A new chapter for European payments

Europe’s payments landscape has changed considerably since the introduction of the Second Payment Services Directive (PSD2). Digital wallets, embedded finance, instant payments and increasingly complex payment ecosystems have transformed how money moves between consumers, businesses and financial institutions.

The regulatory framework is now evolving to reflect that reality. The Third Payment Services Directive (PSD3), alongside the new Payment Services Regulation (PSR), represents one of the most significant updates to European payments regulation in recent years.

The objectives are clear: strengthen consumer protection, reduce payment fraud, improve competition and address regulatory inconsistencies across the European Union.

Yet one area deserves particular attention from payment institutions, electronic money providers and their finance and compliance teams: the safeguarding of customer funds.

Safeguarding has long been a regulatory obligation. What is changing is the level of attention being placed on how institutions protect customer money, manage related risks and demonstrate that their arrangements work in practice.

At the centre of this challenge sits a fundamental financial control: reconciliation.

PSD3 and PSR: What is changing?

The European Commission introduced its payment services reform package in June 2023 to address limitations in the existing PSD2 framework. The reform consists of two closely connected legislative instruments.

• PSD3 primarily addresses authorisation, prudential requirements and supervision. It establishes the regulatory framework governing payment institutions, including institutions providing electronic money services, and covers matters such as licensing, governance, financial requirements and safeguarding.

• The PSR focuses on the conduct of payment services. It introduces more harmonised rules concerning payment transactions, consumer rights, fraud prevention, transparency and access to payment account information.

This separation is important. While directives require implementation through national legislation, regulations generally apply directly across EU Member States once their application date arrives. Together, PSD3 and the PSR aim to create a more consistent European payments market.

Several developments stand out.

• Stronger fraud prevention and customer protection. Payment service providers will face expanded requirements around fraud monitoring, verification of payee information and the handling of certain fraudulent transactions. The reforms also strengthen the framework for authentication and customer reimbursement.

• More consistent open banking. The new rules seek to reduce obstacles faced by authorised third-party providers accessing payment account information, while giving customers greater transparency and control over access permissions.

• A more harmonised supervisory framework. PSD3 brings the regulatory treatment of payment institutions and electronic money institutions closer together. Existing institutions will need to demonstrate their continued compliance with the new requirements under the applicable transitional arrangements.

• Greater attention to operational resilience and governance. Institutions will need to review how their compliance obligations are reflected in internal controls, external service relationships and operational processes.

• Stronger safeguarding provisions. The reform clarifies and develops requirements for protecting customer funds, including segregation, concentration risk, safeguarding arrangements and future technical standards for reconciliation.

Following political agreement in November 2025, the Council adopted its first-reading position on 29 October 2026. As of November 2026, final adoption by the European Parliament remains pending.

The legal direction is therefore increasingly clear, although the precise application timetable and some technical requirements are not yet final.

For payment institutions, the important question is no longer simply what the legislation will say. It is whether their existing processes can demonstrate compliance reliably when the new framework applies.

Safeguarding: Protecting the money behind every payment

Safeguarding is a fundamental protection within European payments regulation.

Payment institutions frequently receive and temporarily hold funds belonging to customers while processing payment transactions. Electronic money institutions, meanwhile, issue monetary value against funds received from customers.

These institutions do not necessarily operate under the same deposit-taking and prudential framework as banks. Safeguarding requirements therefore play an important role in protecting payment service users, particularly if an institution becomes insolvent.

Under the existing PSD2 framework, institutions subject to safeguarding obligations must protect relevant customer funds through permitted arrangements. These generally include:

• Segregating customer funds from other funds and placing them in appropriately protected accounts or qualifying low-risk assets, or

• Using an eligible insurance policy or comparable guarantee.

The purpose is to prevent protected customer funds from becoming available to satisfy the institution’s ordinary creditors in the event of insolvency, subject to the applicable legal framework.

Importantly, safeguarding is not simply a requirement to hold enough cash somewhere within the organisation. The institution must determine which funds require protection, apply an appropriate safeguarding method and maintain arrangements that satisfy the relevant legal requirements.

That distinction becomes especially important as payment operations grow in complexity. A payment institution may process transactions across several countries, currencies, banking relationships and settlement systems. Funds may be received through intermediaries, allocated to individual merchants, transferred between accounts or held pending settlement.

Every movement potentially affects the amount that must be safeguarded.

