These two measures are an upgrade to the existing European payments framework.
PSD2 – adopted in 2015 – gave us open banking and Strong Customer Authentication (SCA). It was a start. But since then, the market has moved fast. To keep pace with digital platforms and more sophisticated fraud, the European Commission is introducing a new two-part package: PSD3 and PSR.
What is PSD3?
PSD3 focuses on the mechanics behind the scenes. It sets the bar for who is allowed to handle your money and how strictly they need to be supervised.
The biggest change is the merging of PIs and EMIs:
Payment Institutions (PIs): These are the companies that move money from point A to point B, but aren't supposed to hold onto it for long.
Electronic Money Institutions (EMIs): These operate more like digital wallets. They can move money, but they can also store it for you indefinitely.
In the past, these two groups had different licences and slightly different rules. With PSD3, they play by the same rulebook. For you, this simplified landscape should mean more secure transactions, fewer false declines at checkout, and more competitive fees.
Beyond licensing, PSD3 strengthens how payment firms are governed. This covers everything from outsourcing to how they operate across borders. While this happens mostly in the background, it dictates which providers can serve you and how resilient their operations actually are.
We’ll dig into these details in our ‘key changes’ section, but first, let’s take a closer look at PSR.
What is PSR?
If PSD3 is the blueprint for the companies handling the money, the Payment Services Regulation is the actual rulebook for every transaction. This means that whether your customer is in Berlin or Barcelona, the core operational rules for security, transparency, and fraud remain consistent across the EU.
For growing European companies, this levels the playing field, simplifies doing business across borders, and provides a more predictable way to scale across Europe. There are three major parts:
Fighting fraud: New rules to tackle ‘spoofing’ (where scammers pretend to be banks). If a bank or payment provider fails to spot a clear fraud attempt, the liability might shift away from the user. It’s a move designed to make the whole ecosystem more trustworthy.
SCA 2.0: The new rules aim to reduce unnecessary SCA challenges for low‑risk transactions and encourage more user‑friendly, phishing‑resistant methods such as biometrics, while tightening controls around device and wallet enrolment.
Clearer identities: We’ve all seen cryptic codes like ‘WP-TX-998’ on a bank statement and wondered what we bought. PSR mandates ‘transaction transparency,’ meaning bank statements must show your actual commercial name. This is a massive win for reducing those accidental chargebacks that happen simply because a customer didn't recognise the bill.
Why is this happening now?
PSD2 laid much of the groundwork for today’s digital payments. But as technology and fraud tactics have evolved, PSD3 is effectively a much-needed security and capability update. That matters because the way we pay has arguably changed more in the past 10 years than in the 50 years before that.
The European Commission is driving this update for three clear operational reasons:
1. Keeping up with fraud
Strong customer authentication reduced basic card theft, but it simply pushed scammers to become more creative. We're seeing a massive rise in AI-powered scams, from social engineering to spoofing. And as instant, account-to-account payments become the new European standard, transactions become irrevocable – meaning the money is just gone.
The new rules target these sophisticated scams directly. Regulators are widening liability to ensure the ecosystem remains trustworthy for your customers.
2. Making ‘Open Banking’ more accessible
Open Banking was the big promise of PSD2, but the reality was often clunky. Many banks provided slow or unreliable connections (APIs) to fintech apps, leading to timeouts and frustrated customers. PSR now forces banks to provide dedicated, high-performance interfaces. It also mandates inclusive design, ensuring authentication works for everyone, including the elderly or those with visual impairments who might rely on voice recognition.
3. Creating an international standard
Under PSD2, different EU countries interpreted the rules slightly differently, meaning that a fintech in Ireland might face different hurdles than one in Italy. By introducing PSR, the EU is providing one set of rules for the whole continent, making it easier for you to scale your business from one country to twenty-seven without changing your entire checkout flow.
