The European Banking Authority’s follow-up peer review of national authorisation practices for payment institutions (PIs) and electronic money institutions (EMIs) under the revised Payment Services Directive (PSD2) finds measurable progress but persistent divergence that risks uneven supervision and regulatory arbitrage across the EU. According to the EBA, 29 national competent authorities (NCAs) were assessed for actions taken after the original 2023 peer review, with the follow-up focusing on authorisation processes, implementation of the EBA guidelines on authorisation, governance, anti-money laundering/combating the financing of terrorism (AML/CFT) controls and local substance. [2][1]
The report records improvements in efficiency at many NCAs achieved through clearer public guidance, enhanced pre-application engagement with firms and streamlined procedural steps. Industry observers and summaries of the EBA’s findings note greater transparency and consistency in some aspects of the authorisation pathway compared with earlier reviews, reflecting the EBA’s sustained push for convergence under PSD2. However, the follow-up also documents significant variation in how deeply NCAs scrutinise applications. [2][3][5]
Authorisation timelines remain highly divergent, even where processes have been clarified. The EBA’s data show times from submission to authorisation ranging from roughly 4–6 months in several states to as long as 27 months in one member state, with a median elapsed time of 9.5 months. The authority attributes many delays to incomplete or low-quality applications and the time required for applicants to remedy identified deficiencies, while also urging NCAs to ensure they have sufficient resources to carry out timely, robust assessments. [2][1][3]
On substantive assessments, the follow-up notes that several NCAs have addressed earlier shortcomings, particularly in business-plan reviews and AML/CFT controls, yet gaps persist. Notably, the assessment of local substance , the demonstrable operational presence and activities of firms in the jurisdiction in which they seek authorisation , remains inconsistent across supervisors. The EBA warns that such inconsistencies could facilitate "forum shopping" by applicants seeking the most permissive or least-demanding regime. [1][5][3]
The EBA repeats recommendations from its earlier peer work that competent authorities should review authorisation resources and processes, and apply common criteria when assessing governance and the suitability of management. Industry-focused summaries draw attention to the EBA’s endorsement of proportionate application of the "three lines of defence" model where appropriate, and to calls for clearer boundaries between categories of payment and e-money services to reduce supervisory ambiguity. [3][5][7]
While the follow-up highlights progress, it makes clear that further convergence is required to deliver a level playing field and to maintain the integrity of the internal market for payments. The EBA calls on NCAs to continue aligning practices, to upskill and resource authorisation teams where necessary, and to raise the quality of both supervisory scrutiny and applicant submissions to shorten timelines without diluting supervisory standards. According to national and industry commentaries, achieving those aims will be essential to prevent fragmentation and to safeguard AML/CFT resilience across the EU’s payments ecosystem. [2][4][6]
##Reference Map:
- [1] (JD Supra) - Paragraph 1, Paragraph 3, Paragraph 4, Paragraph 6
- [2] (European Banking Authority press release) - Paragraph 1, Paragraph 2, Paragraph 3, Paragraph 6
- [3] (EBA peer review summary) - Paragraph 2, Paragraph 4, Paragraph 5
- [4] (Magyar Nemzeti Bank press release) - Paragraph 6
- [5] (Better Regulation service summary) - Paragraph 4, Paragraph 5
- [6] (JD Supra duplicate) - Paragraph 6
- [7] (EBA Peer Review Work Plan 2022-2023) - Paragraph 5
Source: Noah Wire Services