Explained to kids!
PSD3 is a new rulebook for everyone in Europe who moves money: banks, payment companies and apps. The old rules were written before everybody paid with phones. The new ones protect people better against tricks and hidden fees.
Let’s see it in real life…
Every Saturday, Lena and her mom go to the big market in town.
Today there is a new poster at the entrance: “New market rules”.
Lena reads it out loud: “Rule 1: show the full price, with all extras, before people pay.”
“Rule 2: the name on the stall must be the same as the name on the receipt.”
“Rule 3: if someone pretends to be a market guard and tricks you, the market must help you get your money back.”
“Why new rules?” asks Lena. “The old ones were written when nobody paid with a phone,” says Mom.
At the bottom, small letters say: “Agreed by the market council. Starts later, so stalls have time to get ready.”
So the stalls are already changing their signs, one by one.
That is PSD3.
Tiny recap
- It means… a new rulebook for everyone in Europe who handles people’s money.
- It helps when… someone tries to trick you, or a fee is hidden.
- Watch out for… new rules take time. They are agreed, but they don’t apply yet.
…detailed for specialists
PSD3 (the third Payment Services Directive) and its companion, the Payment Services Regulation (PSR), are the EU’s replacement for PSD2. PSD3 covers the licensing and supervision of payment and e-money institutions. The PSR, directly applicable in every member state, sets the conduct rules: fraud, refunds, strong customer authentication, open banking and fee transparency.
In 2026, PSD3 is no longer a draft to watch from a distance. The political deal was struck in November 2025, the European Parliament’s economic committee approved the texts in May 2026, and the final votes are the last step. Most rules should apply from late 2028 at the earliest, which makes 2026 and 2027 the planning years for PSPs, acquirers, PayFacs and platforms.
What is PSD3?
PSD2, applied since 2018, created open banking and strong customer authentication (SCA). It did not anticipate the rise of scams where victims are manipulated into paying, or the gap between banks and payment institutions. The reform splits the rules in two:
- PSD3 (directive): authorization, capital, governance and supervision of payment institutions. E-money institutions lose their separate regime and become a subcategory of payment institutions, which must re-authorize.
- PSR (regulation): the rules of conduct, identical across the EU without national transposition, to reduce differences between countries.
The package sits alongside the Instant Payments Regulation, which already made instant euro transfers and Verification of Payee mandatory in the euro area in October 2025.
PSD3 vs PSD2: what stays, what moves, what is new
- What stays: open banking access for account information and payment initiation providers, strong customer authentication, and refund rights for unauthorized payments.
- What moves: the E-Money Directive is folded into PSD3, and most conduct rules leave the directive for a regulation, so they no longer vary from one country to another.
- What is new: refunds for bank impersonation fraud, fraud data sharing between PSPs, a payee name check for all credit transfers, stricter rules for open banking interfaces, fee transparency for merchants and cash withdrawals without a purchase.
PSD3 and PSR timeline: where do things stand in 2026?
- June 2023: the European Commission proposes PSD3 and the PSR.
- 27 November 2025: the Council and Parliament reach a provisional political agreement.
- 22 April 2026: member states’ representatives receive the final compromise texts for approval.
- 5 May 2026: the Parliament’s ECON committee approves the agreed texts.
- Pending as of October 2026: the Council’s formal adoption and the Parliament’s final plenary vote, indicatively scheduled for 14 December 2026, then publication in the Official Journal. Earlier forecasts of a mid-2026 publication slipped.
- Entry into force: 20 days after publication. Most rules then apply 21 months later, and PSD3 must be transposed in the same window. The extended payee name check applies after 27 months.
What changes with PSD3 and the PSR
Fraud and liability
The agreement targets spoofing fraud, where criminals pose as the customer’s bank, and requires PSPs to share fraud information. Victims of bank impersonation get a full refund, provided they report the fraud to the police and to their PSP, and issuers can recover losses from acquirers. PSPs must check that payee names and identifiers match and offer spending limits and blocking tools. Online platforms that do not remove reported scam content can be liable to PSPs that reimbursed victims.
Payee name check for all transfers
The name-IBAN check already required for euro transfers is extended to other credit transfers, such as those in non-euro EU currencies.
