This deep dive is the second in the line of our PSD3 and PSR series – review part 1: Wind-down planning under PSD3 and part 3: PSD3 fraud prevention.
For Irish firms regulated by the Central Bank of Ireland (CBI), these changes are likely to have strategic, operational and governance implications. Existing Payment Institutions (PIs) and Electronic Money Institutions (EMIs) will need to assess how the revised framework affects their regulatory status, business model and readiness for enhanced supervisory expectations.
Understanding the new regulatory framework
Under the proposed regime, the current PSD2 framework will be split into two distinct components:
- PSD3, which will govern authorisation, licensing and supervision through national legislation.
- The Payment Services Regulation (PSR), which will apply directly across the EU and establish requirements relating to conduct, fraud prevention and operational controls.
This structure is intended to create greater regulatory consistency across Member States by reducing the opportunity for regulatory divergence, while ensuring that supervisory authorities retain oversight of authorisation and prudential requirements.
A move towards a unified licensing framework
One of the most significant changes under PSD3 is the amalgamation of the current PI and EMI authorisation regimes.
Electronic money issuance will become a regulated activity within a single Payment Institution licence, removing the distinction between Payment Institutions and Electronic Money Institutions that exists today.
For firms operating multiple regulated entities, this could create opportunities to simplify group structures and reduce administrative complexity. Organisations that currently maintain separate PI and EMI entities may be able to consolidate activities under a single regulated entity, potentially streamlining governance arrangements, reporting obligations and capital management.
For new entrants, the change also provides greater flexibility by removing the need to decide between licence types at the outset of their regulatory journey.
From a strategic perspective, firms should begin assessing:
- Opportunities for structural streamlining of group entities
- The impact of changes on group-wide governance and prudential requirements
- The future of the delivery of products and services under the revised framework
Re-authorisation: demonstrating ongoing compliance
PSD3 introduces a stronger emphasis on firms demonstrating that they continue to meet regulatory expectations. Existing firms should expect to undergo a transition process demonstrating compliance with the revised PSD3 framework and any applicable national implementation requirements.
Based on the PSD3 proposals and current supervisory priorities, firms should expect scrutiny in areas such as:
- Governance and oversight arrangements
- Financial resilience and business planning
- Fraud prevention capabilities
- ICT risk management
- Operational resilience and continuity planning
- Wind-down and recovery frameworks
As a result, firms should consider undertaking a structured gap assessment against PSD3 and PSR requirements and developing a roadmap to address any identified deficiencies well in advance of implementation.
A broader regulatory perimeter
PSD3 is also expected to expand the scope of activities subject to regulatory scrutiny.
As payments continue to become more deeply integrated into digital platforms and technology-driven business models, regulators are seeking to ensure that the regulatory perimeter remains aligned to market developments.
The main update regarding the regulatory perimeter or the Payment services regulations is the tightening of the conditions under which entities can utilise the “commercial agent exemption”.
For some organisations, these changes may result in authorisation requirements where none previously existed. For others, they may require a reassessment of existing regulatory assumptions and the continued availability of exemptions.
Firms should therefore review current and planned activities to determine whether they remain outside the regulatory perimeter under PSD3.
How Forvis Mazars can help
As the PSD3 and PSR Frameworks continue to evolve and a final implementation date is set, firms will need to understand not only the regulatory requirements but also the practical implications for their operating model, governance arrangements and future growth plans.
Our prudential risk specialists work closely with payment and e-money institutions on licensing, regulatory change and engagement with the Central Bank of Ireland. We support clients in assessing the impact of PSD3, identifying gaps against emerging requirements and developing practical implementation roadmaps.
Our services include:
- PSD3 licensing and regulatory gap assessments
- Re-authorisation readiness reviews
- Regulatory engagement and application support
- Governance and compliance framework reviews
- Operational resilience and risk management assessments
By taking an early and structured approach, firms can position themselves to meet regulatory expectations while supporting sustainable growth in an increasingly competitive payments landscape.