Agents, Distributors or Branches? A Cross-Border Passporting Map Under PSD3

An agent, an e-money distribution person and a branch are not interchangeable routes to the EU market. Under PSD3, an agent is a separate person acting in the name and on behalf of a payment institution in providing payment services and either taking possession of funds for it or participating directly in its provision of those services. A branch is part of the payment institution itself and has no separate legal personality. A person merely distributing or redeeming electronic money does not, for that reason alone, provide a payment service or become an agent.

The classification drives registration, the passport notification, the launch timetable, the allocation of home- and host-state supervision and, for agent networks, possible central-contact-point requirements. It must therefore follow the operating facts – especially the customer journey and funds flow – rather than the heading used in a distribution, outsourcing or commercial agreement.

Why the label matters

The passport is exercised by the authorised payment institution. The choice of operating model determines how that institution exercises its passport and what information must pass between competent authorities. It also determines what can lawfully happen before the relevant registration or notification process has been completed.

The practical consequences extend beyond regulatory filing:

1. whether the third party must be entered in the national and EBA registers;
2. which information must be filed about management, AML controls, the business model, the website and the flow of funds;
3. whether the presence is analysed under the right of establishment or the freedom to provide services;
4. which Member State is the host state in a multi-country or triangular model;
5. what the host authority may require by way of reporting, information and local supervisory access;
6. whether an agent-network central contact point may be required; and
7. how the payment institution must control the third party and disclose the relationship to users.

These questions often arise late in an expansion project, after commercial terms, technology build and launch dates have already been agreed. That sequence creates avoidable risk. The regulatory model should be tested while the customer journey and operating model are still capable of being changed.

Agents, distributors and branches at a glance

Model	Core legal test	Cross-border treatment	Principal consequence
Payment agent	Separate natural or legal person acting in the PI’s name and on its behalf in providing payment services; possesses funds for the PI or is directly involved in the PI’s provision of payment services.	Agent registration under Article 19; Article 30 passport procedure for cross-border activity.	May start only after register entry. Agent-network CCP rules may apply.
E-money distribution / redemption person	A person acting for a PI issuing e-money to distribute or redeem it. Distribution/redemption is not itself a payment service.	Modified application of Articles 29-33 under Article 19(7a); no registration merely for this role.	Cannot issue e-money. PI remains responsible, including for relevant AML/CFT controls.
Branch	A place of business that forms part of the PI, has no legal personality and directly carries out PI business.	Article 21 and the Article 30 passport procedure.	More integrated presence; branch-specific organisational, business-plan and governance information.
Outsourced / technical provider	Performs an operational or technical function without necessarily acting as the PI in providing a payment service.	Outsourcing notification duties, including for functions in a host Member State; not a substitute passport category.	PI responsibility is not transferred; a hybrid provider may still be an agent for separate functions.

1. When is a third party a payment agent?

PSD3 sharpens the agent analysis. Article 2(28) requires two connected elements: the person must act in the name and on behalf of the payment institution in providing payment services; and it must either enter into possession of funds on behalf of the institution or be directly involved in the institution’s provision of payment services.

Recital 45 is deliberately cautionary. Merely participating in the provision of a payment service, or carrying out some client-facing activities, is not sufficient. The point is important for platform, embedded-finance and branded-partner models, where a commercial partner may control the interface without necessarily performing the regulated service.

A functional test, not a drafting test

Calling a counterparty a “distributor”, “programme manager”, “service provider” or “introducer” does not settle its status. The most probative material is usually found outside the definitions clause of the agreement: the screen flow shown to the user, the terms accepted by the user, who receives money, who gives operative instructions, which entity performs payment-service steps and how the relationship is presented at the point of service.

Possession of funds is a strong indicator, but it is not the only route into the definition. Direct involvement in the payment institution’s own provision of payment services is an alternative. Conversely, a provider that supplies software, identity checks or customer support may fall outside the agent definition where it neither acts as the institution in providing the payment service nor satisfies the funds/direct-involvement limb. Article 22 outsourcing obligations may still apply.

