PSD2 assumptions.