--- instrument_id: psd-3 chunk_id: psd-3_t02_ch0I_p1 chunk_title: Licensing and supervision (Part 1) path: "Title 2 > Chapter I" source_class: operative_text document_type: proposal normative_weight: non_binding legal_status: council_compromise_text jurisdiction: EU effective_period: from: null to: null articles_contained: - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 10 - 11 - 12 - 13 - 14 - 15 - 16 - 17 topics: - payments - payment_services - authorisation - licensing - supervision - fraud_prevention - data_protection - operational_resilience - incident_reporting - outsourcing - information_requirements - payment_systems - security - own_funds - winding_up - aml - risk_assessment - crypto_assets - internal_control - competent_authorities - insurance - large_exposures - investment_funds - audit - passporting recitals: - number: 33 text: "Considering the higher risks of deposit-taking activity, it is appropriate to prohibit payment institutions offering payment services from accepting deposits from users, and to require them to only use funds received from users for providing payment services. Funds received from payment service users by payment institutions offering electronic money service should constitute neither a deposit nor other repayable funds received from the public within the meaning of Article 9 of Directive 2013/36/EC of the European Parliament and of the Council.10" - number: 67 text: "Since the further integration of an internal market in payment services, cannot be sufficiently achieved by the Member States alone because it requires the harmonisation of different rules currently existing in the legal systems of the various Member States which would be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective." - number: 70 text: "In the interest of legal certainty, transitional arrangements should be made to ensure that electronic money institutions which have taken up their activities in accordance with the national laws transposing Directive 2009/110/EC are able to continue those activities within the Member State concerned for a specified period. That period should be longer for electronic money institutions that have benefited from the waiver provided for in Article 9 of Directive 2009/110/EC." --- # Chapter I - Licensing and supervision (Part 1) ## Article 3 - Applications for authorisation 1. Member States shall require undertakings other than the undertakings referred to in Article 2(1), points (a), (b), (d), and (e), of Regulation XXX [PSR], and other than natural or legal persons benefiting from an exemption pursuant to Articles 34, 36, 37 and 38 of this Directive, that intend to provide any of the payment services referred to in Annex I, to obtain authorisation from the competent authorities of the home Member Sate for the provision of those services. 2. The authorisation referred to in paragraph 1 shall only be required for those payment services that the applicant payment institutions actually intend to provide. 3. Member States shall ensure that undertakings that apply for an authorisation as referred to in paragraph 1 provide the competent authorities of the home Member State with an application for authorisation, together with the following: (a) a programme of operations setting out in particular the type of payment services envisaged; (b) a business plan including a forecast budget calculation for the first 3 financial years which demonstrates that the applicant is able to employ the appropriate and proportionate systems, resources and procedures to operate soundly; (c) evidence that the applicant holds initial capital as provided for in Article 5; (d) for the undertakings applying to provide services as referred to in Annex I, points (1) to (5), and (8) a description of the measures taken for safeguarding payment service users’ funds in accordance with Article 9; (e) a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures, and a description of the applicant’s arrangements for the use of ICT services as referred to in Articles 6 and 7 of Regulation (EU) 2022/2554, which demonstrates that those governance arrangements, internal control mechanisms and arrangements for the use of ICT services are proportionate, appropriate, sound and adequate; (f) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including a description of the incident reporting mechanism which takes account of the notification obligations of the payment institution laid down in Chapter III of Regulation (EU) 2022/ 2554; (g) a description of the process in place to file, monitor, track and restrict access to sensitive payment data; (h) a description of business continuity arrangements including a clear identification of the critical operations, a description of the ICT business continuity plans and ICT response and recovery plans, and a description of the procedure to regularly test and review the adequacy and efficiency of such ICT business continuity and ICT response and recovery plans, as required by Article 11(6) of Regulation (EU) 2022/2554; (j) a security policy document, including: (i) a detailed risk assessment in relation to the applicant’s payment services; (ii) a description of security control and mitigation measures to adequately protect payment service users against the risks identified, including fraud and the illegal use of sensitive and personal data; (k) for applicant payment institutions subject to the obligations in relation to money laundering and terrorist financing under [Regulation (EU) 2024/1624 of the European Parliament and of the Council] and [Regulation (EU) 2023/1113 of the European Parliament and of the Council], a description of the internal control mechanisms which the applicant payment institution has established to comply with those Regulations; (l) a description of the applicant payment institution’s structural organisation, including, where applicable, a description of: (i) the intended use of agents or branches; (ii) the off-site and on-site checks that the applicant undertakes to perform on those agents or branches at least annually; (iii) a description of outsourcing arrangements; (iv) the applicant’s participation in a national or international payment system; (m) the identity of the persons that hold in the applicant, directly or indirectly, qualifying holdings within the meaning of Article 4(1), point (36), of Regulation (EU) No 575/2013, the size of their holdings and evidence of their suitability to ensure the sound and prudent management of the applicant; (n) the