Registration and the Article 19 information package

A payment institution intending to provide payment services through an agent must notify its home authority. Article 19(1) requires, among other things:

1. the agent’s name, legal name, address and the addresses from which it offers payment services;
2. the agent’s AML internal-control mechanisms;
3. the identity and, where relevant, fitness and propriety of the persons responsible for its management;
4. the payment services for which it is mandated and any unique identifier;
5. a clear description of the proposed agent business model;
6. the address of any website through which the agent offers payment services;
7. proof of incorporation for a legal person; and
8. an overview of the funds flow and operational processing of the intended payment transactions.

Under Article 19(2), the home authority must communicate within six weeks of receiving that information whether the agent has been entered in the register. The agent may commence providing payment services only upon entry. For a cross-border agent, Article 19(5) sends the institution to the Article 30 passporting procedure; the six-week domestic provision should therefore not be presented as though it were simply added to every stage of the Article 30 timetable.

The institution must also ensure that users are informed that the agent acts on its behalf, notify changes without undue delay and remain fully liable for the agent’s acts under Article 23. An agent may support payment services, but Article 19(7b) prevents a payment institution from issuing electronic money through an agent.

Practical consideration: If the notification describes a model that is materially different from the agreement, website, funds-flow diagram or production customer journey, the problem is not merely documentary. It may indicate that the regulatory classification itself has not been settled.

2. What is an e-money ‘distributor’ under PSD3?

‘E-money distributor’ remains useful market shorthand, but legal precision matters: PSD3 does not define a stand-alone category with that name. It refers to natural or legal persons through whom a payment institution issuing electronic money distributes or redeems it.

Recital 45 states that distribution or redemption of electronic money does not itself constitute a payment service. A person carrying out only those activities is therefore not treated as an agent merely because it acts for the issuing institution. Nor are other parties used by that person deemed agents unless they themselves provide payment services.

Receiving funds does not automatically convert distribution into a payment service

The recital expressly contemplates a person receiving funds from a holder in exchange for electronic money. Those funds are treated as received by the payment institution because the person acts on its behalf. That feature must not be confused with authority to issue electronic money: issuance remains an activity of the authorised payment institution.

The practical dividing line is therefore the full activity set. A retail or commercial partner may remain a distribution person when it exchanges funds for e-money or redeems e-money. If it additionally provides a payment service in the institution’s name and meets the Article 2(28) test, it can also be an agent for that separate activity. The roles are capable of co-existing.

A tailored cross-border notification regime

PSD3 does not simply place cross-border e-money distribution outside passporting. Article 19(7a) applies Articles 29-33 mutatis mutandis where a payment institution distributes or redeems e-money in another Member State through a natural or legal person. The mechanism is adapted, however:

1. the branch-information limb in Article 30(1)(e) does not apply;
2. the central-contact-point provisions in Article 31(4)-(7) do not apply; and
3. for the Article 30(1)(d) information package, the institution need not provide the Article 19(1)(c), (ec) and (ed) information concerning management/fitness and propriety, proof of incorporation and the funds-flow/processing overview.

The accompanying recital confirms that these persons are not subject to registration under PSD3 merely because they distribute or redeem e-money, while requiring cross-border information to pass from the home authority to the host authority.

AML/CFT responsibility stays with the institution

The regulatory lightness of non-registration should not be mistaken for a light-control model. Recital 45 makes the payment institution ultimately liable for the distribution or redemption activity and for compliance with the relevant AML/CFT requirements. It also connects the institution’s distributor policies, procedures and controls to Regulation (EU) 2024/1624, the AML Regulation, which generally applies from 10 July 2027.

Classification consequence: The same partner can be subject to a tailored e-money distribution notification for one function and the full agent regime for another. A single label across the whole relationship may conceal two legally distinct roles.

3. When does an operating presence amount to a branch?

Article 2(29) defines a branch as a place of business other than the head office that forms part of the payment institution, has no legal personality and directly carries out some or all transactions inherent in the institution’s business. All places of business established in the same Member State by an institution headquartered in another Member State are treated as a single branch.

