European Economic Area

Licensing, Authorisation & Market Access

The licensing and market-access architecture for payment institutions and e-money institutions across the European Economic Area remains governed by PSD2 as at 6 October 2026, pending formal adoption of the successor Payment Services Regulation and third Payment Services Directive by the European Parliament and Council. The European Parliament legislative train tracker states that the deal needs to be formally adopted by Parliament and Council before it can enter into force, and no confirmation of publication in the Official Journal had been established from the material gathered this cycle.

For firms holding or seeking payment institution or e-money institution authorisation in any EEA Member State, this means the current licensing categories, capital requirements, and passporting mechanics under PSD2 remain the operative framework. No change to authorisation criteria, conduct obligations, or market-access conditions has taken legal effect. This is a licensing-continuity signal rather than a new regulatory event: the successor package has been moving through the EU legislative process for some time, and its continued non-adoption is itself the fact relevant to firms planning licence applications, passporting notifications, or market entry strategy over the near term. The regulatory direction for the bloc is recorded as uncertain in the current tracker, reflecting that the timing and final content of the successor package cannot yet be relied upon for planning purposes beyond the broad outline already debated publicly.

No distinction between bank-PSP and non-bank payment-institution or e-money-institution treatment is indicated by the available material for this item, since the pending-adoption status applies uniformly to the licensing architecture as a whole rather than to a specific firm category.

Outlook

Formal adoption by the European Parliament and Council is anticipated within Q4 2026, as scheduled, though this estimate carries a wide uncertainty band and no firmer date is supported by the available material. Once adoption is confirmed, a CELEX reference and an entry-into-force or transposition date should become available, at which point firms will need to assess any transitional licensing arrangements, grandfathering provisions, or re-authorisation requirements under the new regime. Until then, licensing and market-access planning across the EEA should proceed on the basis that PSD2 remains the governing instrument, and firms should not assume PSD3 or Payment Services Regulation obligations are in legal effect.

Licensing, Authorisation & Market Access

The EEA's payment-services licensing framework is undergoing its most significant structural change since PSD2: COREPER endorsed the PSD3/PSR trilogue agreement texts on 22 April 2026, with the agreed texts published the following day. The new architecture pairs PSD3, a Directive governing authorisation and prudential/governance requirements, with the Payment Services Regulation (PSR), the first payment services Regulation to complement a payment services Directive, which is directly applicable and governs conduct-of-business rules. This dual-instrument structure means that once general application begins, licensing and governance requirements will continue to require national transposition and supervisory application, while conduct rules will apply uniformly and directly across the EEA without transposition, a structural distinction that firms operating across multiple EEA states will need to track separately for each layer.

The practical consequence for market access is that PSD3/PSR replaces the current PSD2/EMD2 dual-instrument regime with a single licensing framework, intended to bring electronic money institutions and payment institutions under a more unified authorisation model than the current separate PSD2 and EMD2 tracks. General application is expected roughly 21 months after Official Journal publication, meaning the practical market-access effect of the new regime will not land immediately upon publication but on a delayed clock that firms should plan authorisation renewal or re-authorisation strategies around.

Distinguishing bank-PSP and non-bank payment-institution/e-money-institution treatment under the new regime is not yet resolved in the evidence available this cycle; the trilogue endorsement establishes the text and the instrument architecture but the detailed prudential and authorisation distinctions between the two firm categories under PSD3 specifically await the Official Journal publication and subsequent national/EU implementation guidance.

Outlook

The marker to watch is Official Journal publication of the final PSD3/PSR texts, which starts the approximately 21-month clock to general application. Firms currently authorised under PSD2/EMD2 should treat the trilogue endorsement as confirmation that re-authorisation planning under the new regime is now a near-term certainty rather than a contingent possibility.

Licensing, Authorisation & Market Access

The formal conclusion of the multi-year revision of the EEAs payment-services framework arrived this cycle with the publication of final compromise texts for the third Payment Services Directive and the new Payment Services Regulation on 23-24 April 2026, following provisional political agreement reached in trilogue on 27 November 2025. This is the single largest licensing-and-authorisation development tracked this cycle, and it is sourced to primary legal-commentary tracking of the compromise texts (ST-8221-2026-INIT and ST-8222-2026-INIT) with confirmed confidence.

