how do psd3 and psr affect the ATM businesses, from the business perspective?

While PSD3 and PSR redefine the legal "who" and "how" of payment access, the [Digital Operational Resilience Act (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) introduces a technical "what" that fundamentally alters the cost of physical infrastructure. The "spillover" effect occurs when the high-level security requirements intended for systemic banks migrate—by contractual necessity or regulatory osmosis—into the independent ATM deployer (IAD) ecosystem. ## Contractual Isomorphism and the "Waterfall" Effect The most immediate spillover is not legislative but contractual. Under **Chapter V of DORA**, financial entities must manage ICT third-party risk. Because banks increasingly outsource ATM fleets to IADs, these IADs—regardless of whether they are officially "financial entities" under Article 2—are forced to adopt DORA-compliant posture to remain "bankable" partners. This creates a state of **contractual isomorphism**, where the smaller, leaner IAD begins to look exactly like a systemic bank in its administrative and technical overhead. As the European Supervisory Authorities (ESAs) note in their [Joint Technical Standards](https://www.esma.europa.eu/press-news/esma-news/esas-publish-first-set-final-draft-technical-standards-under-dora), third-party service providers must provide "unrestricted rights of inspection and audit." For an ATM business, this means the end of "set and forget" hardware; every terminal becomes a node in a live, auditable network. ## The Death of the "Patch Gap" Historically, ATM hardware lifecycles were measured in decades, often running on legacy operating systems (like Windows XP or 7) long after their "end-of-life." DORA’s requirement for **vulnerability management and accelerated patching (Article 6)** creates a "technical spillover" that effectively kills the legacy ATM. > "Financial entities shall identify, classify and document all ICT-supported business functions, the information assets supporting those functions, and the ICT system configurations and the links between them." — *DORA, Article 8(1)* For ATM businesses, this mandates a shift from hardware management to **continuous software orchestration**. The spillover here is a sudden, massive increase in Capital Expenditure (CapEx) as firms are forced to replace stable, physical machines that simply cannot support the encrypted, multi-factor, and log-heavy environments DORA demands. ## Concentration Risk and the "Critical Provider" Trap A counterintuitive spillover is the potential for IADs to be designated as **Critical ICT Third-Party Providers (CTPPs)**. If an ATM deployer captures significant market share in a specific EU member state, they may fall under the direct oversight of the Lead Overseer (e.g., the EBA). This creates a "regulatory ceiling" on growth. An ATM business might find that crossing a certain threshold of market penetration triggers a level of oversight—including "oversight fees" and "recommendations" that carry the weight of law—which destroys the thin margins typical of the ATM industry. Instead of seeking scale, smart IADs may intentionally fragment their operations to avoid the "critical" designation, leading to a less efficient, more decentralized cash infrastructure. ## Resilience as a Barrier to Entry DORA spillover effectively transforms **resilience into a competitive moat**. The requirement for "TLPT" (Threat-Led Penetration Testing) for significant entities means that only the largest ATM operators can afford the "Red Teaming" exercises required to prove their worth to banking partners. This tilts the scales toward consolidation, where the "resilience tax" becomes a barrier that prevents innovative, smaller fintechs from entering the physical cash space.

This creates a "regulatory ceiling" on growth. An ATM business might find that crossing a certain threshold of market penetration triggers a level of oversight—including "oversight fees" and "recommendations" that carry the weight of law—which destroys the thin margins typical of the ATM industry. Instead of seeking scale, smart IADs may intentionally fragment their operations to avoid the "critical" designation, leading to a less efficient, more decentralized cash infrastructure.

In the traditional logic of industrial organization, scale is the ultimate prize, offering economies that drive down marginal costs. However, under the European Union’s [Digital Operational Resilience Act (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj), an Independent ATM Deployer (IAD) that successfully scales may find itself caught in a "regulatory death zone." Here, the reward for market leadership is not higher profits, but a designation as a **Critical ICT Third-Party Provider (CTPP)**, subjecting the firm to direct, intrusive oversight that can functionally invert the benefits of growth. ## The Regulatory Ceiling: Article 31 and Systemic Risk DORA shifts the focus of financial regulation from entities (banks) to the underlying infrastructure (ICT providers). Under **Article 31**, the European Supervisory Authorities (ESAs), such as the [European Banking Authority (EBA)](https://www.eba.europa.eu/), can designate a provider as "critical" based on the systemic impact of a failure. For an IAD, which provides the ICT-heavy services of cash dispensing and transaction processing, crossing a threshold of market penetration triggers this designation. > "The designation of critical ICT third-party providers should reflect the size and nature of the financial sector’s reliance on those providers... [and] the systemic impact that a failure or operational outage of such a provider could have on the financial stability of the Union." — [DORA Preamble, Recital 78](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554) ## The Economic Friction of Oversight Once designated, an IAD faces a regime designed for global cloud giants like AWS or Microsoft, not margin-thin cash operators. This includes: 1. **Oversight Fees:** Under Article 43, the Lead Overseer charges the CTPP fees to cover all expenses related to oversight tasks. For an IAD, these non-negotiable costs can exceed the annual profit generated by the very machines that triggered the designation. 2. **Recommendations with Teeth:** The Lead Overseer can issue "recommendations" on security, audits, and hardware. While technically recommendations, failure to comply can lead to daily penalty payments of up to 1% of the average daily worldwide turnover. ## Strategic Fragmentation: A New "Lucas Critique" Faced with this "regulatory ceiling," smart IADs may engage in a form of **regulatory arbitrage** by intentionally fragmenting their operations. Instead of a single large entity, an operator might split into multiple independent subsidiaries or limit its expansion in a specific Member State to stay below the ESAs' radar. This creates a paradox of resilience. While DORA aims to secure the financial system, it may inadvertently incentivize a **less efficient, more decentralized, and technologically stagnant** cash infrastructure. As the [Bank for International Settlements (BIS)](https://www.bis.org/publ/bcbs_nl25.htm) has noted in discussions on operational resilience, systemic risk often migrates rather than disappears. By forcing IADs to stay small, the regulator might prevent "too big to fail" providers but simultaneously create a "too fragmented to secure" landscape, where no single operator has the capital to invest in high-level cybersecurity. Does the pursuit of institutional resilience fundamentally threaten the economic viability of the very services being protected? This remains the central tension for the future of European cash access.