PSD3, the third Payment Services Directive

Get ready for PSD3 and the new Payment Services Regulation (PSR): open banking, SCA, fraud prevention, licenses and access to payment systems. We help you adapt your institution before the new rules come into force.

Contact us

Free PSD3 consultation

We reply within 24 h

Commission proposal
June 2023
Provisional political agreement
November 27, 2025
SCA factors
2 or more
Impact by sector

How does PSD3 affect each type of institution?

Banks, fintechs, payment institutions, open banking providers and neobanks: each profile faces different implications.

Payment institutions

New authorization and safeguarding regime

"PSD3 unifies licensing requirements, strengthens the safeguarding of client funds and requires resolution plans for payment institutions."

Fintech / TPPs

Better access to accounts and data

"Third-party providers (AISPs/PISPs) get stronger guarantees of access to bank APIs, but also new transparency and security obligations."

Banking

Interface obligations and fraud liability

"Banks must ensure working APIs, take on shared liability in impersonation fraud cases and adapt their SCA systems."

E-commerce

Impact on checkout and conversion

"The new SCA rules and exemptions directly affect the payment flow: you need to balance security and user experience."

Risks

What happens if you do not prepare for PSD3?

Failing to comply with the new payments framework can lead to penalties, loss of your license and being pushed out of the market by competitors.

Loss of license or refusal of authorization: institutions that do not meet the new governance, capital and safeguarding requirements may lose their authorization to operate.

Wider fraud liability: PSD3 introduces shared liability for impersonation fraud (spoofing), which raises the cost of not having effective anti-fraud controls.

Exclusion from the payments ecosystem: payment institutions will be able to access payment systems such as TARGET; failing to adapt means being left out of the European payments infrastructure.

Open Banking Mandatory APIs

Banks that do not offer working dedicated interfaces may be penalized and required to keep providing access via screen scraping.

SCA New exemptions

Failing to adapt authentication flows to the new exemptions (low risk, recurring payments) creates unnecessary friction and lost customers.

Penalties Harmonized regime

The PSR sets up a single EU-wide penalty regime, with fines proportionate to the institution’s business volume.

Is your institution ready for PSD3?

We analyze your current situation, identify regulatory gaps and design a plan to adapt to the new EU payments framework: licenses, open banking, SCA, fraud and compliance.

Fintech Regulation →
Frequently asked questions

PSD3: common questions

What is PSD3?

PSD3 (Payment Services Directive 3) is the new EU directive that replaces PSD2. It comes with the PSR (Payment Services Regulation), a directly applicable regulation that harmonizes payment rules across the EU.

Its aim is to improve user protection, step up the fight against fraud, boost open banking and create a more competitive and integrated payments market.

What is the difference between PSD3 and the PSR?

PSD3 is a directive that mainly governs the authorization and supervision of payment institutions and electronic money institutions (licenses, governance, capital). It must be transposed into each country’s national law.

The PSR is a regulation that applies directly in all Member States and covers the operational rules: user rights, transparency, SCA, account access, fraud liability and fraud prevention.

When does PSD3 come into force?

The legislative proposal was presented in June 2023. On November 27, 2025, the European Parliament and the Council reached a provisional political agreement, and in April 2026 the Council confirmed the final compromise text. The formal vote and publication in the Official Journal of the EU are still pending; publication is expected in the first half of 2026.

It enters into force 20 days after publication, and Member States have 21 months to transpose PSD3. This puts practical application in Spain at around 2027. It makes sense to start the gap analysis now, with that date as the target.

What changes in open banking with PSD3?

PSD3/PSR brings significant improvements to payment account access:

  • An obligation to provide working dedicated interfaces (APIs), with a performance dashboard.
  • Gradual phase-out of screen scraping as the main access method.
  • Greater clarity on the rights of TPPs (AISPs/PISPs) and on response times.
  • Coordination with the upcoming FIDA (Financial Data Access) regulation for open finance.
How does PSD3 affect fraud prevention?

New anti-fraud measures in PSD3/PSR

  • Verification that the payee’s IBAN matches the payee’s name before credit transfers are executed.
  • Shared liability: PSPs may be liable for impersonation fraud (spoofing/social engineering).
  • Wider refund rights for users in certain fraud scenarios.
  • An obligation for PSPs to share fraud information with each other through dedicated mechanisms.
  • Stronger SCA, with new exemptions and improved delegation.
Which entities need to adapt to PSD3?

All entities that provide payment services in the EU are affected:

  • Authorized payment institutions (PIs).
  • Electronic money institutions (EMIs) — PSD3 merges both regimes.
  • Payment initiation service providers (PISPs).
  • Account information service providers (AISPs).
  • Banks and credit institutions that provide payment services.
  • Large platforms and marketplaces with integrated payment flows.
Does PSD3 merge payment institutions and electronic money institutions?