Structurally, the new package repeals both the second Payment Services Directive and the second E-Money Directive. E-money institutions, previously licensed under a separate regime since 2009, are folded into the payment-institution category as a sub-type. This ends a bank-versus-non-bank-adjacent split that had persisted for well over a decade, in which payment institutions and e-money institutions operated under parallel but distinct authorisation regimes despite substantially overlapping activities. Firms currently licensed as e-money institutions should expect a transitional reclassification process as national competent authorities implement the merged category.

The new frameworks general application date is set at 21 months after Official Journal publication of the Regulation, itself expected around mid-2026, which places the effective compliance date for the entire EEA payments industry on a horizon that firms should now be treating as fixed rather than provisional, given that the compromise texts are already published.

A further authorisation-boundary development concerns the intersection of payment-services licensing with the Markets in Crypto-Assets Regulation. The European Banking Authoritys No-Action Letter, which had addressed the authorisation interplay between the second Payment Services Directive and MiCA for crypto-asset service providers handling e-money tokens, expired 2 March 2026. This removes a transitional accommodation that national competent authorities had relied on, and requires them to resolve dual-licensing coordination for this category of firm through ordinary supervisory channels going forward, at a point still ahead of the new frameworks full general application.

Throughout this transition, the distinction between bank and non-bank payment institution and e-money institution licensing tracks remains analytically important even as the two non-bank categories merge with each other: banks continue to operate under separate prudential authorisation entirely, and the PSD3/PSR consolidation does not alter that boundary, only the boundary between the two non-bank categories.

Outlook

The period between now and the expected mid-2026 Official Journal publication, followed by the 21-month general-application window, is the operative licensing-transition runway. Firms currently authorised as e-money institutions should expect national competent authorities to issue guidance on reclassification into the merged payment-institution category, and crypto-asset service providers at the PSD2/MiCA boundary should expect closer supervisory scrutiny of dual-licensing arrangements now that the EBAs transitional no-action relief has lapsed.

Licensing, Authorisation & Market Access

The most consequential licensing-and-market-access development across the EEA payments space this cycle is the political agreement reached by Council and European Parliament negotiators on 27 November 2025 on the terms of the Payment Services Regulation (PSR) and the third Payment Services Directive (PSD3). Both instruments are expected to be published around the third quarter of 2026, triggering a 21-month transition period for Member States and industry. PSD3 and the PSR will together repeal and replace PSD2 and the second E-Money Directive, consolidating what has until now been a two-instrument licensing architecture into a single supervisory framework oriented around harmonisation, fraud prevention, and strengthened open-banking access.

The structurally significant element for market access specifically is the treatment of electronic money institutions: EMIs become a sub-category of payment institutions under the new framework, and EMD2 is eliminated as a standalone authorisation route. Existing EMIs will need to seek re-authorisation as payment institutions rather than continuing under a grandfathered EMI licence, a re-authorisation burden that falls on the non-bank payment-institution and e-money-institution population specifically. Bank-chartered payment providers, by contrast, continue to rely on their underlying banking licence as the primary regulatory basis for payment activity and are materially less exposed to this particular transition mechanic, even though they too will operate under the consolidated PSD3/PSR framework going forward.

It is important to read the 27 November 2025 political agreement for what it is: a negotiating milestone, not final adoption. Formal publication, expected around Q3 2026, remains the operative trigger date that starts the 21-month transition clock; until publication occurs, the precise compliance deadline for full PSD3/PSR application cannot be fixed with certainty.

Outlook

Watch for formal publication of PSD3 and the PSR, expected around Q3 2026, as the trigger event for the 21-month transition period. Once published, the practical work for non-bank payment institutions and e-money institutions will be re-authorisation under the consolidated framework; the pace and administrative capacity of national competent authorities in processing that re-authorisation population at scale is a downstream question this cycle's evidence does not yet address.

Licensing, Authorisation & Market Access

The Council COREPER endorsed final compromise texts for the PSD3/PSR legislative package on 22-23 April 2026, with an ECON committee vote scheduled for 5 May 2026. Official Journal publication is anticipated in the second half of 2026, and general application is expected approximately 21 months after publication, placing the regime effective start near 2028. This licensing-and-market-access development is corroborated across multiple independent law-firm advisories, though no primary Council or Official Journal text was retrieved this cycle, capping the finding at assessed rather than high confidence for the specific dates involved.

