Portugal

Licensing, Authorisation & Market Access

Portugal's payment-institution and e-money-institution licensing framework remains anchored in Decree-Law 91/2018, the existing PSD2-based regime under which Banco de Portugal continues to supervise authorised institutions. The reason this baseline has not moved this cycle is that the successor framework, the PSD3/PSR legislative package, has not yet reached the point where domestic transposition or implementation could begin. The package's final compromise texts, carried in Council documents ST-8221/8222-2026-INIT, were endorsed by the European Parliament's ECON committee on 5 May 2026, but the package still awaits a full plenary vote, Council sign-off, and Official Journal publication. That publication is now expected by December 2026, later than earlier timetables anticipated, and until it occurs the clock toward general application cannot formally start.

Once published, the Payment Services Regulation's general application is expected to follow approximately 21 months after entry into force, which on current scheduling would place substantive application in the first half of 2028 rather than earlier. Verification-of-Payee obligations, which require payment-service providers to confirm that a payee's name matches the account holder before a transfer completes, are phased in on a longer clock still, at approximately 27 months after entry into force. The PSD3 directive component, which requires national transposition, runs on the same underlying timetable as the directly-applicable PSR, so Portuguese market participants, including payment institutions, e-money institutions and banks, face a licensing and authorisation landscape that remains governed by the current regime for a materially longer period than had been anticipated when the package was first negotiated.

This delay is a European Union-wide scheduling matter rather than anything specific to Portugal's domestic implementation capacity, and Banco de Portugal's supervisory posture under the current regime has not been reported as changing in response to the delay. The practical consequence for market-access planning is that firms seeking authorisation or passporting arrangements into or via Portugal over the next twelve to eighteen months should expect to do so under the existing Decree-Law 91/2018 framework, with the PSD3/PSR transition representing a 2027-to-2028 horizon event rather than an immediate consideration.

Outlook

The next concrete milestone to watch is Official Journal publication of the PSD3/PSR package, now expected by December 2026. Once that occurs, the approximately 21-month clock to general application, and the longer approximately 27-month clock for Verification-of-Payee obligations specifically, will begin running in earnest, pointing toward substantive compliance obligations for Portuguese-licensed and Portuguese-passporting payment institutions, e-money institutions and banks materialising around the first half of 2028. Until publication occurs, no further change to Portugal's licensing and market-access landscape under this package is expected, and Banco de Portugal's continued administration of the current PSD2-based regime should be read as the stable baseline against which the eventual PSD3/PSR transition will be measured.

Stablecoins & Digital Money

Portugal's MiCA transitional regime for pre-existing crypto-asset service providers ended on 1 July 2026, closing a window that had allowed firms registered with Banco de Portugal to continue operating pending full authorisation. Bison Bank obtained the first full Crypto-Asset Service Provider authorisation at around this point, reported 30 July 2026, and was the only market participant holding a full authorisation at the close of the transitional window. The governing instrument, Lei 69/2025, divides supervisory responsibility: Banco de Portugal is the competent authority for Titles III and IV of MiCA, covering the issuance of asset-referenced tokens and e-money tokens, while CMVM supervises Chapter 3 of Title V and Articles 66 and 70 to 72, the conduct-facing provisions governing how crypto-asset services are offered to customers.

This division is structurally significant for stablecoin issuers and digital-money providers operating in or into Portugal: an entity issuing an asset-referenced or e-money token engages primarily with Banco de Portugal's prudential remit, while an entity providing crypto-asset services to Portuguese customers engages with CMVM's conduct remit, and many firms will need to satisfy both depending on their business model. The single-authorisation-holder position at the transitional deadline signals a market-access bottleneck for other pre-existing registrants, several of which Banco de Portugal itself warned risked lapsing into unauthorised status.

Outlook

Whether further full CASP authorisations are granted beyond Bison Bank in the near term is the key item to watch; this will determine whether the current concentration in Portugal's licensed digital-asset market persists through the remainder of 2026 or begins to broaden as other pre-existing registrants complete the full-authorisation process.

