.png){kind=logo}
Vixio Intelligence
To keep up to date on Vixio webinars, events and industry and product news,
sign up today
Subscribe NowPSD2 vs PSD3 and the PSR: what changes for licensing, fraud, SCA, open banking and safeguarding, and how payments compliance teams can prepare.
If you're responsible for compliance at a payment institution, EMI, or fintech operating in the EU, you're already planning for PSD3 (the Third Payment Services Directive) and the PSR (the new Payment Services Regulation that accompanies it).
The Council of the EU circulated compromise texts in April 2026 and first-reading texts dated 21 October 2026. As of October 2026, neither measure had been published in the Official Journal. The main PSD3/PSR provisions are scheduled to apply approximately 21 months after entry into force, so the exact compliance date depends on formal adoption and publication.
So where does that leave you and your compliance team?
You’ll have to navigate:
Keeping up with all of this through regulator websites, law firm briefings, and internal spreadsheets is difficult to scale, especially across multiple member states and languages.
This guide discusses the key practical differences between PSD2 and PSD3/PSR, what they mean for your operations, and how an RCM platform can help you prepare.
Vixio helps payments compliance teams track PSD3 transposition across every EU member state, map new requirements to existing frameworks, and manage the transition in one place. Book a demo to see how it works.
PSD3 (the Third Payment Services Directive) and the PSR (Payment Services Regulation) are intended to replace PSD2 as the EU's core framework for regulating payment services. These are the main changes to know:
Under PSD2, EU countries had to turn the directive into their own national laws. That meant payment firms could encounter different interpretations of the same requirements depending on where they operated.
PSD3 and the PSR split those responsibilities.
PSD3 will cover how payment institutions are licensed and supervised, including governance, capital and safeguarding requirements. The PSR will cover how payments actually work, including fraud protection, authentication and open banking. Crucially, the PSR will apply directly across all 27 EU member states, without each country needing to rewrite it into national law.
Why does this matter? Imagine a payment provider operating in Germany, France and Spain. Instead of navigating three potentially different interpretations of consumer protection requirements, it will have a more consistent set of rules to follow. Licensing and supervision will still involve national authorities, but the day-to-day conduct rules should be more uniform.
Under PSD2, payment institutions and electronic money institutions were licensed under separate regimes with different requirements. If you held both types of licence, you were managing two sets of rules in parallel.
PSD3 will repeal EMD2 and bring EMIs under the payment institution framework as a sub-category once the legislation takes effect. That means one licensing regime, one set of supervisory expectations, and revised capital requirements across the board.
Firms can apply for re-authorisation, or competent authorities may grant automatic authorisation where they already hold sufficient evidence of compliance. Firms shouldn’t assume automatic authorisation will apply in every member state.
Under Articles 43 and 44 of the Council's October 2026 PSD3 text, qualifying existing PIs and EMIs may continue their authorised activities for up to 27 months after entry into force while the competent authority assesses compliance. The 21-month point determines which existing firms qualify for these transitional provisions; it is not a general application deadline. Firms that have not demonstrated compliance by the 27-month cut-off may be suspended, although Article 45 permits an exceptional extension of up to three months if the authority cannot process submitted information in time.
Initial capital requirements also change under the final compromise texts:
Why does this matter? If you’re an EMI, you’ll need to go through re-authorisation under the new framework, and the 27-month transitional assessment period still requires early preparation once national transposition timelines are factored in.
Capital thresholds are changing too — some going up, some coming down — and firms spanning the capital categories in Article 5(b)-(d) may need to add the relevant category thresholds, rather than simply use the highest one, so your financial planning needs to reflect the new numbers.
Under PSD2, if a customer authorised a payment — even if they were tricked into it — they generally bore the loss. That made it difficult for victims of authorised push payment (APP) fraud to recover their money.
The proposed PSR introduces reimbursement rights for specific cases, including qualifying impersonation scams, rather than transferring all authorised push payment (APP) fraud losses to PSPs. These rights depend on statutory conditions and exceptions, including fraud or gross negligence by the consumer. Verification of Payee already applies to relevant euro credit transfers under the EU Instant Payments Regulation, with further rules envisaged in the PSR.
Why does this matter? A successful SCA check does not, by itself, resolve every fraud liability or reimbursement dispute. PSPs will need transaction logs, behavioural monitoring data, and structured investigation records to support their position.
That means investment in both systems and processes, not just authentication.
PSD2 required two authentication factors from different categories that include knowledge, possession, or inherence. That rigidity created friction, particularly for subscription businesses where merchant-initiated transactions sat in a grey area.
The proposed PSR generally retains the requirement for independent factors from two different authentication categories, while allowing two independent inherence factors in narrowly defined circumstances subject to additional safeguards. Genuine payee-initiated transactions without payer involvement are outside the SCA requirement; however, electronic mandate setup can still require SCA. But PSPs must now support multiple authentication methods and make SCA accessible to vulnerable customers — including the elderly, people with disabilities, and those with limited digital skills — free of charge.
