Safeguarding: The Underestimated Licence Killer — and What Changes Under PSD3

Payment and e-money institutions spend months on their licence application and years on their product. Safeguarding — the protection of customer funds — often gets a spreadsheet and a bank account. It should get more attention: when payment firms fail or come under supervisory pressure, the question that decides the outcome is almost always whether customer money was where it was supposed to be.

The principle is simple. Payment and e-money institutions are not banks; they may not use customer funds for their own business. Money they receive for executing payments or in exchange for e-money must be protected so that customers get it back even if the institution becomes insolvent. The practice is demanding, because it has to work every day, for every euro, across every account and partner.

How Safeguarding Works Today

• Segregation: customer funds may not be commingled with the institution's own funds.
• Protection method: under current law (Article 10 PSD2, in Germany section 17 ZAG), funds are held in segregated accounts at credit institutions — in Germany typically as trust accounts — or, where the central bank permits it, at a central bank, or they are invested in secure, liquid, low-risk assets; alternatively, they are covered by an insurance policy or comparable guarantee.
• Timing: funds must be protected within tight deadlines after receipt.
• Insolvency remoteness: the structure must ensure that, in insolvency, customers — not general creditors — have access to the funds.

Where Institutions Fail in Practice

The typical weaknesses are rarely dramatic. Reconciliation runs weekly instead of daily. Funds pass through operational accounts longer than permitted. Card scheme settlements, refunds, and chargebacks create gaps that nobody owns. Trust arrangements lack the documentation that makes them insolvency-proof. And the safeguarding bank relationship itself is fragile: many banks have reduced their appetite for payment institution clients, so losing one account can threaten the whole model. Auditors and supervisors — BaFin in Germany, the FMA in Austria — examine exactly these points, and deficiencies can lead to measures up to and including restrictions on the business.

“

Safeguarding is not a treasury detail. It is the promise that makes a payment institution different from a bank — and supervisors check it as such.

What PSD3 Changes

The EU's new payments framework, whose negotiated texts have been available since spring 2026 but which had not yet been formally adopted in October 2026, keeps the principle but tightens the execution. Payment and e-money institutions are merged into one licensing regime, and the safeguarding rules become more detailed:

• Customer information: institutions must tell their customers clearly and transparently how their funds are safeguarded and which insolvency law applies.
• Diversification: institutions should avoid concentrating all customer funds at a single credit institution, and must manage concentration risk actively.
• Faster protection for e-money: funds received for e-money must be safeguarded no later than the end of the business day after receipt.
• Evidence: material changes to safeguarding arrangements must be notified to the supervisor in advance; the EBA will set the details of segregation, designation, reconciliation and calculation of safeguarded funds in regulatory technical standards.

The new rules apply only 21 months after the directive enters into force; existing institutions may continue under their current authorisation for up to 27 months after entry into force and must show their supervisor by then that they meet the new requirements. As formal adoption was still pending in October 2026, application is not to be expected before autumn 2028; until then today's law applies, in Germany section 17 ZAG. Institutions applying for a licence now are well advised to design their safeguarding to the future standard already, so that it does not have to be rebuilt shortly after authorisation.

A Safeguarding Setup That Holds

1. 01Map every flow of customer funds — incoming, outgoing, card settlements, refunds — and assign an owner to each.
2. 02Automate daily reconciliation between the customer ledger and safeguarding accounts, with documented handling of breaks.
3. 03Diversify safeguarding banks early; a second relationship is cheaper to build before it is urgently needed.
4. 04Have trust and account documentation reviewed for insolvency remoteness — and keep it current.
5. 05Include safeguarding in the wind-down plan: who returns which funds to whom, in which order, if the business stops.

Conclusion

Safeguarding decides whether a payment institution keeps the trust of its customers, partners, and supervisors. PSD3 raises the bar, but institutions that already run daily reconciliation, diversified banking relationships, and clean documentation will barely notice the transition. Aegiron Capital Group supports payment and e-money institutions in designing safeguarding structures for the DACH region; legal advice and audits come from the law firm and auditors you engage.