Why 2027 is the deadline for payment infrastructure modernisation

Instant payment, fraud liability, and digital euro deadlines fall across 2027 and 2028. Inspired by BPC's migration guide, we look at why banks need modern issuing, acquiring, and fraud platforms in place by the end of 2027.

Most banks' card and payment platforms still process transactions every day without incident. That reliability is why modernisation is kept down on the agenda. For European financial institutions, the regulatory calendar is turning it into a priority.

Between January 2027 and late 2028, banks face fixed deadlines for euro instant payments and Verification of Payee (VoP), a new fraud liability regime under the Payment Services Regulation (PSR), and the start of a digital euro pilot. Each of these changes reaches into card issuing, merchant acquiring, and fraud monitoring at the same time.

In September 2026, we covered the main findings of BPC's Modernisation Without Disruption guide, which treats legacy infrastructure as both business and technology problems. This article looks beyond that. A platform that must be live in 2028 has to be selected and rehearsed during 2027, which makes the end of next year the practical deadline for a decision.

The deadlines in 2027 and 2028

The first fixed dates arrive in January 2027, and they fall mainly on banks outside the euro area. Under the Instant Payments Regulation (IPR), payment service providers in member states such as Poland, Romania, and Sweden must start receiving instant euro transfers in January and sending them in July, with VoP checks on every outgoing credit transfer.

Dates, requirements, and targets for upcoming European regulation (IPR and PSR)

Date	Requirement	Applies to
9 January 2027	Receive instant credit transfers in euro	Banks in non-euro member states
23 January 2027	Display enhanced merchant data in digital banking channels	Visa consumer-card issuers in most European countries
9 April 2027	Send and receive instant credit transfers in euro	Payment and e-money institutions in the euro area
9 July 2027	Send instant credit transfers in euro and offer VoP	All payment service providers in non-euro member states
September 2027	Start of a 12-month digital euro pilot	Selected payment service providers in the euro area
Expected late 2028	General application of the PSR	All payment service providers in the EU

The PSR date depends on publication in the Official Journal, which was still pending at the time of writing. The final compromise texts were published in April 2026, and most provisions apply 21 months after entry into force. The digital euro timeline also depends on legislation: the ECB aims to be ready for a first issuance in 2029, with a pilot planned from September 2027.

A 2028 deadline means deciding in 2027

The dates matter because a controlled migration takes time. BPC's guide sets out a sequence that starts with analysing the legacy system and moves through data preparation, conversion, repeated mock migrations, and reconciliation before a pilot and full rollout. In its APAC case study, a bank ran five mock migrations before moving around 5 million cards and 30 BINs to the new platform in less than a day.

The guide also lists the dependencies that tend to surface late. Tokenised cards in mobile wallets can stop working or need re-provisioning if the token inventory is not mapped by wallet, network, BIN, and status. Routing, settlement, and scheme certification requirements need early alignment with card schemes, sponsors, and processors.

Timing also shapes the choice of migration path. The guide describes a Big Bang cutover as an option when regulatory or scheme deadlines are fixed, but only where data mapping, testing, and reconciliation are already mature. A phased migration by BIN or product carries the lowest risk and takes the longest. A bank that starts in 2027 can still choose between these routes, while one that waits until 2028 is more likely to have a fast cutover forced on it by the regulatory calendar.

Benefits for issuers

For card issuers, the most direct gain is in approval rates. BPC's guide calls the problem authorisation leakage: good transactions that are declined or time out on legacy systems. In its worked example, an avoidable false decline rate of 0.50 percentage points on 10 million monthly debit transactions means 50,000 lost transactions every month, each one a missed interchange fee and a reason for the customer to reach for another card.

Modern platforms also shorten the path from product idea to launch. The guide contrasts support for debit, credit, prepaid, virtual, corporate, loyalty, BNPL, co-branded, and embedded cards with legacy stacks limited to physical debit and credit. In its MEA case study, a bank used its migration to extend issuing to virtual, corporate, loyalty, and specialised fuel and hospital cards across Visa, Mastercard, and UnionPay.

Many of the 2027 requirements for issuers surface on the digital channel. Visa's rules require consumer card issuers in most European countries to show improved merchant data, such as the merchant's trading name and contact details, in their banking apps from 23 January 2027. Meeting that deadline depends on processing systems that expose transaction data through APIs, the same interfaces banks use to let customers block a card, set limits, or change a PIN in the app.

Benefits for acquirers

On the acquiring side, modernisation is mainly about how many ways a merchant can get paid. BPC's guide sets support for all international schemes, SoftPOS, QR, and NFC against legacy platforms built around local schemes. In the MEA case study, the bank's new platform allows it to accept global card brands across its whole POS network and add cardless ATM withdrawals, FX at ATMs, utility payments, and dynamic currency conversion.

With the 2027 regulatory calendar, that list gets wider. Once instant euro transfers are available from every EU bank account, acquirers that want to offer account-to-account (A2A) payments at checkout need platforms that can process them next to card traffic. If the digital euro is issued, it will also have to run through the same terminals and gateways. The guide's comparison lists ISO 20022 and a CBDC integration toolkit on the modern side, while many legacy switches still speak only ISO 8583.

Message protocols do not all have to change on day one. In the MEA project, BPC kept the bank's existing CR2 message protocols running at first because there was not enough time to move both institutions to new ones before go-live. The bank switched to BPC's protocol later, once the migration was stable.

Benefits for fraud teams

Fraud modernisation required by the regulatory calendar is the strongest case, because the PSR ties liability directly to system performance. Under the final compromise text, transaction monitoring becomes a standalone obligation, and a PSP that fails to monitor properly can be held liable for the customer's loss. The text also requires real-time monitoring for instant credit transfers and gives customers a refund right when fraudsters impersonate their own bank.

Those rules envision a fraud engine that scores each payment before it is executed. BPC's guide describes the legacy alternative as offline or near-real-time monitoring, where static rules either block loyal customers or let fraudulent transactions through. Both outcomes now carry a cost under the PSR, the first in lost spend and complaints, the second in refunds. On the modern side, the guide lists enterprise-grade fraud prevention that applies AI and machine learning models to transaction data in real time.

Migration can also close security gaps that a legacy system has carried for years. In the MEA case study, the bank's old password retrieval procedure handled unencrypted PINs. BPC replaced it with a secure protocol as part of moving the bank to its standard APIs.

Planning the migration around the deadlines

For most banks, the practical question for 2027 is which migration path fits the time left. BPC's guide ties that choice to the bank's current architecture, operational risk, regulatory obligations, and internal readiness. A phased migration that issues new cards on the new platform first, or moves one BIN at a time, lets a bank meet the 2027 and 2028 requirements while legacy portfolios follow in waves. Where the legacy system is close to end of life, a well-rehearsed Big Bang cutover may be the faster route.

For the full migration framework, case studies, and checklists, download BPC's Modernisation Without Disruption guide.

About the author

Vlad is a Senior Writer at The Paypers, working in the commercial team. He uses his research, content, and people skills for all editorial activities revolving around payments, banking, and fintech. Vlad has a degree in Biology and Molecular Genetics and an extensive background in creative writing. You can reach out to him on LinkedIn.