--- title: "Italy Payments Regulation Monitor | World Payments Monitor" canonical: https://payments.gi/jurisdictions/italy/ source_html: /jurisdictions/italy/index.html description: "Italy payments and e-money regulation: 14 modules, 67 sourced findings, updated 2026-10-26. Licensing, safeguarding, stablecoins, AML/CFT." generated_at: 2026-10-26T19:20:26Z content_sha256: 02a9538bd97cb8cfcd7086b36bc77652268d65c21823c6a646fdcdd17801103f generator: "fe-fleet/md-twin@1.0" --- # Italy IT schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-26 · 14 modules · 67 sourced findings · 136 sources in the cumulative register Download report (PDF) Expand all 14 Modules 2 Moved this cycle 1 Key judgments 2 Open gaps 67 Findings 165 Tier-1 sources Confidence mix 10 confirmed 4 unpopulated (sums to 14 rendered modules; click to filter) 2 modules moved this cycle Law made at European Economic Area level that applies in Italy is covered once, on the [European Economic Area](/jurisdictions/european-economic-area/) page. This page covers Italy’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,200 Full executive summary 414 ###### Latest update · 25 October 2026 #### Lead Signal Italy's AI Act institutional architecture for financial services became settled law this period with the entry into force, on 23 October 2026, of Legislative Decree 179/2026. The decree allocates supervision of high-risk AI systems in banking and financial services to Banca d'Italia, in investment services to CONSOB, and in insurance to IVASS, each operating within its pre-existing sectoral competence, with AgID and ACN designated as the general national AI Act authorities. For payment-sector operators, this resolves a standing question of which authority would oversee AI deployments embedded in payment and banking infrastructure, removing the institutional ambiguity that had attended the AI Act's entry into application. #### Other Developments Banca d'Italia published its 2026 survey of non-supervised Italian fintech operators on 21 October 2026, a primary-source publication examining entities operating outside the regulated financial perimeter. The survey's existence and publication date are confirmed directly from Banca d'Italia's own publications index; its substantive content, including methodology and findings, was not retrieved this period and so cannot yet be characterised in detail. #### Cross-Monitor Connections The AI Act supervisory designation under Legislative Decree 179/2026 connects directly to financial-crime and data-protection oversight of AI-driven payment and banking systems, since the same high-risk AI deployments that now fall under Banca d'Italia's, CONSOB's and IVASS's sectoral AI Act competence will also be subject to the Garante's distinct data-protection scrutiny and to anti-money-laundering supervisory expectations tracked elsewhere. Banca d'Italia's non-supervised fintech survey is likewise relevant to financial-integrity monitoring of entities operating outside the regulated perimeter. #### Outlook The practical operation of the new AI Act supervisory split will become clearer as Banca d'Italia, CONSOB and IVASS begin exercising their designated competence over high-risk AI systems in payments, banking, investment and insurance. Separately, the substantive findings of Banca d'Italia's non-supervised fintech survey, once available, may sharpen the picture of where prudential and conduct gaps persist among payment-adjacent entities operating outside Italy's regulated perimeter. At the EU level, formal adoption of the revised payment services regulatory package (PSD3/PSR), including plenary vote, Council sign-off and Official Journal publication, remains expected by December 2026 and would, once adopted, apply to Italy as an EU Member State. 5 earlier updates not shown here. ###### Standing brief · as of 5 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Italy's payments regulatory perimeter reached a structural inflection point this cycle as two multi-year build-outs closed in parallel: the national transitional regime for pre-existing crypto-asset service providers under MiCA closed on 30 June 2026, having been extended from 30 December 2025 via the Omnibus Decree 95/2025, with eight firms holding full CASP authorisation as of 1 July 2026. Alongside this, Banca d'Italia's 3 February 2026 update to its Disposizioni di vigilanza for payment and e-money institutions transposed DORA, its delegated acts and Directive (EU) 2022/2556, and banned outsourcing of operational functions or critical components tied to payment services and e-money issuance. Layered onto this compliance perimeter, a new MiCAR/PSD2 dual-authorisation regime took effect on 2 March 2026, requiring crypto-asset service providers offering e-money-token transfer or custody services that qualify as payment services to hold both a MiCAR CASP authorisation and a PSD2 payment/e-money institution authorisation (or to partner with an already-authorised PSP), with cumulative capital requirements attached. Taken together, these three developments materially raise the compliance and capital bar for both traditional non-bank payment institutions and crypto-native firms seeking to operate in the Italian market, favouring incumbents and bank-partnership models over independent fintech entrants. The market-structure counterpart to this regulatory tightening is a wave of ownership change atop Italy's payments infrastructure. CVC Capital Partners is reported to be nearing agreement with Nexi Group shareholders on a take-private transaction, reportedly conditional on first spinning out Nexi's politically sensitive digital-banking/interbank-network unit. Separately, Poste Italiane finalised its acquisition of a 49% stake in PagoPA in late 2025, for a disclosed EUR400m upfront plus a further EUR100m contingent on performance, with state entity IPZS retaining the remaining 51%. Both moves point to a market in which incumbent, state-linked or private-equity capital is repositioning around Italy's core payments and processing infrastructure at the same time as the regulatory perimeter tightens. #### Other Developments Banca Sella completed a MiCA Article 60 credit-institution notification to Banca d'Italia on 27 May 2026, becoming Italy's first bank cleared for crypto custody and transfer services, a lighter-touch pathway compared with the full CASP licence required of pure-play crypto firms. Conio, backed by Poste Investimenti and Banca Generali, separately secured full MiCAR CASP authorisation from CONSOB and Banca d'Italia ahead of the transition deadline, covering custody, transfer and placement services. Bancomat announced an agreement in early 2025 to acquire a controlling stake in open-banking fintech FlowPay, signalling scheme-level expansion into open-banking and payment-initiation rails, though the deal value was not publicly disclosed. On the enforcement side, D.Lgs. 208/2025 introduces periodic penalty payments (penalita di mora, new Art.144-ter.1 TUB) that can be levied daily, weekly or monthly until non-compliance ceases, sitting alongside classic pecuniary sanctions. Banca d'Italia has also clarified that most buy-now-pay-later agreements qualify as regulated consumer-credit financing under national banking law when the lender is not the merchant, positioning the market ahead of the EU Consumer Credit Directive II, which enters into force from November 2026. On competition, Italy's own submission to the OECD competition committee shows the merged Nexi/SIA processing entity holding roughly 70-75% of Italian card-processing share and 90-95% of non-SEPA clearing share, with the AGCM having flagged an exclusivity arrangement between Nexi and equensWorldline. The ECB's digital euro pilot preparation phase opened its call for expression of interest on 5 March 2026, with PSP applications due 14 May 2026, selection notified end-June 2026, a development phase beginning Q3 2026, and a 12-month pilot exercise planned for H2 2027. On consumer protection, unauthorised-payment liability under the PSD2-derived regime remains capped at EUR50, but no automatic reimbursement scheme exists for authorised push-payment fraud, leaving victims dependent on bank goodwill, fund recall, Arbitro Bancario Finanziario escalation, or criminal reporting. #### Cross-Monitor Connections Italy's April 2026 FATF Mutual Evaluation Report, carried into this brief via the Sentinel.gi feed, found a mature whole-of-government AML/CFT framework with strong inter-agency coordination, but identified persistent beneficial-ownership transparency gaps and insufficiently dissuasive sanctions for non-disclosure; Italy was placed under regular follow-up with a three-year reform window. This beneficial-ownership finding is a live supervisory-cooperation friction point for cross-border PSP onboarding and KYC in Italy and is flagged to the Financial Intelligence Monitor for original illicit-finance analysis; it is carried here as a structural input to Italy's payments risk profile rather than analysed as an illicit-finance question. #### Outlook The closure of the MiCA transitional window and the DORA transposition together crystallise Italy's regulatory perimeter for both bank and non-bank payment/e-money institutions, setting a higher and more uniform compliance floor heading into the second half of 2026. Watch for confirmation or collapse of the reported CVC/Nexi take-private structure, execution of the required digital-banking-unit spin-out, and further MiCAR CASP authorisations as firms complete the post-transitional-regime shakeout. The ECB's digital-euro pilot selection outcomes, due end-June 2026, and the approach of the November 2026 Consumer Credit Directive II deadline for BNPL providers, are the principal near-term regulatory horizon markers for Italian payment-services strategy. Read full brief · 1200 words ###### Latest update · 25 October 2026 #### Regulatory Status Italy's payments-relevant regulatory position this period centres on two developments. First, Legislative Decree 179/2026, in force since 23 October 2026, settles the AI Act supervisory architecture for financial services, assigning high-risk AI oversight in banking and financial services to Banca d'Italia, in investment services to CONSOB, and in insurance to IVASS, with AgID and ACN as general national AI Act authorities. Second, Banca d'Italia published its 2026 survey of non-supervised Italian fintech entities on 21 October 2026, a primary-source publication whose substantive findings were not retrieved this period. No Italy-specific delta was identified in licensing and market access, conduct and safeguarding, stablecoins and digital money, scheme and network compliance, or payment corridor dynamics within this period's research window. #### Outlook The practical operation of Banca d'Italia's new AI Act supervisory competence, and the substantive findings of its non-supervised fintech survey once retrieved, are the two Italy-specific threads to watch. At the EU level, formal adoption of PSD3/PSR, expected by December 2026, would apply to Italy as a Member State once finalised. 