Yes. One of the most significant changes in PSD3 is the merger of the authorization regimes for payment institutions (PIs) and electronic money institutions (EMIs) into a single regulatory category.

This simplifies the licensing framework and removes inconsistencies between the two regimes, but it means adapting articles of association, capital requirements and supervisory processes.

How does PSD3 relate to DORA and MiCA?

PSD3 is part of a wider regulatory ecosystem:

  • DORA (Digital Operational Resilience Act): sets digital resilience requirements for financial entities, including payment institutions.
  • MiCA: regulates crypto-assets and e-money tokens, with overlaps in the issuance of e-money tokens.
  • FIDA: the upcoming financial data access regulation extends open banking to open finance.
Operational guide

Practical guide to PSD3/PSR

PSD3 is not just an update of PSD2: it is a change of model. A directly applicable regulation (PSR), merged licenses, fraud liability and stronger open banking. Here are the pillars of the new framework.

Structure

Directive + Regulation: two instruments

PSD3 (the directive) governs licensing and supervision. The PSR (the regulation) applies directly and covers the operational rules: user rights, SCA, account access and fraud. This removes the national divergences that PSD2 created.

Licenses

PI/EMI merger and access to payment systems

A single authorization regime for payment institutions and electronic money institutions. In addition, payment institutions will be able to access payment systems (such as TARGET) directly, removing their dependence on intermediary banks.

Fraud

Shared liability and user protection

IBAN-name verification, PSP liability for impersonation fraud, wider refunds and an obligation to share fraud data between institutions. A paradigm shift in consumer protection.

PSD3 checklist: 10 steps to prepare your institution

  1. Assess your regulatory fit: are you a PI, EMI, AISP or PISP? Determine how the merger of regimes affects you.
  2. Review capital requirements and the safeguarding of client funds under the new framework.
  3. Adapt your internal governance: structure, committees, key functions and contingency plans.
  4. Audit your account access APIs: functionality, availability, response times and dashboard.
  5. Implement payee IBAN-name verification for outgoing credit transfers.
  6. Review your SCA flows: new exemptions, delegation and the balance with user experience.
  7. Design fraud detection and prevention mechanisms, including liability for spoofing.
  8. Update your policy on transparency and user rights (fees, time limits, complaints).
  9. Coordinate with DORA: operational resilience, ICT risk management and incident reporting.
  10. Plan the transition: timeline, gap analysis, staff training and reporting to the supervisor.

If you need advice on the PSD2 → PSD3 transition, see our fintech regulation services or request a free consultation.

PSD3 in practice

PSD3: from proposal to real impact on your institution

PSD3 and the PSR are transforming the European payments framework. These cards summarize the operational areas you need to review: licenses, open banking, fraud, SCA and governance.

PSD3: licenses and authorization1) License

Single PI/EMI authorization

PSD3 merges the payment institution and electronic money institution regimes into a single license, simplifying requirements but requiring existing institutions to adapt.

  • Unified capital requirements
  • Stronger safeguarding
  • Direct access to payment systems
PSD3: open banking and APIs2) Open Banking

Mandatory APIs and guaranteed access

Banks must offer working dedicated interfaces. TPPs get clearer access rights and tools to measure API performance.

  • Availability dashboard
  • End of screen scraping as a fallback
  • Coordination with FIDA
PSD3: fraud prevention and SCA3) Fraud

Anti-fraud and SCA: a new paradigm

IBAN-name verification, liability for impersonation, wider refunds and an obligation to share fraud data between PSPs.

  • Mandatory IBAN-name check
  • Liability for spoofing
  • New SCA exemptions
PSD3: governance and supervision4) Governance

Stronger supervision and resilience

Stricter governance requirements, coordination with DORA for operational resilience and resolution plans for significant payment institutions.

Tip: the EBA will publish guidelines and technical standards (RTS/ITS) that will spell out many of these requirements.
PSD3: impact map by type of institutionImpact map

PSD3 impact by profile

Bank

Mandatory APIs + liability for impersonation fraud + adapted SCA.

Fintech / PI

Unified license + access to payment systems + new capital requirements.

TPP (AISP/PISP)

Better API access + greater transparency + stronger security obligations.

PSD3 playbook

PSD3 vs PSD2: what changes in practice

Aspect
PSD2 (current)
PSD3/PSR (new)

Legal instrument

A single directive, transposed differently in each Member State.

Directive (PSD3) + directly applicable Regulation (PSR): uniform rules across the EU.

PI / EMI licenses

Separate regimes for payment institutions and electronic money institutions (EMD2).

Merged into a single license. EMIs are now regulated under PSD3.

