PSD3 and the Payment Services Regulation: Key Developments, Timeline, and Action Points for Firms

Executive Summary

The EU is finalising a significant overhaul of its framework for payments regulation. On 22 April 2026, the proposed text of the Third Payment Services Directive (PSD3) and a new directly applicable Payment Services Regulation (PSR) were put before a meeting of national representatives for approval. Together, these measures will repeal and replace the existing regimes under PSD2 and the Electronic Money Directive (EMD2), with a single supervisory framework focused on harmonisation, fraud prevention, and strengthening open banking.

The provisional political agreement for the reforms was reached in November 2025, with formal adoption expected in 2026. On 23 April 2026, the Council of the European Union issued an ‘I’ Item Note (dated 17 April 2026) on the draft Directive and Regulation, alongside final compromise texts for both instruments. The Note which invites the Committee of Permanent Representatives to approve the drafts is another sign that PSD3 and the PSR are close to coming into force.

Firms should anticipate the coming into force of the new regime by late 2027, with transitional provisions applying to licensing. Firms should also note that Level 2 measures (Regulatory Technical Standards and Implementing Technical Standards) from the European Banking Authority (EBA) will follow, shaping detailed compliance requirements.

For banks, payment institutions (PIs), and e-money institutions (EMIs), PSD3 and the PSR will require material operational, legal, and compliance changes, particularly in fraud liability, API performance, and licensing structures.

Key Takeaways

• Structural reform: Where PSD2 required EU Member States to interpret and implement regulation at the national level, conduct rules for payment service providers will sit within regulation, in the form of the PSR, which will be directly applicable and set standards for all EU Member States, reducing fragmentation across the EU.
• Single licensing regime: There will no longer be separate rules for EMIs (including the elimination of the “E-Money Directive” or EMD), and EMIs will become a sub-category of PIs under the PSD3 framework that require re-authorisation.
• Fraud liability expanded: Banks and PIs must comply with expanded fraud and consumer protection obligations, including mandatory international bank account number (IBAN) and name checks and broader reimbursement obligations for authorised push payment (APP) fraud.
• Enforcement of open banking standards: PSD3 imposes more prescriptive requirements for APIs and access interfaces and obligations for Secure Customer Authentication (SCA), further reducing fragmented implementation and user experience across Member States.
• Expanded liability for enablers: Under PSD3, third-party providers of services to payment services providers may be liable where their systems contribute to failures or fraud in the payments chain. The new regime requires stronger internal controls and better transaction validation mechanisms.
• Implementation horizon: The changes are likely to become effective in late 2027, but preparation must begin well in advance.

Background: PSD2 and Its Limitations

Payments services in the EU have been regulated since 2018 by PSD2 (Directive (EU) 2015/2366). The primary objectives of PSD2 were to:

• Create a level, harmonised playing field for the regulation of payments services across the EU;
• Support the growth of “open banking” (access to the payments capabilities of account information and payment initiation services); and
• Improve payments security through SCA.

However, experience and the European Commission review of PSD2 revealed several structural issues within the existing regime:

• Due to the need for each Member State to nationally transpose the Directive, it was open to differences in interpretation and enforcement and failed to completely harmonise regulation and eradicate regulatory arbitrage among Member States;
• Inconsistent enforcement of API standards meant that payment services users across Member States received different qualities of experience and open banking performance; and
• Inconsistent standards of regulation and enforcement were further amplified by distinct regulation for PIs and EMIs, under PSD2 and EMD, respectively.

These shortcomings prompted the European Commission to propose a new framework.

The New Framework: PSD3 and the PSR

Dual legislative structure: The package of regulation proposed by the European Commission in June 2023 introduces a dual legislative structure.

PSD3 (a directive requiring national transposition) will govern authorisations, prudential supervision, and licensing. It will incorporate the requirement for EMIs to seek reauthorisation as a PI under PSD3.

The PSR (a regulation with direct effect at the Member State level) will govern conduct of business rules, including SCA, transparency, open banking standards, and fraud liability.