2 earlier updates not shown here. ###### Standing brief · as of 5 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Regulatory Status Italy's payments regulatory perimeter completed two multi-year build-outs this cycle: the national MiCA transitional regime for pre-existing crypto-asset service providers closed on 30 June 2026, with eight firms holding full CASP authorisation as of 1 July 2026, and Banca d'Italia's 3 February 2026 update to its Disposizioni di vigilanza transposed DORA and banned outsourcing of critical payment and e-money functions. Non-bank payment service providers gained direct access to T2 and TIPS on 6 October 2025 under ECB Guideline ECB/2025/28, subject to operational parity with credit institutions and exclusion from Eurosystem credit and central-bank safeguarding accounts. Italy's April 2026 FATF Mutual Evaluation Report, carried via the Sentinel.gi feed, found a mature AML/CFT framework but identified persistent beneficial-ownership transparency gaps, placing Italy under a three-year follow-up window. Market structure is in flux: CVC Capital Partners is reported nearing a take-private approach for Nexi Group, and Poste Italiane finalised a 49% acquisition of PagoPA in late 2025. #### Outlook The closed MiCA transitional window and finalised DORA transposition set a higher compliance floor for both bank and non-bank payment institutions heading into the second half of 2026. Watch for resolution of the reported Nexi take-private structure, further MiCAR CASP authorisations, and Italy's progress against the FATF beneficial-ownership follow-up window. Read full brief · 414 words × 14 of 14 modules Signal Moved Judgment Gap Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### W1aLicensing, Authorisation & Market Access1 gapConfirmedconfirmed 2026-07-04▾# Italy runs a dual bank-PSP / non-bank licensing regime under the Testo Unico Bancario (TUB, D.Lgs. 385/1993) and the PSD2-transposing D.Lgs. 11/2010, supervised by Banca d'Italia. Payment institutions (IP) and e-money institutions (IMEL) are authorised and registered by Banca d'Italia under the Disposizioni di vigilanza per gli IP e IMEL, most recently updated 3 February 2026 to align with DORA. Capital thresholds are tiered by service type, and a new MiCAR/PSD2 dual-authorisation regime for crypto-asset service providers offering payment-like EMT services took effect 2 March 2026. Open gap — wpm-int-1 No Italy-specific EMI/PI licensing, stablecoin/digital-money, scheme/network compliance, or payment-corridor delta was located within this cycle's search window. Structurally absent rather than a research gap; noted per methodology's bias-correction guardrail for Gibraltar/Crown Dependency coverage. Horizon · 2026-Q4 (± six months) PSD3/PSR formal adoption pending Consultation · Tier 3 source Standing sub-brief · as of 5 July 2026 211 words · last cycle 2026-09-28 #### Licensing, Authorisation & Market Access Banca d'Italia supervises Italy's dual bank-PSP and non-bank payment-institution licensing regime under the TUB and D.Lgs. 11/2010, with capital requirements tiered by service scope: EUR125,000 for full-scope payment institutions offering services 1-5 under Art.1(2)(h-septies.1) TUB, EUR20,000 for money-remittance-only payment institutions, and EUR50,000 for payment-initiation-service providers. These thresholds set the capital-entry cost for any operator seeking an Italian PI or e-money institution licence and directly shape market-access economics for new entrants and PIS-only fintechs. From 2 March 2026, a new MiCAR/PSD2 dual-authorisation regime requires crypto-asset service providers offering e-money-token transfer or custody services that qualify as payment services to hold both a MiCAR CASP authorisation and a PSD2 payment/e-money institution authorisation, or to partner with an already-authorised payment service provider, with cumulative capital requirements applying across both regimes. The requirement materially raises the compliance and capital bar for crypto-native firms wanting to offer payment-like e-money-token services in Italy, favouring bank-partnership or dual-licence structuring over stand-alone crypto entry. #### Outlook With the capital-threshold architecture and the new crypto dual-authorisation regime both now in force, the near-term licensing question for Italy is less about further rule-making and more about how quickly crypto-native applicants absorb the cumulative capital burden, and whether bank-partnership models displace independent CASP-only entry into payment-like e-money-token services. Read full sub-brief · 211 words Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access The Council of the EU's 23 April 2026 'I' Item Note carried final compromise texts for the PSD3 Directive and the PSR (Payment Services Regulation), inviting COREPER approval as the next procedural milestone on the path toward formal adoption. This is a pre-adoption legislative development, not yet in force, but it is a materially advanced stage relative to earlier points in the legislative process: an 'I' Item Note with final compromise texts signals that political agreement on the substance has been reached and the remaining steps are procedural confirmation rather than substantive renegotiation. For Italy's payment-institution and e-money-institution licensing landscape specifically, the significance of PSD3/PSR lies in its consolidation of the current separate EMI (e-money institution) and PI (payment institution) authorisation tracks into a single-licensing regime. Once in force, this would change the authorisation pathway for Italian payment and e-money firms, though the practical mechanics of how Italy's own competent authority would administer that consolidated regime were not detailed in the sources reviewed this cycle, and the regime itself remains pending formal adoption. The distinction between bank and non-bank payment-service provision remains structurally relevant to how this licensing consolidation will apply in practice. A single EMI/PI licensing regime under PSD3/PSR would primarily affect non-bank payment institutions and e-money institutions, since banks already operate under a separate prudential authorisation track; the consolidation is therefore principally a non-bank-PI/EMI development rather than one that changes bank-sector licensing directly. #### Outlook Formal adoption of PSD3/PSR is expected as scheduled toward Q4 2026, subject to COREPER approval and any subsequent procedural steps in the EU legislative process; until formal adoption occurs, Italy's current separate EMI/PI authorisation tracks remain unchanged. The pace of COREPER approval following the 23 April 2026 'I' Item Note is the concrete near-term signal to watch for confirmation that the single-licensing regime is proceeding on the currently expected timeline. Evidence 5 Sources and findings (5) - T1[https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/istituti-pagamento/index.html](https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/istituti-pagamento/index.html)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/disposizioni/disp-ip-20120620/index.html](https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/disposizioni/disp-ip-20120620/index.html)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/vigilanza/business-in-italia/attivita-istituto-imel/index.html](https://www.bancaditalia.it/compiti/vigilanza/business-in-italia/attivita-istituto-imel/index.html) - T3[https://en.spaziocrypto.com/regulation/mica-bank-crypto-custody-europe-explained/](https://en.spaziocrypto.com/regulation/mica-bank-crypto-custody-europe-explained/)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/imel/index.html](https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/imel/index.html)retrieved 2026-07-04 ### W1bConduct, Safeguarding & PromotionsConfirmedconfirmed 2026-07-04▾# Safeguarding for Italian IPs/IMELs that also conduct non-payment business is achieved via a mandatory ring-fenced 'patrimonio destinato' under Art.114-terdecies TUB. Conduct and transparency supervision sits with Banca d'Italia under the TUB's transparency and fairness provisions, with the Banking and Financial Ombudsman (ABF) providing low-cost alternative dispute resolution since 2009. A December 2025 reform (D.Lgs. 208/2025) strengthens Banca d'Italia's enforcement toolkit, including new periodic penalty payments. Horizon · 2025-10-09 (± a quarter) Verification of Payee mandatory eurozone-wide (SEPA Instant) In force · Tier 4 source Standing sub-brief · as of 5 July 2026 123 words · last cycle 2026-09-04 #### Conduct, Safeguarding & Financial Promotions Hybrid-commercial payment and e-money institutions that combine payment services with other, non-payment business lines must