identity of directors and other persons responsible for the management of the applicant payment institution and, where relevant: (i) the identity of the persons responsible for the management of the payment services activities of the payment institution; (ii) evidence that the persons responsible for the management of the payment services activities of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services as determined by the home Member State of the applicant; (o) where applicable, the identity of the statutory auditors and audit firms as defined in Article 2, points 2 and 3, of Directive 2006/43/EC of the European Parliament and of the Council21; 21 Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87). (p) the applicant’s legal status and articles of association; (q) the address of the applicant’s registered office; (r) an overview of EU jurisdictions where the applicant payment institution is submitting or is planning to submit an application for authorisation to operate as a payment institution, or where other entities belonging to the same group as the applicant payment institution have submitted such an application in the past three years. Where the applicant payment institution or any other entity belonging to the same group has submitted an application within the last three years, the decision of the relevant competent authority granting or refusing such authorisation, and, if applicable, the main reasons for refusal. (s) for applicants that intend to provide payment services as referred to in Annex I, points (1) to (5), or point (8), a winding-up plan in case of failure, which is adapted to the envisaged size and business model of the applicant, including the return of safeguarded funds in the event of a disorderly wind-up. For the purposes of the first subparagraph, points (d), (e), (f) and (l), Member States shall ensure that the applicant provides a description of its audit arrangements and of the organisational arrangements it has set up to protect the interests of its users and to ensure continuity and reliability in the performance of payment services. The security control and mitigation measures referred to in the first subparagraph, point (j), shall indicate how the applicant will ensure a high level of digital operational resilience as required by Chapter II of Regulation (EU) 2022/2554, in particular in relation to technical security and data protection, including for the software and ICT systems used by the applicant or the undertakings to which it outsources its operations. 3a. Notwithstanding paragraph 3, Member States shall ensure that undertakings that have been authorised as crypto-asset service provider in accordance with Article 63 of Regulation (EU) 2023/1114 [MiCA] and that apply for an authorisation as referred to in paragraph 1 provide the competent authorities of the home Member State with an application for authorisation, together with the following: (a) the information and documentation required under Article 3(3), points (e), (k), (o), (p), (q) and (r), in the form in which it has been previously submitted in the licensing process pursuant to Article 62 of Regulation (EU) 2023/1114; in the event that parts of this information and documentation are no longer up-to- date, the undertaking shall provide the information and documentation in updated form indicating the documents in which changes have been made; (b) a programme of operations pursuant to Article 3(3), point (a), and a business plan and forecast budget calculation pursuant to Article 3(3), point (b), that builds on the information handed in pursuant to Article 62(2), point (d), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged; (c) evidence that the undertaking holds initial capital as provided for in Article 5 pursuant to Article 3(3), point (c); (d) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including a description of the incident reporting mechanism which takes account of the notification obligations of the payment institution laid down in Chapter III of Regulation (EU) 2022/2554 pursuant to Article 3(3), point (f); that description shall build on the information handed in pursuant to Article 62(2), point (i), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged; (e) a description of the process in place to file, monitor, track and restrict access to sensitive payment data according to Article 3(3), point (g); (f) a description of business continuity arrangements including a clear identification of the critical operations, a description of the ICT business continuity plans and ICT response and recovery plans, and a description of the procedure to regularly test and review the adequacy and efficiency of such ICT business continuity and ICT response and recovery plans, as required by Article 11(6) of Regulation (EU) 2022/2554 pursuant to Article 3(3), point (h); those descriptions shall build on the information submitted pursuant to Article 62(2), point (j), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged; (h) the security policy document pursuant to Article 3(3), point (j), concerning the payment services envisaged; (i) a description of the undertaking’s structural organisation according to Article 3(3), point (l), that builds on the information submitted pursuant to Article 62(2), points (d) and (f), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged; (j) information according to Article 3(3), points (m) and (n), that builds on the information handed in according to Article 62(2), points (g) and (h), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged, containing a clear statement that the information provided under Regulation (EU) 2023/1114 is still up-to- date; (k) a winding-up plan in case of failure, which is adapted to the envisaged size and business model of the undertaking, pursuant to Article 3(3), point (s); (l) if applicable to the intended payment service the information pursuant to Article 3(3), point (d), and Article 3(4). 4. Member States shall require undertakings that apply for authorisation to provide payment services as referred to in Annex I, point (6), as a condition of their authorisation, to hold a professional indemnity insurance, covering the territories in which they offer services, or some other comparable guarantee, and that they ensure that: (a) they can cover their liabilities as specified in Articles 56, 57, 59, 76, and 78 of Regulation XXX [PSR]; (b) they cover the value of any excess, threshold or deductible from the insurance cover or comparable guarantee; (c) they monitor the coverage of the insurance or comparable guarantee on an ongoing basis. For the purpose of the first subparagraph, the professional indemnity insurance or the other comparable guarantee shall be in place at the moment when the applicant starts providing payment services. 