#
PSD3/PSR politically agreed (27 Nov 2025) and formal compromise texts published 22-23 April 2026, replacing PSD2/EMD2 with a directive (authorisation/governance) plus directly-applicable regulation (conduct); Swedish transposition of PSD3 has not yet commenced and realistic applicability is mid-to-late 2027.
The defining development this cycle is the confirmed entry into force, on 1 March 2026, of the Act on Criminal Liability for Unlawful Financial Activities (2026:56), which criminalises conducting financial activities without required authorisation or registration. Penalties run up to two years' imprisonment for the base offence and from six months to six years for aggravated offences. This corrects a baseline research finding that had characterised the measure as a still-pending bill with only a proposed 1 March 2026 in-force date; the Act has since passed the Riksdag and its in-force status is now confirmed. The change raises the stakes of the unauthorised-activity/market-access boundary from a purely administrative matter to one of criminal jurisdiction, materially increasing legal risk for unlicensed operators and the facilitators around them.
FI's enforcement of the licensing perimeter is active in parallel with the new criminal-liability framework: the regulator withdrew the payment institution authorisation of Get betal AB on 21 January 2026 after the firm provided inaccurate information in its authorisation application, with the withdrawal taking immediate effect. The case is a relevant precedent for peer PI/EMI applicants regarding the consequences of application-stage misstatement.
Outlook
With Act 2026:56 now in force and FI continuing to withdraw authorisations for application-stage failures, the Swedish licensing perimeter is tightening on two fronts simultaneously — criminal-law exposure for unauthorised activity and administrative enforcement against authorised firms found to have misrepresented themselves at entry. New PI/EMI applicants should expect continued scrutiny of application accuracy, and unlicensed operators now face materially higher legal exposure than the pre-March-2026 baseline.
Licensing, Authorisation & Market Access
The Riksbank's RBFS 2025:1 regulation on reporting payment statistics entered into force and began to apply on 1 October 2026. The regulation requires payment service providers and payment system operators domiciled in Sweden, and foreign payment service providers operating through a Swedish branch, to report payment statistics to the Riksbank. Account-information-only service providers are excluded from scope, a distinction that matters for firms whose Swedish activity is limited to account-aggregation services without payment initiation or execution. The regulation's credit-transfer reporting limb, the component covering the reporting of credit-transfer transaction data specifically, has been deferred to 1 October 2027, a full year after the main commencement date, giving affected institutions additional time to build the specific reporting pipeline that limb requires rather than demanding it alongside the general 1 October 2026 start date. This phased approach suggests the Riksbank judged the credit-transfer reporting requirement to carry a materially higher implementation burden than the rest of the regulation's scope, and chose to sequence the obligation accordingly rather than impose it all at once.
The regulation applies to both bank and non-bank payment service providers and operators falling within its domiciliary and branch-presence tests, with no indication in the evidence reviewed that the reporting obligation itself differs materially between bank and non-bank entities once a firm is in scope; the distinction that matters here is domicile and branch presence, not entity type.
Outlook
The operative date to track is 1 October 2027, when the credit-transfer reporting limb of RBFS 2025:1 becomes applicable, converting what is currently a partial reporting obligation into the full scope the regulation originally contemplated. Firms newly establishing a Swedish branch presence or Swedish domicile between now and that date should expect to be brought into the full reporting scope on the later date rather than the earlier one if the credit-transfer-specific build is not yet operational.
2 earlier distinct update(s)
Licensing, Authorisation & Market Access
The EU-level licensing framework governing payments market access is advancing toward formal adoption. The Council of the EU's Committee of Permanent Representatives has been invited, per an 'I' Item Note dated 17 April 2026, to approve final compromise texts for PSD3 and the directly-applicable Payment Services Regulation. Once adopted, existing e-money institutions will need to seek reauthorisation as payment institutions rather than continuing under their current e-money licence, a distinction that matters directly for the bank-PSP versus non-bank payment-institution/e-money-institution split that defines this module's practical scope. Formal adoption is expected in 2026, with an 18-24 month transition period before the current PSD2/EMD2 framework is repealed entirely. This is assessed at probable confidence, sourced from a legal-tracker analysis rather than the Council text directly.
For Sweden specifically, the practical effect of this EU-level development is a forthcoming reauthorisation exercise for any Sweden-domiciled or Sweden-serving e-money institution once the transition period begins, layered on top of the domestic developments already reshaping the market-access landscape this cycle -- notably Getswish AB's move to clearing-company status, which itself represents a market-access-relevant supervisory upgrade for a non-bank payment scheme operator.
Outlook
The formal Council and Parliament adoption timeline for PSD3/PSR through the remainder of 2026 is the item to track, as it will fix the exact start of the 18-24 month reauthorisation transition window for e-money institutions operating in or into Sweden. Firms currently operating under EMD2-derived e-money licences should treat this as a defined, dated compliance project rather than a distant possibility.
Licensing, Authorisation & Market Access
Sweden's licensing landscape moved on two distinct axes this cycle. At the prudential-formalisation end, Getswish AB, operator of the Swish instant-payment app, was granted a clearing-company licence, placing Swish under direct Finansinspektionen supervision for the first time, a first-of-kind milestone for the jurisdiction's dominant instant-payment operator (high confidence). At the enforcement end, Finansinspektionen withdrew the payment-institution authorisation of Get betal AB, effective 21 January 2026, for inaccurate application information, an enforcement-driven withdrawal rather than a routine market exit (high confidence). Read together, these two events illustrate the bank-PSP versus non-bank PI/EMI distinction that structures this module: Getswish, a non-bank payment operator, gains a heavier prudential licence category, while Get betal, also a non-bank payment institution, loses its authorisation outright.
At the supranational level, the PSD3 text and the directly-applicable Payment Services Regulation were put before national representatives for approval on 22 April 2026. Together they repeal and replace PSD2 and EMD2, folding electronic-money institutions into a re-authorised payment-institution sub-category and eliminating the standalone EMI regime EU-wide, including in Sweden, once formally adopted (assessed confidence). The Payment Services Regulation enters into force 20 days after publication and becomes applicable 21 months later, with territorial scope covering payment services provided within the EU (assessed confidence). This sets the future national-transposition and re-authorisation clock for Sweden's non-bank payment sector, though the precise date remains contingent on formal adoption.
Outlook
Watch for formal adoption of PSD3 and the Payment Services Regulation, which would start the 21-month applicability clock and determine when Sweden's standalone EMI licence category is folded into the re-authorised payment-institution sub-category. Watch also for whether other non-bank payment institutions face authorisation scrutiny of the kind applied to Get betal, and for further prudential-formalisation moves affecting other large non-bank payment operators following the Getswish clearing-company precedent.
Sources and findings (6)
- T1https://www.fi.se/en/payments/apply-for-authorisation/payment-services/retrieved
- T1https://www.fi.se/en/payments/apply-for-authorisation/electronic-money/retrieved
- T1https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/swedenretrieved
- T3https://ifbusiness.uk/how-to-obtain-an-emi-license-in-sweden-2025-requirements-costs-advantages/retrieved
- T2https://sweden.dlapiper.com/en/news/swedish-government-proposes-criminalisation-unauthorised-financial-activitiesretrieved
- T1https://www.fi.se/en/published/sanctions/financial-firms/retrieved