The compliance landscape for payment service providers has never been more complex, or more consequential. In 2026, PSPs operate at the intersection of payments regulation, anti-money laundering frameworks and emerging digital asset rules.
The compliance landscape for payment service providers has never been more complex - or more consequential. In 2026, PSPs operate at the intersection of payments regulation, anti-money laundering frameworks, and emerging digital asset rules, with the regulatory walls closing in from all directions.
The baseline obligations are well established. PSPs must implement formal AML compliance programmes, conduct KYC and customer due diligence at onboarding and throughout the business relationship, monitor transactions in real time against customer risk profiles, file suspicious activity reports when indicators emerge, and train staff on AML procedures. These are not new requirements. But the standard to which regulators assess them is rising sharply.
Transaction monitoring, in particular, is under scrutiny. It is no longer sufficient to deploy a rule-based system and assume it is working. Regulators expect monitoring to reflect the actual risk profile of customers - dynamically, not statically. Risk assessments conducted at onboarding must be updated continuously as customer behaviour evolves. AI-enhanced monitoring systems are increasingly expected rather than aspirational.
Agent and reseller oversight adds another dimension. PSPs that use agents, gateways, or Independent Sales Organisation arrangements carry responsibility for the AML/CFT compliance of those intermediaries. Background checks, enhanced due diligence, and heightened monitoring of agent arrangements are regulatory expectations, not best practice suggestions.
The incoming PSD3 and Payment Services Regulation - which reached provisional political agreement in November 2025 and are expected to be published in the first half of 2026 - will tighten the framework further. PSD3 strengthens account and transaction monitoring requirements, mandates earlier detection and action on mule accounts, and enhances fraud-relevant intelligence sharing across the EU. The PSR covers security, strong customer authentication, and PSP obligations as a directly applicable regulation across EU member states.
Critically, PSPs now operate within three overlapping regulatory structures: PSD2/PSD3/PSR for payment regulation, the EU Anti-Money Laundering Regulation for cross-sector AML, and the new EU Anti-Money Laundering Authority (AMLA) for centralised supervisory coordination. For PSPs handling e-money tokens or crypto payment services, MiCA adds a fourth layer. The compliance cost is real, but the cost of non-compliance is higher.
For Isle of Man-based PSPs, the principles are the same even if the specific EU rules do not directly apply. The IOMFSA expects transaction monitoring proportionate to customer risk, Travel Rule compliance for payment flows, enhanced scrutiny of agent networks, and robust oversight of outsourcing arrangements.
At Kybri Consulting Limited, we advise payment service providers on AML/CFT compliance design and implementation - from transaction monitoring frameworks and agent oversight to regulatory readiness for PSD3 and emerging digital asset obligations.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