The structural feature of this package most relevant to market access is consolidation: PSD3, a directive requiring national transposition, and the Payment Services Regulation, a directly-applicable regulation, together repeal both PSD2 and the second E-Money Directive, merging the separate payment-institution and e-money-institution authorisation categories into a single supervisory framework. For non-bank payment and e-money institutions, this is a structural change to the authorisation perimeter itself, not merely a tightening of existing rules within the current PI/EMI split. Bank-PSPs, which are authorised under a separate credit-institution regime and merely notify rather than seek fresh authorisation for payment services, are less directly affected by this consolidation than non-bank PIs and EMIs, for whom the merged authorisation category is the primary market-access mechanism into the EEA payments market.

Although the safeguarding and conduct-of-business detail sits primarily under the conduct module, it is the licensing-and-authorisation change that creates the underlying single framework within which those safeguarding rules will operate: once PI and EMI categories merge, whatever safeguarding standard applies to the merged category becomes the market-access baseline for any new entrant seeking non-bank payment-services authorisation in the EEA, rather than a bifurcated standard depending on which of the two legacy categories a firm happened to seek.

The practical market-access implication for firms currently authorised as either a payment institution or an e-money institution is that the regulatory category they currently hold is scheduled to be absorbed into a single framework by around 2028, with the intervening period, from Official Journal publication in the second half of 2026 through to general application roughly 21 months later, as the window in which national competent authorities and firms alike will need to work through transitional arrangements. The gap register for this cycle flags that no Tier-1 primary EU official text, whether from the Council, the European Parliament, or the Official Journal, was retrieved for the PSD3/PSR final compromise texts; the finding rests on convergent Tier-4 law-firm commentary. This does not undermine the substance of the finding, given the consistency across multiple independent advisory sources on both the COREPER-endorsement date and the general timeline, but it does mean that firms should treat the specific dates as assessed rather than confirmed pending Official Journal publication itself.

Outlook

The two dates to track for licensing and market access are Official Journal publication, expected in the second half of 2026, and general application, expected near 2028. Firms currently authorised under the existing PI/EMI split should treat the intervening period as the practical window for assessing what a consolidated authorisation category means for their existing licence, particularly where a firm currently holds separate PI and EMI permissions that the new regime may treat differently. No transitional-mapping guidance was identified this cycle, and that absence is itself worth monitoring as Official Journal publication approaches.

Conduct, Safeguarding & Financial Promotions

The PSR, the Regulation half of the PSD3/PSR package endorsed by COREPER on 22 April 2026, is reported to bring certain safeguarding-of-funds provisions into effect earlier than the package's general application window. Specifically, requirements around how payment institutions and e-money firms segregate, report on, and audit safeguarded customer funds are reported to take effect from around May 2026, notably ahead of the roughly 21-month general application timeline that applies to the bulk of the PSD3/PSR package following Official Journal publication.

This early-effective-date signal currently rests on a single source at the lower end of the source-tier scale, and has not been corroborated by a primary or higher secondary-tier source this cycle. It should be treated as a provisional operator-relevant signal rather than a confirmed compliance deadline: firms planning safeguarding-compliance workstreams should treat May 2026 as an unconfirmed early marker worth monitoring for corroboration, not as a settled date to build a final compliance programme against.

If the early effective date is confirmed, the practical effect for PSPs and e-money firms operating in the EEA would be a compressed timeline for adapting fund-segregation, reporting and audit processes for safeguarded customer funds, ahead of the rest of the PSD3/PSR conduct-of-business framework taking general effect. This would create a two-stage compliance timeline within the same instrument package, with safeguarding obligations landing before the broader conduct and governance requirements.

Outlook

The key marker is whether a primary or higher-tier secondary source corroborates the reported May 2026 safeguarding effective date before that date arrives; absent corroboration, firms should continue planning primarily against the general ~21-month application window while treating the earlier date as a risk-management contingency.

