This report follows up on the EBA's peer review of the authorisation of payment institutions and electronic money institutions under PSD2. It assesses the implementation of the 2023 recommendations regarding authorisation processes, governance, internal controls, and anti-money laundering frameworks. While improvements have been noted, significant differences persist among Member States in the application of…
This report, published in 2025 by the European Banking Authority (EBA), constitutes a follow-up to the peer review conducted in 2023 on the authorizations of payment institutions (PIs) and electronic money institutions (EMIs) under the Payment Services Directive 2 (PSD2). It covers the period 2022-2024 and analyzes the implementation of previous recommendations by 29 competent authorities (CAs) in the European Union and the European Economic Area. Topics addressed include authorization processes, authorities' resources, application of EBA guidelines, governance and internal control mechanisms, AML/CFT frameworks, and local substance requirements.
This report assesses the progress made by competent authorities in implementing recommendations from the 2023 report on the authorization of PIs and EMIs under PSD2. It notes a general decrease in new authorization requests between 2022 and 2024 compared to 2019-2021, except in some Member States where volumes increased, often due to proactive national strategies. Processing times vary widely, ranging from 4-6 months to 27 months, with a median of 9.5 months excluding outliers. These prolonged delays are mainly due to incomplete or low-quality files and candidates' response times. Authorities have taken measures to improve efficiency, such as clearer guides, increased preliminary engagement, and optimized internal procedures, but some delays persist. Regarding the application of EBA guidelines, progress is notable, especially in business plan evaluation and AML/CFT controls, although gaps remain. Most authorities apply the three lines of defense model for governance, but divergences in its formalization complicate practice comparisons. In AML/CFT, several authorities have strengthened their controls, but deficiencies remain, notably in ML/TF risk assessment, branch supervision, and AML/CFT officer verification. Concerning local substance, all authorities verify effective management from the home Member State, but criteria differ, potentially encouraging regulatory arbitrage. In conclusion, despite improvements and a trend toward convergence, significant divergences remain, posing risks to market fairness and AML/CFT control robustness. The report recommends continuing efforts to close these gaps and harmonize practices.
The report follows the 2023 peer review which analyzed the authorization processes of PIs and EMIs under PSD2 over the 2019-2021 period, identifying good practices but also gaps, notably in authorities' resources, application of EBA guidelines, governance, internal controls, and local substance. The objective is to assess, two years later, the adequacy and effectiveness of measures taken by competent authorities in response to recommendations, based on their self-assessments and clarifications. The scope covers 29 competent authorities and focuses on points affecting a significant number of them. The methodology excludes on-site verifications and relies on documentary analysis. The report aims to inform on progress made, persistent challenges, and harmonization needs, while highlighting limitations related to the quality of data provided.
Volume and evolution of requests: The majority of authorities observed a decrease in new authorization requests between 2022 and 2024 compared to 2019-2021, attributed notably to the end of Brexit-related requests, market maturity, and macroeconomic factors. Some authorities (MT, CY, LV, PT, etc.) recorded an increase linked to national strategies favorable to fintech and regulatory changes (p. 7-10).
Duration of authorization processes: Processing times vary from 4-6 months to 27 months (CY), with a median of 9.5 months excluding outliers. These durations largely exceed the regulatory deadline of 3 months after completeness. Main causes are incomplete files, late candidate responses, increasing complexity of business models, resource constraints, and the need to involve multiple authorities (p. 10-13).
Resources of competent authorities: Staff dedicated to processing vary greatly, from less than one FTE to more than 21 FTEs (DE). About half of authorities consider their resources adequate, but this does not guarantee short delays. Some authorities have increased their staff or optimized processes, others have not. Coordination with other missions and increased file complexity are challenges (p. 13-14).
Processes and improvements: Several authorities have improved their processes through clear guides, reinforced preliminary engagement, strict completeness checks, and better internal coordination. Pre-selection of files has become common and effective to improve request quality, but should not mask the total process duration (p. 15-18).
Application of EBA guidelines: Progress has been made, notably in Sweden for business plan evaluation and in Hungary for AML/CFT controls. Six authorities have fully implemented completeness confirmation, while others remain partially or non-compliant, notably due to confirmations based on formal checks without substantive review (p. 20-23).
Governance and internal control: Most authorities apply the three lines of defense model proportionally, but with significant divergences in formalization and application. Some authorities do not systematically assess the qualifications of control function officers, and gaps remain in the review of outsourcing contracts (p. 24-28).
AML/CFT framework: Measures have been taken to strengthen ML/TF risk assessment, branch control systems, and AML/CFT officer competence, but gaps persist. Some authorities have not defined objective criteria or apply only expert judgment, which is insufficient. Minimum experience requirements for AML/CFT officers are sometimes low (p. 29-32).
Local substance: All authorities verify effective management from the home Member State, but criteria vary greatly, ranging from strict residency rules to more flexible approaches based on credible evidence. Most also assess the target clientele in the home country, except Sweden which does not for legal reasons. These divergences create risks of regulatory arbitrage (p. 33-36).
Findings:
- General decrease in authorization requests in 2022-2024 compared to 2019-2021, except in some Member States.
- Very variable processing times, often exceeding the regulatory deadline of 3 months.
- Highly heterogeneous human resources dedicated among authorities.
- Partial to complete implementation of recommendations on EBA guidelines.
- Majority adoption of the three lines of defense model, but variable formalization.
- Improvements in AML/CFT controls, but persistent gaps.
- Widespread verification of local substance, but divergent criteria.
Hypotheses:
- Variations in request volumes are linked to macroeconomic, regulatory, and national strategic factors.
- Prolonged delays are mainly attributable to file quality and available resources.
Interpretations:
- Divergences in rule application and practices may create an uneven playing field and encourage regulatory arbitrage.
- Recent improvement measures could reduce delays in the medium term.
Uncertainties:
- Evaluation of measure effectiveness is limited by the quality and nature of data provided by authorities.
- The impact of recent reforms on delays and authorization quality remains to be confirmed.
The report highlights notable progress in implementing the 2023 recommendations, notably in improving authorization processes, applying EBA guidelines, governance, AML/CFT controls, and verifying local substance. However, persistent divergences in practices and requirements among competent authorities remain, posing risks of regulatory arbitrage and unequal treatment. Some authorities have not yet implemented adequate measures to ensure reasonable processing times or to strengthen AML/CFT controls. The report recommends that all authorities continue to monitor and improve their processes, particularly by reinforcing convergence of practices in governance, internal control, AML/CFT, and local substance, to guarantee a high and homogeneous level of protection and supervision in the European Union.
Synthesis note written from the full document by DataSAI Academy. This note comes from the scientific library of the DataSAI Academy, open to all.