Operational Resilience & Critical Infrastructure

Banco de Portugal introduced an incremental macroprudential tightening measure this cycle, setting the countercyclical capital buffer at 0.75% of risk-weighted national banking-sector credit exposures, effective 1 January 2026. This sits on top of the standard 4.5% Common Equity Tier 1 (CET1) requirement and the 2.5% capital-conservation buffer already applicable to Portuguese banks. This is a Probable finding, sourced to a law-firm summary of the regulator-set buffer rather than a direct Banco de Portugal primary-source citation this cycle.

The buffer applies to the national banking sector's risk-weighted credit exposures generally, rather than being a payments-specific or payment-institution-specific measure; it is most directly relevant to bank-PSPs holding banking licences and subject to the full CET1/buffer stack, rather than to non-bank payment institutions or electronic-money institutions, which are typically subject to a different, non-bank-specific prudential regime under PSD2/DL 91/2018 rather than the CET1 capital-buffer framework applicable to credit institutions. This distinction matters for assessing which categories of payment-services providers in Portugal are directly affected by the buffer increase: bank-PSPs face a modestly higher capital-adequacy bar from 1 January 2026, while non-bank PI/EMI licensees operating under the separate payment-institution prudential regime are not directly captured by this specific buffer setting.

The buffer increase is incremental rather than a signal of acute stress in the Portuguese banking sector; it is consistent with a routine macroprudential calibration exercise rather than a response to any identified vulnerability in the evidence reviewed this cycle.

Outlook

The item to watch is whether Banco de Portugal signals any further countercyclical buffer adjustments in subsequent macroprudential reviews, and whether any clarification emerges on how the buffer setting interacts with payment institutions that hold partial banking authorisations or operate under hybrid licensing arrangements.

Scheme & Network Compliance

The EU Instant Payments Regulation (Regulation (EU) 2024/886) requires Portuguese payment service providers that already offer standard credit transfers to also offer instant credit transfers at no additional charge, together with mandatory Verification of Payee (VoP) checks on domestic and euro-area transfers, a finding sourced directly to Banco de Portugal. Banco de Portugal itself co-developed the Eurosystem's VoP reference solution together with Latvijas Banka, and this solution was live ahead of the EU-wide October 2025 VoP mandate, a directly-sourced ECB finding. This positions Portugal among the earlier movers in the EU's instant-payments scheme-compliance rollout rather than a jurisdiction implementing the mandate at the deadline.

Outlook

The item to watch next cycle is whether Banco de Portugal's early VoP infrastructure role extends into further Eurosystem instant-payments initiatives, and whether PT-specific VoP false-positive or fraud-detection performance data becomes available as the scheme matures.

Payment Corridor Dynamics

The Instant Payments Regulation's second wave began its compliance clock in October 2026, extending the instant-transfer-receiving obligation that previously applied only to banks onto payment institutions and e-money institutions. Euro-area payment institutions and e-money institutions now have a six-month window from that starting point to begin receiving instant transfers, while banks outside the euro area have been given a shorter three-month window. This is a meaningful widening of the instant-payments corridor's reach within Portugal's payments ecosystem: payment institutions and e-money institutions, which had previously been exempted from the receiving-side obligation imposed on banks in the regulation's first wave, now face the same requirement, closing a gap in instant-transfer coverage that had persisted between bank and non-bank payment-service-provider categories.

Portugal enters this second-wave compliance window from a position of comparatively high existing adoption. Reported data shows the share of instant transfers among total transfers in Portugal rising from 25% in 2024 to 80% in 2025, a trajectory that reflects substantial infrastructure build-out and consumer-behaviour shift well ahead of the October 2026 compliance-window opening for payment institutions and e-money institutions specifically. While that adoption data describes the market broadly rather than isolating the payment-institution and e-money-institution segment specifically, it indicates that the underlying corridor infrastructure, including the interbank and inter-provider settlement rails that instant transfers depend on, was already substantially mature in Portugal before the second-wave obligation reached the non-bank segment.

Banco de Portugal's own Verification-of-Payee infrastructure, built in part on solutions developed jointly with Latvijas Banka for the Eurosystem-wide Verification-of-Payee scheme, represents a related corridor-level capability that sits alongside, though is governed on a separate track from, the Instant Payments Regulation's receiving-side obligations addressed here. The two capabilities, instant-transfer receipt and payee-name verification, are complementary parts of the same broader instant-payments corridor architecture, with Verification-of-Payee obligations under PSD3/PSR phasing in on the later, approximately 27-month, timetable discussed separately under the PSD3/PSR licensing development.