Conduct, Safeguarding & Financial Promotions

The most structurally significant conduct-of-business development in the new EEA payments framework is the migration of conduct rules out of the third Payment Services Directive and into the directly-applicable Payment Services Regulation. Transparency requirements, fraud-prevention obligations, strong-customer-authentication rules and open-banking access provisions all move into the Regulation rather than remaining in a directive subject to national implementation. This is confirmed with high confidence and is significant because it eliminates the pattern, characteristic of the PSD2 era, in which conduct standards diverged meaningfully across the 30 EEA jurisdictions depending on how faithfully and how quickly each transposed the directive.

Within that migrated conduct rulebook, the fraud-prevention overhaul is described as the centrepiece of the Payment Services Regulation. It reshapes the allocation of liability between payer and payee banks when fraud occurs, and it introduces a requirement for payer banks to verify that a payee name matches the destination account before a transfer is executed. This mechanism is structurally analogous to the United Kingdoms Confirmation of Payee regime, but it is being introduced at the scale of the entire EEA payments market rather than a single national market, which is a materially larger conduct-and-liability shift for cross-border payment service providers than a UK-only comparison might suggest.

A second, more narrowly technical conduct obligation introduced by the Regulation requires payment service providers that outsource strong-customer-authentication functions to technical service providers to conduct thorough due diligence on those providers before outsourcing. This is a new outsourcing-governance duty that did not exist in comparable form under the second Payment Services Directive, and it reflects a broader regulatory pattern of holding regulated firms accountable for the technical-service-provider layer of their authentication stack, not only for their own directly-operated systems.

The safeguarding dimension of this cycles conduct developments is that all of these obligations apply uniformly to the newly merged payment-institution category, meaning firms previously licensed as e-money institutions under a separate conduct regime will need to align their transparency, fraud-prevention, authentication and outsourcing-due-diligence practices with the single Regulation-based standard alongside payment institutions proper, removing a previous source of divergent national conduct expectations between the two categories.

Outlook

The payee-name-verification requirement and the technical-service-provider due-diligence obligation are the two conduct provisions most likely to require concrete operational build-out ahead of the frameworks general application date. Firms should expect the fraud-liability reallocation in particular to be the most closely watched implementation item, given its direct bearing on consumer-facing loss allocation at EEA scale.

Conduct, Safeguarding & Financial Promotions

The Payment Services Regulation shifts fraud liability onto payment service providers: a PSP that fails to implement suitable anti-fraud mechanisms becomes liable for the resulting customer losses, and transactions initiated or altered by a fraudster are treated as unauthorised, placing the full fraudulent amount on the PSP rather than the customer. This is a direct conduct-of-business change with material commercial consequence for any PSP whose current fraud-prevention controls were built to the older, more consumer-liability-tolerant standard; the reallocation effectively makes fraud-control adequacy a balance-sheet question for PSPs rather than solely a customer-redress question.

Alongside the fraud-liability shift, the PSD3/PSR safeguarding regime for e-money institutions tightens materially: EMIs face a stricter T+1 deadline for securing incoming funds, together with new concentration-risk-management rules governing the custodians and hedging instruments EMIs use to protect client money. This safeguarding change is explicitly a non-bank-PI/EMI-facing rule; bank-PSPs, whose deposit-taking model already carries prudential capital and deposit-guarantee-scheme protections that EMIs do not have, are not the direct target of this tightening, which is aimed specifically at closing the structural safeguarding gap between how banks and non-bank EMIs each protect client funds.

The Instant Payments Regulation adds two further conduct-relevant obligations that are now live. First, mandatory free payer-side Verification-of-Payee has applied to euro-area PSPs since 9 October 2025, a Tier-1, high-confidence finding directly sourced to the European Central Bank; non-euro-area EEA Member States face a materially later compliance date of 9 July 2027, meaning the EEA currently operates under two different VoP compliance timelines depending on currency area. Second, and independently of Verification-of-Payee, Instant Payments Regulation Article 5d requires PSPs offering instant credit transfers to verify at least daily whether any payment-service user is subject to targeted financial restrictive measures, a standing sanctions-screening obligation layered on top of, but distinct from, the payee-verification requirement.

Taken together, these four developments, fraud-liability reallocation, tightened EMI safeguarding, live euro-area Verification-of-Payee, and daily instant-payments sanctions screening, represent a coordinated tightening of the conduct-and-safeguarding perimeter around instant and account-to-account payments specifically, rather than a single isolated rule change. The structural effect is to move both fraud risk and screening obligations further toward the PSP itself and away from the customer or from a purely post-hoc enforcement model, while simultaneously narrowing the safeguarding gap between bank-PSPs and non-bank EMIs, without fully closing it, given that EMIs still operate under a segregation-based safeguarding model rather than the deposit-guarantee-scheme model available to banks.

