error
Subscriptions are not available for this site while you are logged into your current account.
close
Skip to main content

      The move from PSD2 to PSD3 and the accompanying Payment Services Regulation (PSR) represents more than the next iteration of European payments regulation.

      For payment institutions (PIs) and electronic money institutions (EMIs) operating in Ireland, it raises the regulatory baseline across authorisation, safeguarding, fraud, customer protection, data and the operating model underpinning their licence.

      With PSD3 and PSR expected to be finalised imminently, firms need to prepare for implementation now. The key implementation and transition timelines are as follows:

      • 21 months after entry into force

        The main reauthorisation requirements will come into force, requiring firms to use the intervening period to assess readiness, remediate material gaps and ensure their arrangements meet the requirements of the new framework.

      • 27 months after entry into force

        Firms will be required to demonstrate compliance and provide supporting information.

      • 3 months to confirm compliance

        Regulators have 3 months following the receipt of the supporting documentation to confirm compliance with the new requirements.

      • Re-authorisation

        Where firms are able to demonstrate compliance with PSD3 / PSR requirements to the satisfaction of the Regulator, the re-authorisation process will permit existing firms to be authorised as payment institutions.

      In addition to those firms currently authorised as payment firms or EMIs, firms currently seeking authorisation as a payment institution will need to ensure they meet the new authorisation requirements and the changes to the regulatory framework. 

      Shane Garahy

      Partner, Risk Consulting

      KPMG in Ireland

      Uplift from PSD2

      PSD2 significantly reshaped the European payments market, notably through strong customer authentication (SCA) and the development of open banking. A key change is the clearer distinction between PSD3 and the PSR.

      PSD3 will primarily govern authorisation, prudential requirements and supervision, while PSR will set out requirements across conduct, transparency, wind-down planning, payment execution, fraud prevention and open banking.

      Implementation of the changes to PSD2 through PSR and PSD3 rather than solely through a directive is intended to promote greater consistency in the application of payments regulation across the EU.

      Depending on your business model and the time since firm authorisation, the regulatory uplift is potentially significant. Areas requiring particular attention include:

      • Fraud prevention and liability

        Enhanced requirements for fraud prevention, transaction monitoring, data sharing and liability will require firms to consider the impact of Verification of Payee and SCA across their existing controls, processes and customer journeys.

      • Safeguarding

        Firms will need to assess the implications of the revised safeguarding approach including the possibility of safeguarding with a Central Bank, increased emphasis on diversification by safeguarding with more than one bank and only banks authorised in the EU / EEA may provide Safeguarding accounts.

      • Financial Resilience

        Firms will have increased capital requirements and the default capital calculation method will change to Method B (payment volumes). Payment initiation service providers and account information providers, will now have the ability to hold capital instead of obtaining professional indemnity insurance.

      • Open banking and data

        Changes to the open banking framework, including requirements relating to account and payment-system access, data sharing and interfaces, will require firms to consider the implications for their existing technology, data arrangements and payment security.

      • PI and EMI regulation

        The existing electronic-money framework is being consolidated into the future PSD3 framework, creating a more unified supervisory framework for payment and EMIs. For clarity, EMIs will no longer exist as a separate type of financial services firm and will become a type of payment firm under the PSD3/PSR. 

      Firms should consider the implications for their business model, governance, policies, processes, controls and technology, and assess whether these arrangements remain fit for purpose under the new regulatory framework and in line with regulators expectations.

      What does transition mean for Irish firms?

      Re-authorisation should form part of a broader, structured transition programme with firms taking a phased approach to implementing changes required under the new framework.  

      Firms should assess their readiness and identify where targeted enhancements to existing documentation, capital availability, regulatory status and / or operational processes may be required. A structured readiness assessment can provide a clear basis for prioritising change and support the effective implementation of new requirements across the business.

      This assessment should also take account of the wider regulatory landscape including DORA and the associated expectations for ICT risk management, business continuity and third-party risk oversight.

      A two-phase approach to PSD3 readiness

      Given the reauthorisation requirements, firms should adopt a phased approach to address identified gaps and implement the required changes.

      Phase 1: Regulatory impact and readiness assessment


      The immediate priority should be establishing what PSD3 and PSR mean for their business and assess their readiness and any areas of material non-compliance.

      A readiness assessment can then identify:

      • where existing arrangements already align with the requirements reflected in the agreed PSD3 and PSR texts;
      • where additional evidence or targeted enhancement may be required;
      • whether they meet the new prudential requirements and
      • whether the firm’s wind-down plan meets regulatory requirements.

      This phase will give firms a clear view of the changes required across their business to demonstrate compliance with PSD3/PSR. It is expected that if the payment institution can demonstrate that they comply with PSD3/PSR’s requirements, then they will be deemed authorised under PSD3.

      Phase 2: Remediation, implementation and transition readiness


      Where Phase 1 identifies material gaps with the requirements of PSD3/PSR, firms can move into targeted remediation before the transition period is complete.

      Depending on the findings, this may include enhancements across governance, safeguarding and prudential arrangements, fraud management, policies and controls, processes, data and technology. Firms should also consider the evidence required to demonstrate that relevant arrangements have been effectively implemented and are operating as intended.

      Remediation should be proportionate to the firm's business model, regulatory permissions and identified risks, concentrating resources on those aspects of the framework that require material enhancement. 

      How KPMG can help

      KPMG can support both EMIs and payment firms across both phases of the PSD3 and PSR transition, combining Irish regulatory knowledge with specialist expertise across payments, e-money, fraud, safeguarding, wind down plans, controls, technology and transformation.

      An initial PSD3 and PSR impact and readiness assessment can help firms assess the implications for their business, establish the changes required.

      With greater clarity on the new payments framework, firms should now shift their focus from interpretation to readiness, embedding the requirements through a structured transition programme.

      Shane Garahy

      Partner, Risk Consulting

      KPMG in Ireland

      What's next for the banking sector in the face of continued challenges?
      See our banking services

      Discover more in Banking and Capital Markets

      Something went wrong

      Oops!! Something went wrong, please try again