PSD3 Final Text: EMI Licence Merger, Virtual Card Deadline

The final text landed in April. It bites in 2028.

On 23 April 2026 the Council of the EU published the final compromise texts of PSD3, the recast directive, and the PSR, the payment services regulation. In plain terms: the rewrite of Europe's payment rulebook is done negotiating. Clifford Chance expects formal adoption in the Official Journal by late spring or early summer 2026, with most rules applying 21 months after entry into force. That lands in the first half of 2028. The verification of payee service gets 27 months.

Two years sounds like breathing room. For virtual card users it is the opposite. The homework upstream issuers do, or skip, in that window decides whether your card still authorises in 2028.

The EMI licence is about to stop existing

For roughly fifteen years the virtual card industry sat on one load-bearing brick: the electronic money institution licence, the EMI. If you top up a card with USDT, odds are the actual issuer holds an EMI licence, most often out of Lithuania or Malta. Initial capital of 350,000 euros. Too heavy for a shell company, too light for a bank. The exact sweet spot for issuing cards without becoming one.

PSD3 pulls that brick out. The final text repeals the second E-Money Directive entirely. Issuing e-money becomes one more payment service on a single payment-institution licence, and the EMI as a separate category disappears.

The capital numbers moved in both directions. Per Article 5 of the agreed text: initial capital for e-money issuance drops from 350,000 to 250,000 euros, money remittance rises from 20,000 to 40,000, most payment services rise from 125,000 to 150,000, and a firm doing both e-money and payments needs a combined 400,000. One caveat. These figures come from the April compromise text and can still shift before publication in the Official Journal. Fintechlex checked them against the text itself, and the PwC client alert carries the same warning.

The 27-month reapplication is not a rubber stamp

Existing EMIs and payment institutions do not get their licences swapped for new ones. They get a test. Firms must submit reapplication evidence within 21 months of entry into force, with grandfathering for up to another six months, 27 in total. Regulators will check capital, the safeguarding set-up, and whether the firm has a credible wind-down plan, including how critical outsourced activities survive a failure. Firms that pass get automatic confirmation. Firms that fail get suspended.

Translated for card users: mid-2028 is a hard deadline. Any issuer still unauthorised by then stops operating, and card authorisations die the moment it does. No issuer will email a platform's customers first. We have seen this movie. In September 2026 one platform's users lost their cards within an hour when the upstream issuer was switched, see our issuer-switch incident analysis.

Safeguarding goes from T+5 to T+1

The other substantive change hits fund custody. Under the current regime an EMI can wait five business days before placing customer funds in a safeguarding account. That slack is exactly where sloppy operators park float in operating accounts. PSD3 compresses it to T+1: funds must be safeguarded by the end of the next business day.

What this means for you: the window for a platform to borrow your balance for its own working capital shrinks dramatically. Add the mandatory wind-down plan, meaning a documented path to return client money if the firm fails, and the separation of customer funds from platform funds moves from principle to procedure. Our earlier custody-tier and licence checklist made the point that licence type sets the ceiling on protection. PSD3 does not change that logic. It raises the floor.

The crypto angle: e-money tokens get a doorway

Crypto-funded cards pick up one more thread. The final text lets licensed payment institutions provide certain crypto services on e-money tokens, the stablecoins pegged to a single fiat currency, by notifying their regulator 40 working days in advance. No separate MiCA licence needed. Funds exchanged for e-money tokens are safeguarded under Article 54 of MiCA.

The EU has already delisted non-compliant USDT, and euro-stablecoin card rails are filling the gap, see our piece on EURC direct top-ups. PSD3 effectively builds an express lane for the licensed-institution-plus-compliant-stablecoin card route, while unlicensed crypto intermediaries get squeezed further toward the wall. Same direction as the issuing dual-track shift we documented earlier.

Four checks before 2028

• Separate operator from issuer. The EMI badge in a platform's footer usually describes its upstream issuing partner, not the platform itself. Take the issuer's licence number and home country, then look it up in the regulator's public register.
• Watch reapplication status, not licence category. From 2027 national regulators will start publishing reconfirmation outcomes. An issuer on a suspension list is your cue to move.
• Read the safeguarding and wind-down disclosures. A platform still vague about custody after T+1 takes effect deserves suspicion.
• Prefer licensed EMT rails for stablecoin top-ups. The PSD3-plus-MiCA path has a defined legal interface, and the grey route's room to run keeps shrinking. Our MiCA licence audit method still applies.

The read

PSD3 will not switch off any card tomorrow. What it does is put a date on the upstream shakeout. Between 2027 and 2028 a batch of small EMIs will fail reconfirmation: a capital shortfall, no wind-down plan, a safeguarding mechanism that does not comply. Any one of the three is fatal. "Backed by a European EMI" is a sentence losing value by the month, since the category itself is on its way out. After 2028 the credible claim reads "licensed payment institution with e-money issuance permission" plus a register number you can verify. The user-side move is simple to say and rarely done: upgrade from checking badges to checking registers and disclosures. Not pessimism. For once this trade gets rules you can actually audit, which is good news for the operators who took compliance seriously all along.

Further reading: PSD3 and Payment Passkeys. Primary sources: the Clifford Chance briefing "Impact of PSD3" (cliffordchance.com) and the PwC RegCore client alert (legal.pwc.de).