Open Banking

Optional APIs with a screen scraping fallback. Functionality and access problems.

Mandatory APIs with a performance dashboard. Screen scraping only as a regulated last resort.

Fraud

Limited PSP liability. No IBAN-name verification.

Mandatory IBAN-name check. Shared liability for spoofing. Wider refunds.

SCA

Limited exemptions. Unclear delegation.

New exemptions, better delegation and rules proportionate to transaction risk.

Signs that you need to act now

If any of these situations applies to your institution, you should start the gap analysis before the final text is published.

  • You operate as an electronic money institution and will have to migrate to the new unified regime.
  • Your account access APIs do not meet the expected functionality and availability standards.
  • You have no IBAN-name verification mechanisms for outgoing credit transfers.
  • Your SCA model does not cover the new exemptions or improved delegation.
  • You have not assessed the impact of shared liability for impersonation fraud.
Operational glossary

Key PSD3 concepts

If you are preparing the transition to PSD3, these terms come up constantly in legislative texts, in supervision and in day-to-day payment operations.

PSD3Directive

Payment Services Directive 3

The third EU payment services directive. It governs the authorization, supervision and governance of payment institutions and electronic money institutions.

Instrument: directive (requires national transposition).
PSRRegulation

Payment Services Regulation

A directly applicable regulation that unifies the operational rules for payments: user rights, SCA, account access and fraud prevention.

Instrument: regulation (directly applicable across the EU).
SCASecurity

Strong Customer Authentication

Strong customer authentication based on two or more factors (possession, knowledge, inherence). PSD3 widens the exemptions and improves delegation.

Key: balancing security and conversion.
AISPOpen Banking

Account Information Service Provider

A provider that accesses the user’s payment account data (with the user’s consent) to aggregate financial information. Regulated under PSD2 and strengthened under PSD3.

Example: account aggregators, personal finance apps.
PISPOpen Banking

Payment Initiation Service Provider

A provider that initiates payments from the user’s account held with another PSP. Under PSD3, it gains more legal certainty and better access to bank APIs.

Example: direct payment from an account, without a card.
FIDAOpen Finance

Financial Data Access Regulation

A proposed regulation that extends open banking to open finance: access to insurance, investment, pension and credit data, not only payment accounts.

It complements PSD3, moving toward an open financial data ecosystem.
IBAN CheckFraud

IBAN-name verification (VoP)

A check that the payee’s IBAN matches the name provided before the credit transfer is executed. Mandatory under the PSR and already required for SEPA Instant since October 2025.

Goal: reduce fraud caused by errors or impersonation.
DORAResilience

Digital Operational Resilience Act

Regulation on digital operational resilience for financial entities: ICT risk management, resilience testing and incident reporting.

Applies to payment institutions under PSD3.
SafeguardingCapital

Safeguarding of funds

The obligation to protect client funds by segregating them in separate accounts or through equivalent guarantees. Strengthened in PSD3.

Key to user trust and the institution’s stability.
Regulatory status

Current status of PSD3 and the PSR

If you want to know when PSD3 comes into force, what stage the PSR has reached and what steps payment institutions, fintechs and banks should take now, start here.

June 2023 Proposal

The European Commission presents PSD3 and the PSR

The Commission launched the new payment services legislative package to fix the problems identified under PSD2: regulatory fragmentation, fraud, API shortcomings and differences between payment institutions and electronic money institutions.

Formal start of the reform of the European payments framework.
Nov 27, 2025 Political agreement

Parliament and Council reach a provisional political agreement

The PSD3/PSR package made decisive progress with the provisional agreement between the EU institutions. From that point on, the reform was no longer a hypothesis but a regulatory change in its final stage.

A key moment to start the gap analysis and internal adaptation.
April 2026 Final text + OJEU

Final compromise text and publication in the OJEU

In April 2026, the Council confirmed the final compromise text of PSD3 and the PSR. The formal vote and publication in the Official Journal of the EU are still pending, with publication expected in the first half of 2026. From then on, the deadlines start to run: entry into force after 20 days and 21 months for transposition of PSD3, which puts practical application at around 2027.

Early planning reduces regulatory and operational friction.
Scope

Who does PSD3 affect?

PSD3 does not only affect banks. It also affects payment institutions, electronic money institutions, open banking providers, fintechs with integrated payment flows and platforms operating in the European payments ecosystem.

Regulated entities

Payment institutions and electronic money institutions

They are among the groups most directly affected by PSD3. The new framework reorganizes the logic of authorization, strengthens governance, revises the safeguarding of client funds and requires a thorough review of the operating model and documentation.

