Payment Services Directive
PSD2 / PSD3 / PSR
The EU's foundational framework for payment services, open banking, and consumer protection in digital payments. PSD2 created the open banking revolution in 2018. Now, PSD3 and the Payment Services Regulation (PSR) will convert fragmented national rules into a directly applicable single rulebook -- the most significant reform of EU payment law in a decade.
Every time you pay with your phone, send money through an app, or let a budgeting tool read your bank transactions, you are relying on EU payment services law. The Payment Services Directive (PSD2), in force since 2018, created the legal framework that made all of this possible. It forced banks to open their doors to authorised third parties -- fintechs, payment apps, account aggregators -- and introduced Strong Customer Authentication (SCA), the reason you now confirm most online payments with two factors, like a fingerprint and a push notification.
PSD2 was a directive, meaning each EU country implemented it slightly differently. The result: a patchwork of 27 national interpretations that made cross-border payment services harder than they needed to be. The incoming Payment Services Regulation (PSR) fixes this by converting the core rules into a single, directly applicable EU regulation. Its companion, PSD3, handles the licensing and supervision side. Together they form the most significant overhaul of EU payment law since open banking began.
The practical changes matter. Banks will have to verify that a payee's name matches their IBAN before executing a transfer -- and will be liable for fraud losses if they skip the check. Payment providers must offer human customer support, not just chatbots. SCA must be accessible to people without smartphones. And instant credit transfers -- arriving in 10 seconds, around the clock -- are becoming the mandatory baseline across the eurozone under a separate 2024 regulation.
If you are a bank, a payment institution, an e-money issuer, a fintech building on open banking APIs, or a merchant processing online payments, PSD3 and the PSR will reshape your compliance obligations. The political agreement was reached in November 2025, and the new rules are expected to apply from around early 2028. The preparation window is already open.
Two decades of EU payment law reform -- from creating the single payment market to building a directly applicable open banking rulebook.
PSD2 created open banking. PSR enhances it. FIDA extends it to all financial products. Three regulatory layers building toward a comprehensive open finance ecosystem.
SCA requires two of three independent authentication elements for electronic payments and account access. The PSR adds a critical accessibility mandate.
| EXEMPTION | THRESHOLD | CONDITION |
|---|---|---|
| Low-value payments | Under EUR 30 | Cumulative limit: EUR 100 or 5 consecutive low-value transactions since last SCA |
| Contactless payments | Under EUR 50 | Cumulative limit: EUR 150 or 5 consecutive contactless payments since last SCA |
| Trusted beneficiaries | No limit | Payee added to payer's list of trusted beneficiaries (SCA required at addition) |
| Recurring payments | Same amount, same payee | SCA required for first transaction; subsequent identical payments exempt |
| Transaction Risk Analysis | Up to EUR 500 | PSP fraud rate below reference thresholds (e.g., 0.01% for EUR 500) |
| Corporate payments | No limit | Dedicated payment processes or protocols available only to non-consumers |
Four categories of regulated payment service provider, each with distinct capital requirements and operational obligations. PSD3 merges PI and EMI regimes.
The Instant Payments Regulation mandates 10-second euro credit transfers 24/7/365, reinforcing the PSD/PSR payment infrastructure. SCA applies even at accelerated speeds.
Regulation (EU) 2024/886 published in the Official Journal, amending the SEPA and Settlement Finality directives.
All eurozone PSPs must be able to receive instant euro credit transfers within 10 seconds, 24/7/365.
All eurozone PSPs must be able to send instant credit transfers. Charges must not exceed standard credit transfer fees.
Non-eurozone EU PSPs offering euro credit transfers must support receiving instant payments.
Non-eurozone EU PSPs must support sending instant payments in euro. Full EU-wide instant payment infrastructure complete.
PSD2/PSD3 and the PSR apply to all providers of payment services in the EU -- from traditional banks to fintechs and crypto payment processors.
The scale of EU payment services regulation and its impact on the digital payments ecosystem.