PSD 3/PSR – EU Payment Package clears the next hurdle

European Parliament approves reform proposals for regulations on payment services and electronic money providers. 

On 23 April 2024, the European Parliament adopted the European Commission's proposals for the new third Payment Services Directive (PSD 3) and the accompanying Payment Services Regulation (PSR) at first reading. The European Commission's proposals had previously been revised by the Committee on Economic and Monetary Affairs (ECON Committee). The changes made by the European Parliament to the legislative package will now be the subject of further trilogue negotiations.

Financial Data Access and Payments Package

The starting point for the reform proposals was the review of the second Payment Services Directive (PSD 2) (Directive (EU) 2015/2366) by the European Commission and the proposals on the Financial Data Access and Payments Package published on 28 June 2023, which, among other things, provide for a renewal of the PSD 2. The new legal acts on payment services will be complemented by a regulation on a framework for access to financial data, which is intended to facilitate access to data and improve the use of customer data. By doing so, the European Commission is especially trying to improve account information services and financial information services. 

Electronic money institutions will also be subject to the PSD 3 in future

The main change to the PSD is the integration of the provisions of the second Electronic Money Directive (Directive (EU) 2009/110/EC) as a new Section II of the PSD 3 in order to subject electronic money institutions to the same supervision procedures as payment institutions in future. Once the PSD 3 comes into force, the electronic money directive will cease to apply. Despite these far-reaching adaptations, some differences remain, such as different admission requirements. 

Changes to payment services

Changes will also be made to the payment services covered in Annex I of the PSD 3. Some alternatives, such as cash deposits and cash withdrawals to payment accounts, which were still divided into no. 1 and no. 2 in the PSD 2, have now been summarised in no. 1. To this end, the services of "issuing" and "acquiring", which are already considered alternative elements and were previously regulated together in no. 5, have now been split into separate elements nos. 3 and 4. This should make transposing the directive into national law easier and no substantive changes are expected. 

No new authorisation requirement for existing payment institutions

The transitional provisions of the PSD 3 do not provide for a new authorisation requirement for payment institutions that already have a licence within the meaning of Art. 11 PSD 2. However, institutions must ensure they comply with the new regulations within 24 months of them coming into force, otherwise they may not be allowed to provide payment services. To this end, compliance with the new requirements will have to be proven to the supervisory authorities. The same applies to electronic money institutions that already have a licence under the electronic money directive; here too, a transitional period of 24 months after the new regulations come into force is envisaged.

The following changes to the legislative package should be emphasised: 

Reduced initial capital 

While the European Commission's draft still envisaged a lower limit of at least EUR 400,000 for the initial capital for electronic money providers, this has been reduced to EUR 350,000 in accordance with the ECON Committee's proposal.

Cross-border provision of services 

The regulations on the cross-border provision of payment services were also changed as part of the ECON consultations. 

Firstly, the cross-border provision of payment services by agents in Art. 19 PSD 3 was modified by the amendments of the ECON Committee to the effect that electronic money services are now excluded from this regulation. The cross-border provision of electronic money services is governed exclusively by the provisions of Art. 20 PSD 3.

Secondly, the deadlines for processing applications for the provision of cross-border services have been adjusted. The competent authorities in the home country have ten working days to forward the documents to the authorities in the host country, followed by a 15-day processing and examination period (originally a period of one month was envisaged). The competent authorities should inform the institution of their decision within 30 days at the latest (a period of three months was originally envisaged). 

In order to provide sufficient information about this possibility and the information required for this, the European Commission is to set up a special website for this purpose (Recital 37a PSD 3). 

Cash even without a purchase 

Even though it was already possible to withdraw cash in retail outlets if a purchase was also made at the same time, access to cash is to be made even easier in future. The new Art. 37 PSD 3 regulates cash withdrawals in retail outlets even without a purchase. According to this, retail shops are exempt from the application of the directive if they offer cash withdrawals on their premises where goods are sold, or services are provided on a full-time basis. The disbursement limit of EUR 50 envisaged in the original draft was increased to EUR 100 during the ECON consultations. Newly added was the requirement that the customer's withdrawal must not be anonymised, and that customer authentication must be used. 

More transparency for ATM operators 

In addition, the PSD 3 also provides for regulations on pay-outs by ATM operators that do not manage payment accounts or provide other payment services (Art. 38 PSD 3). Such services do not require authorisation but do require registration. Art. 38 PSD 3 has been amended by paragraph 4a, which stipulates that the principles on the transparency of fees and charges set out in Art. 7 of the PSR also apply to ATM operators and that, in particular, it must always be ensured that these are displayed at the start of the provision of the service.

"Buy now, pay later" still relevant for payment services

In addition, many terms will be redefined or further concretised in order to avoid uncertainties in practice. Among other things, Recital 35 PSD 3 now clarifies that the so-called "buy now, pay later" services are in principle to be regarded as loans and, as such, are subject to the Consumer Credit Directive (Directive (EU) 2023/2225). However, if they are provided in conjunction with payment services, they will also fall within the scope of the PSD 3. 

Professional indemnity requirements and initial capital

The PSD 2 already set out a requirement for professional indemnity insurance for providers of payment initiation services and account information services, but now the requirements for the professional indemnity insurance that needs to be taken out, or the requirements for a comparable guarantee against liability, have been modified. In future, these institutions should be able to hold initial capital as an alternative to professional indemnity insurance, albeit only during the authorisation or registration phase. According to the European Commission's proposal, professional indemnity insurance should simply ensure that the liability duties under the PSR can be met. As part of the changes made by the ECON Committee, a liability amount of EUR 50,000 was set as a lower limit. 

Strong customer authentication

The requirements for strong customer authentication already contained in the PSD 2 will also be modified as part of the PSR. Under the PSD 2, customers had to specify two of three authentication factors: knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) in order to gain access to their accounts. While the European Commission's proposal stipulated that these two or more elements do not necessarily need to belong to different categories, the European Parliament's position also makes it clear that the independence of the elements must be maintained at all times, and that the authentication procedure must guarantee a high level of security at all times. 

What next?

Following the vote in the European Parliament, the legislative package relating to the PSD 3 and the PSR is at an advanced stage in the legislative process. It is now up to the Member States in the Council to position themselves so that the trilogue negotiations can begin. However, further steps will only be taken following the European Parliament elections in June 2024.

Once the PSD 3 regulations come into force, they must be transposed by the Member States. A period of 18 months has been provided for this. The European Commission also wants the PSR regulations to apply 18 months after they come into force. The European Parliament has retained the timetable proposed by the European Commission for the transposition of the PSD3, but the PSR regulations will not apply until 21 months after they enter into force. 

Even if not all of the points of the legislative package relating to the PSD 3 and the PSR have been finalised, payment institutions should now be looking at these future regulations and considering how they can be implemented.