constitute a single ring-fenced asset pool -- the patrimonio destinato under Art.114-terdecies TUB -- dedicated exclusively to payment services and e-money issuance. The regime governs customer-fund protection design for any non-bank PI or IMEL diversifying beyond pure payment services, a recurring structuring question for fintech and telco hybrids operating in the Italian market. #### Outlook The ring-fencing regime is a single-T1-anchor finding this cycle and remains a standing structural feature of Italian conduct regulation rather than a live rule-change; watch for a second corroborating anchor before the confidence rating is upgraded, and for any read-across from the D.Lgs. 208/2025 enforcement reform into safeguarding-breach penalties. Read full sub-brief · 123 words Periodic update · new data 2026-09-08 #### Conduct, Safeguarding & Financial Promotions Verification of Payee, the mandatory IBAN/name-match check for SEPA Instant transfers, became mandatory eurozone-wide from 9 October 2025 under the EU Instant Payments Regulation, and this obligation ran ahead of the broader PSD3/PSR name-match requirement for ordinary SEPA credit transfers. This is a Probable-confidence finding, drawn from a Tier-4 secondary source, and it sits squarely within the conduct and anti-fraud dimension of payments regulation: PSPs must now verify that the payee name matches the account holder before an instant transfer completes, a control specifically aimed at reducing authorised-push-payment fraud vectors that arise when a payer is misled into transferring funds to the wrong or a fraudulent account. This obligation applies to both bank and non-bank PSPs offering SCT Inst services in Italy, and it is structurally significant because it establishes a name-matching conduct standard ahead of the wider PSD3/PSR framework, meaning Italian PSPs handling instant transfers were required to build this capability on an accelerated timeline relative to institutions handling only ordinary SEPA transfers. The obligation is directly tied to the parallel Instant Credit Transfer mandate under Regulation (EU) 2024/886, live since 9 January 2025, which requires PSPs to offer and receive instant transfers at parity with standard transfers; the two obligations together form the practical conduct backbone of Italy's instant-payments rollout. No Italy-specific enforcement action or supervisory finding regarding Verification of Payee compliance was surfaced this cycle; the finding is limited to the confirmation of the obligation's applicability and timing. #### Outlook Watch for whether Banca d'Italia or the relevant conduct supervisor publishes any compliance data on Verification of Payee implementation rates among Italian PSPs, and for the broader PSD3/PSR name-match extension to ordinary SEPA transfers, which would bring non-instant transfers under the same conduct standard. Evidence 5 Sources and findings (5) - T1[https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/istituti-pagamento/faq-istituti-pagamento/index.html](https://www.bancaditalia.it/compiti/vigilanza/accesso-mercato/istituti-pagamento/faq-istituti-pagamento/index.html)retrieved 2026-07-04 - T1[https://www.arbitrobancariofinanziario.it/abf/index.html](https://www.arbitrobancariofinanziario.it/abf/index.html) - T3[https://www.diritto.it/dlgs-208-2025-novita-per-banche-e-vigilanza/](https://www.diritto.it/dlgs-208-2025-novita-per-banche-e-vigilanza/)retrieved 2026-07-04 - T1[https://economiapertutti.bancaditalia.it/aree-tematiche/diritti-e-tutele/arbitro-bancario-finanziario/index.html](https://economiapertutti.bancaditalia.it/aree-tematiche/diritti-e-tutele/arbitro-bancario-finanziario/index.html) - T1[https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/disposizioni/disp-ip-20120620/index.html](https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/disposizioni/disp-ip-20120620/index.html)retrieved 2026-07-04 ### W2Stablecoins & Digital MoneyConfirmedconfirmed 2026-07-04▾# Italy implements MiCA via D.Lgs. 129/2024, splitting supervision between CONSOB (lead NCA for CASP Title V authorisation) and Banca d'Italia (EMT/ART issuer authorisation under Title III and AML supervision). Italy's national MiCA transitional regime for pre-existing VASPs closed 30 June 2026 (extended from an original 30 December 2025 deadline via the Omnibus Law Decree 95/2025). By 1 July 2026 eight Italian firms held full CASP authorisation and Banca Sella became the first Italian bank to notify for crypto custody/transfer services. Standing sub-brief · as of 5 July 2026 153 words · last cycle 2026-07-04 #### Stablecoins & Digital Money Italy's national transitional regime for pre-existing virtual-asset service providers under MiCA closed on 30 June 2026, having been extended from an original 30 December 2025 deadline via the Omnibus Decree 95/2025; eight firms held full CASP authorisation as of 1 July 2026, formally closing the transitional-entry window and crystallising the competitive set of regulated Italian crypto-asset service providers. Separately, Banca Sella completed its MiCA Article 60 credit-institution notification to Banca d'Italia on 27 May 2026, becoming Italy's first bank cleared for crypto custody and transfer services, a lighter-touch notification pathway distinct from the full CASP licence pure-play crypto firms require. #### Outlook With the transitional regime now closed, expect the competitive field to consolidate around the eight authorised CASPs and an expanding cohort of bank-notification entrants following Banca Sella's lead; the closed transitional window forecloses further transitional-regime entry, making full CASP authorisation or bank-partnership the only remaining routes to market. Read full sub-brief · 153 words no periodic updates on record for this sub-brief Evidence 5 Sources and findings (5) - T1[https://www.esma.europa.eu/sites/default/files/2024-12/List_of_Competent_Authorities_notified_to_ESMA_under_MiCA.pdf](https://www.esma.europa.eu/sites/default/files/2024-12/List_of_Competent_Authorities_notified_to_ESMA_under_MiCA.pdf) Applies beyond this jurisdiction (EU)retrieved 2026-07-04 - T3[https://bebeez.eu/2026/07/01/eight-italian-firms-receive-the-micar-authorization-from-consob-and-banca-ditalia-to-operate-as-crypto-asset-service-providers/](https://bebeez.eu/2026/07/01/eight-italian-firms-receive-the-micar-authorization-from-consob-and-banca-ditalia-to-operate-as-crypto-asset-service-providers/)retrieved 2026-07-04 - T3[https://en.spaziocrypto.com/banks/banca-sella-italys-first-bank-cleared-crypto-mica/](https://en.spaziocrypto.com/banks/banca-sella-italys-first-bank-cleared-crypto-mica/)retrieved 2026-07-04 - T3[https://coinlaw.io/banca-sella-mica-approval-crypto-italy/](https://coinlaw.io/banca-sella-mica-approval-crypto-italy/)retrieved 2026-07-04 - T3[https://en.spaziocrypto.com/regulation/consob-casp-mica-italy-crypto-deadline-april-2026/](https://en.spaziocrypto.com/regulation/consob-casp-mica-italy-crypto-deadline-april-2026/)retrieved 2026-07-04 ### W3Operational Resilience & Critical Infrastructuremoved1 judgment1 gapConfirmedconfirmed 2026-07-04▾# Italy's operational-resilience regime for payment/e-money institutions is anchored in the Disposizioni di vigilanza per gli IP e IMEL, updated by Banca d'Italia's 3 February 2026 provvedimento to transpose DORA, its delegated acts, and the PSD2-amending Directive (EU) 2022/2556. Incident reporting to Banca d'Italia is mandatory for banks, IPs and IMELs, and the TIBER-IT framework (jointly adopted by Banca d'Italia, CONSOB and IVASS) supports voluntary advanced cyber-resilience testing. Movement — NEW D.Lgs. 179/2026 AI Act financial-sector supervisory designation, in force 23 October 2026 New primary instrument fixing AI Act supervisory architecture for Italy's financial sector. Key judgment — Probable · impact ELEVATED Italy's AI Act supervisory architecture for financial services is now settled in law (D.Lgs. 179/2026), reducing institutional ambiguity for payment-sector high-risk AI deployments overseen by Banca d'Italia. claims: wpm-2026-W43-001 Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/italy/) Open gap — wpm-int-2 Full text of D.Lgs. 179/2026 was not directly retrieved this cycle; reliant on two secondary T3 summaries. Structurally absent for this jurisdiction; flagged only to satisfy the standing bias-correction checklist. Standing sub-brief · as of 5 July 2026 113 words · last cycle 2026-10-25 #### Operational Resilience & Critical Infrastructure Banca d'Italia's 3 February 2026 update to its Disposizioni di vigilanza per gli IP e IMEL transposes DORA, its delegated acts, and Directive (EU) 2022/2556, and bans outsourcing of operational functions or critical components tied to payment services and e-money issuance. The critical-outsourcing ban forces payment and e-money institutions relying on group or third-party technology or banking-as-a-service providers to re-architect vendor arrangements ahead of DORA supervisory review. #### Outlook Expect Banca d'Italia's DORA supervisory review to test the practical boundaries of the critical-outsourcing ban over the coming cycles, particularly for institutions built on group-provided or white-label technology stacks that may now fall within the banned category of critical components. Read full sub-brief · 113 words Periodic update · new data 2026-10-25 #### Operational Resilience & Critical Infrastructure Legislative Decree 179/2026 entered into force on 23 October 2026, fixing Italy's institutional allocation of AI Act supervisory responsibility in a manner directly relevant to payment-sector operational resilience. Article 5 of the decree, as reported, assigns to Banca d'Italia supervision of high-risk AI systems used in banking and financial services within its own competence; the decree separately assigns investment-services AI oversight to CONSOB and insurance-sector AI oversight to IVASS. AgID and ACN are designated as the