Council Publishes First-Reading Position on PSD3:

A Consolidated Framework for Payment Institutions and EMIs

One of the most significant changes is the consolidation of the authorisation and prudential supervision regimes for PIs and EMIs.

Under the existing framework, PIs are primarily governed by PSD2, whereas EMIs are subject to PSD2 and EMD2. The proposed Directive would repeal both instruments and establish a common authorisation framework for payment service providers.

Electronic money issuance as a regulated activity would remain distinct, with specific requirements continuing to apply to its issuance, distribution and redemption. Relevant differences in initial capital and own-funds requirements would also be retained.

For Maltese PIs and EMIs, the transition will require consideration of existing authorisations, governance arrangements, prudential calculations and safeguarding frameworks. EMIs, in particular, should examine the transitional provisions governing their continued operation and assessment against the new requirements.

Firms should not assume that consolidation will result in identical requirements for every institution. The services provided and whether the institution issues electronic money will continue to influence its regulatory obligations.


 

Clarifying the Boundary Between Payment Services and Crypto-Assets

The proposed Directive also addresses the relationship between payment services and crypto-asset services under the Markets in Crypto-Assets Regulation (MiCA).

Providing crypto-asset services involving electronic money tokens (EMTs) does not automatically require authorisation to provide payment services. The relevant question is whether the activities performed also constitute payment services, subject to the applicable exclusions.

In particular, transferring EMTs on behalf of clients may qualify as executing payment transactions, including where the transfer forms part of a broader crypto-asset service. Conversely, certain activities, such as exchanging EMTs as principal without intermediating between buyers and sellers, are distinguished from the provision of payment services.

The proposed Directive also provides a streamlined application procedure for authorised crypto-asset service providers seeking payment institution authorisation. Information previously submitted as part of a MiCA application may be reused where it remains up to date.

For Malta-based businesses offering stablecoin payment products or integrated fiat and crypto services, an activity-by-activity assessment will therefore be important. MiCA authorisation should not be assumed to cover every payment-related activity, nor should every EMT-related service automatically be treated as a payment service.


 

Prudential Requirements and Safeguarding

The proposed Directive retains a detailed prudential framework covering initial capital, own funds and safeguarding arrangements.

The Council’s text addresses the calculation of own funds, including different methods applicable to particular payment services and electronic-money activities. It also provides for competent authorities to adjust own-funds requirements in specified circumstances.

Institutions should assess how the proposed provisions compare with their existing requirements rather than assume that current capital calculations will remain unchanged.

Safeguarding is another central component of the proposed regime. Firms will need to consider how their arrangements align with the requirements applicable to funds received to execute payment transactions and, where relevant, funds received in exchange for issued electronic money.

The treatment of EMTs requires particular care. The proposed Directive addresses EMTs within its broader framework, but the specific safeguarding provisions must be read alongside MiCA’s own requirements. The interaction between these regimes will be particularly relevant to institutions handling both traditional customer funds and EMTs.


 

Governance, Operational Resilience and Winding-Up Plans

The proposed framework places continued emphasis on sound governance and operational arrangements. Authorisation assessments cover matters such as organisational structure, management, internal controls, outsourcing and the security and continuity of services.

The Directive also includes winding-up planning requirements for specified payment service providers. These arrangements are intended to support an orderly cessation of activities, including the return of safeguarded funds and appropriate consideration of critical outsourced services.

Firms should review whether their wind-down plans are sufficiently detailed and proportionate to their business models. They should also consider the relationship between these arrangements and their broader operational resilience obligations, including those arising under the Digital Operational Resilience Act (DORA).

For new applicants, these requirements reinforce the importance of incorporating governance, continuity and orderly exit arrangements into the business model and authorisation documentation from the outset.


 

Transitional Arrangements and Implementation

The proposed Directive includes transitional provisions for existing PIs, EMIs and certain exempted providers. These provide for continued operation under existing authorisations for a transitional period, followed by supervisory assessments against specified requirements of the new framework.

The relevant obligations and deadlines depend on the category of institution and the final adopted text. Crucially, publication of the Council’s position does not itself trigger the implementation periods. The applicable dates will depend on the final legislative process and the adopted Directive’s entry into force.

Nevertheless, firms should begin preparing before the transitional deadlines approach. A structured gap analysis can identify changes needed to authorisation documentation, governance, policies, systems, capital planning and safeguarding arrangements.

The proposed Directive should also inform new applicants’ preparations for authorisation by the Malta Financial Services Authority (MFSA), although the applicable requirements will ultimately depend on the final legislation and relevant supervisory guidance.


 

What Should Malta-Regulated Firms Do Now?

Although the Council’s position is not, by itself, binding law, it provides a useful basis for early preparation. PIs, EMIs and relevant crypto-asset businesses should prioritise:

• Regulatory gap analysis: Compare existing permissions, policies and operational arrangements against the proposed requirements.
• Prudential and safeguarding reviews: Assess potential changes to capital calculations, customer-fund protection and EMT-related arrangements.
• Governance and resilience: Review outsourcing, business continuity, wind-down planning and internal responsibilities.
• Crypto-asset activity mapping: Determine whether EMT transfers or other services may constitute payment services requiring additional authorisation.
• Implementation planning: Establish responsibilities, identify dependencies and prepare a proportionate roadmap for addressing anticipated changes.

The accompanying PSR should be reviewed alongside PSD3. While the Directive focuses on authorisation and prudential supervision, the Regulation addresses important conduct-of-business matters, including payment-service user rights, fraud prevention, transparency and open banking.


 

Looking Ahead

The Council’s first-reading position marks an important milestone in the reform of the EU payments framework. However, the final adopted text, legislative status and implementation dates must be confirmed before firms rely on the proposed provisions as binding requirements.

For Malta’s financial services sector, the changes are particularly relevant to institutions operating across payment services and electronic money, as well as crypto-asset businesses whose products involve EMT transfers.

Early preparation will help firms identify regulatory gaps, assess the impact on their business models and anticipate the supervisory work that the new framework may require. Firms should continue monitoring the legislative process and subsequent guidance from the European Banking Authority and the MFSA.


 

How BDO Malta Can Help

BDO Malta’s legal team can assist businesses in interpreting the proposed PSD3 requirements and carrying out regulatory gap analyses to assess their compliance with the incoming framework.

Contact our team to discuss how these changes may affect your business.