5. The EBA shall develop draft regulatory technical standards specifying: (a) the information to be provided to the competent authorities in the application for the authorisation of payment institutions and for the registration of account information service providers, including the requirements laid down in paragraph 3, points (a), (b), (c), (e), (f) and (g) to (k), (r) and (s), and in paragraph 3a; (aa) the information to be provided to the competent authorities in the registration of ATM deployers, including the requirements laid down in paragraph 3, points (a), (b), (e) to (h), (j) to (l), (n), (p) and (q); (b) a common assessment methodology for granting authorisation of payment institutions, and for registration of account information service providers or ATM deployers, under this Directive; (c) what is a comparable guarantee, as referred in paragraph 4 of this Article and in Article 36(4), first subparagraph, that could be considered inter-changeable with a professional indemnity insurance; (d) the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance and other comparable guarantee as referred in paragraph 4 of this Article and Article 36(4). For the purposes of point (c), the own funds or initial capital of an undertaking referred to in paragraph 4 that are beyond the level required pursuant to this Directive or of an account information service provider referred to in Article 36(1) shall not be excluded from what a comparable guarantee is, provided that theundertaking or the account information service provider provides evidence, to the satisfaction of the relevant competent authority, that it has appropriate safeguards in place to ensure that the respective own funds or initial capital will be available at all times, including in the event of insolvency, in order to meet the liabilities referred to in paragraph 4 of this Article or Article 36(4), respectively. 6. When developing those draft regulatory technical standards referred to in paragraph 5, the EBA shall take account of the following: (a) the risk profile of the undertaking; (b) whether the undertaking provides other payment services as referred to in Annex I or is engaged in other businesses; (c) the size of the activity of the undertaking; (d) the specific characteristics of comparable guarantees, as referred in paragraph 4, and the criteria for their implementation. The EBA shall submit those draft regulatory technical standards referred to in paragraph 5 to the Commission by [ OP please insert the date= 1 year after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010. ## Article 4 - Control of the shareholding 1. Any natural or legal person who has taken a decision to acquire or to further increase, directly or indirectly, a qualifying holding within the meaning of Article 4(1), point (36), of Regulation (EU) No 575/2013 in a payment institution, as a result of which the proportion of the capital or of the voting rights held would reach or exceed 20 %, 30 % or 50 %, or so that the payment institution would become its subsidiary, shall inform the competent authorities of that payment institution in writing of their intention in advance. The same applies to any natural or legal person who has taken a decision to dispose, directly or indirectly, of a qualifying holding, or to reduce its qualifying holding so that the proportion of the capital or of the voting rights held would fall below 20 %, 30 % or 50 %, or so that the payment institution would cease to be its subsidiary. 2. The proposed acquirer of a qualifying holding in the payment institution shall inform the competent authority about the size of the intended holding and relevant necessary information as referred to in Article 23(4) of Directive 2013/36/EU. 3. Member States shall require that where the influence exercised by a proposed acquirer, as referred to in paragraph 1, is likely to operate to the detriment of the prudent and sound management of the payment institution, the competent authorities shall express their opposition or take other appropriate measures to bring that situation to an end. Such measures may include injunctions, penalties against directors or the persons responsible for the management of the payment institution in question, or the suspension of the exercise of the voting rights attached to the shares held by the shareholders or members of this payment institution. Similar measures shall apply to natural or legal persons who fail to comply with the obligation to provide prior information, as laid down in paragraph 2. 4. Where a holding as referred to in paragraph 1 is acquired despite the opposition of the competent authorities, Member States shall, regardless of any other penalty to be adopted, provide for the exercise of the corresponding voting rights to be suspended, the nullity of votes cast or the possibility of annulling those votes. ## Article 5 - Initial capital Member States shall require payment institutions to hold, at the time of authorisation, initial capital, comprised of one or more of the items referred to in Article 26, points (1)(a) to (e), of Regulation (EU) No 575/2013 as follows: (a) where the payment institution provides only the payment service referred to in Annex I, point (5), its capital shall at no time be less than EUR 40 000; (b) where the payment institution provides the payment service referred to in Annex I, point (6), its capital shall at no time be less than EUR 50 000; (c) without prejudice to point (a), where the payment institution provides any of the payment services referred to in Annex I, points (1) to (5), its capital shall at no time be less than EUR 150 000; (d) where the payment institution provides payment service referred to in Annex I, point (8), its capital shall at no time be less than EUR 250 000. Where the payment institution provides payment services referred to in more than one of points (b), (c) and (d), the minimum amounts shall be added together. ## Article 6 - Own funds 1. Member States shall require that the payment institution’s own funds do not fall below the amount of initial capital referred to in Article 5, or the amount of own funds either calculated in accordance with Article 7 for payment institutions that do not issue electronic money, or calculated in accordance with Article 8 for payment institutions that issue electronic money, whichever is the higher. 