general national authorities for AI Act purposes outside these sectoral competences. For payment service providers and banks deploying AI in credit-risk, fraud-detection, transaction-monitoring or customer-facing systems, this decree answers the previously open question of which Italian authority holds AI Act supervisory jurisdiction over those systems: Banca d'Italia, acting within its existing financial-sector competence rather than through a newly created AI-specific body. The decree's full text has not been independently retrieved this period; the account here rests on two consistent secondary press reports describing its substantive allocation of authority. No transitional provisions, compliance deadlines, or enforcement mechanisms tied to this allocation were identified in the sources available. The decree represents a structural clarification of institutional architecture rather than a new substantive obligation on payment-sector operators; existing high-risk AI systems in banking and financial services now have a clearly designated supervisor rather than facing ambiguity as to which body would assert AI Act jurisdiction. #### Outlook As Banca d'Italia begins exercising its designated AI Act supervisory competence over high-risk AI systems in banking and financial services, payment-sector operators deploying AI in these systems should expect that oversight to be exercised through Banca d'Italia's existing supervisory channels rather than a separate AI-specific process. Confirmation of the decree's precise text, including any transitional timelines, remains an open item for the period ahead. 1 earlier distinct update(s) Periodic update · new data 2026-10-05 #### Operational Resilience & Critical Infrastructure Revolut disclosed a confirmed data breach around 12 September 2026 that exploited the European Investigation Order mechanism under the EU e-Evidence Regulation, a mechanism that became operative on 18 August 2026, via a spoofed institutional PEC mailbox. Funds and core systems were not affected; the breach was limited to customer personal data. Because Revolut serves Italian customers without being an Italian-chartered institution, the incident's resilience implications extended beyond the firm itself into a sector-wide Italian regulatory response. The Garante per la protezione dei dati personali opened an immediate review of Italian banks' access-security controls between 16 and 18 September 2026, writing directly to bank data protection officers to request checks for anomalous communications originating from the compromised PEC address used in the Revolut incident. This review represents a direct engagement with bank access-security controls prompted by a non-bank payment-service-provider incident, illustrating how an operational-resilience event at one type of payments entity can generate supervisory attention toward a different, interconnected part of the payments ecosystem. The review produced a further public update on 30 September 2026 and remained open as of that date, with no published outcome identified. Cross-border supervisory coordination followed directly from the incident: the Garante contacted Lithuania's data protection authority, which holds lead-supervisory-authority status for Revolut, to exchange information, and separately approached Italy's Ministry of Interior to establish whether other financial institutions in Italy had been targeted by the same spoofed-PEC technique. This coordination reach, spanning both a cross-border regulatory counterpart and a domestic security-focused ministry, indicates the review's scope extends beyond a single-institution incident response toward an assessment of whether the underlying technique poses a broader sector risk. #### Outlook The principal item to watch is the outcome of the Garante's bank-security review, not yet published as of this cycle. A finding that other Italian financial institutions were targeted using the same spoofed-PEC technique would extend the operational-resilience implications from a single-firm incident to a sector-wide access-security question, with potential bearing on resilience expectations for Italian banks and payment service providers more broadly. Evidence 4 Sources and findings (4) - T3[https://www.ipsoa.it/documents/quotidiano/2026/02/19/banca-italia-aggiornate-regole-ip-imel-luce-dora](https://www.ipsoa.it/documents/quotidiano/2026/02/19/banca-italia-aggiornate-regole-ip-imel-luce-dora)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html](https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html) - T1[https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html](https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html) - T1[https://www.bancaditalia.it/compiti/sispaga-mercati/normativa-sorveglianza/index.html](https://www.bancaditalia.it/compiti/sispaga-mercati/normativa-sorveglianza/index.html)retrieved 2026-07-04 ### W4Scheme & Network ComplianceProbableconfirmed 2026-07-04▾# Italy operates fully within SEPA/SCT Inst and the EU Instant Payments Regulation (Reg. (EU) 2024/886); Banca d'Italia operates TIPS and Verification of Payee became mandatory eurozone-wide from 9 October 2025. Horizon · 2025-01-09 (± a quarter) Instant Credit Transfer PSP obligations under IPR In force · Tier 1 source Horizon · 2025-01-09 (± a quarter) Instant Credit Transfer PSP obligations under IPR In force · Tier 1 source Standing sub-brief · as of 5 July 2026 102 words · last cycle 2026-09-04 #### Scheme & Network Compliance Italy's own submission to the OECD competition committee shows the merged Nexi/SIA processing entity holding roughly 70-75% of Italian card-processing share and 90-95% of non-SEPA clearing share, following the 2021 Nexi/SIA merger; the AGCM has flagged an exclusivity arrangement between Nexi and equensWorldline as a live competition-policy concern. The near-monopoly processing and clearing concentration is a standing scheme-access risk factor for competing acquirers. #### Outlook Watch the AGCM's handling of the flagged Nexi/equensWorldline exclusivity arrangement for signs of a formal competition inquiry, which would be the first material test of Italy's post-merger processing concentration since the 2021 Nexi/SIA combination. Read full sub-brief · 102 words Periodic update · new data 2026-09-08 #### Scheme & Network Compliance Italy's scheme and network compliance picture this cycle is anchored in the full operationalisation of the EU Instant Payments Regulation. Instant Credit Transfer obligations under Regulation (EU) 2024/886 have applied to Italian PSPs since 9 January 2025, a Confirmed-confidence finding drawn from a Tier-1 Banca d'Italia primary source, requiring Italian payment service providers to offer and receive instant credit transfers at parity with regular transfers rather than as an optional premium service. The practical effect of this mandate against Italy's payments history is considerable. Instant payments made up just 1.2% of 2023 transaction volume despite the scheme having been available in Italy since 2017, a Probable-confidence, Tier-3-sourced finding reflecting Italy's persistently strong cash preference relative to other EU markets. The Instant Payments Regulation removes optionality from this equation: with the mandate now structurally binding on both bank and non-bank PSPs, Italy's historically low adoption share is expected to close through regulatory compulsion rather than organic market development, a Probable-confidence key judgment supported directly by the mandate and the adoption-gap finding together. This scheme-compliance shift sits alongside, but is distinct from, the correspondent-settlement reachability requirements addressed under W12; the W4 finding here is specifically about the PSP-facing obligation to offer instant transfers at parity, while the settlement-infrastructure mechanics by which those transfers clear sit under the correspondent-banking module. #### Outlook The primary watch item is whether updated adoption-share data emerges showing the extent to which the mandate has closed Italy's historical 1.2% instant-payments adoption gap. Any divergence between mandate compliance (offering the service) and genuine usage uptake (customers choosing instant transfers) would be a material signal for the scheme-compliance trajectory going into the next cycle. Evidence 4 Sources and findings (4) - T2[https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf](https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-07-04 - T3[https://interchangefeeseu.com/countries/interchange-fees-in-italy](https://interchangefeeseu.com/countries/interchange-fees-in-italy)retrieved 2026-07-04 - T3[https://developer.nexi.it/en/servizio-ecommerce/](https://developer.nexi.it/en/servizio-ecommerce/)retrieved 2026-07-04 - T2[https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf](https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-07-04 ### W5Payment Corridor DynamicsConfirmedconfirmed 2026-07-04▾# Italy's domestic instant-payments rail runs on Banca d'Italia-operated TIPS settlement (Eurosystem) with Bancomat as the leading domestic scheme, cross-border-interoperable with Spain's Bizum and Portugal's SIBS via EuroPA; the EU Instant Payments Regulation is now fully binding on Italian PSPs (receive from Jan 2025, send from Oct 2025), with first mandatory PSP reporting due April 2026. Horizon · 2025-10-01 (± a quarter) SEPA Instant send mandatory milestone (October 2025) fully bedded in In force · Tier 3 source Horizon · 2026-04 (± a quarter) First mandatory PSP reporting on IPR compliance In force · Tier 3 source Standing sub-brief · as of 5 July 2026 96 words · last cycle 2026-09-28 #### Payment Corridor Dynamics Banca d'Italia is the sole developer and operator of TIPS, the TARGET Instant Payment Settlement service, on the Eurosystem's behalf as one of the four providing central banks; payment service providers reachable for SCT Inst within T2 