Why This Roundup Matters Now
Most regulatory news is incremental. This batch is not. Between November 2025 and July 2026, four separate regulatory tracks reached decision points that directly affect anyone operating — or planning to operate — a payment institution, EMI, MSB, or offshore holding company. Some of these changes are already in force. Others are final-text-agreed but not yet applicable. The distinction matters, because compliance teams frequently over-react to “agreed” news as if it were “in force” news, and under-react to enforcement action that is already live.
This article separates the two, jurisdiction by jurisdiction.
Part 1 — PSD3 and PSR: Final Texts Agreed, Application Still 18–21 Months Out
After two and a half years of negotiation since the European Commission's original June 2023 proposal, the European Parliament and Council reached provisional political agreement on PSD3 and the Payment Services Regulation (PSR) on 27 November 2025. The Council's COREPER formally endorsed the compromise texts on 22 April 2026, the European Parliament's ECON Committee voted in early May, and a full plenary vote followed. Publication in the EU Official Journal is expected in mid-to-late 2026 — original estimates pointed to June or July, though legal-linguistic review may push this to September.
What actually changes:
- PI and EMI licenses merge into a single authorisation category. The current split between Payment Institution and Electronic Money Institution licensing consolidates under one regime, simplifying — in theory — the authorisation pathway for firms that need both payment processing and e-money issuance capability.
- Stricter fund safeguarding. A materially tighter deadline applies for securing incoming customer funds, moving toward T+1 logic. New requirements govern concentration risk management for custodians and hedging instruments, and PSPs must report significant changes to their hedging arrangements in advance.
- APP fraud liability. Payment Service Providers become liable for covering customer losses where they failed to implement appropriate fraud prevention mechanisms — a direct response to the growth in authorised push payment fraud across the EU.
- Mandatory IBAN-name check. Extended beyond the existing SEPA instant credit transfer requirement to a broader set of payment rails.
- DORA already applies.The Digital Operational Resilience Act has been in force since January 2025 and continues to apply to all EU payment institutions regardless of PSD3's timeline — this is not new, but it is frequently conflated with PSD3 by applicants.
Timeline reality check: PSR applies directly as a regulation from its entry into force; PSD3 requires national transposition within roughly 18 months of entry into force, with the regime itself becoming operational approximately 21 months after Official Journal publication — putting real-world application into 2027, potentially sliding into 2028 depending on the final publication date.
What existing and prospective EMI/PI applicants should do now:Existing licensees should not wait for transposition to begin reviewing safeguarding arrangements, fraud liability exposure, and hedging governance — supervisors are already signalling that licenses will need active reconfirmation under the new framework. New applicants structuring a Lithuania, Cyprus, or UK EMI license today should build compliance architecture that anticipates PSD3's safeguarding and fraud-liability standards from day one rather than retrofitting later, which is materially more expensive. See our EU EMI license guide and the complete EMI/PSP setup guide for jurisdiction-by-jurisdiction detail.
Part 2 — Canada: FINTRAC's Enforcement Crackdown Is Already Live
Unlike PSD3, this one is not on the horizon — it is happening now, and it is the most consequential change in this roundup for anyone running or planning a Canadian MSB.
On 26 March 2026, two pieces of legislation received Royal Assent: the Strengthening Canada's Immigration System and Borders Act and the Budget 2025 Implementation Act. Together they introduced the most significant amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) in years, restructuring FINTRAC's supervisory architecture, formalising a new administrative monetary penalty framework, and clarifying rules around anonymous accounts.
The enforcement numbers tell the story. FINTRAC revoked 50 MSB registrations in Q1 2026 alone — 23 of them on a single day, 24 March 2026. Typical grounds: failure to respond to an information request within 30 days, a weak or absent compliance programme, missed suspicious transaction reports, and failure to notify FINTRAC of changes to business or ownership information. Several revoked entities had registered as recently as mid-2025, meaning a clean registration in one year offers no protection the next if the compliance programme does not keep pace.
