PSD3 safeguarding vs PSD2: what changes for a French EMI or payment institution in 2026–2027

The safeguarding regime is the single most-litigated paragraph of the payment-services directive in France. PSD2 left national transposition options, and ACPR added national guidance in 2018 and 2021. PSD3 and the Payment Services Regulation (PSR) close most of those options, harmonise the baseline across the EU, and shift responsibility more visibly onto the payment institution's (PI) and e-money institution's (EMI) management body. This article walks the deltas ACPR supervisors will care about and the operating-model changes an EMI or PI should plan for in 2026–2027.

The live texts to keep on your desk are the PSD3 proposal (COM/2023/366) and the PSR proposal (COM/2023/367). Political agreement was reached in mid-2025; the formal application date will follow the final level-1 text and the level-2 package.

Why safeguarding exists

A PI or EMI is not a bank. Client funds on its balance sheet are not covered by deposit guarantee. Safeguarding — holding the funds separately from the institution's own money — is the substitute protection: if the PI or EMI fails, the segregated pool pays clients ahead of other creditors. The entire apparatus exists to prevent a PI failure from becoming a payment-services crisis.

What PSD2 allows today, in France

Under PSD2, French PIs and EMIs safeguard either by segregating funds on a credit-institution account or by covering them with an insurance policy or comparable guarantee. Key features of the current French regime:

• Two methods. Segregation on a dedicated account at a credit institution, or insurance / comparable guarantee. Mixing is tolerated but operationally painful.
• End-of-business-day. The segregation obligation attaches no later than the end of the business day following receipt. Intraday exposures are allowed within limits.
• Eligible account providers. Credit institutions established in the EEA that meet prudential standards. France has been strict about accepting non-EU credit institutions.
• Recording obligation.Safeguarded funds must be identifiable at any moment in the PI's books.
• ACPR expectations. Annual safeguarding review by internal audit, monthly reconciliation between client-funds ledger and safeguarding account, and a written safeguarding policy approved by the executive body.

What PSD3 / PSR change

The PSR is a regulation (directly applicable across the EU), and it is the text that carries most of the prudential detail. The salient deltas for safeguarding are:

What will hurt operationally

Three changes have outsized operational weight for a mid-size French EMI with ~€150m average safeguarded funds:

1. Daily reconciliation. Moving from monthly to daily reconciliation is a process and a headcount change, not a policy change. The Finance team needs a daily cut-off that closes the client-funds ledger by 18:00 CET and reconciles against the credit institution statement the next morning. That implies automation on both sides, a break-management workflow, and a 1LoD / 2LoD signoff on any unreconciled item ageing past 24 hours.
2. Concentration limits. EMIs that concentrate 80%+ of safeguarded funds with one or two French universal banks will need to open new accounts, negotiate pricing, and absorb the operational cost of multi-bank reconciliation. Expect 6–9 months of project work to set up a compliant multi-bank safeguarding pool.
3. Wind-down plan. The wind-down plan is not an afterthought: it must describe how the safeguarding pool is transferred to clients or to another authorised institution if the PI fails. That requires an up-to-date register of clients, a reconciled ledger at any point in time, and a legal opinion on the priority of safeguarded-funds claimants.

What will hurt commercially

Safeguarding provider negotiation is a quiet battlefield. French universal banks are under pressure from CRR3 and from own-funds requirements on non-transactional deposits, and they are repricing EMI safeguarding accounts upward. Under the PSR's concentration rules, a single-provider setup is untenable, which means EMIs need to diversify precisely when acquiring secondary providers is hardest. Two practical consequences:

• Plan on 20–40 bps annual pricing pressure on safeguarding services across 2026–2027.
• Plan on needing a “safeguarding provider relationship” owner with senior seniority to negotiate and run the multi-bank pool, not just a treasury operations analyst.

A defensible safeguarding decision record

Where RegRadar shows its value is in making the safeguarding regime an auditable paper trail rather than a monthly spreadsheet. In an EMI running on RegRadar with the French Payments preset active and PSR in scope, the chain runs like this:

1. The PSR final text is captured as a document with content hash and polling history.
2. The AI produces an impact against the tenant's perimeter: PSR Article 10 (hypothetical final numbering) on safeguarding applies, deadline = application date, severity = high, audience = Finance + Risk + Management Body.
3. The 1LoD owner (Head of Finance or Head of Compliance depending on the split) completes the structured object: affected systems (ledger, treasury), process changes (daily reconciliation, multi-bank setup), owners, deadlines, rationale.
4. A digest goes to the management body via the reviewed-digest workflow, signed off by 2LoD Compliance, with the Rapport comité PDF attached.
5. The obligation “Daily safeguarding reconciliation” is promoted from candidate to approved register with its process-document link (policy v4, board-approved 2026-09-12) and an owner.
6. Monthly and quarterly checks on the obligation (reconciliation exceptions, concentration ratios) flow back as recorded evidence, each with a 1LoD / 2LoD signoff.

Timeline to plan against

Based on the publicly available state of legislative progress as of April 2026:

• Political agreement on PSD3 / PSR reached mid-2025.
• Final text publication in OJ expected H2 2026.
• Level-2 package (RTS on safeguarding methods, low-risk asset basket; ITS on reporting templates) — consultation expected in the months following publication, final text 12–18 months later.
• Application date — the Directive (PSD3) and the Regulation (PSR) will align on a common application date, with a transitional window. Firms should plan for H2 2027 at the earliest and for readiness by end-2026 to avoid last-minute project compression.

Next steps for an EMI treasury and compliance team

1. Commission an internal gap analysis against the PSR text, mapped to the current safeguarding policy article-by-article.
2. Commission a safeguarding-provider diversification assessment. Include pricing, onboarding timelines, reconciliation feasibility, and legal opinions on bankruptcy-remote priority.
3. Draft the wind-down plan and circulate to executive and risk committees. Update the licensing file in anticipation of the 2027 renewal cycle.
4. Pilot daily reconciliation in a shadow mode for 60 days to sizing break-management volumes.
5. Put PSR updates on a dedicated watchlist; RegRadar's French Payments preset plus the PSR horizon seed covers this automatically, but any other tooling must be manually configured to surface level-2 consultations early.

For the governance underneath these decisions — who signs the safeguarding policy, who countersigns each monthly review — see the three-lines-of-defence methodology. For how RegRadar structures each PSR update as an impact object, see the AI confidence methodology.