PSD3 and the PSR: A Compliance Roadmap for Swedish PSPs

Eight years after the implementation of PSD2, Swedish and European payment service undertakings are starting to prepare for a new regulatory landscape. For the past few years, the EU has been redrawing the framework governing payment service providers. The second Payment Services Directive (PSD2) will be replaced by a directly applicable Regulation (the ”PSR”) and a complementary Directive (”PSD3”). At the same time, the Electronic Money Directive will be repealed and absorbed into the payment institution framework. For payment service providers and E-money institutions on the Swedish market, the implications are both far-reaching and require adaption on the part of regulated entities.

The new payment service regulations entail further harmonisation across Europe and ensure that prudential requirements apply consistently across the EU, by regulating business conduct of payment service providers directly in the PSR. However, stricter requirements set out in PSD3 will also increase the prudential and organisational requirements placed on PSPs.

Authorisation and licensing for payment and e-money institutions

Articles 44–45 of the PSD3 compromise text require existing payment institutions and electronic money institutions to demonstrate compliance with the new authorisation requirements within a transitional period. The Swedish FSA (Sw. Finansinspektionen) will need to assess each institution against the enhanced application requirements of PSD3, including the filing of a winding-up plan in case of failure, including the return of safeguarded funds in the event of a disorderly wind-up, disclosure of every application made in the preceding three years by the applicant or any group entity in any EU jurisdiction.

Whereas the originally proposed requirement for re-authorisation of payment institutions has not been maintained in the compromise texts, the requirement to provide information to supervisory authorities will force PSPs to divert time and resources to affirming compliance. Although Swedish law already requires extensive documentation for undertakings applying for authorization as a payment institution, the new regulatory regime will increase the extent of the work necessary for any potential applicants in the future.

For Swedish e-money institutions however, PSD3 will require a renewed authorisation process. PSD3 requires “a single authorisation for providers of payment services which do not take deposits”, and the payment institution regime “will replace the regime applicable to electronic money institutions”, extending also to non-bank issuers of e-money tokens. Electronic money becomes a payment service listed in Annex I of the PSD3, carrying its own initial capital floor of EUR 250,000 and its own own-funds method.

The general PI threshold rises from EUR 125,000 to EUR 150,000. For Swedish companies that have structured their businesses at or near the current minima, this may necessitate capital injections.

As PSD3 is a directive, Member States retain some discretion over how these authorisation requirements are implemented, for example as regards the procedure and timing of the Swedish FSA’s review of existing institutions. However, the substantive requirements leave limited room for national variation, and the precise Swedish approach will only become clear once the implementing legislation is proposed.

Transaction requirements

Of the rules governing the conducting of payment service operations, the main differences compared to PSD2 relate to fraud and refunds, which will no longer be limited to unauthorised transactions, strengthening requirements on transaction monitoring and exposing payment service providers to greater liability. Transaction monitoring becomes a statutory duty on both sides of a payment, under Article 83(1a) of the PSR. The payer’s PSP must monitor transactions before execution and the payee’s PSP must monitor before making funds available. Where monitoring is not carried out and the payer suffers loss, the full amount is refundable, with the burden of proving compliance resting on the provider.

In particular, the PSR aims to prevent so-called spoofing fraud, where a fraudster impersonates a payment service user’s PSP. Under Article 59 of the PSR, PSPs will be required to fully reimburse spoofing victims for the full transactions amount, provided the fraud is reported to the police.

Further, PSPs may no longer rely on authentication. The fact that a transaction was authenticated, including through strong customer authentication, accurately recorded and unaffected by technical failure “shall in itself not necessarily be sufficient” to prove authorisation or user fault, and before concluding that a user acted fraudulently or with intent or gross negligence the provider must invite the user to explain the events leading up to the transaction and take that explanation into account. Further, verification of payee becomes mandatory for all credit transfers, with refund of the full amount where the service is not provided or is provided incorrectly; and consumers manipulated by a fraudster using communication channels attributed to their own provider are entitled to a full refund, subject to prompt notification and a police report, with the provider refunding or giving reasons within 15 business days and bearing the burden of proving fraud or gross negligence.