Why does this matter? The flexibility should reduce checkout friction and give product teams more room to design authentication flows. But the accessibility requirements will need real investment, particularly if your current SCA relies heavily on a single method like mobile app-based authentication.
Under PSD2, banks had to let regulated third-party providers access payment accounts. If banks used dedicated APIs, they had to make them as reliable as their own online banking services, set performance targets and publish quarterly performance figures.
However, PSD2 did not set one EU-wide minimum standard for API performance. Some third-party providers still faced outages, errors and unreliable access.
The proposed PSR aims to improve API reliability and make it harder for banks to place unnecessary barriers in the way of authorised third-party providers. Quarterly performance reporting is not new; PSD2 already required it.
Eligible non-bank payment providers can also apply for direct access to payment systems such as TARGET, instead of relying on sponsor banks. However, they must meet technical, operational and risk requirements. This access was opened up through earlier EU changes, including the Instant Payments Regulation, rather than the PSR alone.
The proposed Financial Data Access Regulation (FIDA) is separate from PSD3/PSR. If adopted, it would extend financial data-sharing rules to areas such as savings, investments, pensions and insurance. Firms preparing for PSD3's open banking changes should also keep FIDA on their radar.
Why does this matter? If you’re an AISP or PISP, you should see more reliable infrastructure to build on. If you’re a non-bank PSP, direct payment system access could reduce your dependency on banking partners and lower your costs. Both changes make the open banking ecosystem more viable as a commercial channel.
Under PSD2 and EMD2, payment institutions and e-money institutions already had to protect customer funds, mainly through segregation or insurance (or a comparable guarantee). The proposed PSD3 brings those requirements into a common framework rather than introducing three entirely new safeguarding methods.
The main changes concern where safeguarded funds may be held. Central bank deposits were already allowed under amended PSD2, subject to the central bank's discretion. PSD3 would also let Member States permit accounts at qualifying post office giro institutions. Separately, funds held in settlement accounts at designated payment systems could count as safeguarded if they are kept separate, protected against other creditors and ultimately held at a credit institution or central bank.
Under Article 9(3) of the proposed PSD3, firms using segregation must avoid concentration risk where appropriate and endeavour not to hold all safeguarded customer funds with one credit institution. The provision does not impose an absolute requirement to use multiple banks in every case.
PIs must also disclose to payment service users how their funds are safeguarded and which member state’s insolvency law applies. Material changes to safeguarding arrangements must be notified to the national competent authority before they take effect.
Why does this matter? If you currently hold all safeguarded funds with a single institution, review and document your concentration risk and consider diversification where appropriate. The disclosure requirements also mean your customer-facing communications need updating. And material changes to safeguarding arrangements will need to be notified to the competent authority before they take effect.
The PSR applies directly from a fixed date, so those requirements land at the same time in every member state. PSD3 is a directive, which means each country has to transpose it into national law on its own timeline.
During PSD2’s rollout, not every country met the transposition deadline. Some member states took months longer than others, creating a period where firms faced different requirements depending on where they operated.
Why does this matter? If you operate across multiple member states, you can’t assume a single compliance deadline. Licensing, safeguarding, and governance requirements under PSD3 could take effect at different times in different countries, which makes monitoring national implementation essential rather than optional.
How PSD3 and the PSR update fraud prevention and liability rules
The fraud and liability changes in PSD3/PSR will directly affect how PSPs handle disputes, what monitoring systems they need, and how much financial exposure they carry.
Under PSD2, customers who authorised payments induced by scams generally had limited statutory refund rights. The proposed PSR creates a narrower reimbursement right for qualifying impersonation fraud, subject to conditions such as timely notification and reporting to the police, and exceptions including consumer fraud or gross negligence. It does not automatically make PSPs liable for every APP scam.
Passing SCA alone won't be enough to prove a transaction was legitimate. PSPs will need transaction logs, behavioural monitoring data, and structured investigation records to support their position in disputes.
PSPs will also be able to block payments and share payee identifiers with other PSPs where there is strong evidence of fraud.
PSD3 introduces requirements for inbound transaction monitoring. Under PSD2, monitoring requirements focused on the sending side. PSPs will have to implement risk-based and behaviour-based monitoring systems that cover both directions.
Electronic communications service providers and large online platforms also face new obligations to cooperate in fraud prevention.
The EU Instant Payments Regulation already requires a Verification of Payee service for relevant standard and instant euro credit transfers, with staggered deadlines by provider and member state. The service informs payers whether the intended payee's name matches the account identifier; a mismatch does not universally prohibit the payment. The proposed PSR would develop this framework further.
Similar schemes already operate in the Netherlands (SurePay) and the UK (Confirmation of Payee). The proposed PSR would broaden and consolidate payee-verification requirements, subject to the final scope and application dates.
The core SCA requirement remains the same as PSD2: authentication using at least two independent factors. Here's what changes:
The principal PSD3/PSR requirements are expected to apply roughly 21 months after entry into force; the definitive date will depend on formal adoption and publication. Here's what that involves.