Outlook

The immediate question for the payment-institution and e-money-institution segment specifically is whether the six-month compliance window opened in October 2026 proceeds without disruption, given that Portugal's broader instant-transfer adoption curve, already at roughly 80% of total transfers by 2025, suggests the corridor infrastructure these institutions will need to plug into is largely already in place. No PT-specific gap-assessment data isolating payment institutions and e-money institutions from the broader adoption figures has been located this cycle, so the extent to which this segment specifically still needs to build out receiving capability, as opposed to simply connecting to existing rails, remains unconfirmed. The non-euro-area bank three-month window, shorter than the payment-institution and e-money-institution six-month window, is not directly applicable to Portugal as a euro-area jurisdiction, but is noted here as the comparative corridor-dynamics backdrop against which the euro-area timetable should be read.

Consumer Protection & APP Fraud

The PSR and PSD3 package will materially broaden consumer-protection obligations around payment fraud once adopted. Verification-of-payee checks, which currently apply only within the scope of the Instant Payments Regulation for SEPA Instant credit transfers, will be extended to cover all wire transfers under the new framework. This is a confirmed development at the EU legislative level, directly applicable to Portuguese payment service providers as an EU member state, and represents a substantive widening of the payee-verification safety net beyond its current instant-payment-only scope to standard, non-instant wire transfers as well.

Alongside the verification-of-payee extension, the PSR/PSD3 package introduces new authorised-push-payment fraud reimbursement obligations. This directly addresses a consumer-protection gap in the current framework, where liability allocation for APP fraud losses has been inconsistent across payment service providers and member states. For Portuguese consumers and the payment institutions serving them, this represents a forward-looking tightening of consumer-protection standards tied directly to the broader PSD3/PSR legislative package moving toward final adoption.

Outlook

The scope and mechanics of the new APP-fraud reimbursement obligation, including liability-allocation rules between sending and receiving institutions, will become clearer once the final PSD3/PSR compromise texts are approved and national implementation begins. Portuguese payment service providers should anticipate operational changes to extend verification-of-payee infrastructure beyond current SEPA Instant scope ahead of the eventual implementation deadline.

AML/CFT & Financial Crime

The European Commission sent a letter of formal notice to Portugal, together with 17 other Member States, on 25 September 2026, over incomplete transposition of Directive (EU) 2024/1640, the sixth Anti-Money Laundering Directive, specifically Articles 11, 12, 13 and 15, which govern access to central beneficial-ownership registers for competent authorities, self-regulatory bodies, obliged entities, and persons able to show a legitimate interest. This intelligence is fed through the Sentinel.gi feed; readers seeking the underlying illicit-finance analysis should refer to that feed directly, as this monitor does not re-analyse the illicit-finance substance.

The payments-sector relevance of this gap lies in its upstream effect on payment service providers' and e-money institutions' customer-due-diligence and beneficial-ownership-identification duties, which in practice depend on the completeness and accessibility of the national beneficial-ownership register. The transposition deadline was 10 July 2026, and Portugal has a two-month window to reply, running to approximately late November 2026.

Outlook

Portugal's response to the European Commission within the reply window, to approximately late November 2026, is the item to watch for payment institutions and e-money institutions relying on the national beneficial-ownership register for CDD purposes.

Correspondent Banking, Settlement & Access

Banco de Portugal settles instant transfers directly in TIPS central-bank money, a directly-sourced Banco de Portugal finding. This is the module's analytical spine: direct TIPS settlement places Portuguese payment service providers inside the Eurosystem settlement perimeter without dependence on a domestic correspondent-banking intermediation layer for retail instant payments, in contrast to jurisdictions where non-bank payment institutions must access settlement indirectly through a correspondent bank. The bank-versus-non-bank access question is therefore substantially resolved for Portugal's instant-payments corridor specifically, though this cycle's sourcing does not extend to Portugal's correspondent-banking access position for other payment rails or currencies.

Outlook

The item to watch is whether Portugal's direct-TIPS-access model for instant payments extends to any additional settlement rails, and whether any non-bank PI/EMI in Portugal reports differential settlement-access experience relative to the bank-settled TIPS model described here.