2. Member States shall take the necessary measures to prevent the multiple use of elements eligible for own funds where the payment institution belongs to the same group as another payment institution, credit institution, investment firm, asset management company or insurance undertaking. The same shall also apply where a payment institution has a hybrid character and carries out activities other than providing payment services. 3. Where the conditions laid down in Article 7 of Regulation (EU) No 575/2013 are met, Member States or their competent authorities may choose not to apply Articles 7 or 8 of this Directive, as applicable, to payment institutions which are included in the consolidated supervision of the parent credit institution pursuant to Directive 2013/36/EU. ## Article 7 - Calculation of own funds for payment institutions that do not issue electronic money 1. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions, other than payment institutions that either only offer payment initiation services as referred to in Annex I, point (6), or only offer account information services as referred to in Annex I, point (7), or only both such services, and other than payment institutions that issue electronic money as referred to in Annex I, point (8), to hold own funds calculated in accordance with paragraph 2 at all times. 2. Competent authorities shall require payment institutions to apply, by default, method B as laid down in point b) below. Competent authorities may however decide that, in light of their specific business model, in particular where they only execute a small number of transactions but of a high individual value, payment institutions shall rather apply method A or C. For the purposes of methods A, B and C, the preceding year is to be understood as the 12-month period prior to the moment of calculation. (a) Method A The payment institution’s own funds shall amount to at least 10 % of its fixed overheads of the preceding year. The competent authorities may adjust that requirement in the event of a material change in a payment institution’s business since the preceding year. Where a payment institution has not completed a full year’s business at the date of the calculation, payment institution’s own funds shall amount to at least 10 % of the corresponding fixed overheads as projected in its business plan, unless the competent authorities have required an adjustment to that plan. (b) Method B The payment institution’s own funds shall amount to at least the sum of the following elements multiplied by the scaling factor k referred to in paragraph 3, where payment volume (PV) represents one twelfth of the total amount of payment transactions executed by the payment institution in the preceding year: (i) 4,0 % of the slice of PV up to EUR 5 million; plus (ii) 2,5 % of the slice of PV above EUR 5 million up to EUR 10 million; plus (iii) 1 % of the slice of PV above EUR 10 million up to EUR 100 million; plus (iv) 0,5 % of the slice of PV above EUR 100 million up to EUR 250 million; plus (v) 0,25 % of the slice of PV above EUR 250 million. Where a payment institution has not completed a 12-month period of operation at the date of the calculation, the PV may be based on the total amount of payment transactions as projected in its business plan, unless the competent authority has required an adjustment to that plan. (c) Method C The payment institution’s own funds shall amount to at least the relevant indicator referred to in point (i), multiplied by the multiplication factor referred to in point (ii) and by the scaling factor k referred to in paragraph 3. (i) The relevant indicator shall be the sum of the following: (1) interest income; (2) interest expenses; (3) commissions and fees received; and (4) other operating income. Each element shall be included in the sum with its positive or negative sign. Income from extraordinary or irregular items shall not be used in the calculation of the relevant indicator. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator where the expenditure is incurred from an undertaking subject to supervision under this Directive. The relevant indicator shall be calculated on the basis of the 12-monthly observation at the end of the previous financial year. The relevant indicator shall be calculated over the previous financial year. Own funds calculated in accordance with method C shall not fall below 80 % of the average of the previous 3 financial years for the relevant indicator. When audited figures are not available, business estimates may be used. (ii) The multiplication factor shall be: (1) 10 % of the slice of the relevant indicator up to EUR 2,5 million; (2) 8 % of the slice of the relevant indicator from EUR 2,5 million up to EUR 5 million; (3) 6 % of the slice of the relevant indicator from EUR 5 million up to EUR 25 million; (4) 3 % of the slice of the relevant indicator from EUR 25 million up to 50 million; (5) 1,5 % above EUR 50 million. 3. The scaling factor k to be used in methods B and C shall be: (a) 0,5 where the payment institution provides only the payment service as referred to in point (5) of Annex I; (b) 1 where the payment institution provides any of the payment services as referred to in any of points (1) to (4) of Annex I. 4. Member States shall require that payment institutions other than payment institutions that either only offer payment initiation services as referred to in Annex I, point (6), or only offer account information services as referred to in Annex I, point (7), or only both such services, and other than payment institutions that only issue electronic money as referred to in Annex I, point (8), that also engage in the activities referred to in Article 10, ensure that the own funds held for the services listed in Annex I, points (1) to (5), are not considered as own funds held for the purpose of Article 10, paragraph 4, point (d) or other services not regulated under this Directive. 5. Competent authorities may, based on an evaluation of the risk-management processes, risk loss data base and internal control mechanisms of the payment institution, require the payment institution to hold an amount of own funds which is up to 20 % higher than the amount which would result from the application of the method chosen in accordance with paragraph 2. Competent authorities may permit the payment institution to hold an amount of own funds which is up to 20 % lower than the amount which would result from the application of the method to be applied in accordance with paragraph 2. 