Payment firms will have to refund customers deceived by fraudsters posing as their bank, check payee names on every credit transfer and reapply for their licences once the new rules take effect.
The EU Payment Services Directive 3 (PSD3) and the Payment Services Regulation (PSR) replace PSD2, the rulebook bringing open banking and strong customer authentication (SCA) to Europe and has largely applied since 2018. The package also absorbs the Electronic Money Directive, which puts payment firms and e-money firms under one set of rules for the first time.
The European Commission proposed the reforms in June 2023 after its own review found PSD2 had left consumers exposed to fraud, produced patchy open banking, and had been enforced differently from one member state to the next.
The package comes in two parts:
- PSD3 is a directive. It covers licensing, capital, safeguarding and supervision, and each member state writes it into national law.
- The PSR is a regulation. It holds the day-to-day conduct rules on fraud, SCA, fees and open banking, and applies word for word across all 27 member states.
Putting the conduct rules in a regulation closes gaps letting some firms passport services from member states with lighter enforcement under PSD2.
When does PSD3 come into force?
Neither PSD3 nor the PSR is in force yet, though the legislative process is in its final stage:
- 28 June 2023: Commission publishes the proposals
- 27 November 2025: Parliament and Council reach a provisional agreement on the payments package
- 23 April 2026: Council publishes the final compromise texts
- 29 October 2026: Council adopts its first-reading position
- Next: Parliament’s second-reading vote, then publication in the Official Journal of the EU
Both instruments, PSD3 and PSR, enter into force 20 days after publication, and their rules apply 21 months after that, with payee verification following at 27 months. Some expect publication in December 2026, which would mean firms have to comply from late 2028.
What changes on fraud?
Fraud liability is the biggest operational change in the package. Credit transfer fraud across the European Economic Area cost €2.5bn in 2024, according to the European Banking Authority (EBA) and the European Central Bank (ECB), and most of those losses came from scams in which customers were manipulated into sending the money themselves. PSD2 placed no reimbursement duty on providers for that kind of fraud.
Under the PSR:
- A payment service provider (PSP) is liable for customer losses if it has not put appropriate fraud prevention in place.
- If a scammer poses as a PSP’s employee and talks a customer into approving a payment, the PSP must refund the full amount, provided the customer reports it to the police and tells the provider.
- Name-and-account checks, which the Instant Payments Regulation made mandatory for euro payments in October 2025, extend to all credit transfers.
- PSPs must monitor transactions for fraud risk and share fraud data with each other.
Providers that pay out can also recover losses from hosting services that stored the scam content, according to law firm Freshfields’ reading of the final text.
The UK has required APP fraud reimbursement since October 2024, and Paul Horlock, Chief Payments Officer at Santander UK, previously spoke about the cost of it: “Customers expect to be protected in the same way they are with cards, regardless of how they pay.
“But in reality, that level of protection isn’t always there in newer payment methods,” he told Payment Expert while discussing the bank’s consumer-first payments strategy. “Protecting customers costs money, and as an industry we need to have an honest conversation about that.”
What changes for open banking?
PSD2 required banks to open customer account data to licensed third parties, but European open banking providers complained the rules were applied unevenly.
The PSR tightens them. Banks must keep at least one dedicated interface for account information and payment initiation providers, free of charge, and the regulation lists the obstacles they may not put in the way of data access.
Customers get a dashboard showing which apps can see their data, with the option to withdraw access, and national regulators can penalise banks whose APIs fall short.
Daniele Tonella, CTO at ING, said successive rules have not turned banks into infrastructure for fintechs. “Open banking, PSD2, PSD3 – these regulations were all aiming at opening up the banking system to give more advantages to consumers. None of it ultimately ended with banks becoming pure plumbing, with everything else sitting in a fintech ecosystem,” he told Payment Expert in an interview on the bank’s API-led payments infrastructure.
He said preparation will separate firms: “Plugging AI agents, open banking and PSD3 into systems that were never designed for them – I think the next couple of years will show us clearly where that differentiation lands.”
What changes for payment and e-money firms?
PSD3 abolishes the separate e-money licence and makes e-money institutions (EMIs) a category of payment institution.
Existing payment institutions and EMIs can keep operating under their current licences for 27 months after entry into force, but must show their regulator they meet the new authorisation requirements within that window or face suspension.
Two changes reduce non-bank firms’ dependence on banks. Payment institutions will be able to hold safeguarded client funds at a central bank where one offers accounts, and an amendment to the Settlement Finality Directive lets them join designated payment systems directly rather than through a sponsor bank.
Does PSD3 apply in the UK?
No. The UK left the EU before PSD3 was proposed and is developing its own payments regime. UK businesses with EU customers, EU entities or EU payment providers may still be affected.
