PSD3/PSR status, as of August 2026: what is agreed, what is not yet law, what to build anyway
The Council published final compromise texts on 23 April 2026. PSD3 and the PSR are adopted in principle but not yet in force. Here is what is settled, what is not, and what to build now.
Where PSD3 and the PSR stand
The Council of the EU published final compromise texts for PSD3 (ST 8221/26) and the PSR (ST 8222/26) on 23 April 2026. The texts reflect the political agreement reached in trilogue. They are adopted in principle. They are not yet law.
| Instrument | Status | Next milestone |
|---|---|---|
| PSD3 (ST 8221/26) | Adopted in principle, not yet published in OJ | OJ publication, expected Q4 2026 |
| PSR (ST 8222/26) | Adopted in principle, not yet published in OJ | OJ publication, expected Q4 2026 |
| Entry into force | 18 months after OJ publication | Expected mid-2028 |
The 18-month transposition window means PSD3 will likely enter into force in mid-2028. PSPs that wait for the OJ publication to start building will have 18 months. PSPs that start now will have 24 to 30 months.
What is settled
The compromise texts resolve the most contentious issues. These provisions are unlikely to change before OJ publication:
-
PSD2 passporting ends. PSD3 replaces PSD2. Existing PSD2 licenses remain valid during a transition period, but PSPs will need to re-authorize under PSD3. The transition period is expected to be 18 months from entry into force.
-
Safeguarding rules tighten. PSD3 Article 10 requires strict separation of customer funds from the PSP's own funds. The compromise text removes the "not available to other creditors" standard and replaces it with a stricter segregation requirement. PSPs using the "aggregate account" model will need to restructure.
-
Open banking access moves to a dashboard. The PSR establishes a central dashboard for open banking access, operated by a designated body. Payment initiation service providers (PISPs) will access accounts through the dashboard rather than through bilateral ASPSP connections.
-
PSD3 applies to all currencies, not just euro. The scope extension to non-euro currencies is settled. PSPs offering payment services in non-euro EU currencies will be in scope.
What is not settled
Two issues remain open in the compromise texts and may shift before OJ publication:
-
The exact perimeter of "payment institutions" vs "electronic money institutions." The compromise text leaves room for interpretation on whether certain crypto-asset service providers fall under PSD3 or MiCA. The ESAs are expected to issue guidance on this, but it is not yet published.
-
The level of the safeguarding exemption for small PIs. PSD3 introduces a lighter regime for small payment institutions (SPIs). The asset threshold for SPI qualification is set in the compromise text but may be adjusted by the Commission delegated act.
What to build now
PSPs should start three workstreams now, without waiting for OJ publication:
-
Safeguarding restructuring. The move from "not available to other creditors" to strict segregation is the most operationally significant change in PSD3. PSPs using aggregate accounts need to move to segregated accounts or escrow structures. This is a legal, operational, and treasury change. It takes 6 to 12 months.
-
Open banking dashboard integration. PISPs that currently connect to ASPSPs bilaterally will need to integrate with the central dashboard. The dashboard operator has not been designated yet, but the integration pattern is known. PISPs should build an abstraction layer that can connect to the dashboard once it is live.
-
Re-authorization preparation. PSD3 re-authorization will require updated business plans, compliance frameworks, and operational evidence. PSPs should start assembling the evidence pack now, using the PSD2 authorization pack as a baseline and mapping the delta to PSD3 requirements.
What not to build yet
Do not build to the open issues. The SPI threshold and the crypto-asset perimeter may change. Building to the current compromise text on these points risks rework.
Sources
- Council final compromise text, PSD3, ST 8221/26, 23 April 2026 (adopted, pending OJ)
- Council final compromise text, PSR, ST 8222/26, 23 April 2026 (adopted, pending OJ)
- PSD2, Directive (EU) 2015/2366, in force until PSD3 transposition
EN draft. Regulatory status as of 4 August 2026. Re-check status tags at publication time. No SME quotes or credentials fabricated.
Related articles
DORA's first enforcement year in numbers: what 3,383 incidents change in your 2027 budget
The ESAs published the first DORA incident report on 3 June 2026: 3,383 major ICT incidents reported by 2,847 financial entities. The data changes how 2027 resilience budgets should be built.
2026-08-04RegulatoryThe AI Act timeline moved: Regulation (EU) 2026/1744 and what still applies to banks
The AI Omnibus deferred Annex III high-risk obligations to 2 December 2027. Nearly all published competitor content assumes the old calendar. Here is the corrected timeline.
2026-08-04