What is coming next: Some amendments are already in force — the new AMP framework, the compliance programme standard, and anonymous account clarifications took effect on 26 March 2026 alongside Royal Assent. Others, including a universal enrolment requirement and a proposed stablecoin MSB registration category, are tied to future regulatory amendments still to be published in the Canada Gazette, Part II.
The dual-registration reality. Canada now effectively runs two overlapping regimes for payment and crypto businesses: MSB registration under FINTRAC governs the AML/CFT perimeter (who moves money, source of funds, beneficial ownership, suspicious activity), while the Retail Payment Activities Act, overseen by the Bank of Canada, governs operational risk, funds safeguarding, and client fund segregation. Most modern neobanks, remittance platforms, and crypto payment processors targeting Canadian clients now need both registrations simultaneously — treating MSB registration as sufficient on its own is an increasingly common and increasingly punished mistake.
What this means practically:Canada remains genuinely attractive for MSB registration — no minimum capital requirement, no licensing fee, and strong North American banking credibility once established. But “registration is free and easy” was always a partial truth, and 2026 closes the gap between registration and operation. A compliance programme that would have passed review in 2023 is not guaranteed to survive a 2026 FINTRAC information request. See our full Canada MSB and payment company setup guide for the registration process and realistic budget.
Part 3 — Mauritius PIS: A Rare Piece of Good News
Against a global backdrop of tightening rules, Mauritius moved to make its Payment Intermediary Services (PIS) license more attractive rather than less. The FSC Mauritius has confirmed extension of the Partial Tax Exemption Regime to PIS license holders that meet substance requirements, applying from the year of assessment commencing 1 July 2025 and every subsequent year of assessment.
This sits alongside a statutory “determination of application” provision introduced to accelerate FSC decision-making once an application file is complete — a practical improvement to the licensing timeline for an already cost-efficient jurisdiction.
Why this matters for structuring decisions: The PIS license — MUR 2,000,000 minimum capital (roughly USD $45,000), a Category 1 Global Business Company structure, and an explicitly offshore-focused mandate covering payment initiation, acquiring, execution, and money remittance conducted exclusively outside Mauritius — remains one of the most cost-effective regulated payment authorizations available anywhere, and the tax treatment is now more favourable for substance-compliant holders than it was eighteen months ago. This is a jurisdiction moving in the opposite direction from Canada and the EU on regulatory friction, while maintaining the AML/CFT and GDPR-aligned data protection standards that keep it whitelisted by European counterparties. See our Mauritius PIS License guide for the full capital, timeline, and substance breakdown.
Part 4 — Offshore Substance: BVI, Cayman, and Seychelles All Tightened in 2026
The direction of travel for offshore corporate structures in 2026 is unambiguous: presence must be real, not documented.
Seychelleshas effectively ended nominee-director-only compliance for licensed entities. Firms holding a Seychelles license must now maintain full-time resident personnel rather than relying on an absent nominee providing a registered address and signature service. This aligns Seychelles with the OECD's BEPS Action 5 “substantial activities” standard and mirrors requirements already in force in the BVI, Cayman, and Malta. Seychelles remains off the FATF AML/CFT grey list and has been removed from the EU's Annex II enhanced-due-diligence list — a reputational upside for firms that make the substance investment.
BVIbeneficial ownership filing obligations under the amended Beneficial Ownership Secure Search System framework carried a deadline of 1 January 2026. Entities that missed it are marked “In Penalty” on the BVI FSC system; a moratorium on filing fees and penalties ran only until 31 March 2026, meaning non-compliant entities now face real operational restrictions on transactions and corporate actions, independent of any financial penalty. Economic substance notification and reporting obligations under the Economic Substance Act continue to apply on top of this, for entities carrying on relevant activities.
Caymanissued its Beneficial Ownership Transparency (Amendment) Regulations, 2026 on 23 January 2026, tightening reporting requirements further and reinforcing Cayman's positioning as a transparent-but-efficient fund and holding jurisdiction rather than a secrecy jurisdiction.
