PSD2 passporting — the three routes and the real clock
The three-month passporting clock does not start when you file. It starts on the date your file is assessed complete and accurate — which is a date the home authority sets, not you. Article 28 of Directive (EU) 2015/2366 and Commission Delegated Regulation (EU) 2017/2055 together set out how a payment institution extends into another member state: three different passport types, three different information sets, two one-month legs and a three-month outer limit. This is the procedure an expansion plan actually runs on, and the part most launch dates are wrong about.
1. Three passports, three information sets
Article 28(1) requires an authorised payment institution wishing to provide payment services in another member state for the first time — under either the right of establishment or the freedom to provide services — to notify its home competent authority. What it must supply depends on which route it takes, and the delegated regulation prescribes a different template for each.
| Services passport | Agent passport | Branch passport | |
|---|---|---|---|
| Template | Annex V | Annex III | Annex II |
| Core content | 8 items | Agent information under Article 19(1) | 12 items |
| Business plan | — | — | Yes — forecast budget for 3 financial years |
| Governance description | — | — | Yes — must demonstrate AML compliance |
| Named individuals | Contact person | Contact person | Contact person and branch management |
| Start date | Intended date declared up front | Notified after registration | Notified after registration |
The branch file is the heavy one. Beyond identification, the authorisation number and — where available — the Legal Entity Identifier, it requires the branch address, the identity and contact details of the persons responsible for managing it, the services to be provided, the branch’s organisational structure, a business plan including a forecast budget calculation for the first three financial years demonstrating that the branch can employ appropriate and proportionate systems, resources and procedures, and a description of the branch’s governance arrangements and internal control mechanisms — administrative and risk-management procedures included — demonstrating that they are proportionate, appropriate, sound and adequate for the host-state business and comply with AML/CFT requirements.
The services file is the light one: identification, the host member state, the passport type, the contact person, the services, and — a detail that catches people — the intended date of start of the provision of services, declared in the application itself rather than notified afterwards.
One separate rule applies to e-money: where an electronic money institution distributes electronic money by engaging a natural or legal person, the notification runs on the Annex IV template rather than the agent template. Distribution and agency are not the same notification, and using the wrong template is a completeness failure — see our note on agents, distributors and liability.
2. When the clock actually starts
This is the provision worth building a plan around. Article 4 of the delegated regulation requires the home authority, on receipt of a passport application, to assess the completeness and accuracy of the Article 28(1) information. Where it assesses the information as incomplete or incorrect, it must inform the institution without delay, indicating in which respect. And then the decisive sentence: the time periods in Article 28(2) and 28(3) are considered as having commenced on the date of receipt of a complete and accurate passport application.
From that date, two legs run. Within one month of receiving all the Article 28(1) information, the home authority sends it to the host authority. Within one month of receiving it from the home authority, the host authority assesses it and provides the home authority with relevant information about the intended provision of services — and in particular must inform the home authority of any reasonable grounds for concern about money laundering or terrorist financing in connection with the intended engagement of an agent or establishment of a branch.
Where the home authority disagrees with the host’s assessment, it must give the host its reasons. And where the home authority’s own assessment is not favourable — in particular in light of what the host said — it shall refuse to register the agent or branch, or withdraw the registration if it has already been made. The host does not decide, but it can supply the grounds on which the home authority must act.
Then the outer limit: within three months of receipt of the Article 28(1) information, the home authority communicates its decision to the host authority and to the institution.
3. You start on registration, not on approval
Article 28(3) is explicit about the moment activity may begin: upon entry in the register referred to in Article 14, the agent or branch may commence its activities in the host member state. Not on the decision, not on the expiry of a period, not on the absence of an objection — on the register entry.
The institution must then notify the home authority of the date from which it commences activities through the agent or branch, and the home authority informs the host. Articles 9 and 13 of the delegated regulation route that communication through the Annex VI template.
Facts: a payment institution files a branch passport application in early March and books a host-market launch for mid-June, reasoning that three months is the statutory maximum.
What the rule says: the three months run from the date the home authority assesses the file as complete and accurate, not from filing. If the business plan or the governance description comes back for revision twice, the clock may not start until May. Activity then begins on the register entry, which follows the decision.
What the practitioner does: treats the completeness determination as the real milestone and works backwards from it — pre-agreeing the language with both authorities, confirming the host’s accepted transmission channel, and having the three-year forecast budget and the AML-compliant governance description ready at first filing rather than iterating them through the completeness loop.
