how do psd3 and psr affect the ATM businesses, from the business perspective?

While PSD3 and PSR redefine the legal "who" and "how" of payment access, the [Digital Operational Resilience Act (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) introduces a technical "what" that fundamentally alters the cost of physical infrastructure. The "spillover" effect occurs when the high-level security requirements intended for systemic banks migrate—by contractual necessity or regulatory osmosis—into the independent ATM deployer (IAD) ecosystem. ## Contractual Isomorphism and the "Waterfall" Effect The most immediate spillover is not legislative but contractual. Under **Chapter V of DORA**, financial entities must manage ICT third-party risk. Because banks increasingly outsource ATM fleets to IADs, these IADs—regardless of whether they are officially "financial entities" under Article 2—are forced to adopt DORA-compliant posture to remain "bankable" partners. This creates a state of **contractual isomorphism**, where the smaller, leaner IAD begins to look exactly like a systemic bank in its administrative and technical overhead. As the European Supervisory Authorities (ESAs) note in their [Joint Technical Standards](https://www.esma.europa.eu/press-news/esma-news/esas-publish-first-set-final-draft-technical-standards-under-dora), third-party service providers must provide "unrestricted rights of inspection and audit." For an ATM business, this means the end of "set and forget" hardware; every terminal becomes a node in a live, auditable network. ## The Death of the "Patch Gap" Historically, ATM hardware lifecycles were measured in decades, often running on legacy operating systems (like Windows XP or 7) long after their "end-of-life." DORA’s requirement for **vulnerability management and accelerated patching (Article 6)** creates a "technical spillover" that effectively kills the legacy ATM. > "Financial entities shall identify, classify and document all ICT-supported business functions, the information assets supporting those functions, and the ICT system configurations and the links between them." — *DORA, Article 8(1)* For ATM businesses, this mandates a shift from hardware management to **continuous software orchestration**. The spillover here is a sudden, massive increase in Capital Expenditure (CapEx) as firms are forced to replace stable, physical machines that simply cannot support the encrypted, multi-factor, and log-heavy environments DORA demands. ## Concentration Risk and the "Critical Provider" Trap A counterintuitive spillover is the potential for IADs to be designated as **Critical ICT Third-Party Providers (CTPPs)**. If an ATM deployer captures significant market share in a specific EU member state, they may fall under the direct oversight of the Lead Overseer (e.g., the EBA). This creates a "regulatory ceiling" on growth. An ATM business might find that crossing a certain threshold of market penetration triggers a level of oversight—including "oversight fees" and "recommendations" that carry the weight of law—which destroys the thin margins typical of the ATM industry. Instead of seeking scale, smart IADs may intentionally fragment their operations to avoid the "critical" designation, leading to a less efficient, more decentralized cash infrastructure. ## Resilience as a Barrier to Entry DORA spillover effectively transforms **resilience into a competitive moat**. The requirement for "TLPT" (Threat-Led Penetration Testing) for significant entities means that only the largest ATM operators can afford the "Red Teaming" exercises required to prove their worth to banking partners. This tilts the scales toward consolidation, where the "resilience tax" becomes a barrier that prevents innovative, smaller fintechs from entering the physical cash space.

This creates a "regulatory ceiling" on growth. An ATM business might find that crossing a certain threshold of market penetration triggers a level of oversight—including "oversight fees" and "recommendations" that carry the weight of law—which destroys the thin margins typical of the ATM industry. Instead of seeking scale, smart IADs may intentionally fragment their operations to avoid the "critical" designation, leading to a less efficient, more decentralized cash infrastructure.