A marketplace collects a buyer’s payment and pays the seller once the goods arrive. Whether the commercial agent exclusion can take that flow outside the proposed EU Payment Services Regulation (PSR) will not depend on who holds the money in between, but on whom the platform acts for under its agreements, and on whether it has actual scope to negotiate or conclude the sale.
Questions like this one decide much of what the PSR, as agreed by the co-legislators, would ask of an institution. Our first article in this pair covered the fraud duties that apply to every payment service provider (PSP). This one takes the three questions that decide most of the rest: whether a flow is in scope, which turns on the commercial agent exclusion and the rules for e-money tokens; whether the accounts are payment accounts, which brings the dedicated interface and the consent dashboard; and whether the users are consumers or businesses, which decides the refund routes. It then turns to two-biometric strong customer authentication (SCA), bank account access for payment institutions and the PSD3 licence transition.
This article, part of our series on the forthcoming EU payments framework, is the second of two on the Council’s first-reading positions on the PSR (ST 8543/26) and on the third Payment Services Directive, PSD3 (ST 8535/26), published on 21 October 2026. The Council has yet to adopt them formally; Parliament would then approve them at second reading, indicatively on 14 December 2026. On current estimates, both texts would enter into force in early 2027, and most of their rules would apply around the end of 2028, replacing the second Payment Services Directive (PSD2), with verification of payee extended to more credit transfers around mid-2029. Article numbers follow the Council’s positions. This article is general information, not legal advice.
The commercial agent exclusion and e-money tokens
The commercial agent exclusion still covers only an agent acting for the payer or for the payee, not both. The PSR adds a second condition: the agreement must give the agent actual scope to negotiate or to conclude the sale. The recitals, which guide interpretation, add that the exclusion does not depend on whether the agent holds client funds, and that e-commerce platforms acting for both buyers and sellers, without either side having actual scope to negotiate, are not excluded. The European Banking Authority (EBA) is due to issue guidelines on the exclusion to national supervisors within a year of entry into force.
E-money tokens, which the Markets in Crypto-Assets Regulation (MiCA) treats as e-money, carry lighter rules: the payee name check and its liability rule do not apply to payments in them, nor do the account provider’s obligations towards payment initiation and account information providers in Articles 41 and 42, and for transactions settled on the ledger, a reasoned estimate, given before the payer authorises the payment, can replace information that the PSP cannot give for reasons beyond its control.
Some token flows also leave PSD2 from the day the PSR enters into force and stay outside the PSR afterwards: token payments made directly between payer and payee with no intermediary, exchanges where a crypto-asset service provider intermediates between buyer and seller or deals in its own name, and payment transactions between those providers for their own account. Transfers of tokens for clients can still be payment services. Custody of tokens alone is not a payment service; the PSD3 recitals indicate that where the same provider also transfers tokens for its clients, the services concerned would qualify as payment services.
The dedicated interface and consent dashboard for payment accounts
An account that a PSP holds in a user’s name, and that can be used to send funds to and receive funds from third parties, is a payment account. Once the PSR applies, if the account is accessible online, its provider will need a dedicated interface for third-party providers. It will also need a consent dashboard where customers can see and withdraw the access they have given. Our analysis of the draft agreement sets out both requirements in detail; its timeline is superseded by the dates above.
Refunds for unauthorised payments and impersonation (spoofing) fraud
Under the agreed text, any payer, consumer or business, will be able to claim a refund for an unauthorised payment. The payer will have to notify without undue delay, and the outer limit will grow from 13 to 18 months after the debit date. With business users, the contract can set aside the rules on the burden of proof and on the payer’s share of losses, and can change the time limits, but not the PSP’s basic duty to refund an unauthorised payment.
Consumers will gain a second route for PSP impersonation, often called spoofing, which we followed through the negotiations: a fraudster pretending to be their own PSP, using channels attributed to it, manipulates them into authorising payments. Once they have notified the PSP without undue delay, reported the fraud to the police and given the PSP the police report, the PSP has 15 business days to refund, or to refuse if it has objectively justified reasons to suspect fraud or gross negligence by the consumer, giving its reasons and the bodies the consumer can turn to.
This route does not cover fraudsters posing as the police, a relative or another bank, or investment scams, unless national law or the PSP’s own terms go further; in those cases, the refund owed where the payer’s PSP cannot show that both PSPs monitored the transaction may still apply, depending on the evidence. On both routes, the PSP must prove fraud or gross negligence, after inviting the customer to explain what happened, and a customer’s silence does not prove it on its own. Member States may extend the consumer rules to microenterprises.
Two-biometric SCA and bank account access for payment institutions
Two further sets of rules apply. For every PSP, once the PSR applies, SCA may rest on two inherence elements, such as a face and a fingerprint, if the PSP demonstrates to its competent authority that the two remain fully independent and that the procedure ensures a high level of security at all times. How to assess that independence is still to come: the EBA is due to issue guidelines on it within 18 months of entry into force. For payment institutions, the existing right of access to bank accounts will gain a closed list of refusal grounds, and for all authorised or registered PSPs, the access rules for payment systems will extend to payment schemes.
A bank will be able to refuse or close the account of a payment institution, its agent or an applicant only where opening or keeping the account would breach the EU Anti-Money Laundering Regulation, for a material breach of contract, where information or documents are missing, or where the licence has been refused or withdrawn. A refusal must be notified without undue delay and at the latest one month after a complete application, to the applicant and the competent authority, with duly justified reasons that specify the risks and are not generic, and a closure requires at least four months’ notice and duly justified reasons.
In anti-money laundering cases, however, the bank only states that ground, without details, and may close on shorter notice. Under PSD3, existing e-money institutions would become payment institutions once the competent authority has verified that they meet the new requirements, or authorised them automatically, and the protection would then cover them. Payment system and payment scheme operators, other than those serving a single group, will be able to refuse an authorised or registered PSP only where it poses specific risks to the system, and must notify the refusal in writing and duly justify it.
How to prepare, and the PSD3 licence transition
The first step is to answer the three questions for each entity and each flow. Where the answers bring an institution into scope, the work covers interface parity and the consent dashboard for online payment accounts, refund deadlines and the evidence behind refusals, the terms agreed with business users, the SCA changes, and, for payment institutions, complete files for bank account applications.
Most PSR provisions would apply around the end of 2028. Existing payment and e-money institutions could keep operating under PSD3 without a new licence until around mid-2029, but by then the competent authority would have to assess the information they send it on capital, safeguarding, governance and information and communication technology (ICT), incident handling, business continuity, wind-down, and authorisation applications in other EU jurisdictions. An institution that does not comply would be suspended until the authority has verified the missing information, although the authority could extend the period by up to three months where the institution sent its information but the authority could not process it in time. National law will set when that information must be sent. We would prepare that information well before then.
We plan to publish a PSR readiness checklist soon: subscribe to our newsletter to receive it when it is ready, or get in touch to discuss what the PSR means for your institution.