must also be reachable in TIPS. This structural infrastructure role and the associated reachability obligations shape instant-payment corridor design for all Italian payment service providers. #### Outlook TIPS reachability mandates remain a stable, mandated feature of Italy's instant-payment architecture; no material change to Banca d'Italia's 4CB role or the SCT Inst/TIPS reachability linkage was identified this cycle. Read full sub-brief · 96 words Periodic update · new data 2026-09-28 #### Payment Corridor Dynamics Italy's domestic instant-payments infrastructure runs on TIPS (TARGET Instant Payment Settlement), the Eurosystem's 24/7 central-bank-money settlement layer that underpins SCT Inst instant euro transfers. Banca d'Italia's participation in TIPS provides the settlement backbone against which Italian payment service providers' instant-transfer obligations under the EU Instant Payments Regulation (IPR) actually clear, making TIPS the structural foundation for Italy's instant-payments corridor rather than a peripheral piece of infrastructure. On the compliance-deadline dimension of this corridor, Italian PSPs have been required to receive instant euro transfers under the IPR since January 2025 and to send them since October 2025. Both obligations are now fully in force rather than forward developments, and the compliance clock has moved to the reporting dimension: the first mandatory PSP reporting on IPR compliance, covering service availability, adoption rates and compliance, is due in April 2026. This reporting deadline is the next concrete checkpoint in the corridor's compliance timeline for Italian PSPs. A separate and less well-corroborated development concerns retail payment-scheme interoperability: Bancomat, Italy's domestic card and payment scheme, is reported to be cross-border interoperable with Spain's Bizum and Portugal's SIBS schemes via the EuroPA initiative. This finding rests on a single, lower-tier source this cycle and was not independently corroborated; it should be read as a reported development rather than a confirmed structural fact of Italy's payment-corridor landscape at this time. #### Outlook The April 2026 first-mandatory-reporting deadline under the IPR is the concrete near-term item to watch for Italy's instant-payments corridor; the resulting reporting data, once published, would give the clearest indication yet of actual IPR adoption and compliance levels among Italian PSPs. The Bancomat/Bizum/SIBS interoperability claim via EuroPA would benefit from independent corroboration in a future cycle before being treated as an established corridor feature. 1 earlier distinct update(s) Periodic update · new data 2026-09-14 #### Payment Corridor Dynamics Italy's payment-corridor landscape this cycle is defined by the full phase-in of Regulation (EU) 2024/886, the EU Instant Payments Regulation. This regulation obliges all eurozone payment service providers, a category that includes Italian banks and payment institutions operating under Banca d'Italia's supervision, to be able to receive real-time SEPA Instant Credit Transfers from January 2025 and to send them from October 2025. Fee parity between instant transfers and standard SEPA credit transfers is written directly into the regulation, meaning Italian PSPs cannot charge a premium for the instant-settlement service relative to standard non-instant transfers. With the October 2025 send-side deadline now in the past, the regulation's core mandate is fully in force for the Italian market as of this cycle. The settlement infrastructure underlying this mandate runs through Banca d'Italia, which manages the TARGET Instant Payment Settlement, or TIPS, platform for the Eurosystem. TIPS was developed jointly with three other national central banks, reflecting the pan-European, rather than purely domestic, character of the settlement rail that now underpins Italy's instant-payments capability. This infrastructure detail is a first-collection baseline finding for Italy under this monitor, corroborated at Probable confidence this cycle. Taken together, the compliance-deadline finding and the settlement-infrastructure finding describe a corridor that has moved from regulatory design to operative reality within the past year: Italian payment service providers are now operating under a live, binding instant-payments mandate with an established Eurosystem settlement backbone, rather than a forthcoming or partially-implemented requirement. #### Outlook With both the receive-side and send-side compliance deadlines now in the past, the payment-corridor question for Italy shifts from regulatory phase-in toward practical adoption and enforcement depth: watch for indications of how consistently Italian PSPs are applying the mandated fee parity in practice, and for any signal of transaction-volume growth on the TIPS settlement rail as the instant-payments mandate matures from a compliance requirement into standard market infrastructure. Evidence 5 Sources and findings (5) - T1[https://www.bancaditalia.it/compiti/sistema-pagamenti/pagamenti-tips/index.html](https://www.bancaditalia.it/compiti/sistema-pagamenti/pagamenti-tips/index.html) - T3[https://www.lightspark.com/knowledge/instant-payments-italy](https://www.lightspark.com/knowledge/instant-payments-italy)retrieved 2026-07-04 - T3[https://en.wikipedia.org/wiki/TARGET2](https://en.wikipedia.org/wiki/TARGET2)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/sispaga-mercati/comitato-pagamenti-italia/bonifici-istantanei/index.html](https://www.bancaditalia.it/compiti/sispaga-mercati/comitato-pagamenti-italia/bonifici-istantanei/index.html) Applies beyond this jurisdiction (EU) - T3[https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/](https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/)retrieved 2026-07-04 ### W6Industry Structure & CommercialmovedProbableconfirmed 2026-07-04▾# Nexi is Italy's dominant payments group, holding roughly 70% of domestic payment-processing volumes and generating around 55% of its group revenue from Italy, but is under active commercial pressure from Italian bank-sector consolidation (BPER/Banca Popolare di Sondrio, MPS/Mediobanca mergers eroding its merchant book) and a reported CVC Capital Partners take-private approach in 2026. Poste Italiane's 49% acquisition of PagoPA (finalised late 2025, ~EUR500m) marks a significant state-linked market-structure shift in public-sector digital payments infrastructure. Movement — NEW Banca d'Italia 2026 Fintech survey of non-supervised entities, published 21 October 2026 New T1 publication mapping non-supervised fintech activity outside the licensed perimeter. Standing sub-brief · as of 5 July 2026 163 words · last cycle 2026-10-25 #### Industry Structure & Commercial Dynamics CVC Capital Partners is reported to be nearing agreement with Nexi Group shareholders on a take-private transaction, reportedly conditional on first spinning out Nexi's politically sensitive digital-banking/interbank-network unit. A successful take-private would be the single largest market-structure event in Italian payments this cycle, reshaping scheme and processing ownership and raising the possibility of a separate re-listing of the interbank-network unit. Separately, Poste Italiane finalised acquisition of a 49% stake in PagoPA in late 2025 for a disclosed EUR400m upfront plus EUR100m contingent on performance, with state entity IPZS retaining the remaining 51%. The state-linked consolidation of public-sector payments infrastructure, which processed EUR97bn in 2025, under a commercial postal operator is a significant market-structure shift with implications for competitive neutrality. #### Outlook Watch for confirmation or collapse of the reported CVC take-private structure and execution of the required digital-banking-unit spin-out; the Poste/PagoPA integration will be a useful marker of how state-linked consolidation interacts with competitive-neutrality expectations for public-sector payments infrastructure. Read full sub-brief · 163 words Periodic update · new data 2026-10-25 #### Industry Structure & Commercial Dynamics Banca d'Italia published its 2026 Fintech survey of non-supervised Italian entities on 21 October 2026, under its Research and analysis publication series. This is a primary-source Banca d'Italia publication, confirmed directly from the institution's own publications index, examining entities that operate in the Italian fintech space outside the regulated financial perimeter. The survey's publication is itself a signal of continued central-bank attention to the structure and scale of unregulated or lightly-regulated fintech activity in Italy, a segment whose boundaries and risk profile are of ongoing interest to industry-structure analysis. The substantive content of the survey -- its methodology, the population of non-supervised entities covered, and its specific findings -- was not retrieved within this period's research window, so no characterisation of its conclusions can yet be offered. What is confirmed is the fact and date of publication, which positions this survey as a reference point for subsequent industry-structure analysis of Italy's fintech sector once its findings become available for review. #### Outlook Retrieval and review of the survey's substantive findings would be the natural next step in characterising how Banca d'Italia maps the non-supervised fintech population and what industry-structure or commercial-dynamics implications it draws. Until that content is available, the development stands as a confirmed publication event without yet-assessable substantive conclusions. