The PSD2 limited network exclusion — the three limbs, the EUR 1 million notification and how it is lost
The limited network exclusion is not a licence exemption you claim once. Cross EUR 1 million in a rolling twelve months and you owe the regulator a notification — which it can answer by deciding you were never in the exclusion at all. Article 3(k) of Directive (EU) 2015/2366 takes certain closed-loop instruments outside the payment services regime; Article 3(l) does the same for some telecoms-billed transactions. Article 37 then builds a notification and public-register layer on top. This walks through the three limbs, the numbers, and how the exclusion is lost.
1. Three ways to be a limited network
Article 3(k) excludes services based on specific payment instruments that can be used only in a limited way and that meet one of three conditions:
- (i) instruments allowing the holder to acquire goods or services only in the premises of the issuer, or within a limited network of service providers under direct commercial agreement with a professional issuer;
- (ii) instruments which can be used only to acquire a very limited range of goods or services;
- (iii) instruments valid only in a single member state, provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer.
Recital 13 explains how the limbs were meant to be read, and it is the recital that most closed-loop products fail rather than the article. It states that it should not be possible to use the same instrument to make payment transactions to acquire goods and services within more than one limited network, or to acquire an unlimited range of goods and services. It then describes the first limb as covering purchases in a specific retailer or specific retail chain where the entities involved are directly linked by a commercial agreement — for example providing for the use of a single payment brand, used at the points of sale and appearing where feasible on the instrument. And it describes the second limb as a scope of use effectively limited to a closed number of functionally connected goods or services regardless of the geographical location of the point of sale.
Recital 13 also records why the drafters tightened this: feedback showed that activities covered by the exclusion under the previous directive often involved significant payment volumes and values, offering consumers hundreds or thousands of different products and services — which did not fit the purpose of the exclusion and implied greater risk and no legal protection for users, and clear disadvantages for regulated market actors.
2. The telecoms limb and its hard caps
Article 3(l) excludes payment transactions by a provider of electronic communications networks or services, provided in addition to electronic communications services, for a subscriber to the network or service, in two cases: for the purchase of digital content and voice-based services, regardless of the device used, charged to the related bill; or performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets.
Unlike Article 3(k), this limb has explicit numbers. It applies only provided that the value of any single payment transaction does not exceed EUR 50 and either the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or — where the subscriber pre-funds its account with the provider — the cumulative value does not exceed EUR 300 per month.
These are conditions of the exclusion, not thresholds for reporting. A provider whose product routinely exceeds them is not in Article 3(l) at all.
3. The EUR 1 million notification, and what it invites
Article 37(1) requires member states to prohibit natural or legal persons that are neither payment service providers nor explicitly excluded from the scope of the Directive from providing payment services. Article 37(2) then creates the monitoring layer for the limited network exclusion.
Service providers carrying out either of the activities in Article 3(k)(i) or (ii), or both, for which the total value of payment transactions executed over the preceding 12 months exceeds EUR 1 million, must send a notification to the competent authorities containing a description of the services offered and specifying under which of those exclusions the activity is considered to be carried out.
And then the consequence that makes this more than an administrative filing: on the basis of that notification, the competent authority takes a duly motivated decision on the basis of the criteria in Article 3(k) where the activity does not qualify as a limited network, and informs the service provider accordingly. The notification is therefore an invitation to be assessed. A firm that has grown past EUR 1 million on a shaky classification is required to present that classification to the regulator and name the limb it relies on.
Note what the trigger is not. It is not a threshold below which the exclusion applies and above which a licence is needed — the substantive test is always Article 3(k). EUR 1 million is the point at which the regulator gets to look.
| Provision | Number | What it actually does |
|---|---|---|
| Article 3(l) | EUR 50 per single transaction | Condition of the exclusion — exceeded, the exclusion does not apply |
| Article 3(l) | EUR 300 per subscriber per month | Condition of the exclusion, on cumulative value or on a pre-funded account |
| Article 37(2) | EUR 1 million over the preceding 12 months | Notification trigger for Article 3(k)(i) and (ii) — invites a motivated decision |
| Article 37(3) | Annual | Audit opinion testifying compliance with the Article 3(l) limits |
4. The annual audit opinion, and public visibility
Article 37(3) treats the telecoms limb more strictly than the closed-loop limbs. Service providers carrying out an activity under Article 3(l) must send a notification to the competent authorities and provide an annual audit opinion testifying that the activity complies with the limits set out in Article 3(l). There is no volume trigger — the audit opinion is a recurring obligation for anyone relying on that limb.
