Since 2025, the EU Digital Services Act (DSA) has established new obligations and requirements for very large online platforms (VLOPs) and e-marketplaces, fundamentally altering compliance, risk, and operational standards for large technology firms.
Now, the upcoming EU Anti-Money Laundering Regulation (AMLR), alongside the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR), will further disrupt the ecosystem. The new rules will apply from 2027, with PSD3 and PSR expected to come into force in early 2027, bringing VLOPs and marketplaces under one payment services regulatory framework.
VLOPs and digital marketplaces have increasingly expanded into financial services over recent years with payment services becoming part of their product suite and business models, competing directly with traditional financial institutions.
Previously, PSD2 enabled tech firms to offer integrated payment and wallet services. However, with the end of PSD2 carve-outs in March 2026, VLOPs and digital marketplaces need to comply fully with regulatory requirements if they continue to provide payment services such as:
Also, under the EU AMLR (Regulation (EU) 2024/1624), the definition of a “correspondent relationship” will include not only banks but also credit and financial institutions, and crypto-asset service providers engaged in funds transfer, securities, and payment services. This potentially captures the global payment functionality of the VLOPs and digital marketplaces.
The integration of financial services into online platforms and digital marketplaces has created additional regulatory obligations, which means companies facilitating payments or cross-border transactions will need to manage activities such as enhanced due diligence, ongoing monitoring, and data-sharing requirements to prevent financial crime.
The DSA will require VLOPs and digital marketplaces to verify the legitimacy of business customers, leading to:
The AMLR also expands requirements for:
The VLOPs and digital marketplaces could view these changes as both a challenge and an opportunity for innovation. The convergence of payments, embedded finance, digital identity, and crypto calls for agile compliance, strategic collaboration, and technical investment.
Assess platform licensing: It’s key for VLOPs and digital marketplaces to assess exemptions—PSD3 for instance makes it harder to operate as an unregulated payment intermediary, and could make a payment license necessary
Upgrade fraud prevention and consumer protection: Many of the tech firms who need to comply would also need to implement advanced screening and monitoring, broadening customer authentication, verification, and other key checks.
Know your customer (KYC), know your customers’ customer (KYCC), and anti-money laundering (AML): Large platforms and digital marketplaces are also likely to need to strengthen onboarding, due diligence, and entity verification — such as clarifying the ultimate beneficial owners of a business, capturing customer and downstream client data, creating traceable, and auditable flows for payment and crypto-related services.
API & Open Banking readiness: Firms may need to prepare mandates requiring greater accessibility and standardization in open banking APIs and consumer data portability.
Governance and documentation: An upgrade of compliance documentation may also be required, along with preparing for direct supervision by regulators, and robust reporting on cross-border transactions.
Building trust and innovation:
Very large online platforms and digital marketplaces who embrace these regulatory changes may be better positioned for future growth and global credibility.
AMLR and PSD3 require VLOPs and digital marketplaces to implement advanced AML and fraud controls, deliver transparency, and bearing greater legal and financial risk for non-compliance. These changes fundamentally shift how they need to manage exposure to financial crime in the European Union if offering financial services.
By proactively adapting to these changes, VLOPs and digital marketplaces have an opportunity to strengthen trust, enhance operational resilience, and unlock opportunities for innovation—operating as leaders in a regulated, secure, and globally credible digital economy.
For more information about Moody’s solutions for automated onboarding, monitoring, and due diligence, please get in touch with the team—we would love to hear from you.
*Disclaimer: This content is for informational purposes only and reflects our understanding of the subject matter as of the date of publication. It does not constitute legal, regulatory, or compliance advice.