6. The EBA shall develop draft regulatory standards in accordance with Article 16 of Regulation (EU) No 1093/2010 concerning the criteria to determine when the payment institution’s business model is such that they only execute a small number of transactions, but of a high individual value, as referred in paragraph 2 of this Article. The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date = 1 year after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010. ## Article 8 - Calculation of own funds for payment institutions that issue electronic money 1. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions offering both the payment services referred to in point (8) of Annex I and any payment services referred to in points (1) to (5) of Annex I, to hold, at all times, own funds calculated in accordance with Article 7 for the provision of payment services referred to in points (1) to (5) of Annex I. 2. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions that only offer the payment service referred to in point (8) of Annex 1 to hold, at all times, own funds calculated in accordance with Method D as set out in paragraph 3. 3. Method D: The own funds shall amount to at least 2 % of the average outstanding electronic money. 4. Member States shall require that payment institutions that both issue electronic money as referred to point (8) of Annex I and offer payment services as referred to in Annex I, points (1) to (5), hold at all times own funds that are at least equal to the sum of the requirements referred to in paragraphs 1 and 2 of this Article. 5. Member States shall allow payment institutions that both issue electronic money as referred to in point (8) of Annex I and (a) offer any of the payment services referred to in points (1) to (5) of Annex I, where those payment services are not linked to the issuance of electronic money referred to in point (8) of Annex 1, or (b) offer any of the activities referred to in Article 10(1) and (4), to calculate their own funds requirements on the basis of a representative portion assumed to be used for the issuance of electronic money referred to in point (8) of Annex 1, provided that such a representative portion can be reasonably estimated on the basis of historical data and to the satisfaction of the competent authorities, where the amount of outstanding electronic money is unknown in advance. Where a payment institution providing the payment service referred to in point (8) of Annex 1 has not completed a sufficient period of business, its own funds requirements shall be calculated on the basis of projected outstanding electronic money evidenced by its business plan subject to any adjustment to that plan required by the competent authorities. ## Article 9 - Safeguarding requirements 1. Member States shall require a payment institution which provides payment services as referred to in Annex I, points (1) to (5), or point (8), to safeguard all funds other than electronic money tokens it has received from payment service users or through another payment service provider for the execution of payment transactions, or where applicable the funds received in exchange for electronic money that has been issued, in one or more of the following ways: (a) the payment institution shall ensure that those funds as soon as possible are no longer commingled with the funds of any natural or legal person other than the payment service users on whose behalf the funds are held; (b) those funds shall be covered by an insurance policy or some other comparable guarantee from an insurance company or a credit institution authorised in a Member State, which does not belong to the same group as the payment institution itself, for an amount equivalent to the amount that would have been segregated in the absence of the insurance policy or other comparable guarantee, payable in the event that the payment institution is unable to meet its financial obligations. For the purposes of the first subparagraph, point (a), where the payment institution still holds the funds and has not yet by the end of the business day following the day when the funds have been received, delivered those funds to the payee or transferred those funds to another payment service provider in order to complete the transfer of the funds to the payee, the payment institution shall do either of the following: (a) deposit those funds either in a separate account in a credit institution authorised in a Member State, or at a central bank at the discretion of that central bank; (b) invest those funds in secure, liquid low-risk assets, as determined by the competent authorities of the home Member State; For the purposes of the first subparagraph, point (a), Member States and payment institutions shall ensure that those funds are insulated in accordance with national law in the interest of the payment service users against the claims of other creditors of the payment institution, in particular in the event of insolvency. By way of derogation from the second subparagraph, point (a), Member States may allow payment institutions to deposit those funds in a separate account in a post office giro institution referred to in Article 2, paragraph 1, point (b), of [Regulation XXX (PSR)], provided that that post office giro institution is established in a Member State and is supervised and subject to prudential requirements comparable to those applied to credit institutions. For the purposes of the first subparagraph, payment institutions shall ensure that they safeguard the amount that corresponds to the claim against the payment institution of the payment service user arising from the provision of payment services. Payment institutions shall inform their payment service users in a clear and transparent manner how funds of the individual user are safeguarded, the insolvency law of which Member State is applicable, and in which Member State a claim is to be raised in the event of the insolvency of the payment institution. By way of derogation from subparagraph 1, and without prejudice to paragraph 4 of this Article, where a payment institution issues electronic money tokens, it shall safeguard the funds received in exchange for the electronic money tokens in accordance with the methods set out in Article 54 of Regulation (EU) 2023/1114. 