A branch is therefore structurally different from an agent. It is not an independent counterparty operating under a mandate. It is an integrated part of the institution. That difference affects governance, employment, infrastructure, operational control and the content of the passport submission.

The branch passport

Article 21 requires a payment institution establishing a branch in another Member State – or using a branch located in one Member State to provide services into another – to follow Article 30. The Article 30 branch package includes a business plan for the host-state business, governance and internal-control information, a description of the branch’s organisational structure and the relevant Article 19 information applied mutatis mutandis.

As with an agent, the branch must tell payment service users that it acts on behalf of the payment institution. Article 23 confirms the institution’s full liability for the acts of its branch.

A branch should not be treated as a ‘more substantial agent’. The correct question is whether the place of business is part of the same legal person. An incorporated subsidiary cannot become a branch simply because it is wholly owned and tightly controlled.

4. How does the PSD3 cross-border passport work?

Article 30 governs both the right of establishment and the freedom to provide services. A payment institution intending to start providing payment services in another Member State must give its home authority the institution’s identifying details, the target Member State, the planned start date, the services to be provided and, where relevant, the agent or branch information.

The article also requires a payment institution intending to outsource operational functions of payment services to an entity in the host Member State to inform its home authority without undue delay. That is a notification obligation; it does not turn the outsourced entity into a branch or agent.

The Article 30 sequence

1. Complete filing. The payment institution submits all required information to its home authority.
2. Home-to-host transmission. Within ten business days after receiving all required information, the home authority sends it to the host authority.
3. Host assessment. Within one month after receipt, the host authority assesses the information and may identify grounds for concern concerning money laundering or terrorist financing in connection with the intended agent or branch.
4. Home decision. Within ten weeks after receiving the institution’s information, the home authority communicates its decision to the host authority and the institution.
5. Registration and commencement. The agent or branch may start activity in the host Member State only after entry in the register. The institution then notifies the actual start date to the home authority, which informs the host authority.

Material changes, including additional agents, branches or host-state outsourcing entities, must be notified without undue delay and are routed through the same Article 30(2)-(3) procedure.

Right of establishment or freedom to provide services?

This is a second classification exercise. First identify whether the third party is an agent, e-money distribution person, branch or outsourced provider. Then determine whether the way services are provided involves an establishment or the cross-border freedom to provide services.

The analysis is fact-sensitive. It should consider the stability and continuity of the local presence, the functions carried out there and the actual means through which the institution pursues business in the host state. The agreement’s choice of ‘services’ or ‘establishment’ language is not conclusive. PSD3 itself recognises the distinction in Article 31: the central-contact-point thresholds count agents operating under the right of establishment in a specific way, while certain transaction calculations include agents operating under either route.

The triangular passport: A, B and C

Triangular structures have produced persistent practical uncertainty under PSD2. The typical model is a payment institution authorised in Member State A, using an agent or branch located in Member State B, to offer payment services to users in Member State C.

PSD3 addresses the point expressly. Under Article 30(2), where services are provided via a third Member State, the Member State to be notified is the one where services are provided to payment service users. Recital 56 describes the same A/B/C model and treats C as the host state for the service offered there.

That answer should not be overextended. The physical or legal presence of the intermediary in B may still have consequences that require separate analysis. The point made by Article 30(2) is that, for the service offered into C, the relevant host notification cannot stop at B merely because the intermediary is located there.

Article 30(5) requires the EBA to develop regulatory technical standards on home-host cooperation and information exchange, including the case where an agent or branch located in one host Member State offers payment services in another Member State. Those standards are due 18 months after PSD3 enters into force and will be important to the operational detail of triangular notifications.

6. Home-state control, host-state powers and central contact points

The home authority remains central to prudential supervision, but cross-border provision is not a home-state-only matter. Article 31 requires home and host authorities to cooperate. The home authority may carry out on-site inspections in the host state or delegate the inspection to the host authority. The host authority may require periodic reports from institutions with agents or branches in its territory and may request ad hoc information where it has evidence of non-compliance.

