In a Dear CEO letter (“The Malta Financial Services Authority’s Minimum Expectations on the Authorised Person’s preparedness for Payment Services Directive 3”) of the 8 June 2026, the Malta Financial Services Authority (MFSA) made it expectations clear: payment institutions (PIs) and e-money institutions (EMIs) (Authorised Persons) should already be preparing for the transition to the upcoming European payments regulatory framework.
The reform comprises two complementary legislative instruments: the revised Payment Services Directive 3 (PSD3) and a new Payment Services Regulation (PSR).
PSD3 will consolidate the authorisation framework for PIs and EMIs, introducing revised prudential, governance and supervisory requirements. The PSR, meanwhile, will establish a directly applicable and more harmonised set of rules governing the provision of payment services across the EU.
The implications extend well beyond obtaining a new licence. Institutions will need to demonstrate both their continued eligibility for authorisation under PSD3 and their operational readiness to comply with the PSR.
PSD3 introduces a consolidated authorisation framework for PIs and EMIs, requiring existing institutions to undergo reassessment within a 27-month transitional period. The MFSA expects institutions to undertake a substantive gap analysis and establish a Board-approved remediation plan during 2026.
The 27-month transition is not a 27-month preparation window.
Within 12 months from PSD3’s entry into force, the European Banking Authority (EBA) is expected to submit draft authorisation standards, which then need Commission adoption, followed by up to six months of legislative scrutiny. Assuming that the EBA will use the full year, binding rules are likely to arrive in the coming months of the second year.
PSD3 introduces significant changes to the prudential and operational requirements applicable to payment and electronic money institutions, with safeguarding and capital adequacy likely to present some of the more substantial implementation challenges.
Institutions will need to demonstrate that safeguarded amounts adequately cover funds owed to payment service users, clearly document the applicable insolvency protections and claims mechanisms, and address concentration risk in their safeguarding arrangements. The reduction of the existing T+5 safeguarding period to T+1 for certain funds received through payment instruments will also require institutions to reassess their settlement, reconciliation and safeguarding processes.
Capital requirements will likewise become more demanding. Initial capital thresholds will increase from €125,000 to €150,000 for certain payment services and from €20,000 to €40,000 for money remittance alone. For electronic money institutions, the €350,000 threshold has been retained. Institutions providing both payment services and electronic money services will also need to assess the cumulative impact of the applicable own-funds requirements.
The authorisation process will additionally entail enhanced regulatory disclosures, including information on previous, pending and contemplated authorisation applications across the EU, extending to relevant group entities. Taken together, these requirements may necessitate substantive changes to existing business models, governance arrangements and operational infrastructure.
While PSD3 reshapes the authorisation and prudential framework, the PSR will fundamentally affect how payment services are delivered across the EU. As a directly applicable Regulation, it seeks to reduce national regulatory divergence while strengthening fraud prevention, consumer protection and competition within the payments market. Fraud prevention is a central focus of the reform. Institutions will face enhanced obligations concerning transaction monitoring, fraud detection and prevention, alongside revised liability and reimbursement rules in specified fraud scenarios. The framework also revisits Strong Customer Authentication (SCA), including the applicable requirements and exemptions, potentially requiring changes to authentication infrastructure, customer verification procedures and payment journeys.
Further measures address verification of payee, transparency and payment service user rights, as well as the execution of payment transactions. In parallel, the PSR seeks to strengthen the open banking framework by removing obstacles encountered by payment initiation and account information service providers and introducing more prescriptive requirements concerning access interfaces and account servicing payment service providers.
For many institutions, compliance will extend well beyond updating internal policies and customer-facing documentation. It may require significant investment in technology, transaction monitoring capabilities, authentication systems and third-party arrangements, together with changes to existing operational processes.
The message is clear: waiting for the final technical standards before commencing preparations risks leaving institutions with insufficient time to implement meaningful changes.
At ARQ, we assist PIs and EMIs in assessing the implications of PSD3 and PSR, identifying regulatory and operational gaps, and developing practical remediation plans to support a timely and orderly transition.