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Industry Structure & Commercial Dynamics The European Central Bank has approved UniCredit's acquisition of control over Commerzbank, a change-in-control clearance that removes the regulatory cap previously limiting UniCredit's shareholding to below 30%. The clearance follows a 45 billion euro offer that secured approximately 48% of Commerzbank's outstanding shares. This is the most material industry-structure development for an Italian banking and payments group this cycle, and it represents a significant consolidation event in European cross-border banking: UniCredit, Italy's largest banking group and a major payment-services provider, is now positioned to exercise control over Commerzbank, one of Germany's largest banks. The regulatory review was conducted under the European Central Bank's change-in-control framework and the clearance status is reported as cleared as of 16 October 2026. For payment-services analysis specifically, this consolidation has structural implications beyond the banking-sector headline: a combined UniCredit-Commerzbank entity would operate payment infrastructure, correspondent banking relationships, and payment-institution subsidiaries across both the Italian and German markets, with potential effects on competitive dynamics in merchant acquiring, cross-border payment corridors, and correspondent access for smaller institutions that currently rely on either bank as a sponsor or correspondent. No specific integration timeline, payment-infrastructure consolidation plan, or effect on existing payment-services subsidiaries of either bank has been confirmed this cycle; the clearance is a necessary precondition for such integration steps rather than a confirmation that they have begun. Separately, and at a much smaller scale, Milan-based fintech Computis raised approximately 2.25 million US dollars in a pre-seed funding round focused initially on Italian small and medium enterprises. This is an early-stage domestic funding event with limited standalone significance, but it is one data point suggesting continued investor interest in Italy's SME-focused fintech segment even as larger banking-sector consolidation dominates the structural narrative this cycle. #### Outlook The UniCredit-Commerzbank transaction now moves from regulatory clearance toward integration; the key items to watch are whether UniCredit proceeds toward full ownership beyond its current approximately 48% stake, how payment-services and correspondent-banking functions across the two institutions are rationalised, and whether German or Italian supervisors issue further commentary on competitive effects in either domestic payments market. Computis's pre-seed round is too early to indicate a broader trend; watch for whether it attracts a larger follow-on round or additional Italian SME-fintech funding activity in coming cycles. Evidence 5 Sources and findings (5) - T4[https://capitalblueprint.substack.com/p/nexi-spa-in-depth-financial-analysis](https://capitalblueprint.substack.com/p/nexi-spa-in-depth-financial-analysis)retrieved 2026-07-04 - T3[https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/](https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/)retrieved 2026-07-04 - T3[https://www.ainvest.com/news/italy-pagopa-acquisition-implications-digital-payments-2512/](https://www.ainvest.com/news/italy-pagopa-acquisition-implications-digital-payments-2512/)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/stabilita-finanziaria/politica-macroprudenziale/2025.11.14-o-sii/index.html](https://www.bancaditalia.it/compiti/stabilita-finanziaria/politica-macroprudenziale/2025.11.14-o-sii/index.html) - T4[https://dwaynegefferie.substack.com/p/deconstructing-nexi-can-europes-consolidation](https://dwaynegefferie.substack.com/p/deconstructing-nexi-can-europes-consolidation)retrieved 2026-07-04 ### W7Legal & LitigationConfirmedconfirmed 2026-07-04▾# Banca d'Italia continues to issue administrative sanctions against payment/e-money institutions and banks (e.g. Moneynet Spa, Smart Bank Spa), and D.Lgs. 208/2025 (effective 2026) materially strengthens enforcement by introducing periodic 'penalita di mora' penalty payments alongside classic pecuniary sanctions. AGCM competition review of the Nexi/SIA merger (2021) continues to shape scheme-access litigation risk, and Banca d'Italia's supervisory interpretation reclassifying most BNPL products as regulated consumer credit is reshaping compliance exposure for BNPL providers. Horizon · 2026-11-01 (± a quarter) EU Consumer Credit Directive II enters into force, tightening BNPL exemption thresholds Adopted, not yet in force · Tier 3 source Standing sub-brief · as of 5 July 2026 144 words · last cycle 2026-07-04 #### Legal & Litigation D.Lgs. 208/2025 introduces periodic penalty payments -- penalita di mora, under new Art.144-ter.1 TUB -- leviable daily, weekly or monthly until non-compliance ceases, alongside classic pecuniary sanctions. The reform materially raises enforcement exposure for payment and e-money institutions with unresolved supervisory findings, changing the cost calculus of prolonged non-compliance. Separately, Banca d'Italia has clarified that most buy-now-pay-later agreements qualify as regulated consumer-credit financing under national banking law when the lender is not the merchant, ahead of the EU Consumer Credit Directive II entering into force from November 2026. The reclassification pulls independent BNPL providers into licensing, AML and disclosure regimes, favouring bank-backed BNPL models as CCD II compliance thresholds tighten. #### Outlook Watch for the first periodic-penalty-payment enforcement actions under D.Lgs. 208/2025 and for how independent BNPL providers adapt their licensing posture ahead of the November 2026 Consumer Credit Directive II deadline. Read full sub-brief · 144 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/index.html](https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/index.html)retrieved 2026-07-04 - T3[https://www.diritto.it/dlgs-208-2025-novita-per-banche-e-vigilanza/](https://www.diritto.it/dlgs-208-2025-novita-per-banche-e-vigilanza/)retrieved 2026-07-04 - T2[https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf](https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-07-04 - T3[https://www.globenewswire.com/news-release/2026/02/03/3230796/28124/en/Italy-Buy-Now-Pay-Later-Business-Report-2025-A-26-6-Billion-Market-by-2031-from-8-06-Billion-in-2025-Featuring-Klarna-Scalapay-Oney-PayPal-PagoLight-Nexi-Confidis-Deutsche-Bank.html](https://www.globenewswire.com/news-release/2026/02/03/3230796/28124/en/Italy-Buy-Now-Pay-Later-Business-Report-2025-A-26-6-Billion-Market-by-2031-from-8-06-Billion-in-2025-Featuring-Klarna-Scalapay-Oney-PayPal-PagoLight-Nexi-Confidis-Deutsche-Bank.html)retrieved 2026-07-04 ### W8Merchant Acquiring & RiskProbableconfirmed 2026-07-04▾# Nexi is Italy's leading merchant acquirer, offering PCI-DSS-tiered integration paths (hosted page, SAQ-A iFrame, SAQ-D server-to-server) via its XPay gateway; the wider acquiring market blends Nexi/SIA-legacy processing with major bank acquirers (Intesa Sanpaolo, UniCredit, Banco BPM) and international players (Adyen, Stripe) operating via EU passporting. High-risk verticals such as gaming and crypto face materially stricter PSP onboarding and compliance scrutiny. Standing sub-brief · as of 5 July 2026 92 words · last cycle 2026-07-04 #### Merchant Acquiring & Risk On Nexi's XPay e-commerce gateway, PCI DSS compliance burden scales by integration model: a hosted payment page requires no merchant certification, an SAQ-A-compliant iFrame integration carries a lighter self-assessment burden, and a full server-to-server integration requires SAQ-D certification. The choice of integration model directly determines PCI DSS compliance cost and audit burden for Italian e-commerce merchants on the country's leading payment gateway. #### Outlook This is a dated, vendor-documentation-sourced finding rather than a live rule change; no regulatory shift to Italy's merchant-acquiring PCI DSS framework was identified this cycle. Read full sub-brief · 92 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T3[https://developer.nexi.it/en/servizio-ecommerce/](https://developer.nexi.it/en/servizio-ecommerce/)retrieved 2026-07-04 - T3[https://payatlas.com/countries/italy-it](https://payatlas.com/countries/italy-it)retrieved 2026-07-04 - T3[https://www.bitpace.com/blog/payment-gateways-for-businesses-in-italy/](https://www.bitpace.com/blog/payment-gateways-for-businesses-in-italy/)retrieved 2026-07-04 - T4[https://capitalblueprint.substack.com/p/nexi-spa-in-depth-financial-analysis](https://capitalblueprint.substack.com/p/nexi-spa-in-depth-financial-analysis)retrieved 2026-07-04 ### W9Product Innovation & Market DevelopmentConfirmedconfirmed 2026-07-04▾# Italy is an active participant in Eurosystem digital-euro preparation (PSP applications for the pilot phase due 14 May 2026, pilot expected H2 2027) and in domestic public-sector digital infrastructure via the PagoPA platform, now 49%-owned by Poste Italiane. Open banking (MyBank, Bancomat Pay) and BNPL products continue to expand, with the latter facing incoming CCD II-driven regulatory tightening from November 2026. Horizon · 2026-Q3 (± a quarter) Digital euro pilot development phase begins Adopted · Tier 1 source Horizon · 2027-Q3 (± six months) Digital euro 12-month pilot exercise expected to begin Proposed · Tier 1 source Standing sub-brief · as of 5 July 2026 111 words · last cycle 2026-07-04 #### Product Innovation & Market Development The ECB's digital euro pilot preparation phase opened its call for expression of interest on 5 March 2026, with payment service provider applications due 14 May 2026, selection notified end-June 2026, a development phase beginning Q3 2026, and a 12-month pilot exercise planned for H2 2027. The timeline determines the near-term participation window for Italian payment service providers in Eurosystem digital-euro infrastructure build-out, a strategically material product-development decision point. #### Outlook The end-June 2026 selection notification and the Q3 2026 development-phase start are the immediate markers to watch; the planned