Where the host authority identifies non-compliance, Article 32 ordinarily routes the issue to the home authority for action. In an emergency involving a serious threat to the collective interests of users in the host state, the host authority may take appropriate, proportionate and temporary precautionary measures pending home-state action.

When may a central contact point be required?

Article 31 allows a host Member State to require a payment institution operating through agents, with its head office in another Member State, to appoint one central contact point in that host state. The requirement is available only where at least one statutory threshold is met:

1. the institution has at least ten agents providing Annex I payment services in the host state under the right of establishment;
2. the value of payment transactions in the host state through locally situated agents exceeds EUR 3 million in the last financial year and at least two of those agents operate under the right of establishment; or
3. the number of payment transactions in the host state through locally situated agents exceeds 100,000 in the last financial year and at least two agents operate under the right of establishment.

The contact point centralises reporting and communication and facilitates inspections and supervisory measures. It must have the resources and data access necessary to perform those functions. Importantly, Article 19(7a) excludes Article 31(4)-(7) from the tailored regime for persons merely distributing or redeeming e-money. The agent-network central-contact-point rules should therefore not be transposed uncritically to distributor-only models.

7. Do not forget the fourth category: outsourcing

Many real-world models cannot be analysed properly using only the three nouns in the title. A third party may be an outsourced operational provider, a technical service provider, an agent for one function, a distributor for another – or some combination of those roles.

Article 22 requires notification of outsourced operational functions and prevents important operational functions from being outsourced in a manner that materially impairs internal control or supervisory monitoring. Outsourcing must not delegate senior-management responsibility, alter the institution’s obligations to users, undermine the conditions of authorisation or modify the basis on which authorisation was granted. DORA continues to apply to relevant ICT services.

Article 23 supplies the common accountability principle: the payment institution remains fully liable for employees, agents, branches, outsourced entities and other persons acting on its behalf. The business case for a particular model may change operational control, but it does not create a route to outsource regulatory responsibility.

Hybrid-model warning: Do not classify the counterparty once and then apply that answer to every activity. Classify each service and operational function, map the funds and contractual relationships, and then aggregate the resulting registration, notification, AML, outsourcing and oversight requirements.

8. A practitioner method for classifying the model

A reliable analysis usually follows the evidence in the order below. Starting with the contract alone tends to reproduce the parties’ preferred label rather than the regulated reality.

1. Map the legal persons and places of business. Identify the authorised PI, every affiliate and third party, and every country in which staff, premises, systems, partners and users are located.
2. Map each regulated and unregulated function. Separate issuance of e-money, distribution, redemption, execution, acquiring, remittance, onboarding, technical processing, customer support, complaints and safeguarding-related activity.
3. Trace funds end to end. Identify who receives, holds, controls, transfers or can direct funds at each step, and in whose legal capacity that occurs.
4. Review the user-facing evidence. Test websites, apps, terms, receipts, disclosures, branding and complaint routes against the proposed legal model.
5. Identify who makes operative decisions. Determine whether the third party merely supplies inputs or participates directly in the institution’s provision of a payment service.
6. Map the geography of the service. Identify where the institution is established, where each intermediary is located and where payment services are offered to users.
7. Determine establishment versus services. Apply the EU-law and supervisory analysis to the actual presence, not only the notification preference.
8. Align contracts and controls. Only after the model is settled should the mandate, oversight plan, AML allocation, audit rights, disclosures and termination arrangements be finalised.

Documents that usually decide the classification

1. the full customer journey and production screenshots;
2. the funds-flow and settlement diagram;
3. end-user terms and regulatory disclosures;
4. the commercial, agency, distribution and outsourcing agreements;
5. AML onboarding, monitoring and escalation procedures;
6. the responsibility matrix for payment-service steps and operational decisions;
7. web domains, app-store listings, branding and customer communications; and
8. the location and role of personnel, premises and technology infrastructure.

