New EBA report on PSD2 licensing: what does it mean for payment institutions and the Polish Financial Supervision Authority?

In its follow-up review of authorisation practices under PSD2, the European Banking Authority (EBA) concludes that although competent authorities are gradually aligning their approaches, material differences still persist.

These divergences may lead to unequal competitive conditions and regulatory arbitrage, particularly in the areas of corporate governance, anti-money laundering and counter-terrorist financing (AML/CFT), and the requirement for a genuine operational presence in the home Member State.

PSD2 licensing in practice

The analysis covers the period from 2022 to 2024. The median duration of authorisation procedures, calculated from the date of submission of the application, was 9.5 months, with a range from as little as 4-6 months to as long as 27 months in extreme cases. EBA stresses that the three-month deadline provided for in PSD2 only starts to run once a complete application has been submitted. In practice, extensions are mainly driven by poor-quality documentation, delays in providing additional information, and changes to the business model during the course of the procedure.

Some authorities also pointed to insufficient supervisory staffing as an additional factor, a concern that was noted in relation to Poland as well.

The Polish Financial Supervision Authority under scrutiny: what has changed in the practice of the Polish authority?

The findings for Poland are particularly relevant. First, the Polish Financial Supervision Authority (KNF) recorded a 32% increase in new applications compared to the previous period and was included among the authorities reporting a shortening of procedures, with average processing times in Poland of around 10 to 12 months.

Second, KNF was identified as one of the authorities that have clarified regulatory expectations by publishing or updating guidance on key elements of the application, in particular the business plan and the governance and internal control framework.

Third, in the area of outsourcing, KNF has implemented requirements for reviewing outsourcing agreements, including the obligation to include incident reporting clauses for events that may have a material impact on the activities of a payment institution or an electronic money institution. The report also notes that Poland is among the few authorities that do not promote a pre-application contact phase.

Incomplete harmonization and regulatory risks in the EU

At the same time, EBA underlines that convergence of practices remains incomplete. In the AML/CFT area, specifically with regard to the assessment of systems and controls ensuring compliance for activities carried out by branches, agents or distributors, EBA indicates that the information provided by Poland did not allow a clear assessment of the level of implementation of the recommendations. It also highlights the need to apply objective criteria that go beyond a basic checklist approach.

What should applicants know? Practical tips from the report

For applicants, the report serves as a practical risk map. Licensing processes tend to run more smoothly where corporate governance is genuinely embedded in a three-lines-of-defence model, outsourcing arrangements include comprehensive operational and reporting clauses, and AML/CFT frameworks are based on a documented risk assessment and adequate controls tailored to the intended distribution channels.

Do you need support with the licensing process?

If you are planning to apply for a license to conduct payment services or electronic money business, it is worth taking care of every detail- from documentation to compliance with AML and outsourcing requirements. Contact us to safely and efficiently go through the PSD2 licensing process.