The EU is replacing its payments rulebook. A new Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation (PSR) will take over from PSD2 and the E-Money Directive, merge the payment and e-money licences into one, and shift more fraud liability onto providers. For a Turkish payment or e-money institution with EU customers on its roadmap, two things are true at once: a TCMB licence does not open the EU market, and the EU licence you would need is changing shape. The political deal dates from 27 November 2025; as of 8 October 2026 the texts were agreed but not yet formally adopted.
Where the package stands on 8 October 2026
The Council and the European Parliament reached a provisional political agreement on 27 November 2025. The final compromise texts (Council documents 8221/26 for the PSR and 8222/26 for PSD3, dated 17 April 2026) were confirmed by COREPER on 22 April 2026 “with a view to reaching an agreement at second reading”, and Parliament’s ECON committee approved them on 5 May 2026.
Formal adoption was still pending at the time of writing. The Council’s state-of-play note of 2 October 2026 lists the COREPER confirmation as the latest step, Parliament’s Legislative Observatory shows both files as “Awaiting Council’s 1st reading position”, and we found no Official Journal publication. Article numbers in this article follow the 17 April 2026 compromise texts and may change in the published versions. The timing in the agreed texts runs from entry into force (the twentieth day after publication):
- PSR: applies 21 months after entry into force; the payee name check (Art. 50) and its liability rule (Art. 57) apply after 27 months.
- PSD3: transposed and applied by Member States 21 months after entry into force, when PSD2 and the E-Money Directive are repealed.
- Existing EU institutions: payment and e-money institutions already authorised may continue until 27 months after entry into force while their authority checks them against the new rules, with an exceptional extension of up to 3 months.
No passport for a Turkish licence: you need an EU entity
The PSD3 text contains no route for a firm licensed outside the EU. An applicant is authorised only if it “is a legal person established in a Member State” (Art. 13(1)(a)), and where a registered office is required, the head office must be in the same Member State, with part of the payment business carried on there (Art. 13(3)). Under the PSR, anyone neither authorised nor exempt is “prohibited from providing payment services” (Art. 89b).
Once granted, the authorisation is valid in all Member States (Art. 13(6)) through the notification procedure in Art. 30, so one EU subsidiary can serve the single market. Two conditions deserve early attention from a Turkish parent: authorisation is refused where third-country laws governing persons with close links to the applicant prevent effective supervision (Art. 13(5)(c)), and the authority may require a separate entity where other business lines could impair soundness or supervision (Art. 13(4)).
One licence for payments and e-money
PSD3 drops the separate e-money institution. Issuing electronic money becomes payment service no. 8 in Annex I, so one payment institution authorisation can cover both. Initial capital depends on the services (Art. 5): EUR 40,000 for money remittance only, EUR 50,000 for payment initiation, EUR 150,000 for the services in points 1 to 5 and EUR 250,000 for e-money issuance; across those bands “the minimum amounts shall be added together”.
The authority must decide within 3 months of a complete application (Art. 14). E-money cannot be issued through agents (Art. 19(7b)). For crypto groups, a MiCA-authorised crypto-asset service provider that wants to provide payment services only with e-money tokens gets a decision within 60 business days (Art. 13(2a)).
What the PSR changes in daily operations
- Name and IBAN check for all credit transfers. The verification-of-payee rules of Regulation 260/2012 are extended to all credit transfers (Art. 50). If a provider’s failure leads to a defective transfer, the payer’s provider refunds the payer; where the failure was the payee’s provider’s or the payment initiation provider’s, that provider compensates the payer’s provider (Art. 57).
- Impersonation fraud. Where a consumer is manipulated by someone posing as their own provider through channels attributed to it, the provider must refund the full amount, provided the consumer promptly notified it and reported the fraud to the police (Art. 59(1)). Within 15 business days the provider refunds or gives reasons for refusing, and it bears the burden of proving fraud or gross negligence (Art. 59(2), (4)).
- Strong customer authentication (SCA). The PSR lists creating a tokenised instrument, raising spending limits and changing a password or contact details online among the remote actions that require SCA (Art. 85(1)(d)). Providers must offer more than one means of SCA and cannot make it depend on owning a smartphone unless the user chose app-only service (Art. 88).
- Permission dashboard. Account servicing providers must give users a dashboard of all consents granted to account information and payment initiation providers, with free withdrawal and reinstatement within 48 hours (Art. 43). Account information providers must apply SCA (their own or the account provider’s) when the user accesses data through them 180 days or more after SCA was last applied (Art. 86(4)).
- Access to bank accounts and payment systems. Banks must give payment institutions and applicants account access on an objective, non-discriminatory and proportionate basis, may refuse or close only on listed grounds with specific reasons, and generally give 4 months’ notice of closure (Art. 32). Payment system operators need published, proportionate access rules (Art. 31).
- Advertising on large platforms. Very large online platforms and search engines must ask advertisers of payment and other regulated financial services for proof of authorisation in a Member State or at EU level (Art. 59b).
EU subsidiary or EU partner?
Own EU subsidiary. You set up in one Member State, obtain PSD3 authorisation for the services you need (e-money included) and passport across the EU. You control product and customer, and you carry EU capital, governance, safeguarding, a real home-state presence and the full PSR liability regime, including impersonation refunds.