1a. Funds of payment service users held by a payment institution in settlement accounts with payment systems designated under the Directive 98/26/EC shall be considered as compliant with the requirements set out in paragraph 1 if those funds are not commingled with the funds of any natural or legal person other than payment service users. Member States shall ensure, without prejudice to requirements of Directive 98/26/EC, that funds of payment service users held in settlement accounts with payment systems are insulated in accordance with national law in the interest of payment service users against the claims of other creditors of the payment institution, in particular in the event of its insolvency. The first subparagraph shall apply only to those payment systems where the funds used for settlement are ultimately held in credit institutions or central banks. 2. Where payment institutions use the safeguarding method set out in paragraph 1, first subparagraph, point (a), they shall avoid, where appropriate, concentration risk to safeguarded payment service users' funds. In particular, they shall endeavour not to safeguard all payment service users' funds with one credit institution. 3. Where a payment institution is required to safeguard funds under paragraph 1 and a portion of those funds is to be used for future payment transactions with the remaining amount to be used for services other than payment services, that portion of the funds to be used for future payment transactions shall also be subject to the requirements of paragraph 1. Where that portion is variable or not known in advance, Member States shall allow payment institutions to apply this paragraph on the basis of a representative portion assumed to be used for payment services, provided that such a representative portion can be reasonably estimated on the basis of historical data to the satisfaction of the competent authorities. 4. Funds received for the purpose of issuing electronic money need not be safeguarded until the funds are credited to the payment institution’s payment account or are otherwise made available to the payment institution in accordance with the execution time requirements laid down in Regulation XXX [PSR]. In any event, such funds shall be safeguarded by no later than the end of the business day following the day when the funds have been received, after the issuance of electronic money. A payment institution issuing electronic money shall ensure that holders of that electronic money, both the payment service user having exchanged funds for electronic money and the beneficiary of a payment transaction in electronic money, are always entitled to redemption at par value and upon request, through the issuing payment institution. 5. For the purpose of application of paragraph 1, secure, liquid, low-risk assets are asset items falling into one of the categories set out in Table 1 of Article 336(1) of Regulation (EU) No 575/2013 for which the specific risk capital charge is no higher than 1,6 %, but excluding other qualifying items as defined in Article 336(4) of that Regulation. For the purposes of paragraph 1, secure, liquid, low-risk assets are also units in an undertaking for collective investment in transferable securities (UCITS) which invests solely in assets as specified in the first subparagraph. In exceptional circumstances and with a proper justification, the competent authorities may, based on an evaluation of security, maturity, value or other risk elements of the assets as specified in the first and second subparagraphs, determine which of those assets shall not be considered as secure, low-risk assets for the purposes of paragraph 1. 6. A payment institution shall inform the competent authorities in advance of any material change in measures taken for safeguarding of funds received for payment services provided and in case of the payment service referred to in Annex I, point (8), in exchange for electronic money issued. 7. The EBA shall develop regulatory technical standards on safeguarding requirements, laying down in particular safeguarding risk management frameworks for payment institutions to ensure protection of users’ funds, and including requirements on segregation, designation, reconciliation and calculation of safeguarded funds. They shall in particular specify the circumstances in which it is appropriate to avoid concentration risks as referred to in paragraph 2 of this Article, taking into account the principle of proportionality, and requirements on segregation and reconciliation of payment service users' funds held in settlement accounts pursuant to paragraph 1a of this Article. The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 1 year after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. ## Article 10 - Activities 1. In addition to the provision of payment services, payment institutions shall be entitled to engage in the following activities: (a) the provision of operational and closely related ancillary services, including, foreign exchange services, safekeeping activities, and the storage and processing of data; (b) the operation of payment systems; (c) business activities other than the provision of payment services, having regard to applicable Union and national law. 2. For the purpose of providing payment services, payment institutions shall hold, or maintain for its payment service users, only payment accounts which are used exclusively for payment transactions. 3. Any funds received by payment institutions from payment service users to provide payment services shall not constitute a deposit or other repayable funds within the meaning of Article 9 of Directive 2013/36/EU. 4. Payment institutions may grant credit relating to the payment services referred to in Annex I, points (2) to (4), subject to the following conditions: (a) the credit is ancillary to, and granted exclusively in connection with, the execution of a payment transaction; (b) notwithstanding national rules, if any, on providing credit by issuers of credit cards, the credit granted in connection with a payment and executed in accordance with Article 13(6) and Article 30 is to be repaid within a reasonably short period, which shall in no case exceed 12 months; (c) the credit granted does not come from the funds received or held for executing a payment transaction or from the funds which have been received from payment services users in exchange for electronic money and held in accordance with Article 9, paragraphs 1 and 1a; (d) the own funds of the payment institution are at all times and to the satisfaction of the supervisory authorities appropriate in view of the overall amount of credit granted. 