PSD2 agents and distributors — the Article 14 register, the two-month clock and where liability sits
An agent cannot start providing payment services when you sign it. It can start when the competent authority enters it in the register — and the authority has two months to decide. Article 19 of Directive (EU) 2015/2366 sets out what a payment institution must tell its home supervisor before using an agent, what the supervisor does with it, and how outsourcing is treated differently. Article 20 then makes the institution fully liable for everything the agent does. This walks through the notification content, the timing that governs go-live, the cross-border route, and where the liability actually sits.
1. What has to be notified
Article 19(1) lists five items a payment institution must communicate to the competent authorities of its home member state where it intends to provide payment services through an agent:
- the name and address of the agent;
- a description of the internal control mechanisms the agent will use to comply with its money-laundering and terrorist-financing obligations under Directive (EU) 2015/849 — to be updated without delay where the particulars given at initial notification change materially;
- the identity of the directors and persons responsible for the management of the agent to be used in providing payment services and, for agents that are not themselves payment service providers, evidence that they are fit and proper persons;
- the payment services of the institution for which the agent is mandated; and
- where applicable, the unique identification code or number of the agent.
Two of these are commonly under-delivered. The AML control description is a live document, not a onboarding artefact — the obligation to update it without delay on material change runs for the life of the relationship. And the fit-and-proper evidence is required for agents that are not themselves payment service providers, which is most retail agent networks.
2. The two-month clock, and what it gates
Article 19(2) is the provision that should drive the commercial plan. Within two months of receipt of the Article 19(1) information, the home competent authority communicates to the payment institution whether the agent has been entered in the register provided for in Article 14. And then the operative words: upon entry in the register, the agent may commence providing payment services.
That is a positive gate. The agent’s authority to act does not flow from the agency contract, from the notification being filed, or from the expiry of the two months — it flows from the register entry. Article 19(3) allows the authorities, before listing, to take further action to verify information they consider incorrect; Article 19(4) provides that if they remain unsatisfied after doing so, they refuse to list the agent and inform the institution without undue delay.
Facts: a payment institution signs a distribution agreement with a retail chain, files the Article 19(1) notification, and lets the chain begin taking transactions six weeks later on the reasoning that no objection has been received.
What the rule says: Article 19(2) permits commencement upon entry in the register. Silence during the two-month period is not deemed approval, and the authority may still take verification steps under Article 19(3) or refuse under Article 19(4).
What the practitioner does: makes register entry a hard gate in the onboarding workflow — a system flag rather than a project milestone — and checks the public register rather than relying on the absence of correspondence. Where launch dates are contractual, the agreement should make go-live conditional on registration.
3. Using an agent in another member state
Article 19(5) routes cross-border use elsewhere: if the payment institution wishes to provide payment services in another member state by engaging an agent or establishing a branch, it must follow the procedures set out in Article 28 — the passporting notification chain between home and host authorities, not the domestic Article 19 process alone.
This is the point at which agent networks and the passport interact, and it is why the choice between an agent and a branch is a regulatory question before it is a commercial one. Our note on branch versus freedom of services covers the wider comparison. Note also that firms operating under the registered small-payment-institution regime have no access to this route at all, because Articles 28 to 30 are disapplied for them — see our note on the Article 32 exemption.
Article 19(8) closes the loop for changes: institutions must communicate to their home authorities, without undue delay, any change regarding entities to which activities are outsourced and — following the same paragraphs 2, 3 and 4 procedure — regarding agents, including additional agents. Each new agent runs the registration gate again.
4. Outsourcing is a different regime
Article 19(6) handles outsourcing on a notification basis rather than a registration basis: where a payment institution intends to outsource operational functions of payment services, it must inform the home competent authorities. There is no two-month register gate.
The substantive constraint is qualitative. Outsourcing of important operational functions, including IT systems, must not be undertaken in such a way as to materially impair the quality of the institution’s internal control, or the ability of the competent authorities to monitor and retrace the institution’s compliance with its obligations under the Directive.
