Two roads, one destination: cross-border payments are becoming infrastructure by decree

Two documents landed on the desks of payments executives this year, from two very different institutions, written in two very different dialects of regulatory prose. In late April, EU member state representatives in COREPER endorsed the final compromise texts of PSD3 and the Payment Services Regulation, clearing the path toward formal adoption of Europe’s most sweeping payments overhaul in a decade. Two months earlier, in February, the BIS Committee on Payments and Market Infrastructures published updated harmonised ISO 20022 data requirements for cross-border payments. Read separately, they are a legal reform and a technical standard. Read together, they are the same instruction issued twice.

That instruction is this: the era in which a cross-border payments business could treat licensing as a checkbox and data formatting as plumbing is closing. Europe is legislating what a payment institution must be — its governance, its licensing posture, its authentication and open-banking obligations. The CPMI, meanwhile, is standardising what a payment message must carry — the harmonised data that makes a transaction traceable, screenable, and interoperable across rails from SEPA to FedNow to Brazil’s Pix ecosystem.

For MTOs, wallets, and neobanks building cross-border products, this is not two compliance projects. It is one strategic question: do you build this capability yourself, or do you stand on infrastructure that already has it?

PSD3 and the PSR have lived in the realm of consultation papers and speculative panels for years. The COREPER endorsement of the final compromise texts changes that. With member states aligned and the path to formal adoption with Parliament now visible, the package moves from “monitor” to “mobilise” on every EU-exposed operator’s roadmap. The reform touches nearly everything that defines a payment institution’s operating model: how firms are licensed and supervised, how customer data is shared under open-banking rules, how strong customer authentication is applied, and how governance must be structured.

Two audiences should be paying particular attention. First, EU-licensed institutions, who face a readiness exercise spanning licensing posture, governance, and data-sharing architecture as texts roll out across member states. Second — and often overlooked — non-EU PSPs with European ambitions. Legal briefings circulating this year make clear that firms crossing into EU markets will have to map themselves onto PSD3/PSR obligations as a condition of expansion. The regulatory moat around Europe just got deeper, and it now favours operators who already hold a supervised European licence.

The strategic implication is uncomfortable for anyone planning to bolt compliance on later: under the new framework, embedded payment flows in EU markets must be designed around the regulation, not retrofitted to it.

While Brussels legislates, Basel standardises. The CPMI’s February 2026 update on harmonised ISO 20022 data requirements — reinforced by follow-up material detailing how APAC, Europe, and MEA are aligning their messaging — is the quieter half of this story, but arguably the more operationally consequential one. Consistent, structured data across corridors is what makes sanctions screening reliable, disputes resolvable, FX and tax reporting coherent, and straight-through processing possible across a patchwork of instant-payment systems, card rails, and FX gateways.

For a RaaS or embedded-payments operator, the economics are straightforward: every corridor that runs on a divergent data model is a corridor that demands bespoke integration work, bespoke compliance scrubbing, and bespoke exception handling. Harmonisation collapses that rework. The CPMI’s attention to Brazil’s Pix as part of ISO 20022 cross-border interoperability plans is especially telling — it signals that LATAM’s most important real-time rail is being wired into the same global data fabric, which reshapes how anyone serious about Brazilian and regional corridors should plan their connectivity.

And the commercial backdrop keeps the pressure on. The World Bank’s refreshed Remittance Prices Worldwide data — now reflecting corridors through Q3 2025 — continues to make corridor-level pricing publicly visible across LATAM, Africa, and Southeast Asia. Transparent prices compress margins; compressed margins punish operators carrying duplicated integration and compliance costs. The firms that internalise harmonised data standards earliest will simply have a lower cost-to-serve than those that don’t.

The rules and the rails are converging. Build on infrastructure that already speaks both languages.