Outcome: the launch date hangs off a date the firm can influence — file quality — rather than off a statutory maximum it cannot.
4. The mechanics that quietly cause rejections
Article 3 of the delegated regulation sets requirements that read as administrative and behave as gating conditions. The templates and the information in them must be in writing and in a language accepted by the competent authorities of both the home and the host member state. They must be transmitted by electronic means where those means are accepted by the host authority, followed by an electronic confirmation of receipt — or by post with acknowledgement of receipt.
Because the accepted language and the accepted channel vary, each competent authority is required to make available to the others both the languages it accepts and the email or postal address to which templates are to be sent. For an institution planning several markets at once, this means the language and channel question has to be answered per host state before drafting, not after.
Two further mechanics are worth knowing. Where a disagreement-settlement procedure between authorities has been initiated under Article 27 of PSD2 in relation to a passport application, the home authority must inform the institution that the decision is deferred pending resolution under Article 19 of Regulation (EU) No 1093/2010 — a suspension with no fixed length. And where an institution intends to outsource operational functions of payment services to entities in the host member state, it must tell its home authority, which then tells the host.
5. Every change re-runs the procedure
Article 28(4) requires the institution to communicate to its home authority, without undue delay, any relevant change to the information already notified — expressly including additional agents, branches or entities to which activities are outsourced in the host states where it operates. The procedure in Article 28(2) and (3) then applies again.
The delegated regulation softens the paperwork without softening the process: for a change, the home authority transmits only those parts of the relevant template that are affected, under Articles 8, 12 and 16 for branch, agent and services passports respectively. So the filing is partial; the assessment cycle is not.
Facts: an institution already passported into a host state on a services basis signs its first two agents in that market, and treats it as an operational rollout under the existing passport.
What the rule says: adding agents is expressly a relevant change under Article 28(4), which re-runs the Article 28(2) and (3) procedure — including the host authority’s opportunity to raise AML concerns about the intended engagement of those agents — and the agents may commence only on entry in the register.
What the practitioner does: builds the notification lead time into the commercial agent pipeline, and briefs the sales side that a signed agent contract is not a live agent. Our note on branch versus freedom of services covers which route to choose in the first place.
6. FAQ
How long does a PSD2 passport take?
The outer statutory limit is three months from receipt of a complete and accurate application, inside which sit two one-month legs — home to host, then the host’s assessment back to home. The elapsed calendar is usually longer, because the clock only starts once the home authority assesses the file as complete and accurate.
Which passport type do we need?
Services where you provide cross-border without an establishment; agent where you engage an agent in the host state; branch where you establish one. Each has its own template and information set, and the branch file additionally requires a three-year forecast budget and a governance description demonstrating AML compliance.
Can the host authority block us?
Not directly. The host assesses and supplies relevant information, in particular any reasonable grounds for concern about money laundering or terrorist financing. But where the home authority’s assessment is not favourable in light of that, it must refuse to register the agent or branch, or withdraw a registration already made.
When can we actually start trading?
On entry in the register referred to in Article 14 — not on the decision and not on the expiry of a period. You must then notify your home authority of the date you commence activities, which it passes to the host.
Do we have to re-notify when we add an agent?
Yes. Additional agents, branches or host-state outsourcing entities are relevant changes under Article 28(4), and the full Article 28(2) and (3) procedure applies again — though only the affected parts of the template are re-transmitted.
What language do we file in?
A language accepted by the competent authorities of both the home and the host member state. Each authority publishes the languages it accepts and the channel to which templates should be sent, so this has to be settled per host state before drafting.
7. What to do, today
- Plan to the completeness date, not the filing date. It is the only date from which the statutory periods run, and it is the one your file quality controls.
- Confirm language and channel per host state before you draft. Both are prescribed conditions, both vary, and both are published by the authorities.
- Front-load the branch file. The three-year forecast budget and the AML-compliant governance description are the two items that come back, and each round trip is time the clock has not begun to count.
- Expect the AML question. The host authority is specifically directed to flag money-laundering concerns about an intended agent or branch, so the agent due-diligence file should be capable of answering it before it is asked.
- Put agent additions on the notification calendar, not the commercial calendar — a signed agent may not operate until it is on the register.
Related: branch versus freedom of services · agents, distributors and liability under PSD2 · where to base an EMI in the EU · the Article 32 small payment institution exemption