As transaction volumes increase, the difficulty lies not only in protecting customer funds but in maintaining an accurate, current and verifiable understanding of the institution’s safeguarding position.

What PSD3 changes for safeguarding

Article 9 of the proposed PSD3 establishes the new framework for safeguarding requirements. Several provisions are particularly relevant for payment institutions and electronic money providers.

1. Clearer requirements around the timing of safeguarding

The Council’s October 2026 text requires institutions using segregation-based safeguarding to separate relevant customer funds from other parties’ funds as soon as possible.

Where funds remain with the institution and have not been delivered to the payee or transferred to another payment service provider by the end of the following business day, they must be placed in an appropriate separate account or invested in qualifying secure, liquid, low-risk assets.

The text also specifies safeguarding timing for funds received in exchange for electronic money, strengthening the alignment of the payment services and electronic money regimes.

For institutions managing continuous inflows and outflows, this places particular importance on reliable transaction timestamps, accurate balance calculations and clear processing cut-offs.

2. Greater attention to concentration risk

The proposed framework explicitly addresses concentration risk in safeguarding arrangements. Institutions using segregation-based safeguarding are expected to avoid excessive concentration where appropriate and endeavour not to place all safeguarded customer funds with a single credit institution.

The objective is to reduce the dependency of customer-fund protection on one banking counterparty.

Operationally, this introduces additional considerations. Using several safeguarding banks can reduce concentration risk, but it also creates more accounts, data sources, settlement movements and reconciliation requirements.

A more diversified safeguarding structure therefore requires effective consolidated oversight.

3. Stronger transparency and governance

The proposed rules require institutions to provide customers with clear information about how their funds are safeguarded, including relevant insolvency arrangements. Institutions must also inform competent authorities in advance of material changes to their safeguarding measures.

This makes safeguarding governance an ongoing responsibility rather than a control assessed only during initial authorisation.

4. Dedicated technical standards for safeguarding

One of the most significant developments appears in Article 9(8).

The proposed provision directs the European Banking Authority (EBA) to develop regulatory technical standards covering safeguarding risk-management frameworks, including requirements concerning segregation, designation, reconciliation and the calculation of safeguarded funds. These standards are also expected to address concentration risk and the treatment of relevant settlement accounts.

The EBA would be required to submit its draft standards within 12 months of PSD3 entering into force.

The final technical details remain to be developed. In particular, it would be premature to claim that PSD3 already mandates a universal reconciliation frequency or a specific software approach for every institution.

Nevertheless, the legislative direction is significant.

Safeguarding reconciliation is explicitly recognised as an element of the regulatory control framework, not merely an internal accounting activity.

Why safeguarding reconciliation matters

A safeguarding arrangement can be legally well designed and still depend on financial information that is incomplete, delayed or incorrect.

Consider a payment institution holding customer funds across several bank accounts. Its internal records show the amounts owed to individual payment service users. Its banking partners hold the corresponding funds. Its payment processing systems record transactions moving through various stages of settlement.

The institution must be able to demonstrate that these records are consistent and that the funds requiring protection are adequately safeguarded. That is where safeguarding reconciliation becomes essential.

In practical terms, safeguarding reconciliation establishes whether the institution’s safeguarding requirement is accurately calculated and supported by eligible safeguarded funds or other permitted protection arrangements. It typically involves two related dimensions.

• Internal reconciliation verifies the consistency of customer-level records, payment processing data, subledgers and relevant accounting balances. It helps establish the amount the institution owes to payment service users and therefore the amount that requires safeguarding.

• External reconciliation compares the established safeguarding requirement with evidence of the assets or other eligible arrangements protecting those obligations. This can involve bank statements, designated safeguarding accounts, qualifying investments or relevant guarantees.

These controls are related but not interchangeable.

A bank account may reconcile perfectly to the general ledger while the institution has nevertheless calculated its customer liabilities incorrectly. Similarly, an institution may hold sufficient aggregate cash but fail to meet applicable segregation or legal protection requirements.

A balanced ledger does not, by itself, prove that customer funds are properly safeguarded.

Effective safeguarding reconciliation must address both the financial amount and the regulatory treatment of the funds.

Where safeguarding reconciliation becomes operationally complex

In theory, reconciliation is straightforward: determine the amount that must be safeguarded and verify that adequate protection exists.