H2 2027 twelve-month pilot exercise is the next major milestone for Italian PSP participation in digital-euro infrastructure. Read full sub-brief · 111 words no periodic updates on record for this sub-brief Evidence 5 Sources and findings (5) - T1[https://www.ecb.europa.eu/euro/digital_euro/pilot/html/ecb.faq-digital-euro-pilot.en.html](https://www.ecb.europa.eu/euro/digital_euro/pilot/html/ecb.faq-digital-euro-pilot.en.html) Applies beyond this jurisdiction (EU)retrieved 2026-07-04 - T3[https://www.openbankproject.com/blog/the-digital-euro-infrastructure/](https://www.openbankproject.com/blog/the-digital-euro-infrastructure/)retrieved 2026-07-04 - T2[https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf](https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-07-04 - T3[https://www.globenewswire.com/news-release/2026/02/03/3230796/28124/en/Italy-Buy-Now-Pay-Later-Business-Report-2025-A-26-6-Billion-Market-by-2031-from-8-06-Billion-in-2025-Featuring-Klarna-Scalapay-Oney-PayPal-PagoLight-Nexi-Confidis-Deutsche-Bank.html](https://www.globenewswire.com/news-release/2026/02/03/3230796/28124/en/Italy-Buy-Now-Pay-Later-Business-Report-2025-A-26-6-Billion-Market-by-2031-from-8-06-Billion-in-2025-Featuring-Klarna-Scalapay-Oney-PayPal-PagoLight-Nexi-Confidis-Deutsche-Bank.html)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/vigilanza/index.html](https://www.bancaditalia.it/compiti/vigilanza/index.html)retrieved 2026-07-04 ### W10Consumer Protection & APP FraudConfirmedconfirmed 2026-07-04▾# Consumer protection in Italian payments runs through Banca d'Italia's transparency/fairness supervisory mandate and the ABF ombudsman scheme. PSD2 (as transposed by D.Lgs. 11/2010) caps consumer liability for unauthorised payments at EUR50 and requires bank refunds for unauthorised transactions, but there is no automatic reimbursement scheme for authorised push-payment (APP) fraud/scams -- victims must rely on bank goodwill, fund recall, ABF escalation, or criminal reporting via Polizia Postale. Standing sub-brief · as of 5 July 2026 104 words · last cycle 2026-09-28 #### Consumer Protection & APP Fraud Consumer liability for unauthorised payments under the PSD2-derived regime is capped at EUR50, but no automatic reimbursement scheme exists for authorised push-payment fraud in Italy; recovery instead depends on bank goodwill, fund recall, Arbitro Bancario Finanziario escalation, or criminal reporting. The absence of a mandatory APP-fraud reimbursement scheme, unlike the UK's PSR-style model, is a structural consumer-protection gap relevant to future PSD3 debate. #### Outlook This remains an under-indexed area: recovery-rate data for Italian APP-fraud victims was not surfaced this cycle, and the comparative gap with UK-style mandatory reimbursement is worth deeper sourcing of Polizia Postale recovery statistics next cycle. Read full sub-brief · 104 words Periodic update · new data 2026-09-28 #### Consumer Protection & APP Fraud The PSD3/PSR compromise text, carried in the Council of the EU's 23 April 2026 'I' Item Note, introduces two consumer-protection-relevant obligations bearing directly on Italy's future payment-service landscape once the regime is formally adopted. The first is mandatory IBAN-and-name verification: payment transfers would require verification that the account name matches the IBAN provided, a mechanism intended to catch a common vector in authorised-push-payment fraud where victims are induced to transfer funds to an account under a different name than the one they believe they are paying. The second is an expanded PSP liability regime for authorised-push-payment fraud: under the compromise text, payment service providers face expanded liability to reimburse fraud victims specifically where the PSP did not meet expected detection standards. This shifts a portion of APP-fraud loss exposure onto PSPs in circumstances where their own detection systems fell short of the expected standard, rather than leaving the loss entirely with the defrauded consumer. Both obligations remain pre-adoption. The compromise text has reached an advanced legislative stage, with COREPER approval invited following the 23 April 2026 'I' Item Note, but formal adoption of PSD3/PSR has not yet occurred, and neither the IBAN/name-verification requirement nor the expanded APP-fraud liability standard is yet binding on Italian PSPs. Once adopted, both provisions would apply within the same single-licensing PSD3/PSR framework covering Italy's EMI/PI authorisation landscape. #### Outlook Formal adoption of PSD3/PSR, expected as scheduled toward Q4 2026, is the trigger event that would bring the IBAN/name-verification and expanded APP-fraud-liability obligations into force for Italian PSPs. Until adoption occurs, Italian consumers' practical protection against authorised-push-payment fraud continues to operate under the existing pre-PSD3 framework, and PSPs should treat the compromise text's provisions as a forward compliance requirement to prepare for rather than a currently binding obligation. Evidence 4 Sources and findings (4) - T3[https://ministryofcyberaffairs.com/news/how-to-report-cybercrime-in-italy-and-get-your-money-back-879fad32-91b5-4d61-9dd7-979570edf33b](https://ministryofcyberaffairs.com/news/how-to-report-cybercrime-in-italy-and-get-your-money-back-879fad32-91b5-4d61-9dd7-979570edf33b)retrieved 2026-07-04 - T1[https://www.arbitrobancariofinanziario.it/abf/index.html](https://www.arbitrobancariofinanziario.it/abf/index.html) - T1[https://economiapertutti.bancaditalia.it/aree-tematiche/diritti-e-tutele/arbitro-bancario-finanziario/index.html](https://economiapertutti.bancaditalia.it/aree-tematiche/diritti-e-tutele/arbitro-bancario-finanziario/index.html) - T4[https://veritas-advisory-group.com/litigation-by-country/italy/](https://veritas-advisory-group.com/litigation-by-country/italy/)retrieved 2026-07-04 ### W11AML/CFT & Financial CrimeSourced from Sentinel.gi ↗Confirmedconfirmed 2026-07-04▾# SENTINEL-FED POSITION ONLY. Italy's April 2026 FATF Mutual Evaluation Report (on-site June-July 2025) found a mature, whole-of-government AML/CFT framework with strong inter-agency coordination on organised-crime-linked money laundering, but identified persistent beneficial-ownership transparency gaps and insufficiently dissuasive sanctions for non-disclosure; Italy was placed under regular follow-up with a three-year reform window. Banca d'Italia applies continuous risk-based AML supervision to payment institutions and e-money institutions under its dedicated AML supervisory regulation (updated 13 March 2026). Horizon · 2029 (± more than a year) FATF three-year follow-up reform window for Italy's beneficial-ownership transparency gaps Proposed · Tier 1 source Standing sub-brief · as of 5 July 2026 112 words · last cycle 2026-07-04 #### AML/CFT & Financial Crime This module is sourced from the Sentinel.gi feed. Italy's April 2026 FATF Mutual Evaluation Report found a mature whole-of-government AML/CFT framework with strong inter-agency coordination, but identified persistent beneficial-ownership transparency gaps and insufficiently dissuasive sanctions for non-disclosure; Italy was placed under regular follow-up with a three-year reform window. The beneficial-ownership transparency gap is a live supervisory-cooperation friction point for cross-border PSP onboarding and KYC in Italy; original illicit-finance analysis of this finding belongs to the Financial Intelligence Monitor, not this monitor. #### Outlook Track Italy's progress against the three-year FATF follow-up window via the Sentinel.gi feed and the Financial Intelligence Monitor rather than through original analysis in this brief. Read full sub-brief · 112 words no periodic updates on record for this sub-brief Evidence 7 Sources and findings (7) - T1sentinel.bancaditalia.it/compiti/supervisione-normativa-antiriciclaggio/normativa/archivio-norme/disposizioni-organizzazione/index.html - T?FIM (sentinel.gi) per-JID baseline profile — Italy — Italy's AML/CFT/CPF regime rests on Legislative Decree 231/2007, with the UIF (Financial Intelligence Unit) housed in Banca d'Italia, Guardia di Finanza's Nucleo Speciale di Polizia Valutaria, and the Direzione Investigativa Antimafia providing investigative depth. FATF's April 2026 mutual evaluation found a sophisticated whole-of-government approach with strong asset-recovery outcomes, but flagged persistent beneficial-ownership access limitations and weak, slow-to-publish supervisory sanctions. - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-005) — Gap: sourcing-thinness - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: absent-field-provenance - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: regulatory-failure - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: enforcement-absence - T1FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: EU listing ### W12Correspondent Banking, Settlement & AccessConfirmedconfirmed 2026-07-04▾# Banca d'Italia is one of the Eurosystem's four providing central banks (4CB) for the TARGET Services (T2, T2S, TIPS) and the sole developer/operator of TIPS. Following the Instant Payments Regulation's amendment of the Settlement Finality Directive, non-bank PSPs (Italian IPs and IMELs) gained the right to direct access to T2 and TIPS as of 6 October 2025 (ECB Guideline ECB/2025/28), though the Eurosystem will not permit central-bank accounts to be used for safeguarding client funds. Standing sub-brief · as of 5 July 2026 125 words · last cycle 2026-09-04 #### Correspondent Banking, Settlement & Access Italy's correspondent-banking access structure has historically run on a bank-versus-non-bank asymmetry: as of 6 October 2025, following amendment of the Settlement Finality Directive under ECB Guideline ECB/2025/28, Italian e-money and payment institutions gained the right to direct T2 participation, subject to operational parity with credit institutions, account-balance