PSD3 Lands, Core Banking Pivots, and BaaS Finally Grows Up: Inside Europe's Open-Finance Reset
Brussels has locked the scope and timeline for PSD3 and the Payment Services Regulation. Meanwhile, Tuum, Mambu, and Thought Machine are rewriting what "core banking modernisation" actually means in the field. Here is what shifted this week.
If there has been a quiet consensus in European banking circles over the past year, it is that the next real competitive edge will come from the plumbing, the APIs, the core systems, the BaaS platforms that decide whether a bank can launch a new product in six weeks or sixteen months. This week delivered a one-two punch that forces that conversation out of the back-office memo and onto the executive agenda. First, Brussels locked in the contours of PSD3 and the Payment Services Regulation. Second, a cluster of core-banking deals landed in the field that collectively reset the bar for what modernisation looks like in 2026.
Here is the state of play, and why your weekly reading list from this one is worth sharing with your CIO.
PSD3 and PSR: The Scope Is Locked, the Clock Is Ticking
The big regulatory news first. As confirmed in advisories from Alston & Bird, Morrison Foerster, and tracked by Vixio and Worldline, the European Commission has accepted the Council's position on the new EU payment services rules, locking in the scope and timeline for both PSD3 (the Third Payment Services Directive) and the PSR (Payment Services Regulation). William Fry's practice note calls the legislative agreement "a decisive moment" for European payments reform, and that framing feels earned.
What is actually changing? A great deal, but three strands matter most for anyone running an open-banking strategy.
Fraud Liability Finally Gets Teeth
Under the new framework, liability for authorised push-payment fraud shifts in meaningful ways, with payment service providers facing clearer obligations to detect and prevent impersonation scams. Entersekt's analysis and PwC's regulatory briefing both flag this as the single biggest shift in day-to-day operations for issuers. Expect a rush of procurement cycles around behavioural biometrics, device intelligence, and real-time transaction monitoring in the first half of 2027.
Open Banking Gets a Grown-Up Permissions Layer
PSD3 replaces the hodgepodge of PSD2 implementation standards with a more harmonised approach to consent, dashboards, and data access. According to analysis from Finologee and Matheson, the new rules introduce a standardised "financial data access" framework that treats customer consent as a first-class, revocable, and portable right. In practice, that means the clunky consent flows that have plagued open-banking adoption for the past five years will be replaced by something much closer to the OAuth-style consistency developers already expect from other data ecosystems.
Fintech Licensing Tightens
Pulse.bot's reporting captured a less-advertised angle: PSD3 also tightens the perimeter of fintech licensing, closing some of the arbitrage that allowed firms to operate under lighter regimes while effectively offering full payment services. Expect consolidation. Expect some currently-flying fintechs to find themselves grounded.
Timeline
As Gr4vy's merchant briefing lays out, the formal adoption and transposition timeline stretches into 2026-2027 for PSR, with longer runway for PSD3 elements that require national transposition. That is the official story. The unofficial one, as Adyen's knowledge hub notes, is that sophisticated players are already restructuring compliance roadmaps now, because catch-up in 2027 will be more expensive than readiness in 2026.
Thought Machine and Deutsche Bank: Core Modernisation Hits the Big Leagues
Away from Brussels, the core banking story got a headline that would have been considered impossible five years ago. Deutsche Bank has selected Thought Machine's Vault Core platform for a major core systems overhaul, confirmed by Thought Machine's press office and reported by The Paypers and FinTech Futures.
Let that sentence land. One of the largest universal banks in Europe, with a legacy stack whose age is measured in decades, has publicly committed to a cloud-native, API-first core banking rewrite. This is the kind of deal that reframes the risk calculus for every tier-one institution still sitting on the fence. If Deutsche Bank can do it, the "we're too big and too complex" excuse quietly evaporates.