In practice, payment institutions operate across systems that record different stages of the same financial transaction. A customer’s payment may be authorised in one system, captured in another, settled through a payment network and reflected in a bank statement at a later point. Meanwhile, the customer’s corresponding balance or the institution’s settlement obligation may already have changed.

Several factors make this difficult.

Timing differences between financial systems

Payment processing systems and bank statements rarely operate on identical timelines. Transactions may cross settlement cut-offs, weekends, bank holidays or time zones. Instant payment services introduce further complexity by making funds move continuously rather than within a small number of settlement windows.

Reconciliation must distinguish legitimate timing differences from actual safeguarding discrepancies.

Multiple banks, entities and currencies

Institutions operating internationally may maintain different safeguarding arrangements across subsidiaries, jurisdictions and currencies. A complete safeguarding position may depend on information from several banks and internal ledgers.

Foreign exchange transactions, bank-specific statement formats and movements between safeguarding accounts add further complexity.

Refunds, chargebacks and unsettled transactions

A payment is not necessarily final when it first appears in a processing system. Refunds, chargebacks, reversals and transactions awaiting settlement can affect the amount owed to customers.

If these changes are not consistently reflected across systems, the calculated safeguarding requirement may become inaccurate.

Exceptions that remain unresolved

Even where a reconciliation process identifies discrepancies, resolving them can require additional work. Teams may need to retrieve bank confirmations, investigate transaction histories, clarify settlement arrangements or request corrections from other departments.

This is frequently where the process becomes dependent on spreadsheets, emails and individual experience.

The problem is not always that an exception cannot be identified. It is that identifying the exception does not automatically resolve it.

From matching balances to demonstrating control

The next stage in safeguarding reconciliation is not simply a higher matching rate. It is the ability to demonstrate that the entire control process works consistently, including when transactions do not match.

An illustrative scenario

A payment institution calculates that it has €25 million in customer liabilities requiring safeguarding at a defined reporting cut-off. Its reconciliation identifies €24.98 million in eligible safeguarded assets.

The €20,000 difference requires investigation. It could reflect a timing difference, an omitted bank transaction, an incorrectly classified customer balance or a genuine safeguarding shortfall.

The aggregate numbers alone do not establish the cause.

An effective control process must identify the underlying transactions, apply the institution’s approved reconciliation rules and determine the appropriate next action.

• If the discrepancy is explained by a legitimate timing difference, the supporting evidence and subsequent settlement must be documented.

• If the discrepancy represents a genuine shortfall, it must be escalated and addressed in accordance with applicable safeguarding requirements and the institution’s policies.

In both cases, the objective is a verified and documented outcome.

This distinction matters because reconciliation controls should not end when a difference is identified. They should establish what happened, why it happened, who is responsible for resolving it and how the final result can be demonstrated.

That is the difference between a reconciliation report and an effective safeguarding control.

The future of safeguarding reconciliation: Continuous, governed and auditable

PSD3 creates an opportunity for payment institutions to reconsider how safeguarding reconciliation is designed and operated.

Historically, many financial controls have developed around periodic reporting and manual review. Payment volumes, however, increasingly operate continuously. Institutions can process large numbers of transactions across different systems and counterparties while their finance teams remain responsible for proving the resulting balances.

The long-term direction is therefore towards reconciliation processes that are more closely connected to the underlying transaction flows. Three capabilities will be particularly important.

Reliable calculations based on approved rules

The calculation of safeguarding requirements must follow defined and validated logic. Institutions need clarity about which balances fall within scope, how individual transactions affect customer liabilities and what adjustments are permissible.

These calculations should be reproducible and traceable to the relevant underlying records.

Exception management that leads to resolution

A reconciliation process should distinguish between matched positions, explainable timing differences and discrepancies that require investigation.

Unresolved items need clear ownership, appropriate escalation and documented outcomes. The financial importance of an exception should also inform how quickly it is addressed.

Evidence that stands up to scrutiny

A safeguarding reconciliation should produce more than a final balance. It should preserve the information required to demonstrate how that balance was established.

This includes relevant source records, calculation rules, reconciliation results, outstanding differences, approvals, corrections and timestamps.

For finance leaders, compliance teams and auditors, that evidence is essential to understanding whether a control has operated effectively.

The direction is towards a more complete operational model: one in which safeguarding positions are calculated, verified, investigated and documented through governed processes.

