EU negotiators reached provisional agreement on the third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR) in November 2025, and the final texts were put to member states for approval in April 2026. Once published, the PSR will apply directly across the EU, while PSD3 has to be written into national law. Most provisions are expected to apply from 2028. For payment institutions that already comply with PSD2, the real questions are how much of their current compliance carries over and where the new rules need genuine work.
The structural change: from directive to regulation
PSD2 was a directive, so each member state wrote it into national law in its own way and practice varied widely. Most of the conduct rules now move into a regulation that applies directly and uniformly across the EU, with little room for national variation on core provisions. For payment institutions operating in several EU countries, one rulebook replaces the patchwork that PSD2 produced. PSD3 itself will cover licensing and supervision, and it brings e-money institutions into the payment institution regime.
Material changes from PSD2
Fraud rules are the biggest operational change. Verification of payee, already required for euro credit transfers under the Instant Payments Regulation since October 2025, is extended to credit transfers more widely. Payment service providers will also face refund obligations in some impersonation scams, where fraudsters pose as bank staff, and must share fraud data with each other.
Strong customer authentication stays, but the rules are clearer. The PSR keeps the SCA obligation for electronic payments, clarifies the existing exemptions and adds provisions to make SCA accessible to people who cannot use smartphones. Clearer rules on transaction risk analysis should reduce the differences in interpretation that PSD2 produced.
Open banking access is tightened. Banks must provide a dedicated interface that meets performance standards, and customers get a dashboard to see and withdraw the data access permissions they have granted. Obstacles that banks put in the way of third-party providers are listed and prohibited.
What stays essentially the same
The basic structure of licensing is familiar: the categories of payment service, capital requirements and safeguarding obligations largely carry over. Existing institutions will be able to keep operating during a transition period, but they will need to give their national regulator the information required to confirm their authorisation under the new rules, and e-money institutions will need to adjust to operating as payment institutions.
What institutions should be doing now
There is time before the rules apply, but the work should not be underestimated. Payee verification and fraud data sharing need technology changes that take time to build. SCA exemption logic may need reconfiguring, and open banking interfaces may need upgrading to meet the new performance and dashboard requirements. Institutions should run a gap assessment against the final text now, starting with the fraud and payee verification obligations, which bring the largest operational change.