Partner model. An EU-authorised institution provides the regulated service; your group provides technology, brand or distribution. The institution may outsource, but not so as to materially impair internal control or supervision, and senior management keeps responsibility (Art. 22); it remains fully liable for outsourced entities (Art. 23). Expect audit rights and exit clauses. Technical service providers also fall directly under parts of the PSR, such as liability for failing to support SCA (Art. 58) and the outsourcing agreement required where they provide and verify SCA elements (Art. 87).
If you start with a partner and plan your own licence later, design data flows, contracts and customer terms so the book can migrate without being rebuilt.
EU and Türkiye side by side
| Point | EU: PSD2 → PSD3/PSR | Türkiye: Law No. 6493 and TCMB rules |
|---|---|---|
| Instruments | Today PSD2 (Directive (EU) 2015/2366) and EMD2 (Directive 2009/110/EC); next PSD3 (transposed) plus the directly applicable PSR | Law No. 6493 and the TCMB Regulation on payment services and e-money issuance (Official Gazette 1 December 2021, No. 31676) |
| Licence architecture | Payment and e-money institutions merged into one payment institution authorisation; e-money is Annex I service 8 | Two separate TCMB operating permits: payment institution (Art. 14) and e-money institution (Art. 18) |
| Who may provide | Only authorised or exempt PSPs (PSR Art. 89b); applicant must be established in a Member State; authorisation valid EU-wide | Only banks and the PSPs listed in Art. 13; institutions must be joint-stock companies with a TCMB permit (Arts. 14(2)(a), 18(3)(a)) |
| Minimum capital | EUR 40,000 to 250,000 by service, added together (PSD3 Art. 5) | Statutory paid-in capital of TRY 1m or 2m (payment) and TRY 5m (e-money), with capital and own funds further set by TCMB (Arts. 14(2)(ç), 14(6), 18(3)(ç), 18(6)); see current equity floors |
| Decision period | 3 months from a complete application (PSD3 Art. 14) | 6 months from a complete file (Art. 15(4)) |
| Open banking | Dedicated interfaces, permission dashboard (PSR Art. 43), SCA renewed through the account information provider at least every 180 days (Art. 86(4)) | Payment initiation and account information are payment services (Art. 12(1)(f)-(g), added by Law No. 7192); TCMB sets data-sharing rules and AIS-only firms need no minimum capital (Art. 14/A) |
The reverse also holds: an EU licence does not let you serve Turkish users, because Art. 13(2) of Law No. 6493 reserves payment services to banks and the listed providers. A group active in both markets needs a licensed entity, or a licensed partner, on each side.
Where to start
- Map each product to its PSD3 Annex I service, including e-money as service 8, and add up the initial capital.
- Choose between subsidiary and partner, and a home Member State where head office and real activity can sit.
- Test your ownership chain and close links against Art. 13(5)(c) before filing.
- Build the fraud stack: payee name check, impersonation claims handled within 15 business days, SCA without smartphone-only dependency.
- Open banking providers: plan for bank-side consent dashboards and 180-day re-authentication.
- Keep the Turkish licence and its equity floor in view; neither licence replaces the other.
For the Turkish side, see our payment and e-money institution licence page and the fintech law hub; the glossary has short entries on PSD2 and PSD3 and the PSR.
Frequently asked questions
Can a TCMB-licensed payment institution serve EU customers directly under PSD3?
No. PSD3 authorisation is available only to a legal person established in a Member State, and the PSR prohibits anyone neither authorised nor exempt from providing payment services. You need your own EU-authorised entity or a licensed EU partner.
When will PSD3 and the PSR apply?
Only after Official Journal publication, which had not happened as of 8 October 2026. The PSR applies 21 months after entry into force (27 months for the payee name check), and Member States must apply PSD3 21 months after entry into force.
Do we still need a separate e-money licence in the EU?
Not under PSD3. E-money issuance becomes a payment service a payment institution can be authorised for, with EUR 250,000 initial capital for that service, added to the amounts for other services.
Does the impersonation fraud refund cover business customers?
Article 59(1) covers a payment service user who is a consumer, so the mandatory full refund in that paragraph is a consumer protection. For business users, the PSR’s other liability provisions and the contract govern.
Sources. Council of the EU, press release of 27 November 2025, “Payment services: Council and Parliament agree to step up the fight against fraud and increase transparency“; European Parliament press release of 27 November 2025, “Payment services deal: More protection from online fraud and hidden fees“; Council document 8220/26; final compromise texts: PSR, Council document 8221/26 (Arts. 31, 32, 43, 50, 57, 58, 59, 59b, 85, 86, 87, 88, 89b, 112) and PSD3, Council document 8222/26 (Arts. 5, 13, 14, 19, 22, 23, 30, 44, 45, 45a, 48, 49, 50, Annex I); Council state-of-play note 13589/26 (2 October 2026); European Parliament Legislative Observatory, 2023/0209(COD) and 2023/0210(COD); Directive (EU) 2015/2366 (PSD2); Directive 2009/110/EC (EMD2); Law No. 6493 (Official Gazette 27 June 2013, No. 28690), Arts. 12, 13, 14, 14/A, 15, 18, as amended by Law No. 7192; TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (Official Gazette 1 December 2021, No. 31676).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