What role should AI play?

Artificial intelligence can support the development and operation of more effective finance processes, but safeguarding requires a careful distinction between interpretation and financial control.

AI can help institutions understand unfamiliar data formats, accelerate the development of reconciliation logic and support the investigation of complex exceptions. It may also help finance teams interpret unstructured supporting information or identify recurring sources of discrepancies.

But the regulatory calculation itself should not depend on an opaque, probabilistic decision.

Where a safeguarding requirement can be established through defined financial rules, those rules should be reviewed, approved and executed consistently. The same inputs and approved logic should produce the same result.

Human expertise remains essential for policy interpretation, material exceptions, financial decisions and control ownership.

At Valurec, we believe the real value of automation in regulated finance lies in creating processes that are not only faster, but more reliable, transparent and auditable.

That means combining the flexibility of modern technology with the discipline of established financial controls. AI can support the development and improvement of reconciliation processes, while approved rules, clear responsibilities and traceable decisions provide the reliability that safeguarding requires.

The objective is not to introduce AI into every transaction. It is to build financial processes that remain accurate, explainable and controlled as transaction volumes grow.

Preparing for PSD3: What payment institutions should prioritise now

Institutions do not need to wait for every technical standard to be finalised before evaluating their safeguarding controls.

A sensible starting point is to understand how safeguarding requirements are calculated today and how that calculation connects to the actual movement of customer funds. That requires a clear view of the underlying transaction lifecycle, relevant customer liabilities, financial systems, safeguarding accounts and responsible legal entities.

The next step is to assess whether existing reconciliations provide sufficient coverage and evidence:

• Can the institution establish its safeguarding requirement at the appropriate cut-off?

• Can it demonstrate the eligible arrangements protecting that amount?

• Can it identify discrepancies at transaction level and distinguish timing differences from actual shortfalls?

Equally important is what happens after a discrepancy is detected. Institutions should review how exceptions are prioritised, who is authorised to investigate or approve corrections, how potential shortfalls are escalated and how decisions are recorded.

Finally, finance, compliance, risk and technology teams should work from a shared set of control requirements. PSD3 implementation should not result in a regulatory interpretation sitting in one department while the actual reconciliation logic operates independently in another.

The rules, calculations, processes and evidence must remain connected.

As the EBA develops its safeguarding technical standards, institutions will then be in a stronger position to assess additional requirements against an existing, documented control environment.

Conclusion: Safeguarding is becoming a question of operational evidence

PSD3 and the PSR represent an important step in the evolution of European payments regulation. Their impact will extend across fraud prevention, customer protection, open banking, authorisation and the governance of payment institutions.

Safeguarding is a particularly important part of that development because it concerns the fundamental obligation to protect money held on behalf of payment service users.

The proposed regulatory framework reinforces the importance of segregation, safeguarding risk management and the ability to determine and verify the amount of funds requiring protection. The forthcoming EBA technical standards will provide greater detail on how these requirements are expected to operate.

For institutions, the operational implication is already clear. Protecting customer funds requires more than maintaining safeguarding accounts. It requires reliable financial records, accurate calculations, effective reconciliations and documented resolution of discrepancies.

As payment operations become faster and more complex, those controls must also become more capable.

At Valurec, we see this as an important development in the future of financial operations. Regulatory requirements and operational efficiency should not be treated as competing priorities. Well-designed reconciliation processes can support both, reducing repetitive manual work while improving the reliability and traceability of financial results.

The future of safeguarding reconciliation is not simply about matching the numbers. It is about being able to prove, at every relevant stage of the process, that the numbers are correct, customer funds are adequately protected and exceptions have been properly resolved.

That is where regulatory compliance and modern finance operations meet. And it is where trust in the payments ecosystem is ultimately established.

Sources and further reading

• Council of the European Union: PSD3, Council first-reading text, 21 October 2026, Article 9.

• KPMG Law: PSD3 and PSR: New payment regulation for payment service providers and banks, updated 4 May 2026.

• European Union: Payment Services Directive (EU) 2015/2366, consolidated text.

• GÖRG: Publication of the near-final legal texts on PSD3 and PSR, 3 November 2026.

Regulatory status: 9 November 2026. This article provides general regulatory and operational analysis, not legal advice. The final legislative text, national implementation and forthcoming EBA technical standards should be consulted when determining institution-specific obligations.