Outlook

The non-euro-area Verification-of-Payee deadline of 9 July 2027 is the next scheduled conduct-and-safeguarding milestone, and the practical question for PSPs in non-euro EEA Member States is whether they build toward that deadline on the same technical rulebook the euro area already uses, given that the European Payments Council Scheme Rulebook already exists and entered into force ahead of the euro-area deadline. For EMIs, the T+1 safeguarding deadline and the new concentration-risk-management rules are the most immediate operational change to plan around, since the safeguarding tightening does not carry a phased or staggered implementation date in the material identified this cycle. Whether the fraud-liability reallocation under the PSR produces a measurable shift in PSP anti-fraud-control investment ahead of general application near 2028 is a further point worth tracking in subsequent cycles.

Stablecoins & Digital Money

The European Banking Authority's Opinion of 12 February 2026 ended the no-action-letter transition period that had applied to crypto-asset service providers conducting payment services using e-money tokens. That transition period closed on 2 March 2026. From that date, crypto-asset service providers conducting payment services in relation to e-money tokens must hold their own PSD2 authorisation as a payment institution, or operate in partnership with an already-authorised payment service provider, in order to continue providing those services lawfully. This closes a gap that had previously allowed e-money-token payment activity to proceed under a supervisory no-action posture rather than full PSD2 licensing, and it marks a clear tightening of the regulatory perimeter around stablecoin-adjacent payment activity in the EEA.

The agreed, though not yet adopted, Payment Services Regulation text would build a more structural route alongside this tightened baseline. The Council's compromise text of 17 April 2026 provides that a payment institution may provide crypto-asset services in relation to e-money tokens for the purposes of providing payment services, where those crypto-asset services are themselves properly authorised, and separately provides that undertakings already authorised as a crypto-asset service provider under the Markets in Crypto-Assets Regulation would not be required to duplicate certain authorisation steps when also providing payment services. Read together, these agreed provisions would create a streamlined route connecting MiCA-based crypto-asset service provider authorisation to PSD2/PSR-based payment institution status for e-money-token activity specifically, rather than requiring entirely separate authorisation tracks. Because the Payment Services Regulation is agreed but unadopted, this streamlined route is not yet available, and firms must currently satisfy the full, separate PSD2 authorisation or authorised-partner requirement established by the EBA's February 2026 Opinion.

This sits within the broader Markets in Crypto-Assets Regulation framework governing e-money tokens and asset-referenced tokens generally, including MiCA's restrictions on the issuance of asset-referenced tokens, authorisation requirements for crypto-asset service provision, and marketing-communications rules, all of which continue to apply to stablecoin issuers and service providers in the EEA independent of the payment-services-specific PSD2 authorisation question addressed by the EBA's Opinion.

Outlook

The immediate compliance reality for crypto-asset service providers conducting e-money-token payment services is the EBA's February 2026 Opinion: PSD2 authorisation or an authorised-PSP partnership is required now, not at some future date, since the no-action transition period ended 2 March 2026. The streamlined MiCA-to-PSD2/PSR authorisation route that the agreed Payment Services Regulation text would introduce remains contingent on PSD3/PSR's still-outstanding formal adoption, expected around the European Parliament's indicative plenary vote of 14 December 2026 at the earliest, with provisions generally applying 21 months after entry into force thereafter.

Stablecoins & Digital Money

The Markets in Crypto-Assets Regulation reached full enforcement across all 27 Member States on 1 July 2026, as its transitional grandfathering window closed. This is the single most consequential digital-money milestone in the EEA this cycle, though it is corroborated only at Tier 4 through commercial secondary sources, with no ESMA or EBA primary text retrieved confirming the milestone in primary-regulator language.

