PSD3 PSR Readiness Checklist: Your Compliance Roadmap

Alejandro Martínez · 2026-06-23

If you're in the payments space, you've probably heard the buzz about PSD3 and PSR. But let's be real—turning regulatory noise into actionable steps is tough. That's why we put together this checklist. It's based on the MFSA's DEAR CEO letter, which outlines what Malta's regulator expects from authorized firms. Think of it as your no-nonsense guide to getting ready. ### What's Changing with PSD3? The Payment Services Directive 3 isn't just a minor update. It's a full overhaul of how payments work across Europe. The goal? Stronger consumer protection, better competition, and tighter security. For compliance teams, this means new rules on everything from customer authentication to data sharing. And yes, the deadlines are real. ### The MFSA's Minimum Expectations Malta's Financial Services Authority published a clear letter to CEOs. It spells out exactly what they expect from authorized persons. Here's the gist: - **Risk assessments** must be updated to cover new PSD3 requirements - **Customer due diligence** processes need to be checked for gaps - **Reporting obligations** will change, so your systems must adapt - **Third-party providers** (like payment initiation services) face new rules This isn't optional. The MFSA is making it clear: if you're not ready, you'll face consequences. ### Key Areas to Focus On #### Strong Customer Authentication (SCA) SCA is getting a refresh. Under PSD3, exemptions are narrower, and the rules around dynamic linking are stricter. Make sure your authentication flows meet the updated standards. Test them now, not the week before the deadline. #### Open Banking and Data Sharing PSD3 tightens the rules on how banks share customer data with third parties. If you're a payment initiation service provider, you'll need to ensure your APIs comply with new technical standards. And remember, consent management is key. #### Incident Reporting Breach notification timelines are shrinking. Under PSR, you might have to report certain incidents within hours, not days. Update your incident response plan and train your team on the new thresholds. ### Your Compliance Team Needs a Plan Here's the thing: the checklist is just the start. You need legal support that understands both the letter and the spirit of PSD3. That means reviewing contracts, updating privacy notices, and stress-testing your operations. Don't wait until the regulator comes knocking. ### Download the Full Checklist We've created a detailed PSD3 / PSR readiness checklist you can download. It breaks down every requirement into manageable tasks. Whether you're a small fintech or an established bank, it'll save you hours of head-scratching. > "The best time to prepare for regulation is before it arrives. The second best time is now." ### Get in Touch Need help navigating PSD3? Our team has deep experience in payments compliance. We work with firms across Europe to get them ready. Reach out to Dr Justine Scerri Herrera, our Founder and Managing Partner, for a confidential chat. ### Final Thoughts PSD3 and PSR aren't just paperwork exercises. They're opportunities to build trust with your customers and streamline your operations. Use this checklist as your starting point, but don't stop there. Stay informed, stay proactive, and you'll come out ahead.