MFSA publishes minimum expectations on PSD3 preparedness

The road to reauthorisation starts now

Last week, the MFSA issued a Dear CEO Letter outlining its minimum expectations regarding firms’ preparedness for the introduction of the revised Payment Services Directive (PSD3). The communication focuses on the authorisation and supervision of payment institutions and sets out the actions licensed entities are expected to begin taking ahead of PSD3’s anticipated publication in the Official Journal of the European Union later this year, following approval by the EU Council.

PSD3 represents a significant evolution of the current regulatory framework. Most notably, it consolidates the provisions of PSD2 and the Electronic Money Directive 2 into a single regime, creating a unified authorisation framework for institutions providing payment services and issuing electronic money. As a result, electronic money issuance will become a regulated payment service under the new framework.

A matter of timing

One of the most significant messages emerging from the MFSA’s letter relates to timing.

Existing payment institutions and electronic money institutions wishing to continue providing their current services will be required to obtain reauthorisation from the MFSA within 27 months of PSD3’s publication in the EU Official Journal.

While this may appear generous at first glance, the practical implementation timeline is considerably shorter. PSD3 mandates the European Banking Authority (EBA) to develop Regulatory Technical Standards (RTS) on authorisation and registration within 12 months of its publication. These standards are expected to provide the detailed requirements that firms will need to satisfy as part of the reauthorisation process.

This effectively leaves institutions with a window of approximately 15 months between the publication of the RTS and the deadline for reauthorisation.

The MFSA's message is therefore clear: firms should not wait for the RTS to be finalised before beginning their preparations.

MFSA’s minimum expectations for 2026

Given the limited timeframe available for reauthorisation, the MFSA expects firms to begin their PSD3 readiness programmes immediately.

In particular, institutions are expected to:

1. Raise awareness among boards of directors, senior management and key function holders regarding the implications of PSD3, including the expected reauthorisation timeline and forthcoming RTS requirements.
2. Perform a comprehensive gap analysis to assess the differences between the current PSD2 framework and the future PSD3 requirements, identifying areas requiring remediation ahead of reauthorisation.
3. Develop a formal implementation plan for achieving PSD3 compliance and obtain approval of that plan by the Board of Directors.
4. Closely monitor the development of EBA technical standards, guidelines and other regulatory deliverables supporting the implementation of PSD3.

Preparing early will be key to ensuring that reauthorisation is a structured compliance exercise rather than a time-critical remediation programme once the RTS are finalised.

How we can help

We’d like to share some work we’re presently doing in this space, which may be relevant to your payment institution:

• Training and awareness – board and senior management briefings on PSD3 requirements, implementation timelines and strategic implications.
• PSD3 gap assessment – comprehensive assessment of your institution’s readiness against the forthcoming PSD3 framework.
• Controls advisory – review and enhancement of governance, safeguarding, incident management, and business continuity arrangements, including supporting policies and procedures.
• Winding-up plans – development of compliant winding-up plans, including arrangements for the return of safeguarded funds in the event of failure.

Should you wish to discuss any aspect of PSD3 or your institution’s readiness programme, please contact us.