11.06.2026

Author: Peter Amrhyn

FAQ: PSD3, PSR and AMLA

EU formalities aren't always easy to understand, but it is very important to know them for compliance. The same is true of PSD3, PSR, and AMLA. To provide an initial overview, we have compiled some of the most important questions about the new legislation in this FAQ.

What are PSD3, PSR, and AMLA?

PSD3 (Payment Services Directive), PSR (Payment Services Regulation), and AMLA (Anti-Money Laundering Authority) are three major components of the EU's evolving financial services legislative framework. PSD3 focuses on authorization, licensing, and supervision for payment institutions. PSR sets directly applicable rules for payment and e-money services, including fraud prevention, transparency, and authentication. AMLA is the new EU anti-money-laundering authority responsible for coordinating national supervisors, supporting Financial Intelligence Units, and directly supervising selected high-risk cross-border financial entities.

What is the timeline for these changes?

The European Commission published the PSD3 and PSR proposals on 28 June 2023. The European Parliament and the Council reached a provisional political agreement on 27 November 2025, but formal adoption is still required before the final legal texts enter into force. Unlike PSR, which is a regulation, PSD3 must be transposed into national law before entering into force in the member states.

For AMLA, the timeline is further advanced. The AMLA Regulation was published in the Official Journal on 19 June 2024. AMLA was legally established on 26 June 2024, operations began in 2025, and direct supervision of selected entities is expected to begin in 2028.

Who will be affected by PSD3, PSR, and AMLA?

PSD3 and PSR will affect a wide range of payment service providers, including banks, payment institutions, e-money institutions, e-commerce platforms, marketplaces, network operators, and technical service providers active in the EU payments market. In practice, any business that moves money, holds funds on behalf of third parties, or enables technical access to financial data may fall within scope. AMLA has a narrower direct mandate, but its standards and supervisory expectations will influence many more firms across AML/KYC, customer due diligence, governance, data quality, and audit readiness.

What is new in the latest framework?

The core change is a clearer split between institutional supervision and operational payment rules. PSD3 updates the licensing and supervisory framework for payment institutions and e-money institutions, while PSR introduces directly applicable rules intended to reduce national divergence across the EU.

The package places stronger emphasis on:

fraud prevention,
liability,
customer protection,
payee verification,
stronger customer authentication,
consumer information,
and more consistent supervision across borders.

AMLA adds a more centralized AML/CFT (Anti-Money Laundering/Countering the Financing of Terrorism) architecture, with greater coordination, technical standards, and data expectations for cross-border supervision.

What does this mean in practice?

Under PSD3, banks, fintechs, and other finance businesses licensed in one EU member state but serving customers across multiple countries should expect closer scrutiny of governance, safeguarding, outsourcing, and supervisory reporting. Under PSR, a provider handling account-to-account payments may face greater liability if it fails to implement adequate fraud controls, customer warnings, or payee verification. Under AMLA, a cross-border financial group with customers and suspicious-activity cases in several EU countries should expect stronger demands for consistent data, case handling, documentation quality, and supervisory cooperation.

How should organizations prepare now?

Organizations should prepare by focusing on both compliance and proof of compliance. Regulators are increasingly expecting organizations to show who did what, when, on what basis, and under which controls. That means readiness depends not only on policies, but also on evidence trails, process integrity, authentication strength, and auditability.

Practical preparation checklist:

Map the customer journeys and internal approval steps that create the highest fraud, liability, or AML exposure, especially onboarding, account opening, payment approval, mandate management, and high-risk changes to customer data.
Identify where evidence is weak, fragmented, or manually reconstructed, for example, in consent capture, contract acceptance, identity proofing, log integrity, or internal sign-off processes.
Review whether authentication, payee checks, warnings, and escalation paths are designed to meet stricter fraud and reimbursement expectations under the new payments framework.
Strengthen auditability for AML/CFT processes, including case handling, documentation quality, data lineage, and cross-border information exchange readiness.
Build a reusable trust layer rather than a collection of isolated compliance patches, so that the same digital trust components can support onboarding, contracting, approvals, audit trails, and supervisory evidence across multiple use cases.

How can Swisscom Trust Services support compliance readiness?

Swisscom Trust Services can serve as a practical trust layer for banks and fintechs that need to meet multiple regulatory requirements simultaneously. Qualified electronic signatures, qualified seals, and eIDAS-compliant onboarding can help create legally robust, fully digital customer journeys while supporting evidence, authenticity, integrity, and auditability across PSD3/PSR, AML/KYC, DORA, FIDA, and future wallet-based scenarios.

If you want to dive deeper into these topics, we have compiled the most important information in a concise whitepaper. Download here for free.

Customer success stories

Customer success stories

FAQ: PSD3, PSR and AMLA

What are PSD3, PSR, and AMLA?

What is the timeline for these changes?

Who will be affected by PSD3, PSR, and AMLA?

What is new in the latest framework?

What does this mean in practice?

How should organizations prepare now?

How can Swisscom Trust Services support compliance readiness?

Latest Blog Articles

FAQ: PSD3, PSR and AMLA

Start getting ready for PSD3 now

Building Digital Identity Readiness:...

The EUDI-wallet business models of...