Keeping up with all of this manually across multiple member states, languages, and regulatory bodies is difficult to scale. It’s also vulnerable to potential compliance gaps when requirements change mid-implementation.
Vixio is a regulatory change management platform built for payments and financial services compliance teams. The platform combines AI-powered monitoring with in-house regulatory analysts who review, interpret, and contextualise every development across 200+ jurisdictions.
Here's what you get when you use Vixio:
Many compliance teams already use tools like ChatGPT and Gemini for regulatory research. In Vixio's State of AI Trust in Regulatory Compliance report (August 2026), 53% said they use AI for regulatory change tasks. But 65% distrust generic AI for regulatory decision-making, and 59% cite hallucinations as their top concern.
With PSD3 and the PSR still proceeding through formal adoption and national transposition yet to begin, the risk of relying on outdated or inaccurate answers is high.
VIQ, Vixio's regulatory intelligence assistant, draws only from a closed, analyst-curated library of verified content. Every answer is cited and traceable to the original source.
PSD3 is a directive, which means 27 different national transposition processes.
If you're operating cross-border, you need to know when each country publishes its implementing legislation, what differs from the directive text, and whether your local licensing obligations have changed.
Vixio monitors regulatory sources across 200+ jurisdictions and surfaces relevant developments through the Triage feed, categorised by relevance and urgency. Your team sees national transposition developments as they happen rather than finding out weeks later through a law firm briefing. Reg Analysis reports then provide analyst-written interpretation of what each development means in practice, with every update linked back to the primary source.
Most firms outsource gap analysis to external law firms, which means weeks of turnaround, significant fees, and a static deliverable that gets outdated fast.
Vixio's Requirements Extraction tool will let you work directly with the PSD3 and PSR texts, turning specific provisions into structured obligations. Regulatory Mapping then links each obligation to your internal policies and controls, so you can see where your current PSD2 framework already covers PSD3 and where it falls short.
PSD3 touches licensing, safeguarding, SCA, fraud, and open banking at the same time, usually involving different teams. During re-authorisation, regulators expect you to show when each requirement was assessed and what action was taken.
Vixio connects monitoring to execution. That means when a transposition development lands in your Triage feed, you can convert it into a task, assign it to the right person, and track it through to completion. Then, Project Tracking gives leadership visibility across all workstreams, and Reporting generates the audit trail you need for regulators.
Over 500 organisations rely on Vixio for regulatory intelligence, including compliance teams at Mastercard, Google, SumUp, Worldline, and Trustly.
Vixio gives payments compliance teams a structured way to manage the PSD2-to-PSD3 transition: analyst expertise combined with AI-powered monitoring across every EU member state, intelligent Triage that separates actionable developments from noise, and workflows that turn regulatory requirements into auditable compliance tasks.
Book a demo to see how Vixio tracks PSD3 implementation and helps your team prepare ahead of the deadline.
PSD2 was a single directive. PSD3 splits the framework into two instruments: PSD3 (a directive covering licensing, authorisation, and safeguarding) and the PSR (a regulation covering SCA, fraud liability, open banking, and consumer protection). Once in force, PSD3 will repeal EMD2 and integrate EMI and PI authorisation. The package will also strengthen fraud-prevention rules and create specific reimbursement rights; Verification of Payee already applies to relevant euro credit transfers under the Instant Payments Regulation.
Council compromise texts were circulated in April 2026, followed by first-reading texts dated 21 October 2026. The measures had not yet been published in the Official Journal as of October 2026. The main application and national transposition periods are expected to run for 21 months from entry into force (which follows publication), not from the April compromise. The actual dates remain to be confirmed.
PSD3 is a directive requiring national transposition; it covers licensing, authorisation, safeguarding, and governance. The PSR is a regulation that applies directly across all member states; it covers SCA, fraud prevention, liability, open banking, and consumer protection. PSR requirements land at the same time everywhere, while PSD3 requirements depend on each country's transposition timeline.
Yes. EMD2 is repealed, and EMIs become a sub-category of payment institutions. Qualifying existing EMIs may continue their activities for up to 27 months after entry into force while the competent authority assesses their compliance. The proposed rules do not impose a blanket 24-month re-authorisation application deadline. Non-compliant institutions can be suspended after the transition, with a possible exceptional extension of up to three months where the authority cannot process submitted information.
Under PSD2, customers who authorised payments induced by scams generally faced limited statutory reimbursement rights. The proposed PSR adds targeted refunds for qualifying impersonation fraud and other specified failures, not a general transfer of APP fraud liability to PSPs. It also strengthens fraud monitoring and builds on the Verification of Payee requirements already established by the EU Instant Payments Regulation.
PSD3 and the PSR are EU legislation and don't directly apply to the UK. However, UK-based firms holding EU licences or providing payment services into the EU will need to comply with PSD3/PSR in those jurisdictions. The UK may also update its own payments framework in response, so firms operating across both markets should monitor developments in both.