This dual structure permits national regulators to have a certain level of control over determining which firms are permitted to operate in the jurisdiction while ensuring greater legal certainty and consistency of services across the EU.

Enhanced fraud prevention and liability: Payment services providers will be required to check, for each credit payment not already covered under instant payments regulation, that the payee name matches the unique identifier/IBAN and provide early warnings where there are discrepancies in this information.

Where APP fraud occurs, the payment will be treated as an unauthorised transfer and payment services providers will be required to fully reimburse the payer.

Payment services providers (PSPs) will be required to implement risk- and behaviour-based transaction monitoring systems. In conjunction with principles of the General Data Protection Act, and in an effort to improve fraud detection across the market, PSPs will also be able to exchange specified information as part of a structured, fraud information-sharing arrangement.

Strengthened open banking framework: PSD3 and the PSR introduce more prescriptive requirements for API performance and uptime.

National regulators will be expected to act “without delay” against interfaces which don’t meet expected standards of functionality, don’t meet response timelines for incident reports, and/or overly rely on fallback interfaces where dedicated interfaces fail.

Expanded regulatory perimeter: Technical service providers (TSPs) providing SCA to PSPs must be subject to detailed written agreements as part of increased scrutiny of outsourcing arrangements.

PSD3 tightens outsourcing requirements by requiring firms to ensure that outsourcing does not impair operational resilience, mandating clear allocation of responsibilities, audit and access rights, and contingency planning, including exit strategies.

Increased harmonisation: Core conduct rules will now move to the PSR and will not be open to inconsistent interpretation and implementation across Member States.

An example of this will be the application of the Limited Network Exemption. Where application of this exemption was previously open to interpretation under PSD2, allowing some Member States to take a more restrictive approach, the PSR will now specify the conditions for the exemption to apply and will be directly effective.

Governance and risk management: The draft PSD3 requires payment institutions to have robust governance arrangements, including information and communication technology (ICT) risk management; internal control mechanisms; systems ensuring continuity of payments services; and incident management capabilities.

These requirements build on PSD2 but are more explicit and aligned with concepts in the Digital Operational Resilience Act (DORA) (e.g., risk frameworks, incident handling).

PSPs should use the time between now and the coming into force of PSD3 and the PSR to think through the changes needed for their businesses to be compliant. For EMIs, this exercise could be potentially significant with a requirement for new authorisation as a PI.

We outline below some practical steps that all PSPs should follow to ensure readiness and compliance with the new payments regime.

UK Divergence: Increasing Regulatory Separation

While PSD3 and the PSR will reshape the EU payment services framework, the UK is pursuing its own payments reform agenda, which will most likely lead to increasing divergence.

Key Areas of Divergence

• Future regulatory framework: HM Treasury is developing a Financial Services and Markets Act (FSMA) based model, which will replace established EU law, and the changes brought about by PSD3 and the PSR will not automatically apply in the UK.
• Open banking: Where PSD3 and the PSR present harmonised and prescriptive rule based regulation of SCA requirements, open banking APIs, and fraud liability, the UK is taking a more principles based approach and moving towards open finance via industry led initiatives such as the commercial open banking model following the Joint Regulatory Oversight Committee (JROC) recommendations.
• APP fraud reimbursement: The UK has already introduced mandatory reimbursement requirements applicable to payments made via the Faster Payment System (FPS) or the Clearing House Automated Payment System (CHAPS), in some respects going further than the EU proposals.

Practical Implications

• Firms operating across borders must increasingly manage dual compliance frameworks.
• Product design, fraud controls, and API standards may diverge.
• Licensing strategies will need to reflect separate UK and EU regimes.

Conclusion

PSD3 and the PSR represent a fundamental redesign of EU payments regulation, with a clear emphasis on harmonisation, consumer protection, and operational resilience.

Although implementation is expected by late 2027, the scale of change—particularly in fraud liability, licensing, and open banking—means firms should begin preparations now.

At the same time, UK divergence will require firms to adopt jurisdiction-specific compliance strategies, increasing complexity for cross-border operations.