DSP3

Definition

DSP3 (PSD3, for Payment Services Directive 3) is the third European directive on payment services. The Commission proposed it on 28 June 2023, together with a regulation, the PSR (Payment Services Regulation). The two texts will jointly replace DSP2 and the second Electronic Money Directive (EMD2).

DSP3 keeps what has to go through national law: the licensing of institutions, their capital, the safeguarding of customer funds and supervision. The rest of DSP2 moves into the PSR, which applies without transposition. That covers open banking, SCA, fraud and user rights.

The article numbers cited on this page are those of the compromise texts of 17 April 2026 (Council, doc. 8222/26 for DSP3 and doc. 8221/26 for the PSR). The Council's first-reading positions of 21 October 2026 (doc. 8535/26 for DSP3 and doc. 8543/26 for the PSR), revised by the lawyer-linguists, renumber the articles, and this page has not yet switched to the new numbering.

Where the text stands

DSP3 is not adopted and has not been published in the Official Journal. The substance has been settled since spring 2026, and only the formal steps remain. The procedure is an early second-reading agreement. The Council adopts a first-reading position that takes over the agreed text, then Parliament approves it without amendment.

As of 25 October 2026, Parliament's Legislative Observatory lists a plenary sitting on 14 December 2026. That date is indicative. On 21 October 2026 the Council circulated its first-reading position, now translated into the other languages, and put its adoption on the provisional list of A items for its meeting of 29 October 2026.

How the application dates are calculated

The text contains no calendar date. Everything counts from entry into force, set at the twentieth day after publication in the Official Journal. That date is called T.

• At T + 21 months, Member States must have transposed DSP3 and must apply it (art. 49). DSP2 and EMD2 are repealed on the same date (art. 48), and the PSR applies.
• At T + 27 months, licences granted under DSP2 and EMD2 are suspended if the institution has not proved that it complies (art. 44 and 45). The PSR's verification of payee applies on the same date.
• The authority may grant three more months, as an exception, when it could not process a file in time (art. 45a).

Until T + 21 months, DSP2 and its implementing texts, including Delegated Regulation 2018/389 on SCA, remain the rule. The years announced by several firms in spring 2026 assumed publication in summer 2026 and are already out of date.

What the directive changes

DSP3 folds electronic money institutions into the payment institution regime. Issuing electronic money becomes the eighth payment service in Annex I, and the EMI status disappears with the repeal of EMD2.

Initial capital changes (art. 5). The new amounts are EUR 40,000 for money remittance alone, EUR 50,000 for payment initiation, EUR 150,000 for services 1 to 5 and EUR 250,000 for issuing electronic money, and they are cumulative. DSP2 sets EUR 20,000, EUR 50,000 and EUR 125,000, and EMD2 sets EUR 350,000.

To safeguard customer funds, an institution may deposit them with a central bank if that central bank agrees. It must avoid placing all of them with a single credit institution (art. 9).

An institution that is already licensed does not file a new application. It gives its authority the evidence that it meets the new rules on capital, safeguarding, governance, business continuity and wind-down plan (art. 44). If it complies, it is deemed licensed. If not, its licence is suspended. Compliant EMIs are deemed licensed as payment institutions (art. 45).

Account information service providers remain subject to registration only (art. 36). The EBA will keep a central, machine-readable register of PISPs and AISPs with their name, identifier and licensing status (art. 18(7)).

What the PSR changes alongside

The rules people often associate with DSP3 are in the PSR. The main ones are covered in detail on the PSR entry.

• Every bank that offers an online payment account must have a dedicated interface, and the fallback mechanism required by the current RTS disappears (PSR art. 35 and 38). The authority may grant an exemption on request (art. 39).
• The text sets no numeric threshold for availability or response time. It requires parity with the customer interface and presumes the interface unavailable after five consecutive requests that return an error or get no response within 30 seconds (art. 38).
• The bank must offer a consent dashboard where the customer can see and withdraw their consents (art. 43).
• The AISP applies SCA itself at least every 180 days (art. 86(4)).
• The standalone confirmation of funds service for card issuers (CBPII) is removed. The PISP keeps a yes or no answer on the availability of funds (art. 36(5)).
• The only new right to a refund covers a customer manipulated by someone posing as their own bank (art. 59).
• Fines for breaches of the open banking and SCA rules must be able to reach at least 10% of annual turnover (art. 97).

What DSP3 does not do

• It does not cover savings, credit or insurance accounts. That is the subject of FIDA, which is still under negotiation.
• It does not set the technical rules. The EBA must write seven standards and guidelines for DSP3 and eleven for the PSR, based on a count made on the compromise texts. At the end of September 2026, it had published neither a roadmap nor a consultation.
• It does not apply yet, and DSP2 remains the law in force.

In the PSD2 ecosystem (which becomes PSD3)

DSP3 brings the DSP2 and EMD2 framework into a single text, with a single licence. For a bank or a TPP, most of the technical work will come from the PSR and the EBA standards.

Concrete examples

• An electronic money institution licensed today will not have to file a full application again. Before T + 27 months, it will have to show its authority that it meets the new requirements, and it will then carry on as a payment institution.
• A fintech that only does money remittance will see its minimum capital go from EUR 20,000 to EUR 40,000.
• A bank that wants to check a TPP's status will be able to query the EBA's central, machine-readable register.
• A compliance roadmap counts in months from T. The date of T depends on publication in the Official Journal, which you can follow on Parliament's procedure file.