PSD3 breakthrough: EU legislators agree payments regulation reforms

The European Parliament and Council have agreed changes to the EU’s payments regulatory framework. A new Payment Services Regulation (PSR) and a third Payment Services Directive (PSD3) will replace the current PSD2 and Electronic Money Directive regimes. The Parliament and Council need to formally adopt the texts before they come into force.

The journey so far

The European Commission proposed PSD3 and PSR in June 2023. The Commission’s proposal included:

• merging the e-money regime into PSD3

• introducing the PSR so that conduct of business rules apply directly across the EU

• extending verification of payee to all credit transfers and changing strong customer authentication rules

Earlier this year the Parliament and Council started talks to negotiate a compromise version of the legislation. According to a Parliament press release, those talks have now ended. The agreed texts are still to be published.

Change on the horizon

The press release highlights several changes that PSD3 and PSR will introduce to the existing payments rulebook. These include:

• More liability for payments firms: If a fraudster initiates or changes a transaction, it will be treated as unauthorised transaction and the payment service provider will be liable for the fraudulent amount. The PSR also introduces specific rules on employee impersonation fraud.

• Verification of payee service: Payment service providers will have to check that a payee’s name and unique identifier match for all credit transfers. Firms will be responsible for covering losses resulting from fraud if that verification mechanism fails.

• Transaction limits: Payment service providers must enable customers to set their own spending limits and block credit cards and other payment instruments where they suspect fraud.

• More liability for tech firms: Online platforms will be liable to payment service providers who have reimbursed defrauded customers if they are told about fraudulent content on their platform and failed to remove it.

• Transparent charges: Payment service providers will have to share information about payment transactions before they are initiated, such as information about currency conversion charges.

• Access to cash: Retail stores will be able to provide cash withdrawals of up to €150 without the customer having to buy anything and without needing a licence for regulated payment services.

• Data access: Payment service providers must offer customers a dashboard to manage third party access to their payments data. The PSR also prohibits banks from imposing certain obstacles to firms providing open banking services.

• Mobile data sharing: Manufacturers of mobile devices and electronic service providers will have to allow apps or user interfaces to store and transfer data needed to process payments on fair, reasonable, and non-discriminatory terms.

Next steps

The agreed text will now go through the usual EU legislative process ahead of its formal adoption, including legal linguistic review and translation. At the end of this process, likely in Q2 2026, the text will enter into force and then start to apply after a transition period which is expected to be 21 months.