See payment institution license →
LicenseGovernanceClient fundsCompliance
Banking

Banks and credit institutions that provide payment services

Banks will have to review the quality of their APIs, their strong authentication mechanisms, fraud management and account access operations. The impact is especially significant for open banking, fraud liability and the user experience in payments.

Open banking and account access →
APIsSCAFraudAccount access
TPP

AISPs and PISPs

Account information and payment initiation service providers must review access, security, contractual documentation, API use and their stronger obligations toward users and banks.

PISP, AISP and open banking →
Open BankingAPIs
Fintech

Fintechs with a payments product

If your model includes wallets, transfers, checkout, account aggregation or embedded payments, PSD3 may affect your legal, technology and operating architecture, even if part of the service is outsourced.

Fintech regulation →
Embedded FinanceWallets
E-commerce

Marketplaces and platforms

Platforms with payment collection flows, integrated checkout or marketplace structures must analyze whether their activity counts as a payment service, which exemptions apply and how PSD3 will affect fraud and authentication.

Do I need a license? →
CheckoutExemptions
Regulatory overlap

Groups with cross-cutting impact

Many institutions will have to review PSD3 together with DORA, MiCA, outsourcing, data protection and anti-money laundering rules. The problem is rarely a single law; it is the sum of overlapping obligations.

Integrated regulatory approach →
DORAMiCA

Not sure whether your business falls under PSD3?

We analyze your model, determine whether you provide payment services or related activities and tell you which regulatory obligations you need to review now.

Request an initial analysis →

REGULATORY CONTROL CENTER · PSD3/PSR

PSD3 readiness dashboard: gap analysis and roadmap

For payment institutions, fintechs and banks, the transition to PSD3 requires a structured plan: licenses, open banking, SCA, fraud and governance. This dashboard summarizes the impact areas and their level of urgency.

PSD3 impact matrix by regulatory area

Prioritize the areas with the greatest impact and urgency for your type of institution.

Area
Bank
PI / EMI
TPP
License
LowAlready authorized
HighPI/EMI merger
MediumNew registration
Open Banking
HighMandatory APIs
LowConsumer
MediumBetter access
Fraud
HighIBAN check
MediumData sharing
LowAdaptation
Contact

Book a call

Tell us about your situation and we will explain how to prepare your institution for PSD3 and the new PSR.

PSD3 and the PSR: the new European payment services framework

The Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) are the biggest reform of the EU payments regulatory framework since PSD2 was adopted in 2015. The proposal, published by the European Commission in June 2023, responds to the shortcomings found in the application of PSD2 and to the fast-changing digital payments market.

Why is PSD3 needed?

PSD2 introduced open banking and strong customer authentication (SCA), but its implementation revealed problems: divergent national transposition, low-quality bank APIs, rising online fraud (especially impersonation fraud) and a licensing regime split between payment institutions and electronic money institutions. PSD3 and the PSR address these problems with two legislative instruments: a directive for supervision and licensing, and a directly applicable regulation for the operational rules.

Main changes in PSD3/PSR

The most significant changes include: the merger of the payment institution and electronic money institution regimes into a single regulatory category; access for payment institutions to payment systems such as TARGET; better open banking, with mandatory APIs and performance dashboards; mandatory IBAN-name verification; shared liability for impersonation fraud; and a harmonized penalty regime at EU level.

Coordination with DORA, MiCA and FIDA

PSD3 does not operate in isolation. It fits together with the DORA Regulation (digital operational resilience, applicable since January 2025), the MiCA Regulation (crypto-assets and e-money tokens) and the proposed FIDA Regulation (financial data access for open finance). Regulated entities must assess the combined impact of these rules on their business model, governance and technology systems.

Timeline and preparation

On November 27, 2025, the European Parliament and the Council reached a provisional political agreement on PSD3 and the PSR. In April 2026, the Council confirmed the final compromise text; the formal vote and publication in the Official Journal of the EU are still pending, with publication expected in the first half of 2026. From entry into force, Member States have 21 months to transpose PSD3, which puts practical application in Spain at around 2027. Institutions that adapt early—gap analysis, license review, API upgrades, anti-fraud protocols and training—will start with a competitive and regulatory advantage.

PSD3 PSR PSD2 SCA Open Banking FIDA DORA MiCA
Last updated: June 2026

Related services

Fintech Regulation → Payment Institution License → EMI License (Electronic Money) → PISP, AISP and Open Banking → Anti-Money Laundering (AML/CFT) → Corporate Compliance →

Financial regulation

MiCA and Crypto-Assets → Securities Market Regulation → Crypto-Assets and Blockchain → Banking Crypto Proceeds →

Resources and blog

Blog: articles on regulation and compliance → AML/CFT Audit → External Expert Report →

Official sources

Key legislation, linked to the official text:

Legislation and links reviewed in .

More in Fintech Regulation