The Directive then defines the trigger. An operational function is important if a defect or failure in its performance would materially impair the continuing compliance of the institution with its authorisation requirements, its other obligations under the Directive, its financial performance, or the soundness or continuity of its payment services. Where important operational functions are outsourced, four conditions must be met:
- the outsourcing must not result in the delegation by senior management of its responsibility;
- the institution’s relationship and obligations towards its payment service users under the Directive must not be altered;
- the conditions the institution must comply with to be and remain authorised must not be undermined; and
- none of the other conditions subject to which the authorisation was granted may be removed or modified.
| Agents — Article 19(1)–(5) | Outsourcing — Article 19(6) | |
|---|---|---|
| Regulatory step | Notification then entry in the Article 14 register | Inform the home competent authority |
| Timing gate | Two months for the authority to respond; may commence on register entry | No register gate in the Directive |
| Refusal possible | Yes — Article 19(4) | Not framed as a listing decision |
| Public visibility | Yes, via the register | No |
| Substantive test | Fit and proper management, AML control description, mandated services | No material impairment of internal control or supervisory retraceability; four conditions for important functions |
| Liability | Article 20(2) — the institution remains fully liable for both | |
5. Where the liability sits
Article 20 is two sentences that remove most of the argument. Article 20(1) requires that where payment institutions rely on third parties for the performance of operational functions, they take reasonable steps to ensure the Directive’s requirements are complied with. Article 20(2) requires member states to ensure that payment institutions remain fully liable for any acts of their employees, or any agent, branch or entity to which activities are outsourced.
There is no proportionate-fault carve-out and no reduction for a well-drafted indemnity. A contractual recovery right against an agent is a commercial remedy that operates after the institution has already borne the regulatory consequence.
Article 19(7) adds the customer-facing duty that is most often missed in practice: payment institutions must ensure that agents or branches acting on their behalf inform payment service users of that fact. That is a disclosure obligation discharged at the point of service, in the agent’s own materials and premises — not by a clause in the institution’s terms.
Facts: an agent’s staff mis-sell a payment product and fail to run the AML checks the notified control description promised. The institution points to the agency agreement, under which the agent warranted compliance and indemnified the institution.
What the rule says: Article 20(2) makes the institution fully liable for the agent’s acts. Separately, the AML control description notified under Article 19(1)(b) is the institution’s representation to its supervisor about how those checks would work — so the failure is also a divergence from what was notified.
What the practitioner does: treats agent oversight as first-line monitoring with sampling and testing rather than contractual assurance, and re-files the updated control description when the reality changes. The indemnity is worth having and is not a defence.
6. Records
Article 21 requires member states to oblige payment institutions to keep all appropriate records for the purposes of Title II for at least five years, without prejudice to Directive (EU) 2015/849 or other relevant Union law. For an agent network that means the notification packs, the fit-and-proper evidence, the successive versions of the AML control description, the register-entry confirmations and the oversight output — held for five years and capable of showing what was true at each point, not just what is true now.
Where the outsourced or agent-delivered function is also an ICT service, the DORA contractual and register requirements apply on top; see our notes on DORA Article 30 contract terms and the register of information.
7. FAQ
When can an agent start providing payment services?
On entry in the register provided for in Article 14. Article 19(2) gives the home competent authority two months from receipt of the notification to communicate whether the agent has been entered, and permits commencement upon that entry.
Is silence from the regulator after two months an approval?
No. The Directive frames commencement around register entry, and Articles 19(3) and 19(4) allow the authority to verify information further and to refuse listing, informing the institution without undue delay.
What must be notified about an agent?
Name and address; a description of the AML/CFT internal control mechanisms, updated without delay on material change; the identity of directors and managers, with fit-and-proper evidence where the agent is not itself a payment service provider; the payment services the agent is mandated for; and any unique identification code.
How do we use an agent in another member state?
Through the Article 28 passporting procedure, which Article 19(5) makes applicable where the institution wishes to provide payment services in another member state by engaging an agent or establishing a branch.
Does outsourcing need registration too?
No. Article 19(6) requires the institution to inform its home authority, with substantive conditions for important operational functions, but there is no register-entry gate equivalent to the agent process.
Can liability for an agent be transferred by contract?
Not as against the regulatory obligation. Article 20(2) requires the institution to remain fully liable for the acts of its employees, agents, branches and entities to which activities are outsourced.
8. What to do, today
- Make register entry a system gate. If an agent can be switched live in your platform before the register-entry confirmation is recorded, the control does not exist.
- Put the two months on the commercial timeline and make contractual go-live conditional on registration rather than on a date.
- Version the AML control description per agent and re-file on material change. The notified version is the benchmark you will be measured against.
- Classify before you contract: decide whether an arrangement is an agent relationship or outsourcing of an important operational function, because the regulatory step and the timing differ entirely.
- Check the Article 19(7) disclosure is actually visible where the agent serves customers, in the agent’s own materials.
- Build the five-year record set around Article 21 so that the position at any past date can be evidenced, not just the current one.
Related: Branch versus freedom of services · The Article 32 small payment institution exemption · DORA Article 30 ICT contract terms · PSD2 fraud reporting under Article 96(6)