The compliant euro-stablecoin market grew materially around this milestone. Eight MiCA-compliant euro-denominated stablecoins were recorded as of June 2026, up from five, with compliant market capitalisation up 128 percent year-on-year to approximately 673.9 million dollars. Three tokens, EURT, EURS and EURA, exited compliance over the period, while four new entrants, EUROP, EURQ, EURI and EURAU, achieved compliance, indicating a churning rather than a simply additive market. Circle EURC remains the dominant issuer, holding roughly 41 percent of euro-stablecoin market capitalisation as of the first quarter of 2026, up from 17 percent a year earlier in capitalisation terms, even as independent reporting suggests its trading-volume share is declining as MiCA-compliant rivals such as EURCV, EURI and EURAU grow. The apparent tension, rising capitalisation share alongside declining volume share, suggests EURC retains an outstanding-balance advantage while newer entrants are capturing a growing share of transactional flow.

A distinct regulatory development this cycle addresses the boundary between payments regulation and crypto-asset regulation directly. Following a 2025 EBA no-action letter whose transition period ended 2 March 2026, an EBA Opinion issued 12 February 2026 narrowed the scope of e-money-token-related activities that require dual authorisation under both PSD3 and MiCA, though the Opinion stops short of eliminating dual-licensing altogether: two-licence outcomes remain necessary for some business models. This is a market-access-relevant clarification for any e-money-token issuer structuring its EEA entity around a single-licence model, and it sits at the direct intersection of this module and the licensing-and-authorisation module, since the practical effect is to narrow, but not close, the population of firms that need both a payment-institution-type authorisation and a MiCA crypto-asset-service-provider authorisation for the same underlying activity.

Outlook

Further EBA clarification on the PSD3/MiCA dual-licensing boundary for e-money-token activity is anticipated, following the 12 February 2026 Opinion, though its timing is uncertain and no confirmed publication date was identified this cycle. Whether the euro-stablecoin issuer landscape continues to diversify away from Circle EURC dominance in trading-volume terms, even as EURC capitalisation share holds up, is the key market-structure question for this module going forward, and the growing set of bank-affiliated issuers entering the market, discussed further under the commercial-intelligence module this cycle, is a direct input into that diversification trend. Any forward-looking framing here is offered as analytical orientation only, not as investment or compliance advice.

Operational Resilience & Critical Infrastructure

The Instant Payments Regulation (Reg (EU) 2024/886) continues its staggered EEA-wide compliance rollout, with the operational resilience implications differing materially between euro-area and non-euro-area PSPs. Verification-of-Payee, the mechanism requiring payer PSPs to check that the payee name matches the intended account before an instant payment is executed, applied to euro-area PSPs from 9 October 2025. The first mandatory EBA reporting deadline for PSPs under the IPR fell on 9 April 2026, requiring PSPs to report on payment activity dating back to 22 October 2022, a reporting scope that reaches well before the reporting deadline itself and requires firms to have retained and be able to reconstruct historical payment-activity data across that period.

For non-euro-area EEA PSPs, the operational resilience timeline is materially longer: these PSPs are not required to provide the Verification-of-Payee service until 9 July 2027, nearly two years after the euro-area deadline. This creates a genuinely two-speed operational resilience landscape within the same regulatory instrument: euro-area payment infrastructure has already had to build and operate VoP checking and historical reporting capability, while non-euro-area EEA infrastructure has a materially longer runway to build the equivalent capability.

The retrospective reporting scope reaching back to 22 October 2022 is a significant operational-resilience point in its own right: PSPs subject to the 9 April 2026 reporting deadline needed to have systems and data retention in place capable of reconstructing over three years of payment activity for the purposes of the first mandatory report, which is a materially more demanding operational requirement than a purely forward-looking reporting obligation would have been.

Outlook

The next marker for non-euro-area EEA PSPs is 9 July 2027, when Verification-of-Payee obligations extend to their operations. Firms operating across both euro-area and non-euro-area EEA jurisdictions should treat the intervening period as a window in which they operate two distinct instant-payments compliance postures within a single legal instrument, rather than assuming uniform EEA-wide application.

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act was incorporated into the EEA Agreement by the EEA Joint Committee in February 2026, in the same written procedure that also incorporated the Markets in Crypto-Assets Regulation. This is confirmed with high confidence via primary EFTA Secretariat sourcing. Incorporation into the EEA Agreement, however, is a distinct legal step from entry into force at the national level within the EEAs EFTA pillar: the Regulation enters into force in Iceland, Liechtenstein and Norway only once each of those states has satisfied its own national constitutional requirements for incorporating EEA-relevant EU legislation.

