#
Conduct-of-business rules migrate to the directly-applicable PSR, ending divergent national implementation; fraud-prevention overhaul is the PSR centrepiece requiring payee-name verification; new TSP due-diligence duty for SCA outsourcing.
The live safeguarding development concerns where non-bank client money may be held. The Instant Payments Regulation amended PSD2 to introduce an option for non-bank PSPs to safeguard user funds in a central-bank account, exercisable at the discretion of the relevant national central bank; the Eurosystem itself does not provide such safeguarding accounts. This is a discretionary, NCB-level mechanism and must be kept distinct from the October 2025 TARGET settlement-access change covered in W12 — safeguarding concerns the location of client funds, settlement access concerns the rails through which payments clear. The distinction is a non-bank-PI/EMI-specific one and matters because conflating the two overstates what the Eurosystem has committed to provide.
On the evidence that the existing conduct regime works, the EBA/ECB joint 2025 report confirms that strong customer authentication, mandated under PSD2 since 2020, remains effective in reducing fraud, particularly for card payments. This Tier-1 joint supervisory finding supports the continuation of the SCA mandate into the incoming PSR and applies across both bank and non-bank PSPs.
Outlook
The conduct trajectory is escalating but timeline-bound. SCA effectiveness is settled supervisory evidence; the open variables are the PSR's entry into force, which tracks the PSD3/PSR Official Journal publication, and the extent to which national central banks actually exercise the discretionary central-bank safeguarding option. The distinction between safeguarding accounts and settlement access is not fully resolved in the underlying evidence — the definitive position that the Eurosystem will not provide safeguarding accounts rests on a pre-October-2025 source — and warrants monitoring as practice develops.
Conduct, Safeguarding & Financial Promotions
The safeguarding of customer funds held by non-bank payment service providers in the EEA rests on a narrower practical foundation than is sometimes assumed. The European Central Bank's Decision (EU) 2025/222, read together with the European Banking Authority's Q&A 2024_7165, establishes that where a central bank does not offer safeguarding accounts, keeping Article 10(1) funds in a payment-system settlement account after the end of the business day following the day the funds were received cannot, by itself, be considered a safeguarding measure under Article 10(1). In practice, this means Eurosystem settlement accounts cannot be treated as a safeguarding mechanism for funds held beyond the immediate settlement window, and payment institutions must continue to rely on commercial-bank segregated accounts or insurance-based arrangements to meet their safeguarding obligations for funds held longer than overnight.
This constraint becomes more significant when read against the agreed, though not yet adopted, Payment Services Regulation text. The Council's compromise text of 17 April 2026 includes a provision requiring payment institutions to endeavour not to safeguard all payment service users' funds with a single credit institution, addressing concentration risk directly. Because this is agreed but unadopted, it does not yet bind payment institutions, but it signals the direction the regime is moving: away from single-institution concentration and toward a more explicit multi-institution segregation expectation, layered on top of the already-binding constraint that settlement accounts cannot substitute for genuine safeguarding accounts.
A further and distinct safeguarding development concerns deposit-guarantee protection for the funds once they are segregated. Directive (EU) 2026/804, adopted 30 March 2026 and in force from 10 May 2026, inserts a new Article 8b into the Deposit Guarantee Schemes Directive, providing per-client cover for segregated safeguarding accounts, and a new Article 16a, imposing information duties on the banks holding those accounts. National transposition measures giving effect to these provisions generally apply from 11 May 2028, a multi-year runway. The European Banking Authority has opened a consultation, EBA/CP/2026/15, on draft regulatory technical standards under Article 8b(4) addressing client identification for repayment purposes and the technical detail of per-client cover; that consultation closes 23 October 2026 and the resulting standards are proposed to apply from 11 May 2028 alongside the Directive's national transposition.
On the UK side of the EEA-adjacent regulatory landscape, safeguarding reform is proceeding through a separate process. HM Treasury's consultation on modernising UK payment services regulation, published 14 July 2026, closed 6 October 2026, and specifically contemplates moving safeguarding requirements into FCA rules rather than leaving them in standalone legislation. The FCA's own PS25/12 states that it will consider the consultation feedback alongside its review of the effectiveness of the existing Supplementary Regime and whether to progress what it terms the Post-Repeal Regime; the FCA explicitly notes that the timing, nature and feasibility of transitioning to that Post-Repeal Regime remain under consideration, meaning no statutory-trust-based Post-Repeal Regime has been adopted as at this cycle.