The strategic read:None of this makes BVI, Cayman, or Seychelles unviable — but it does close the gap between “offshore” and “unsubstantiated.” A holding structure with genuine directors, documented decision-making, and correctly filed beneficial ownership information is unaffected by any of this. A structure that was quietly relying on a nominee-only setup to avoid substance costs is now in a materially different risk position than it was in 2024. For businesses weighing offshore holding jurisdictions against onshore or mid-shore alternatives, our 2026 holding company jurisdiction guide and Pillar Two offshore holding company analysis cover the substance-cost trade-off in detail.
Part 5 — What This Means for Founders and Existing Licensees
Four takeaways cut across all of the above:
1. “Proposed” and “in force” are not the same thing — treat them differently.PSD3 is agreed but not yet applicable; FINTRAC's Bill C-12 enforcement powers are already being used. Compliance budgets should be allocated accordingly — immediate remediation for Canada, forward planning for PSD3.
2. Enforcement capacity is scaling faster than headline rules.FINTRAC's revocation pace, Cayman and BVI's beneficial ownership reconciliation, and Seychelles' substance verification all represent regulators using existing legal authority more aggressively — not necessarily new law. A compliant business in 2023 is not automatically a compliant business in 2026 without an active review.
3. Jurisdiction selection is no longer just about capital and tax rate.Mauritius's tax relief for substance-compliant PIS holders versus Seychelles's mandatory resident personnel versus Canada's zero-capital-but-high-enforcement MSB regime each represent a different risk-cost trade-off. The lowest headline cost is frequently not the lowest total cost once enforcement risk is priced in.
4. Multi-jurisdiction structures need coordinated review, not piecemeal fixes. A payment company with an EU EMI, a Canadian MSB registration, and a BVI holding company is now tracking three independently accelerating regulatory tracks simultaneously. Reviewing each in isolation misses the compounding effect — a FINTRAC information request during a period of BVI beneficial ownership remediation is a materially worse position than either alone.
Frequently Asked Questions
Is PSD3 already in force in 2026?
No. PSD3 and the Payment Services Regulation (PSR) reached final political agreement in April 2026 and are expected to be published in the EU Official Journal in mid-to-late 2026. The rules apply 21 months after publication, so realistic application is 2027-2028. Existing EMI and PI holders should still start compliance planning now — safeguarding, fraud liability, and IBAN-check requirements will apply to live operations, not just new applicants.
Why is FINTRAC revoking so many MSB registrations in 2026?
Bill C-12 received Royal Assent on 26 March 2026 and materially increased FINTRAC's administrative monetary penalty powers alongside PCMLTFA amendments. FINTRAC revoked 50 MSB registrations in Q1 2026 alone, including 23 on a single day. Typical grounds are failing to respond to information requests within 30 days, weak AML programmes, missed suspicious transaction reports, and failing to notify FINTRAC of business changes.
Is the Mauritius PIS license still available in 2026?
Yes. The FSC Mauritius has extended the Partial Tax Exemption Regime to PIS license holders that meet substance requirements, effective from the year of assessment commencing 1 July 2025. The PIS license remains the standard offshore payment authorization route for companies targeting Africa, South Asia, and the Indian Ocean corridor.
Do BVI and Seychelles companies still need economic substance?
Yes, and requirements have tightened in 2026. Seychelles-licensed firms must now have full-time resident personnel rather than nominee-only arrangements. The BVI beneficial ownership filing deadline expired 1 January 2026, with a penalty moratorium only until 31 March 2026. Cayman's Beneficial Ownership Transparency (Amendment) Regulations took effect 23 January 2026, tightening reporting further.
Free Initial Consultation
Need guidance on licensing or company formation?
Our team at Zitadelle AG provides a free initial assessment — covering jurisdiction selection, structure, timeline, and costs. No commitment required.
Get a Free Consultation →Zitadelle AG supports payment companies, MSBs, and offshore holding structures through the full regulatory lifecycle — licensing, AML/CFT programme design, substance planning, and ongoing compliance monitoring across the EU, Canada, Mauritius, Labuan, BVI, Cayman, and Seychelles. For a confidential review of how these 2026 changes affect your specific structure, contact Zitadelle AG.
Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory timelines, penalties, and requirements are subject to change and should be verified against primary regulator sources before relying on them. Last updated: July 2026.