5. Payment institutions shall not take deposits or other repayable funds within the meaning of Article 9 of Directive 2013/36/EU. 6. Payment institutions that issue electronic money shall exchange any funds, including cash or scriptural money, received by that payment institution from payment service users for electronic money without delay. Such funds shall neither constitute a deposit, nor other repayable funds received from the public within the meaning of Article 9 of Directive 2013/36/EC. 7. This Directive shall be without prejudice to Directive 2008/48/EC, other relevant Union law or national measures regarding conditions for granting credit to consumers not harmonised by this Directive that comply with Union law. ## Article 11 - Accounting and statutory audit 1. Council Directive 86/635/EEC22, Directive 2013/34/EU and Regulation (EC) No 1606/2002 of the European Parliament and of the Council23, shall apply to payment institutions mutatis mutandis. 2. Unless exempted under Directive 2013/34/EU and, where applicable, Directive 86/635/EEC, the annual accounts and consolidated accounts of payment institutions shall be audited by statutory auditors or audit firms as defined in Article 2, points 2 and 3, of Directive 2006/43/EC. 3. For supervisory purposes, Member States shall require that payment institutions provide separate accounting information for, on the one hand, payment services, and, on the other hand, the activities referred to in Article 10(1), which shall be subject to an auditor’s report. That report shall be prepared, where applicable, by the statutory auditors or an audit firm. 4. The obligations laid down in Article 63 of Directive 2013/36/EU shall apply mutatis mutandis to the statutory auditors or audit firms of payment institutions in respect of payment services. 22 Council Directive 86/635/EEC of 8 December 1986 on the annual accounts and consolidated accounts of banks and other financial institutions (OJ L 372, 31.12.1986, p. 1). 23 Regulation (EC) No 1606/2002 of the European Parliament and of the Council of 19 July 2002 on the application of international accounting standards (OJ L 243, 11.9.2002, p. 1). ## Article 12 - Record-keeping Member States shall require payment institutions to keep all appropriate records for the purpose of this Title for at least 5 years, without prejudice to Directive (EU) 2015/849 or other relevant Union law. When such records include personal data, the payment institution shall not keep those records for longer than necessary for the purpose of this Title. Where there is a withdrawal of the authorisation of the payment institution in accordance with Article 16, records that include personal data shall not be kept more than 5 years after the authorisation has been withdrawn. ## Article 13 - Granting of authorisation 1. Member States shall authorise an applicant payment institution for the payment services it intends to provide, provided that the applicant payment institution: (a) is a legal person established in a Member State; (b) has submitted to its competent authorities the information referred to in Article 3(3) or Article 3(3a) respectively; (c) has taken into account the need to ensure the sound and prudent management of the applicant payment institution, robust governance arrangements for the payment services it intends to provide, including: (i) a clear organisational structure with well-defined, transparent and consistent lines of responsibility; (ii) effective procedures to identify, manage, monitor and report the risks to which the applicant payment institution is or might be exposed; (iii) adequate internal control mechanisms, including sound administration and accounting procedures. (d) has the initial capital referred to in Article 5; (e) complies with Article 3(4). The governance arrangements and control mechanisms referred to in point (c) shall be comprehensive and proportionate to the nature, scale and complexity of the payment services the applicant payment institutions intend to provide. By [OP please insert the date: one year after the date of entry into force of this Directive], the EBA shall adopt guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Directive, on the arrangements, processes and mechanisms referred to in this paragraph. 2. Competent authorities of the home Member State shall grant an authorisation if the information and evidence accompanying the application complies with all of the requirements laid down in Article 3 and if the competent authorities’ overall assessment, having scrutinised the application, is favourable. Before granting an authorisation, the competent authorities may, where relevant, consult the national central bank or other relevant public authorities. 2a. Without prejudice to paragraph 2, competent authorities of the home Member State shall decide on the authorisation within 60 business days where a crypto-asset service provider that has been authorised as crypto-asset service provider in accordance with Article 63 of Regulation (EU) 2023/1114 intends to provide payment services only with electronic money tokens. The period as set out in first subparagraph shall commence upon receipt by the competent authority of the home Member State of the application and the information to be submitted pursuant to Article 3(3a). Where the competent authority concludes that an application is not complete, it shall immediately inform the applicant crypto-asset provider thereof, specifying the missing or incomplete information, and set a deadline by which that applicant is required to provide the missing information. The period as set out in the first subparagraph shall be suspended until the information is provided or on the expiry of that deadline, whichever comes sooner. The competent authority may, in accordance with the procedure described above, continue to request any missing or incomplete information until the application is complete. If an authorisation is granted, it shall be limited to the provision of services specified in the application. 3. A payment institution which, under the national law of its home Member State, is required to have a registered office, shall have its head office in the same Member State as its registered office and shall carry out a part of its payment service business there. The competent authorities of the Member State where the payment institution is to have its registered office shall however not require the payment institution to carry out the majority of its business in the country where it will have its registered office. 