Outlook
Three safeguarding workstreams are running in parallel on different timelines: the EU's agreed-but-unadopted PSR concentration provision, pending formal adoption of PSD3/PSR; the Deposit Guarantee Schemes Directive amendments, with technical standards consultation closing 23 October 2026 and national transposition generally due by 11 May 2028; and the UK's own safeguarding modernisation process, with its consultation closed as of 6 October 2026 and no adopted Post-Repeal Regime yet in place. Firms operating safeguarding arrangements across both the EEA and the UK will need to track these as distinct regulatory tracks rather than a single converging reform.
3 earlier distinct update(s)
Conduct, Safeguarding & Financial Promotions
The PSR, the Regulation half of the PSD3/PSR package endorsed by COREPER on 22 April 2026, is reported to bring certain safeguarding-of-funds provisions into effect earlier than the package's general application window. Specifically, requirements around how payment institutions and e-money firms segregate, report on, and audit safeguarded customer funds are reported to take effect from around May 2026, notably ahead of the roughly 21-month general application timeline that applies to the bulk of the PSD3/PSR package following Official Journal publication.
This early-effective-date signal currently rests on a single source at the lower end of the source-tier scale, and has not been corroborated by a primary or higher secondary-tier source this cycle. It should be treated as a provisional operator-relevant signal rather than a confirmed compliance deadline: firms planning safeguarding-compliance workstreams should treat May 2026 as an unconfirmed early marker worth monitoring for corroboration, not as a settled date to build a final compliance programme against.
If the early effective date is confirmed, the practical effect for PSPs and e-money firms operating in the EEA would be a compressed timeline for adapting fund-segregation, reporting and audit processes for safeguarded customer funds, ahead of the rest of the PSD3/PSR conduct-of-business framework taking general effect. This would create a two-stage compliance timeline within the same instrument package, with safeguarding obligations landing before the broader conduct and governance requirements.
Outlook
The key marker is whether a primary or higher-tier secondary source corroborates the reported May 2026 safeguarding effective date before that date arrives; absent corroboration, firms should continue planning primarily against the general ~21-month application window while treating the earlier date as a risk-management contingency.
Conduct, Safeguarding & Financial Promotions
The most structurally significant conduct-of-business development in the new EEA payments framework is the migration of conduct rules out of the third Payment Services Directive and into the directly-applicable Payment Services Regulation. Transparency requirements, fraud-prevention obligations, strong-customer-authentication rules and open-banking access provisions all move into the Regulation rather than remaining in a directive subject to national implementation. This is confirmed with high confidence and is significant because it eliminates the pattern, characteristic of the PSD2 era, in which conduct standards diverged meaningfully across the 30 EEA jurisdictions depending on how faithfully and how quickly each transposed the directive.
Within that migrated conduct rulebook, the fraud-prevention overhaul is described as the centrepiece of the Payment Services Regulation. It reshapes the allocation of liability between payer and payee banks when fraud occurs, and it introduces a requirement for payer banks to verify that a payee name matches the destination account before a transfer is executed. This mechanism is structurally analogous to the United Kingdoms Confirmation of Payee regime, but it is being introduced at the scale of the entire EEA payments market rather than a single national market, which is a materially larger conduct-and-liability shift for cross-border payment service providers than a UK-only comparison might suggest.
A second, more narrowly technical conduct obligation introduced by the Regulation requires payment service providers that outsource strong-customer-authentication functions to technical service providers to conduct thorough due diligence on those providers before outsourcing. This is a new outsourcing-governance duty that did not exist in comparable form under the second Payment Services Directive, and it reflects a broader regulatory pattern of holding regulated firms accountable for the technical-service-provider layer of their authentication stack, not only for their own directly-operated systems.
