Everything you need to know about PSD3 and PSR

If you’re comparing PSD3 vs PSD2, the biggest shift is moving from providing access to ensuring quality. PSD2 opened the door for fintechs, but PSD3 and PSR are here to make sure that door stays open, the hinges don’t squeak, and the security alarm actually stops fraudsters.

The new framework splits the rules into two categories: how companies are run (PSD3) and how payments actually happen (PSR). Here’s what’s changing:

1. Strong Customer Authentication

Under PSD2, SCA (that two-factor check at checkout) was a bit of a one-size-fits-all hammer. PSR refines this into a surgical tool:

• Frictionless by default: It encourages more exemptions for low-risk payments, meaning fewer annoying pop-ups for your regular customers.

• Biometrics first: There is a strong preference for biometrics (Face ID, fingerprint) because they’re harder to steal than SMS codes.

• Secure digital wallets: PSR specifically requires robust SCA at the time of digital wallet enrolment. This stops a fraudster from putting your card on their phone.

• Fewer false declines: The rules support better sharing of transaction risk signals, so issuers can make more accurate approval decisions without forcing extra customer steps every time.

2. Enhanced user accessibility and rights

Payments should work for everyone, not just the tech-savvy.

• Inclusivity by design: For the first time, there’s a legal mandate to ensure SCA is accessible to users with disabilities or those who don’t own a smartphone.

• Empowering the user: If a customer uses a Payment Initiation Service (PIS) or Account Information Service (AIS), their rights are now explicitly protected. They get consent dashboards to see exactly who has access to their data and can revoke it in one tap.

3. Fraud prevention and liability

This is the most important part when it comes to your daily operations.

• Verification of payee (VoP): Before a customer hits send, their bank must verify that the name on the account matches the IBAN. If the bank fails to warn the customer of a mismatch, the bank – not the customer or business – may be liable for the loss.

• Spoofing protection: If a fraudster impersonates a bank employee to trick a customer into a transfer, the bank is now much more likely to be on the hook for a refund.

• Expanded liability: Where required security measures aren’t properly applied, liability may not sit only with the customer or the business. Other parties in the flow may bear more liability.

• Fraud signal sharing: Regulated providers will be able to share relevant fraud signals across the ecosystem, improving detection without adding friction for legitimate customers.

4. More reliable Open Banking

Under PSD2, Open Banking was often clunky because bank APIs (the digital connectors) simply weren’t as robust as they needed to be. With PSD3, they’ve upgraded the system in two ways:

• Performance mandates: Banks are now required to provide dedicated, high-quality interfaces, aiming to improve reliability and reduce disruptions. 

• Consent dashboards: Your customers will get a control panel in their banking app where they can see any data-sharing permissions they’ve given to apps, and cancel them with one click. This should reduce ‘ghost permissions’, improve customer trust, and cut support overhead.

5. Beyond payments: The FiDA Link

You might hear the term FiDA (financial data access) pop up from time to time. While PSD3 focuses on your payment account, FiDA has more all-encompassing goals. It aims to expand Open Banking principles to your entire financial life, including insurance, pensions, and investments. 

In many ways, PSD3 is a test case for this broader EU vision of open finance.

6. Direct access to payment systems (for non-bank PSPs and EMIs)

The new rules reinforce fair, non‑discriminatory access to payment systems and accounts for non‑bank PSPs and e‑money providers, reducing over‑reliance on a small number of sponsor banks.

For payment providers, this can reduce dependency on sponsor banks and improve resilience. For businesses, the long-term effect should be more competition and faster product innovation, though outcomes will depend on implementation and market dynamics.

7. Clearer currency conversion fee disclosures (FX transparency)

PSR strengthens transparency requirements for currency conversion charges in certain payment flows (such as credit transfers and remittances). Where currency conversion applies, providers may need to show the FX mark-up as a percentage over the ECB reference rate before the customer initiates the transaction. 

For businesses selling cross-border, this can affect checkout and receipt messaging, and could reduce disputes driven by unexpected FX costs.

Now that we’ve covered the why, let’s move on to the who and when.