PSD3 re-authorisation for Luxembourg PIs and EMIs: the winding-up plan is the new deliverable

PSD2 did not require a winding-up plan as part of the authorisation dossier. PSD3 does. That single change is where most Luxembourg PI and EMI gap analyses are running thin. The headline items get the attention: EMI merger into the PI regime, mandatory verification of payee for all credit transfers, expanded fraud liability, DORA compliance as an authorisation condition. The winding-up plan keeps getting added last.

It is not a recovery plan in the BRRD sense. It must define measures for an orderly wind-down, including continuity and recovery of critical activities performed by outsourced service providers, agents, and distributors. For Luxembourg PIs with significant agent networks across multiple EU jurisdictions, this is the most time-consuming new requirement and the one most likely to surface gaps in vendor and agent documentation.

Other points the November 2025 political agreement and the Commission proposal already settle:

- Method B becomes the default own funds calculation for PIs providing payment services. Methods A and C survive but become restricted to business models with low volume and high value transactions, subject to NCA validation against EBA RTS criteria. PIs currently on method A should model method B exposure now rather than discover the impact at re-authorisation.

- Safeguarding diversification is introduced. Concentrating all client funds in a single segregated account at one credit institution will not be sufficient. Opening additional accounts in Luxembourg takes months given local bank appetite for PI safeguarding.

- The PSR applies directly 18 months after entry into force; PSD3 needs national transposition within the same window. Luxembourg transposed PSD2 over six months past deadline, so PSR obligations may bite before the PSL rewrite is complete.

- Re-authorisation is expected to follow a simplified process for currently authorised entities, but simplified still means filing a winding-up plan, demonstrating DORA compliance, refreshed security policy documentation, and a passporting overview. A 2019 file will have material gaps.

CSSF has not yet published PSD3 implementation guidance. Filing early once it does should help, since the harmonised three-month authorisation timeline will not survive a queue of simultaneous re-authorisation requests.

Source basis: COM(2023)366 (PSD3), COM(2023)367 (PSR), Directive (EU) 2015/2366 (PSD2), Directive 2009/110/EC (EMD2), Regulation (EU) 2022/2554 (DORA), Luxembourg Law of 10 November 2009 on payment services as amended in 2018.

Full article: https://regreportingdesk.com/psd3-luxembourg-payment-institutions-electronic-money/