caps, and exclusion from Eurosystem credit; central-bank accounts may not be used for client-fund safeguarding. Direct TARGET access is a structural correspondent-banking upgrade for non-bank payment service providers, reducing settlement-bank dependency, though the safeguarding-account refusal preserves a residual client-fund protection gap. #### Outlook The bank-versus-non-bank access asymmetry persists in modified form: non-banks now reach TARGET directly but remain excluded from central-bank safeguarding, an unresolved structural gap worth tracking as non-bank PSP TARGET participation grows. Read full sub-brief · 125 words Periodic update · new data 2026-09-08 #### Correspondent Banking, Settlement & Access The analytical spine of Italy's correspondent-banking and settlement picture this cycle is the reachability requirement now binding on PSPs adhering to SCT Inst. All PSPs that adhere to SCT Inst and are reachable in the T2 RTGS system must now be reachable in TIPS, the Eurosystem's instant-settlement infrastructure, either as a direct participant or via a reachable-party arrangement with another institution. This is a Confirmed-confidence finding drawn from a Tier-1 Banca d'Italia primary source, and it captures precisely the bank-versus-non-bank access asymmetry that structures correspondent-banking analysis generally: a bank PSP with T2 RTGS reachability faces a direct path to TIPS participation, while a non-bank PSP or EMI without direct RTGS reachability must secure a reachable-party arrangement through a correspondent bank, introducing a dependency and potential access bottleneck that direct participants do not face. TIPS itself settles instant payments in central-bank money at an average Eurosystem-wide throughput of 500 payments per second, with BANCOMAT identified as the key Italian domestic-scheme participant in this settlement infrastructure. This is a Confirmed-confidence, Tier-1-sourced finding. Layered on top of this settlement-infrastructure picture is Italy's fragmented domestic scheme landscape: BANCOMAT (approximately 36 million cards), MyBank (an open-banking account-to-account scheme), and PostePay (approximately 28 million cards) each represent locally distinctive access points, a Probable-confidence, Tier-4-sourced finding relevant to any institution mapping correspondent and settlement access into the Italian market. Taken together, these findings describe a settlement environment where direct TIPS reachability is increasingly the norm for T2-RTGS-reachable institutions, while non-bank PSPs and EMIs continue to depend on correspondent relationships for the same functional access, a structural asymmetry with direct implications for settlement risk, cost, and operational resilience planning. #### Outlook Watch for any consolidation or interoperability development among Italy's fragmented domestic schemes (BANCOMAT, MyBank, PostePay) as instant-payment volumes grow, and for whether reachable-party arrangements for non-bank PSPs show any signs of concentration risk as TIPS reachability becomes near-universal among direct T2 RTGS participants. Evidence 4 Sources and findings (4) - T1[https://www.bancaditalia.it/compiti/sistema-pagamenti/target2/index.html](https://www.bancaditalia.it/compiti/sistema-pagamenti/target2/index.html) - T3[https://inventi.io/news/non-bank-psps-gain-direct-access-to-target2-services/](https://inventi.io/news/non-bank-psps-gain-direct-access-to-target2-services/)retrieved 2026-07-04 - T1[https://www.ecb.europa.eu/press/intro/news/html/ecb.mipnews20240719.en.html](https://www.ecb.europa.eu/press/intro/news/html/ecb.mipnews20240719.en.html) Applies beyond this jurisdiction (EU)retrieved 2026-07-04 - T1[https://www.bancaditalia.it/compiti/sistema-pagamenti/security-target2/index.html](https://www.bancaditalia.it/compiti/sistema-pagamenti/security-target2/index.html) ### W13Commercial Intelligence (M&A, Investment & Product)limited signalProbableconfirmed 2026-07-04▾# Trailing-12-month Italian payments commercial activity is dominated by the reported CVC Capital Partners take-private approach for Nexi, Poste Italiane's ~EUR500m acquisition of a 49% stake in PagoPA (finalised late 2025), Bancomat's early-2025 controlling-stake acquisition of open-banking fintech FlowPay, and a wave of MiCAR CASP authorisations (Conio, Young Platform, CheckSig and others) culminating in Banca Sella's first-mover bank crypto-custody notification in May 2026. Horizon · 2026-12 (± a quarter) PSD3/PSR formal adoption and Official Journal publication Adopted · Tier 3 source Standing sub-brief · as of 5 July 2026 165 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) CVC Capital Partners is reported nearing agreement with Nexi Group shareholders on a take-private transaction, reportedly requiring prior spin-out of Nexi's digital-banking/interbank-network unit; the deal value has not been publicly disclosed. Poste Italiane finalised acquisition of a 49% stake in PagoPA in late 2025 for EUR400m upfront plus EUR100m contingent on performance. Bancomat announced an agreement in early 2025 to acquire a controlling stake in open-banking fintech FlowPay; the amount was not publicly disclosed. Banca Sella completed its MiCA Article 60 notification on 27 May 2026, launching a regulated crypto custody and transfer service targeting corporate and institutional clients before end-2026. Conio, backed by Poste Investimenti and Banca Generali, received MiCAR CASP authorisation from CONSOB and Banca d'Italia ahead of the 30 June 2026 transition deadline, covering custody, transfer and placement services. #### Outlook Watch for confirmation of the CVC/Nexi take-private structure and execution of the required spin-out, alongside further MiCAR CASP product launches as firms complete the post-transitional-regime shakeout. Read full sub-brief · 165 words Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech Mastercard launched a global money platform, building on its earlier acquisition of BVNK, that enables fintech partners to hold euro-denominated and stablecoin account balances, convert between them, transfer by bank rail, and spend via card. The launch is global and EU-in-scope rather than targeted at any specific national market, and no Italy-specific partner, integration, or rollout has been confirmed. This is nonetheless a relevant development for Italian payment institutions and e-money institutions to track, since any future partner integration with the platform would give an Italian fintech or payment institution direct access to stablecoin-denominated account functionality through an established card-scheme rail rather than requiring independent stablecoin infrastructure build-out. Separately, Milan-based fintech Computis raised approximately 2.25 million US dollars in a pre-seed funding round focused initially on Italian small and medium enterprises; this is a discrete, disclosed commercial funding event rather than a structural product-access theme, and amount was disclosed as reported by the primary source rather than withheld. Both developments should be read as commercial-intelligence data points: the Mastercard platform launch is a specific vendor product release (not a structural stablecoin-market trend, which would instead be tracked as a thematic regulatory or market-structure matter), and the Computis round is a specific funding event rather than a broader Italian SME-fintech funding trend claim, which this cycle's evidence does not support making. #### Outlook The clearest forward marker for Italy is whether an Italian payment institution, e-money institution, or bank becomes a named integration partner for Mastercard's stablecoin-money platform, which would convert this currently global development into an Italy-specific one worth tracking as a distinct regulatory and commercial matter. For Computis, watch for a follow-on funding round or evidence that the SME-focused product has achieved meaningful adoption within the Italian market it was initially designed to serve. Evidence 6 Sources and findings (6) - T3[https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/](https://businessofpayments.com/2026/05/05/business-of-payments-may-2026/)retrieved 2026-07-04 - T3[https://www.ainvest.com/news/italy-pagopa-acquisition-implications-digital-payments-2512/](https://www.ainvest.com/news/italy-pagopa-acquisition-implications-digital-payments-2512/)retrieved 2026-07-04 - T2[https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf](https://one.oecd.org/document/DAF/COMP/WD(2025)36/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-07-04 - T3[https://coincentral.com/italys-conio-secures-mica-approval-before-eu-deadline/](https://coincentral.com/italys-conio-secures-mica-approval-before-eu-deadline/)retrieved 2026-07-04 - T3[https://en.spaziocrypto.com/banks/banca-sella-italys-first-bank-cleared-crypto-mica/](https://en.spaziocrypto.com/banks/banca-sella-italys-first-bank-cleared-crypto-mica/)retrieved 2026-07-04 - T3[https://bebeez.eu/2026/07/01/eight-italian-firms-receive-the-micar-authorization-from-consob-and-banca-ditalia-to-operate-as-crypto-asset-service-providers/](https://bebeez.eu/2026/07/01/eight-italian-firms-receive-the-micar-authorization-from-consob-and-banca-ditalia-to-operate-as-crypto-asset-service-providers/)retrieved 2026-07-04 No modules match. Filters combine as OR inside a group and AND across groups. Reset all filters ## Provenance and declared absence Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. Suppressed by doctrine: derived risk score; per-module RAG traffic light. Not shown on this page. Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-26. A year-precision row is never promoted into a tighter band. Orphan deltas: 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. Envelope: baseline resolved at jurisdiction_json.baseline ; 14 module(s), 67 finding(s), 136 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](/legal/#contact).