This two-step structure creates a temporal fragmentation risk between the EU-27 track, where DORA has already been in force and generating compliance obligations for financial entities and their critical ICT third-party providers, and the EFTA-pillar track, where the same obligations remain formally pending until constitutional clearance is complete in all three states. This is assessed as a probable, elevated-impact development: it does not change what DORA requires, but it does mean that the operational-resilience compliance clock is currently running at two different speeds within a single economic area, for firms that might reasonably assume EEA-wide simultaneity given the Agreements single-market character.

For payment service providers with cross-border operations spanning both the EU-27 and the EFTA pillar, this asymmetry has practical significance for group-wide operational-resilience programme design: a firm cannot treat DORA compliance as uniformly binding across all EEA jurisdictions on the same timeline, and must track the constitutional-clearance status of Iceland, Liechtenstein and Norway individually rather than assuming simultaneous entry into force alongside the EU-27.

The specific completion timeline for constitutional clearance in each of the three EFTA states was not established by this cycles research, and that absence of a firm date is recorded here as an open point rather than assumed to resolve by any particular quarter.

Outlook

The pace of constitutional clearance in Iceland, Liechtenstein and Norway is the key variable to track for operational-resilience compliance planning across the EFTA pillar. Firms with group entities in those three jurisdictions should expect continued asymmetry with EU-27 DORA obligations until each states clearance process concludes, and should not assume a single EEA-wide effective date for operational-resilience requirements in the interim.

Scheme & Network Compliance

The Payment Services Regulation extends the Verification of Payee mechanism from its current scope, euro-denominated instant credit transfers under the amended SEPA Regulation, to cover all credit transfers, including those outside SEPA's geographic and currency reach. This is the cycle's principal scheme-and-network-compliance development, and it carries direct fraud-liability consequences: payment service providers may need to absorb losses where the verification mechanism itself fails, and providers will be required to offer customers spending limits and transaction-blocking measures. A specific reimbursement requirement applies to employee-impersonation fraud scenarios, allocating loss exposure toward providers in a defined category of fraud that has proven difficult for verification-only controls to prevent.

Because the existing SEPA-only Verification of Payee obligation already covers the euro instant-credit-transfer population, providers that have already built verification infrastructure for SEPA instant transfers face a scaling exercise, extending existing logic to a wider transfer population, rather than a from-scratch build. The scope extension nonetheless represents a meaningful widening of scheme-level compliance obligations beyond the euro-area instant-payments core that has been the initial focus of Verification of Payee implementation to date.

Outlook

Watch for the PSR's formal publication, expected around Q3 2026, to fix the compliance timeline for the Verification of Payee scope extension. Providers should expect the transition period applicable to PSD3/PSR generally to also govern the phase-in of the wider Verification of Payee obligation, though this cycle's evidence does not confirm a separate, earlier-dated compliance deadline specific to the VoP extension itself.

Scheme & Network Compliance

The European Payments Council published a dedicated Verification-of-Payee Scheme Rulebook, entering into force 5 October 2025, just days ahead of the 9 October 2025 regulatory deadline under the Instant Payments Regulation. This is a Tier-2, high-confidence finding, and the timing detail, the scheme rulebook entering into force ahead of rather than concurrent with the regulatory deadline, is itself a useful data point on scheme-level readiness: the European Payments Council built and activated the network-level rulebook with a small margin ahead of the legal deadline it was designed to support, rather than the two dates coinciding exactly or the rulebook lagging behind the regulation.

Signal on scheme and network compliance this cycle is otherwise limited: no further scheme-rulebook development, card-scheme rule change, or network-level dispute-resolution update was located for the EEA this cycle beyond the Verification-of-Payee Rulebook itself. The module is flagged as thin-signal accordingly, reflecting an honest account of what was found rather than an attempt to extend a single finding into a broader network-compliance narrative.

Outlook

The practical scheme-compliance question going forward is whether the European Payments Council Rulebook approach, building and activating a dedicated scheme rulebook ahead of a regulatory deadline, is repeated for the non-euro-area Verification-of-Payee deadline of 9 July 2027, or whether that later deadline is met through a different scheme-governance mechanism. No further scheme-level signal was identified this cycle to assess that question directly.