Article 37(4) requires competent authorities to inform the EBA of the services notified under paragraphs 2 and 3, stating under which exclusion the activity is carried out. And Article 37(5) requires the description of the notified activity to be made publicly available in the registers provided for in Articles 14 and 15 — the national register and the EBA’s central register.
That public element is worth pausing on. The classification a firm asserts becomes visible to its competitors and counterparties, who can compare it against what the product visibly does. Acquiring banks and scheme partners read these registers.
Facts: a retail group issues a closed-loop card usable across its own stores and, through a partnership, at a chain of coffee shops and a car-park operator. Annual load value passes EUR 1 million. The group notifies under Article 3(k)(i) on the basis that all participants have commercial agreements with it.
What the rule says: Article 3(k)(i) requires a limited network of service providers under direct commercial agreement with a professional issuer, and recital 13 frames it as a specific retailer or specific retail chain linked by commercial agreement, typically with a single payment brand. It also states that the same instrument may not be used within more than one limited network. Retail, hospitality and parking are not obviously one network, and the competent authority may take a motivated decision that the activity does not qualify.
What the practitioner does: decides the classification before the partnership expands, not after the notification is due — and if the answer is that the product spans networks, plans for authorisation or for an issuing arrangement with a licensed provider. The notification is not the moment to start the analysis.
5. Losing the exclusion
The exclusion has no grandfathering. It is a description of what an instrument does, tested continuously, so a product drifts out of it through ordinary commercial success: another merchant category is added, a partner network is acquired, a card gains general acceptance, a telecoms product’s average transaction value rises past EUR 50.
Facts: a firm relying on Article 3(l) for ticket purchases charged to a mobile bill sees average transaction values rise as ticket prices increase. Several months now include subscribers above EUR 300 cumulative.
What the rule says: the EUR 50 per-transaction and EUR 300 per-subscriber-per-month figures are conditions of the exclusion. Transactions outside them are not excluded transactions, and the annual audit opinion under Article 37(3) is precisely the instrument by which that will surface.
What the practitioner does: monitors both figures as live product controls with hard limits rather than as reporting metrics, so the product cannot execute a transaction that falls outside the exclusion. Where the commercial model needs to exceed them, the answer is a licence or a licensed partner — the audit opinion cannot be qualified quietly.
Firms in this position generally have three routes: obtain authorisation as a payment institution or e-money institution; distribute through a licensed provider so the regulated activity sits with the licence holder; or restructure the product back inside the exclusion. The Article 32 registration regime is sometimes proposed as a fourth route, but it is domestic only and carries its own volume ceiling.
6. FAQ
What is the limited network exclusion?
Article 3(k) of PSD2 takes outside the Directive services based on specific payment instruments usable only in a limited way — in the issuer’s premises or a limited network under direct commercial agreement, for a very limited range of goods or services, or under a single-member-state social or tax scheme regulated by a public authority.
Is there a value threshold for the exclusion?
Not for Article 3(k) itself — the test is qualitative. EUR 1 million over the preceding 12 months is the point at which a notification is owed under Article 37(2), on which the authority may decide the activity does not qualify.
Can one instrument serve two limited networks?
Recital 13 states that it should not be possible to use the same instrument to make payment transactions within more than one limited network, or to acquire an unlimited range of goods and services.
What are the telecoms limb limits?
No single transaction above EUR 50, and either cumulative value per individual subscriber not exceeding EUR 300 per month, or the same EUR 300 monthly cap where the subscriber pre-funds its account with the provider.
Do we need an audit opinion?
If you rely on Article 3(l), yes — Article 37(3) requires notification plus an annual audit opinion testifying compliance with the Article 3(l) limits. There is no equivalent audit requirement for Article 3(k).
Is the notification public?
Yes. Article 37(5) requires the description of the notified activity to be made publicly available in the registers provided for in Articles 14 and 15, and Article 37(4) requires authorities to inform the EBA.
7. What to do, today
- Name your limb in writing. Article 37(2) will require you to specify which exclusion you rely on; deciding that under time pressure is how firms end up asserting a position they cannot defend.
- Track twelve-month rolling transaction value now, so the EUR 1 million notification is a scheduled event rather than a discovery.
- Test the “functionally connected” question against your actual merchant categories, and treat every new partner category as a classification review.
- If you rely on Article 3(l), implement the EUR 50 and EUR 300 limits as blocking controls, not as reports — the annual audit opinion tests the activity, not your intentions.
- Read your own register entry as a counterparty would, and check it still matches what the product does.
- Decide the exit route before you need it: authorisation, a licensed distribution partner, or product restructuring. All three take longer than the notification timeline allows.
Related: The Article 32 small payment institution exemption · Where to base your EMI · Safeguarding compared across the EU