The AWS Migration Twist
Thought Machine also announced a partnership with Amazon Web Services on an AI-powered solution to accelerate legacy banking migrations, per IBS Intelligence and Amazon's own press release. The pitch: use generative AI to analyse and translate legacy COBOL and mainframe artefacts into modern, cloud-native equivalents, materially compressing the modernisation timeline. Whether the toolchain delivers on that promise is the next 18 months' big question, but the direction of travel is clear.
Tuum's Sprint: From Baltic Challenger to Global BaaS Infrastructure
Estonian core banking platform Tuum had the kind of week most vendors would trade a quarter for. Per FF News and Zawya, Tuum has been selected by Kazakhstan's Bank CenterCredit to power its new Banking-as-a-Service proposition, a deal that both companies are explicitly framing as "a blueprint for BaaS and core modernisation in global banking." That is strong language, and it is backed up by the technical substance: a cloud-native core providing the foundation for the bank's embedded finance partners to plug into.
Additional recent Tuum deals cement the trend. LHV UK selected Tuum as its core banking platform provider to accelerate product development, per FF News. Germany's Quirin Privatbank picked Tuum to modernise its core architecture, as reported by FinTech Futures. And Tuum's existing partnerships with Audax, the Islamic finance specialists at Coorb, and DDCAP round out a BaaS portfolio that now spans Europe, Central Asia, and the Middle East.
Why This Matters for BaaS Specifically
The BaaS narrative has had a difficult eighteen months. Regulatory scrutiny in the US made middle-office compliance the new bottleneck, and a few high-profile failures of sponsor-bank-fintech relationships rattled the category. The European response, exemplified by Tuum's approach, leans heavily on the architecture itself: cloud-native, permissioned APIs, embedded compliance tooling, and transparent client segregation at the platform level. In other words, if BaaS 1.0 was about speed, BaaS 2.0 is about verifiable, auditable speed.
Mambu and Light Frame: Cloud-Native Core Goes Upmarket
Mambu, the Dutch cloud-banking stalwart, announced a strategic partnership with Light Frame to deliver cloud-native core banking into the wealth management sector, per IBS Intelligence and FF News. Wealth is the segment that, for structural reasons, has been slowest to migrate off on-premise systems: ultra-high-net-worth clients, complex instrument coverage, and bespoke reporting requirements all militated against a one-size-fits-all core.
The Light Frame-Mambu pitch targets that resistance directly, pairing Mambu's modular core with Light Frame's wealth-specific overlays. Expect follow-on deals in private banking and multi-family office segments through 2027.
Eiendomskreditt Picks Knowit-Mambu
Norwegian mortgage specialist Eiendomskreditt also tapped Knowit and Mambu to modernise its core banking platform, per IBS Intelligence. It is not a headline-grabber in isolation, but as part of a pattern it matters: specialist lenders are realising that the cost of running proprietary stacks is no longer defensible when Mambu's cloud offering ships most of what they need out of the box.
Monument Technology: BaaS Infrastructure Bags a Challenger
The UK BaaS infrastructure segment had its own moment. Monument Technology announced a platform deal with Castle Trust Bank, per FF News, Fintech Global, and Moneyage. The agreement sees Castle Trust adopt Monument's platform to accelerate product development and customer onboarding, a textbook example of a specialist lender buying rather than building its tech backbone. The deal follows Monument Technology's £18 million funding round earlier in the year, per Mortgage Soup, giving the firm the runway to pursue more such contracts.
The Picture That Is Forming
String these threads together and a coherent 2026 narrative appears. The regulatory layer is being rewritten in Brussels in a way that forces modernisation. The core banking layer is being migrated at scale by the Deutsche Banks of the world, giving the mid-tiers permission to move. The BaaS infrastructure layer is consolidating around credible platforms - Tuum, Mambu, Thought Machine, Monument - each of which is now operating at a level of ambition that would have seemed implausible even eighteen months ago.
For banks that have been running the "we'll modernise in phases" playbook, the coming twelve months look increasingly like the last window to catch up. For the vendors, this is the harvest. And for the open-banking ecosystem as a whole, PSD3 is less a regulatory event than a starting gun.
