Payment services in transition – workshop, November 2026

The MMC Polska workshop «Payment services in transition – regulation, security and technological development» (4–5 November 2026) is behind us. We would like to thank the organisers for inviting DLK Legal to take part in the event.

Dr Krzysztof Korus, Partner at DLK Legal, presented selected issues concerning the new legal framework for payment services, strong customer authentication and digital money. Below we summarise the key topics discussed during the event (legal status as at 5 November 2026).

In brief

• PSR and PSD3: access of Polish payment institutions (KIP) to Elixir and Sorbnet will not require a KNF opinion, and safeguarding will cover the full amounts due to merchants. Without a timely amendment to the Payment Services Act (UUP), uncertainty will affect, among others, ATM operators and CASPs.
• SCA: two “inherence” elements will be possible with KNF approval, and dynamic linking is required only for internet transactions. The EUDI Wallet must be accepted, but at the provider’s own risk and without an outsourcing agreement with the wallet “issuer”.
• EMTs and the digital euro: a CASP does not need a payment licence for many EMT-related services, but an EMT transfer does require one. The digital euro will be covered by VoP with aliases, with no obligation to offer PIS.

1. PSR and PSD3: a new framework for payment institutions

• Access to payment systems. Access of KIPs to payment systems, including Elixir and Sorbnet, will be governed by the PSR rather than Polish law. A KNF opinion will not be required to become a participant.
• Complaint against refusal of a bank account. The PSR grants a right to complain to the KNF against a refusal to provide a bank account. The right is available to:
  • KIPs, small payment institutions (MIP) and payment service offices (BUP),
  • ATM operators,
  • applicants for these statuses,
  • their agents.

Note: in a similar situation, the Polish legislator decided in Article 41(7) UUP that a KNF decision should not merely find the refusal unlawful, but should expressly order that access to the interface be provided.

• Safeguarding merchants’ funds in full. The PSR requires KIPs to safeguard funds for merchants in the amount due to them, not only up to the amount received on their behalf. The difference arises, among others, with refunds and chargebacks netted by payment schemes. The PSR does not bring forward the moment from which funds must be safeguarded.
• Central bank account. If a KIP holds a central bank account for participation in a payment system, the PSR allows funds in that account to be treated as safeguarded. This applies, however, only to the amount corresponding to actual settlement needs (the “synthetic central bank digital currency” issue, synthetic CBDC).
• Failure to amend the UUP in time. Many PSR/PSD3 solutions require amendments to the Payment Services Act. If the amendment is not adopted in time, serious problems will arise, including:
  • A KIP will not be able to apply for permission to issue electronic money.
  • ATM operators will not be certain whether they may continue their business. Their situation resembles that of VASPs under MiCAR: the prohibition on operating without a licence stems from the EU regulation itself, not from a directive.
  • CASPs operating in Poland will not benefit from the exemption from the authorisation requirement for EMT-related services (see section 3).

2. SCA under the PSR and the EUDI Wallet

• Authentication elements. The PSR allows the payer’s PSP to apply to the KNF for approval to use two SCA elements from the same “inherence” category (something the user is). The condition is that the independence of these elements is ensured.

Note: each payer’s PSP must apply individually. A card scheme cannot apply for approval jointly on behalf of all issuers.

• Dynamic linking. The PSR requires dynamic linking only for internet transactions. In proximity transactions where the payer’s app requires an internet connection, “harmonized security measures” are sufficient. This corresponds to the payee-requested flow in the EMVCo specification and in TS12 for the EUDI Wallet.
• SCA exemptions. The PSR exemption from SCA for payee-initiated transfers is not limited to purchases of goods and services.

The PSR expressly confirms that the payee’s PSP may apply an SCA exemption.

• Access to NFC. The right of access to NFC or similar components under the PSR is not limited to components provided by gatekeepers within the meaning of the DMA.
• EUDI Wallet as an SCA tool. The EUDI Wallet is a standalone and complete SCA tool. For private wallets performing SCA, the PSR requires an outsourcing agreement with the wallet provider. With the EUDI Wallet, the payer’s PSP will have no such agreement with the wallet “issuer”.

Key takeaway: accepting the EUDI Wallet for SCA purposes is at the provider’s own risk, similarly to accepting a state-issued ID card. This is the case even though eIDAS obliges the provider to accept the wallet.

3. Stablecoins (EMTs), crypto-assets and the digital euro

• EMT notifications despite the absence of a national act. The KNF is currently forwarding to ESMA notifications of EMT issuance by Polish institutions authorised to issue electronic money. It does so despite the absence of a Polish act accompanying MiCAR.
• CASPs and payment licences. EMTs are electronic money, but the PSR does not require a payment licence from a CASP which, in relation to EMTs:
  • buys or sells them,
  • intermediates in exchange as the operator of a trading platform,
  • executes orders or receives and transmits them,
  • provides custody without transfers.

Note: so as not to postpone these effects until 2028, the PSR immediately amends PSD2 in the same direction. In Poland, however, achieving this effect would require an immediate amendment to the UUP.

• EMT transfers. In other cases, the PSR disapplies the following provisions with respect to EMT transfers:
  • verification of payee (VoP),
  • open banking,
  • certain information requirements.
• Safeguarding of EMTs. Safeguarding in relation to EMTs is governed exclusively by MiCAR, not PSD3. Only the issuer safeguards the funds.
• Payments from crypto-asset balances. A “payment” from a BTC balance requires a payment licence.
• Digital euro: VoP / PIS. In online digital euro transactions, VoP applies, taking into account the use of a user alias. Providers of digital euro accounts are not obliged to enable the use of payment initiation services (PIS).

Questions about implementing the PSR, PSD3, MiCAR or the digital euro? [Contact us]([adres angielskiej strony kontaktowej])