The safeguarding dimension of this cycles conduct developments is that all of these obligations apply uniformly to the newly merged payment-institution category, meaning firms previously licensed as e-money institutions under a separate conduct regime will need to align their transparency, fraud-prevention, authentication and outsourcing-due-diligence practices with the single Regulation-based standard alongside payment institutions proper, removing a previous source of divergent national conduct expectations between the two categories.
Outlook
The payee-name-verification requirement and the technical-service-provider due-diligence obligation are the two conduct provisions most likely to require concrete operational build-out ahead of the frameworks general application date. Firms should expect the fraud-liability reallocation in particular to be the most closely watched implementation item, given its direct bearing on consumer-facing loss allocation at EEA scale.
Conduct, Safeguarding & Financial Promotions
The Payment Services Regulation shifts fraud liability onto payment service providers: a PSP that fails to implement suitable anti-fraud mechanisms becomes liable for the resulting customer losses, and transactions initiated or altered by a fraudster are treated as unauthorised, placing the full fraudulent amount on the PSP rather than the customer. This is a direct conduct-of-business change with material commercial consequence for any PSP whose current fraud-prevention controls were built to the older, more consumer-liability-tolerant standard; the reallocation effectively makes fraud-control adequacy a balance-sheet question for PSPs rather than solely a customer-redress question.
Alongside the fraud-liability shift, the PSD3/PSR safeguarding regime for e-money institutions tightens materially: EMIs face a stricter T+1 deadline for securing incoming funds, together with new concentration-risk-management rules governing the custodians and hedging instruments EMIs use to protect client money. This safeguarding change is explicitly a non-bank-PI/EMI-facing rule; bank-PSPs, whose deposit-taking model already carries prudential capital and deposit-guarantee-scheme protections that EMIs do not have, are not the direct target of this tightening, which is aimed specifically at closing the structural safeguarding gap between how banks and non-bank EMIs each protect client funds.
The Instant Payments Regulation adds two further conduct-relevant obligations that are now live. First, mandatory free payer-side Verification-of-Payee has applied to euro-area PSPs since 9 October 2025, a Tier-1, high-confidence finding directly sourced to the European Central Bank; non-euro-area EEA Member States face a materially later compliance date of 9 July 2027, meaning the EEA currently operates under two different VoP compliance timelines depending on currency area. Second, and independently of Verification-of-Payee, Instant Payments Regulation Article 5d requires PSPs offering instant credit transfers to verify at least daily whether any payment-service user is subject to targeted financial restrictive measures, a standing sanctions-screening obligation layered on top of, but distinct from, the payee-verification requirement.
Taken together, these four developments, fraud-liability reallocation, tightened EMI safeguarding, live euro-area Verification-of-Payee, and daily instant-payments sanctions screening, represent a coordinated tightening of the conduct-and-safeguarding perimeter around instant and account-to-account payments specifically, rather than a single isolated rule change. The structural effect is to move both fraud risk and screening obligations further toward the PSP itself and away from the customer or from a purely post-hoc enforcement model, while simultaneously narrowing the safeguarding gap between bank-PSPs and non-bank EMIs, without fully closing it, given that EMIs still operate under a segregation-based safeguarding model rather than the deposit-guarantee-scheme model available to banks.
Outlook
The non-euro-area Verification-of-Payee deadline of 9 July 2027 is the next scheduled conduct-and-safeguarding milestone, and the practical question for PSPs in non-euro EEA Member States is whether they build toward that deadline on the same technical rulebook the euro area already uses, given that the European Payments Council Scheme Rulebook already exists and entered into force ahead of the euro-area deadline. For EMIs, the T+1 safeguarding deadline and the new concentration-risk-management rules are the most immediate operational change to plan around, since the safeguarding tightening does not carry a phased or staggered implementation date in the material identified this cycle. Whether the fraud-liability reallocation under the PSR produces a measurable shift in PSP anti-fraud-control investment ahead of general application near 2028 is a further point worth tracking in subsequent cycles.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (4)
- T3openbankingtracker / Crassula PSD3-PSR
- T1ECB (Tier-1)
- T1BaFin (DE NCA, Tier-1)
- T1EBA/ECB joint 2025 payment fraud report (Tier-1)