Common errors

1. Treating the agreement’s title as the legal classification.
2. Assuming every customer-facing partner is an agent.
3. Treating receipt of funds in exchange for e-money as conclusive evidence of payment-agent status.
4. Allowing an agent or distribution person to be described as issuing e-money.
5. Failing to separate e-money distribution from any additional payment service.
6. Using ‘outsourcing’ as a label for activity that in substance satisfies the agent definition.
7. Stopping the geographical analysis in country B when services are offered to users in country C.
8. Treating the six-week Article 19 period and ten-week Article 30 period as a single additive timetable.
9. Ignoring host reporting, inspection and central-contact-point implications when scaling an agent network.

9. What changes from PSD2 and EMD2?

Current law should be kept analytically separate from the future framework. PSD2 defines an agent more briefly as a natural or legal person acting on behalf of a payment institution in providing payment services. EMD2, as amended by PSD2, permits electronic money institutions to distribute and redeem e-money through persons acting on their behalf, while preventing issuance through agents.

PSD3 integrates payment and electronic-money institution authorisation into one directive and makes several matters more explicit at Level 1. For this article’s subject, the most important developments are the more specific agent definition, the detailed Article 19 information package, express treatment of cross-border e-money distribution, a clearer triangular-passport rule, the Article 30 timetable and the inclusion of central-contact-point thresholds in Article 31.

Issue	Current PSD2 / EMD2 baseline	PSD3 direction
Agent test	Acts on behalf of the PI in providing payment services.	Adds the funds-possession or direct-involvement limb.
E-money distribution	Distribution/redemption through persons acting on the EMI’s behalf; no issuance through agents.	Preserves the distinction and specifies a tailored cross-border notification regime.
Triangular passport	Practical uncertainty and reliance on existing cooperation rules and supervisory interpretation.	Expressly identifies the user-facing state C as host for the service and mandates further EBA RTS.
Central Contract Point	Threshold detail sits principally in Delegated Regulation (EU) 2020/1423.	Places the operative thresholds in Article 31 and excludes distributor-only persons from the regime.

This does not justify re-papering existing arrangements on the assumption that every element of the compromise text is final. It does justify an early inventory: institutions with extensive agent, distributor or branch networks should be able to identify which relationships would require new data, revised notifications, altered disclosures or different supervisory engagement once the final text and implementation timetable are settled.

Frequently asked questions

Is every e-money distributor a payment agent under PSD3?

No. Distribution or redemption of electronic money is not itself a payment service, and a person performing only that role is not an agent merely because it acts on behalf of the issuer. The person can nevertheless also be an agent if it separately provides payment services and satisfies Article 2(28).

Can a person distributing e-money receive funds from the customer?

Yes. PSD3’s recitals contemplate receipt of funds from a holder in exchange for electronic money and treat those funds as received by the payment institution. The analysis must still test whether any additional activity constitutes a payment service.

Can an agent issue electronic money?

No. Article 19(7b) provides that payment institutions must not issue electronic money through agents. Issuance is carried out by the authorised payment institution.

Does using an agent always mean exercising the right of establishment?

Not automatically. The agent classification and the establishment-versus-services analysis are related but distinct. The stability, continuity and functions of the local presence must be tested on the facts and against applicable EU-law and supervisory criteria.

Which state is the host state in a triangular A/B/C model?

For the payment service offered to users in C through an agent or branch in B, Article 30(2) identifies C as the Member State to be notified. Separate consequences associated with the intermediary’s presence in B still require analysis.

When may a cross-border agent or branch start operating?

Article 30 states that the agent or branch may commence activities in the host Member State upon entry in the relevant register. The institution must then notify the actual start date through its home authority.

The central takeaway

Designing a cross-border payments model is not an exercise in choosing the most convenient noun. Agent, e-money distribution person, branch and outsourced provider describe different legal relationships, but the regulatory answer follows the facts: legal personality, place of business, customer-facing conduct, participation in the payment service, possession of funds and the geography in which the service is offered.

PSD3 gives institutions a clearer map, particularly for the agent definition, e-money distribution and triangular passporting. It does not remove the need for functional analysis. The most defensible model is the one in which the notification, agreements, funds flow, operating procedures and customer journey all tell the same story.

---