.svg)
The details of the updated EU payments regime are becoming clearer, with negotiators aiming to deliver a more open and competitive payments sector that places strong emphasis on consumer protection.
The European Parliament and Council of the EU have reached a provisional political agreement on the updated Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR).
The package is intended to update and replace the rules under the current regime (originating in PSD2 and related legislation), reflecting the rapidly evolving payments landscape.
There is a significant focus on fraud reimbursement, with payment service providers (PSPs) that fail to implement appropriate fraud-prevention mechanisms to be held liable for covering customers’ losses.
For example, in cases where a fraudster initiates or changes a transaction, it will be treated as unauthorised and the PSP will be liable for the full amount.
Similarly, in cases of impersonation fraud, where a scammer pretends to be a PSP employee and tricks the customer into approving a payment, the PSP must refund the full amount, provided the customer reports the fraud to the police and notifies the PSP.
In a development likely to be welcomed by those calling for greater responsibility from large online platforms, such platforms will be liable to PSPs that have reimbursed defrauded customers if they are informed of fraudulent content and fail to remove it. The announcement notes that this builds on the protections under the Digital Services Act.
René Repasi, the rapporteur for the PSR, said: “Consumers will benefit from new harmonised rules on the payment services regulation. Mandatory fraud preventive measures will be applied and lead to less payment fraud. Banks have to share more of the burden if they fail to do their part.”
Another key development concerns open banking, with the agreement stipulating that authorised providers must be able to access payment account data. The legislation includes a list of prohibited obstacles to data access.
In addition, customers will be given a dashboard to monitor and manage the permissions they have granted for data access, and banks will be required to provide payment institutions with access to payment accounts on a non-discriminatory basis.
A competitive and innovation-friendly payments ecosystem
The expanded fraud regime and new liability provisions raise the stakes for PSPs, which will no longer be able to disclaim responsibility easily.
Firms must ensure that they build robust fraud detection, monitoring and name–IBAN matching processes or risk bearing full losses, which may require significant investment in technology, risk management and customer-service infrastructure.
The extension of liability to online platforms introduces a new dimension, in that payments risk now overlaps with content moderation, platform governance and digital services compliance.
Morten Løkkegaard, rapporteur for PSD3, said: “This deal is a significant step toward a more open and resilient single market for payments. By updating outdated rules, we ensure Europe stays competitive in a rapidly evolving financial sector.”
In strengthening open banking rights and removing barriers to non-bank providers, the new rules effectively broaden the market.
Fintechs and PSPs outside the traditional banking system stand to gain, because they will be able to access account data more reliably and offer payment-initiation and account-information services on a level playing field.
This could stimulate competition, encourage alternative payment models such as mobile wallets and embedded finance, and reduce banks’ dominance.
Banks and large incumbent institutions will need to adapt. Data-sharing will no longer be optional or friction-laden: account-servicing providers must provide non-discriminatory access to account data, reshaping existing data-access models and placing compliance obligations squarely on banks.
Preparing effectively for implementation
As clarity increases regarding the new payments regulatory framework, PSPs operating in the EU can begin preparing for its introduction.
This will involve work across several areas, including mapping existing systems against the revised obligations. Key priorities will include name–IBAN matching, fraud detection and monitoring, fee and transparency disclosures and customer-support infrastructure.
Organisations should also get ready for the anticipated expansion in open banking. For banks, this means creating APIs and processes that ensure non-discriminatory data access. For fintechs, it means developing plans to take advantage of improved data access by building services around account data dashboards.
The PSD3/PSR agreement marks a significant shift in the EU payments ecosystem. The updated regime is intended to offer a comprehensive redesign, rather than incremental reform, and promises to modernise payments, bolster consumer protection, democratise access to both data and cash and level the competitive playing field.
The reforms also raise the bar for compliance, risk management and operational readiness, and banks, fintechs and non-bank PSPs should already be preparing.
With formal adoption still ahead, there remains scope for further change. But the direction is clear: the EU intends to establish a more open and competitive payments regime that emphasises consumer protection.
Organisations that act early will have the advantage; those that wait may find adapting more challenging.