Correspondent Banking, Settlement & Access

The defining development in correspondent banking and settlement access this cycle is the amendment of the Settlement Finality Directive as part of the PSD3/PSR package, which now permits payment institutions and e-money institutions to participate directly in designated payment systems. This right had previously been reserved to banks, meaning non-bank payment service providers were required to access settlement infrastructure indirectly, typically through a sponsoring bank relationship. The amendment is confirmed with high confidence via primary legal-commentary tracking of the compromise texts and represents a direct structural break from the bank-only settlement-access model that has defined correspondent and settlement relationships across the EEA payments market to date.

The analytical spine of this development is precisely that bank-versus-non-bank access asymmetry. Under the prior regime, a payment institution or e-money institution seeking finality-protected access to a designated payment system had no direct route and depended on a bank counterparty willing to sponsor that access, a dependency that shaped correspondent-relationship pricing, concentration risk and operational resilience for the non-bank payment sector as a whole. The amendment does not abolish correspondent banking relationships outright, but it removes the structural requirement that non-bank payment service providers rely on them for settlement-system access specifically, which is the more consequential half of the correspondent relationship for many payment institutions and e-money institutions.

This settlement-access change should be read alongside the broader PSD3/PSR licensing consolidation described elsewhere in this brief: the same package that merges e-money institutions into the payment-institution category as a sub-type also extends that merged categorys settlement rights, meaning the newly unified non-bank payment-institution category gains both a simplified authorisation status and, for the first time, a direct settlement-access right previously withheld from both of its constituent parts.

No further correspondent-banking developments, such as changes to nostro-vostro relationship management practices or bank de-risking patterns affecting EEA payment institutions, surfaced this cycle beyond the Settlement Finality Directive amendment itself.

Outlook

The practical uptake of direct settlement-system participation by payment institutions and e-money institutions, once the amended Settlement Finality Directive takes effect alongside the wider PSD3/PSR framework, is the development to watch. Sponsoring banks that currently provide indirect settlement access to non-bank payment service providers should expect commercial pressure on that intermediation role as direct participation becomes a genuine alternative for at least the larger and better-capitalised payment institutions and e-money institutions.

Correspondent Banking, Settlement & Access

The defining structural feature of correspondent banking and settlement access in the EEA this cycle is the bank-versus-non-bank access asymmetry, and this cycle records a material move to narrow it. Since October 2025, non-bank payment service providers meeting TARGET Guideline requirements have been able to access TARGET Services directly, both T2 for payment settlement and TIPS for instant-payment settlement, under a harmonised Eurosystem access policy. This is a Tier-1, high-confidence finding sourced directly to the European Central Bank.

Prior to this harmonised access policy, non-bank PSPs seeking instant or high-value settlement typically depended on a correspondent or agency-bank relationship with a directly-participating bank, a dependency that carries both cost and de-risking exposure, since correspondent banks retain discretion to terminate or restrict access to non-bank PSP clients they assess as higher-risk or lower-margin. Direct TARGET Services access removes that intermediation step for non-bank PSPs that meet the TARGET Guideline eligibility requirements, which is a structural de-risking-mitigation development: a non-bank PSP with direct settlement access is no longer solely dependent on a correspondent bank continuing relationship for its core settlement function, even though it may still rely on correspondent banks for other cross-border or non-euro functions.

This access change should be read as structural rather than incidental. It does not eliminate the underlying asymmetry between bank-PSPs, which have always had direct central-bank settlement access as an incident of their banking licence, and non-bank PSPs, for whom direct access has historically been unavailable regardless of scale or risk profile; but it does narrow the asymmetry specifically for the instant-payment and core payment-settlement functions that TARGET and TIPS cover, which is where the practical correspondent-dependency cost has historically been most acute for non-bank PSPs processing high transaction volumes.

Outlook

The practical question going forward is one of take-up: how many eligible non-bank PSPs move from correspondent-bank-intermediated settlement to direct TARGET Services access, and over what timeframe, is not established by the material identified this cycle, which confirms the policy change but not adoption data. The correspondent-banking de-risking dynamic that direct access is intended to mitigate remains a live background condition even as the harmonised access policy narrows its practical bite for the specific instant-payment and core-settlement functions TARGET and TIPS cover.