4. Competent authorities may, as a condition for authorisation, require that the applicant payment institution establishes a separate entity for the provision of the payment services referred to in Annex I, points (1) to (6) and (8), where the applicant payment institution is engaged in other business activities that may impair, or is likely to impair, either the financial soundness of the applicant payment institution or the ability of the competent authorities to monitor the applicant payment institution’s compliance with this Directive. 5. Competent authorities shall refuse to authorise an applicant payment institution in any of the following cases: (a) where, taking into account the need to ensure the sound and prudent management of the payment institution, those competent authorities are not satisfied as to the suitability of the shareholders or members that have qualified holdings; (b) where there are close links as defined in Article 4(1), point (38), of Regulation (EU) No 575/2013 between the payment institution and natural or legal persons that do prevent the effective exercise of the supervisory functions of the competent authorities; (c) where the laws, regulations, or administrative provisions of a third country governing one or more natural or legal persons with which the payment institution has close links as defined in Article 4(1), point (38), of Regulation (EU) No 575/2013, or difficulties involved in the enforcement of those laws, regulations or administrative provisions, prevent the effective exercise of the supervisory functions of the competent authorities. 6. An authorisation shall be valid in all Member States and shall allow the payment institution concerned to provide the payment services that are covered by the authorisation throughout the Union, pursuant to the freedom to provide services or the freedom of establishment. ## Article 14 - Communication of the decision to authorise or refuse authorisation Within 3 months of receipt of an application for authorisation as referred to in Article 3, or, where such application is incomplete, of all of the information referred to in Article 3(3) required for the decision, the competent authorities shall inform the applicant whether the authorisation is granted or refused. The competent authority shall give reasons where it refuses an authorisation. ## Article 15 - Maintenance of the authorisation as a payment institution Member States shall require payment institutions to, without undue delay, inform their competent authority of any change in the information and evidence provided in accordance with Article 3 which may affect the accuracy of that information or evidence. ## Article 16 - Withdrawal of the authorisation as a payment institution 1. Competent authorities of the home Member State may withdraw an authorisation issued to a payment institution only where: (a) the payment institution has not made use of its authorisation within 12 months after it has obtained that authorisation, or has not provided any of the services for which it has been authorised for more than six successive months; (b) the payment institution has explicitly renounced that authorisation; (c) the payment institution no longer meets the conditions for granting the authorisation or fails to inform the competent authority on major developments in this respect; (d) the payment institution has obtained the authorisation based on false statements or any other irregular means; (e) the payment institution has breached its obligations in terms of money laundering or terrorist financing prevention under Directive (EU) 2015/849; (f) the continued provision of the payment services by the payment institution would threaten the stability of, or the trust in, the payment system; (g) the payment institution falls within one of the cases where national law provides for such withdrawal. 2. The competent authority shall give reasons for any withdrawal of an authorisation and shall inform those concerned accordingly. 3. The competent authority shall make public the withdrawal of an authorisation, including in the registers or lists referred to in Articles 17 and 18. ## Article 17 - Register of payment institutions in the home Member State 1. Member States shall operate and maintain, free of charge, a public electronic register of payment institutions, including entities registered in accordance with Articles 34, 36, 38, and of their agents. Member States shall ensure this register contains all of the following information (a) payment institutions authorised in accordance with Article 13 and their agents, if any; (b) natural and legal persons registered in accordance with Articles 34(2), 36(1) or 38(1) and their agents, if any; (c) the institutions referred to in Article 1(2) that are entitled under national law to provide payment services. Branches of payment institutions shall be entered in the register of the home Member State if those branches provide services in a Member State other than their home Member State. 2. The public register referred to in paragraph 1 shall: (a) identify the payment services and the respective brands for which the payment institution has been authorised, or for which the natural or legal person has been registered; (b) include the agents through which the payment institution provides payment services, and specify the services these agents carry out on behalf of the payment institution; (c) include the other Member States where the payment institution is active and indicate the date when these passported activities started. 3. Member States shall ensure that payment institutions are listed in the register referred to in paragraph 1 separately from natural and legal persons registered in accordance with Articles 34, 36 or 38, and that that register is publicly available for consultation, accessible online, and updated without delay. 4. Competent authorities shall enter in the public register dates of authorisation or registration, any withdrawal of authorisation, suspension of authorisation, and any withdrawal of a registration pursuant to Articles 34, 36 or 38. 5. Competent authorities shall notify the EBA without any undue delay of the reasons for the withdrawal of the authorisation or registration, suspension of authorisation or registration, or of any exemptions pursuant to Article 34, 36 or 38.