Prudential requirements and own funds

Article 6 of the PSD3 compromise text requires own funds at all times equal to the higher of initial capital and the amount produced by the applicable calculation method. The PSD2 methods survive, but a default method is introduced. Article 7(2) obliges supervisors to prescribe Method B, a sliding scale on monthly payment volume running from 4.0 per cent of the first EUR 5 million down to 0.25 per cent above EUR 250 million. Method A (ten per cent of fixed overheads) and Method C (an income indicator) may be imposed only for models executing few transactions of high individual value. Electronic money issuers shall apply Method D, two per cent of average outstanding electronic money.

The safeguarding requirements, now found in Article 9 of PSD3, are sharpened. Funds still held at the end of the business day following receipt must sit in a separate account with a credit institution or a central bank, or be invested in secure, liquid, low-risk assets. Users’ funds in settlement accounts with designated payment systems now count as safeguarded provided they are not commingled, removing a cost disadvantage for institutions offering instant credit transfers. Institutions must also tell users how their funds are safeguarded, which insolvency law applies and where a claim would be raised, and concentration risk must be avoided. PSPs placing the whole client float with one bank will need to review their safeguarding.

Open banking and data access

The open banking rules move into the PSR and become materially more prescriptive.

Account servicing providers offering online payment accounts must maintain a dedicated interface (API) through which other providers can access account data or initiate payments, meeting recognised technical standards, offering performance on par with the provider’s own customer interface and subject to publicly reported availability statistics.

Users must also be given a dashboard to monitor and withdraw the permissions they have granted, and providers may not create obstacles to data access, while screen scraping is banned. The practical consequence is a publicly reported service-level obligation.

Passporting and cross-border services

For PIs operating in several EU countries, passporting is streamlined. A single authorisation remains valid across the Union for both establishment and services, and Article 30 of PSD3 sets a firmer notification timetable. The compromise text also clarifies two points related to passporting. First, where an institution authorised in one Member State provides services in a second Member State via an establishment in a third Member State, the Member State to be notified is the one where the services are provided to users. Second, the requirement that an institution carry out “part” of its business in its home Member State is clarified to mean less than the majority of its business, so that home authorities may not require most of the business to be conducted there. .

Consumer protection and dispute resolution

The PSR strengthens the complaints procedure for consumers. Providers must operate complaint-handling procedures in every Member State where they offer services and in the local language, and reply to all points raised within 15 business days, with a holding reply and a final answer no later than 35 business days.

Participation in alternative dispute resolution (ADR) becomes mandatory for providers, although consumers cannot be forced into it and retain their right to go to court. Member States must also allow users and consumer associations to complain directly to the competent authority. Sweden starts from a strong position, with the National Board for Consumer Disputes already handling payment disputes, but the requirements are reinforced by harmonised administrative sanctions and daily penalty payments for ongoing breaches.

Practical implications for Swedish PSPs

For Swedish PSPs looking to adapt to the new regulatory environment, there are two main tasks ahead. The first, which concerns payment institutions and e-money institutions specifically, is regulatory mapping to ensure that the institution can show compliance with the new requirements, including the stricter own funds requirements, and preparing the winding-up plan and three-year group application history. E-money institutions will be required to undergo an extensive new authorization process, and should be prepared to produce the documentation necessary to lodge an application once the new rules enter into force.

The second, which applies to all PSPs is adapting the business to the new business conduct requirements and ensuring that the internal governance frameworks and technical solutions are adapted to comply with the strengthened transaction requirements. Framework contracts, consumer terms and outsourcing arrangements need revisiting.

The PSR applies from 21 months after entry into force, and Member States must transpose PSD3 and apply their implementing measures from the same point, when PSD2 and the Electronic Money Directive are repealed. The payee-verification provisions apply only from 27 months after entry into force, and existing payment and electronic money institutions may continue under the current framework until that same point, by which time they must have submitted the information supervisors need to assess compliance. Authorities may exceptionally extend that period by up to three months.

Whereas the payment service package has not yet been finally adopted and published in the Journal of the European Union, PSPs should already start reviewing their business and internal processes, to ensure that they are well prepared for a further harmonized and stricter regulatory environment.