Strong customer authentication
SCA stays, with adjustments: two biometric checks can count as the two factors, exemptions tighten, and PSPs must sign detailed agreements with the technical providers that deliver SCA for them, such as wallets and authentication services.
Open banking
Banks must provide dedicated, reliable interfaces, publish performance figures quarterly, offer fallback options and give customers a dashboard to manage their consents. National authorities must act without delay against interfaces that fall short.
Transparency on fees and names
- Providers of card acceptance must clearly disclose their fees to merchants.
- The merchant’s trading name must match the name on the customer’s bank statement.
- Card scheme fees must be unbundled and disclosed in a standard format, with at least six months’ notice of changes.
- Currency conversion charges must be shown as a markup over the ECB reference rate, and ATM fees before the withdrawal.
Financial ads on online platforms
Large online platforms and search engines may only show ads for financial services in a member state if the provider is regulated and authorized there. The goal is to cut off fake investment and payment offers that feed scams.
Cash without a purchase
Shops may offer cash withdrawals without a purchase, up to €150, to support access to cash in rural areas.
PSD3 in numbers (2026)
- €4.2 billion: payment fraud in the EEA in 2024, up from €3.5 billion in 2023, according to the EBA and ECB.
- €2.2 billion: credit transfer fraud in 2024 (+16%), with users bearing about 85% of losses. Card fraud reached €1.33 billion (+29%).
- 17 times: card fraud is that much higher when the merchant is outside the EEA, where SCA is often not applied.
- 21 and 27 months: the gap between entry into force and application for most PSR rules, and for the extended payee check.
PSD3: what changes for PSPs, PayFacs and platforms
Acquirers and PSPs
Fraud liability moves along the chain. Acquirers must monitor fraud risk and can be charged back by issuers for impersonation losses, so merchant risk scoring, monitoring and contracts with sub-merchants need review. Clear merchant descriptors and transparent fee reporting become legal requirements, not only good practice. Unbundled scheme fees will make it easier to compare interchange and scheme costs across providers.
PayFacs, marketplaces and platforms
Payment and e-money institutions will have to re-authorize under the new regime. Platforms that rely on the commercial agent exemption should watch closely: its future scope depends on EBA guidelines still to come. See our decoding of the PayFac model for why this matters.
Checkout and authentication
SCA flows, exemptions and contracts with wallet and 3-D Secure providers must be reviewed. Disputes on cards still follow scheme rules (see chargebacks), but impersonation refunds add a new path for customers.
Account-to-account payments
Better open banking APIs and consent dashboards make pay by bank, instant payments and future variable recurring payments more viable in the EU. Payouts in non-euro currencies will need payee name checks.
NORBr provides the white-label payment infrastructure to route, onboard, pay out and analyze, under your own brand.
Is PSD3 worth preparing for in 2026?
Yes. The content is settled even if the final vote and publication are still pending. Re-authorization, fraud monitoring, SCA contracts, fee transparency and open banking interfaces are long projects. Firms that map their gaps in 2026 can spread the work over the 21-month window instead of rushing at the end.
Frequently Asked Questions
What is PSD3?
PSD3 is the EU’s third Payment Services Directive. With the Payment Services Regulation (PSR), it replaces PSD2. PSD3 covers licensing and supervision of payment and e-money institutions, while the PSR sets directly applicable rules on fraud, refunds, strong customer authentication, open banking and fees.
When will PSD3 and the PSR apply?
A political agreement was reached in November 2025 and the Parliament’s ECON committee approved the texts in May 2026. The final plenary vote is indicatively scheduled for December 2026. Most rules apply 21 months after entry into force, so late 2028 at the earliest.
What is the difference between PSD3 and the PSR?
PSD3 is a directive that each member state transposes into national law; it covers authorization and supervision of payment institutions. The PSR is a regulation that applies directly across the EU; it covers conduct rules such as fraud liability, SCA, open banking and transparency.
Does PSD3 make banks refund fraud victims?
Yes, in certain cases. Under the PSR, a customer tricked by someone impersonating their bank gets a full refund, provided the fraud is reported to the police and the bank. PSPs that lack adequate fraud prevention, such as payee name checks, must also cover losses.
Does PSD3 replace strong customer authentication?
No. Strong customer authentication remains. The PSR adjusts it: two biometric checks can count as two factors, exemptions are tightened, and PSPs must have detailed agreements with technical providers that perform authentication for them.
