EU Reaches PSD3 and PSR Compromise: What It Means for Malta

The EU's payment services rulebook is about to undergo its most significant overhaul since PSD2, with the Council publishing final compromise texts on 24 April 2026 for both the Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR).

For Malta's payment institutions, e-money issuers and fintech operators, the package signals a shift toward tighter harmonisation, directly applicable conduct rules, and new obligations spanning crypto-assets, fraud prevention and open banking.

The core change is structural. PSD3 will repeal and replace PSD2 in full, moving many conduct-of-business rules from national-level directives into a directly applicable regulation. This is designed to eliminate the fragmentation that emerged under PSD2, where different national transpositions weakened consistency across the Single Market.

Malta, which transposed PSD2 through its own national legislation, will see those varying interpretations replaced by a single rulebook for conduct requirements. Authorisation, prudential standards and supervisory structures remain within a directive framework, but the shift reduces the scope for local divergences.

The compromise also aligns conduct obligations for electronic money institutions with those for payment institutions, while preserving their separate licensing and capital regimes. This reflects the growing convergence between e-money and payment services, a trend that is particularly relevant in Malta's mature payments and fintech ecosystem.

Crypto-assets and e-money tokens are explicitly brought into the framework. Transfers involving e-money tokens and certain crypto-related payment activities may fall within PSD3 where they serve a payment function. Payment institutions may also offer crypto-asset services linked to e-money tokens, subject to conditions and notification procedures, while avoiding overlap with the Markets in Crypto-Assets Regulation (MiCA).

Consumer transparency is a central theme. Currency conversion costs must now be disclosed as both a monetary amount and a percentage mark-up over an aggregated mid-market rate. Virtual IBANs are recognised as valid payment account identifiers, with safeguards to reduce misuse.

On fraud, the liability framework is retained but providers must implement real-time fraud detection measures and warn consumers before executing suspected fraudulent transactions. The compromise introduces a liability-sharing mechanism between the payer's and payee's providers where the payee's provider failed to apply adequate controls.

For Malta's open banking sector, third-party providers retain access rights, but the text introduces clearer technical and contractual parameters. Account-servicing payment service providers face more specific obligations on the quality and reliability of dedicated interfaces, with the EBA mandated to develop technical standards on performance and fallback mechanisms.

The strong customer authentication framework is preserved but clarified, with greater detail on exemptions such as transaction-risk analysis and trusted beneficiaries. Delegated authentication arrangements receive a clearer legal basis, subject to liability safeguards.

The compromise also narrows scope exclusions. The commercial-agent exclusion is tightened to prevent platforms from sidestepping payment service provider obligations, and the specific-purpose instrument exemption is constrained to stop large-scale consumer-facing services from avoiding core protections.

National competent authorities will gain stronger investigatory and sanctioning powers, including the ability to impose administrative fines calibrated to the seriousness and duration of an infringement. The EBA's role in supervisory convergence is strengthened.

The new regime must be read alongside the Instant Payments Regulation, which requires EU payment service providers to offer instant euro credit transfers at charges no higher than standard transfers. The two frameworks are complementary: the Instant Payments Regulation governs availability and pricing, while PSD3 and PSR shape the broader conduct, transparency and authorisation framework.

For Maltese firms, the practical implications are significant. Compliance programmes will need to integrate both regimes, particularly where fraud-screening duties must be performed in real time. The shift to a directly applicable PSR means less room for bespoke national interpretations, which could benefit firms operating cross-border from Malta.

The compromise texts represent a political agreement. Formal adoption by the European Parliament and Council is expected to follow, after which Member States will have a period to transpose the directive elements. Operators should begin assessing the impact now.