The European Banking Authority (EBA) has published a follow-up to the 2023 Peer Review Report assessing progress in the authorisation of payment institutions and electronic money institutions under the revised Payment Services Directive (PSD2). While notable improvements and increased convergence have been observed, significant differences persist in key areas such as governance, internal control mechanisms, and local substance. These divergent implementations continue to pose risks of regulatory arbitrage and an uneven playing field across Member States.
The follow-up Peer Review, covers 2022-2024 and assesses how supervisors have implemented the 2023 recommendations, focusing on authorisation processes, implementation of the EBA Guidelines on authorisation, governance and internal controls, AML/CFT frameworks, and local substance.
The Review identifies ongoing market shifts since the previous assessment. Application volumes and authorisation timelines still vary significantly across Member States. Most Member States saw fewer applications compared to 2019-2022, mainly due to market maturity and the end of Brexit-driven demand, though some jurisdictions experienced increases. The median authorisation process in the EEA (counting from submission of an application) now takes 9.5 months, with delays often resulting from incomplete or poor-quality applications and the time needed to address deficiencies.
Most supervisors have improved efficiency by providing clearer guidance, engaging with applicants earlier on, and streamlining internal procedures. However, delays remain, as not all changes have had a significant impact. While supervisors report better assessments of applicants’ governance and internal control mechanisms, divergent implementations persist in these areas and in the assessment of local substance. These differences, linked to the broad requirements of PSD2, risk creating an uneven playing field and regulatory arbitrage.
The EBA encourages supervisors to address the remaining gaps, and work towards greater convergence in governance and internal control frameworks across the EU.
Legal basis and background
The follow-up Peer Review was conducted in accordance with Article 34 of the EBA Methodology for the conduct of peer reviews (EBA/DC/2020/327) that requires a review committee to prepare a follow report two years after the publication of the initial peer review and submit it to the Board of Supervisors. In accordance with the methodology, the follow-up report shall include an assessment of, but not be limited to, the adequacy and effectiveness of the actions undertaken by the competent authorities that are subject to the peer review in response to the follow-up measures of the peer review report.
Source: EBA
