COREDO – EU Legal & Compliance Services Expert legal consulting, financial licensing (EMI, PSP, CASP under MiCA), and AML/CFT compliance across the European Union. Headquartered in Prague, we provide seamless regulatory solutions in Germany, Poland, Lithuania, and all 27 EU member states.
Gregory Lutsenko
09.10.2025 | 6 min read
Updated: 15.10.2026
As of 15 October 2026, PSD3 and the Payment Services Regulation (PSR) have not yet been finally adopted or published in the Official Journal. Payment companies today operate under PSD2.
The Council of the EU and the European Parliament reached a political agreement on the package on 27 November 2025. In spring 2026 the two sides confirmed the final compromise texts. Formal adoption is still ahead, and the new rules will apply only after a transitional period.
This article covers where the procedure stands, what PSD2 requires today and what the agreed text will change. The changes will affect business security, customer authentication and access to data.
What PSD3 and PSR are and where they stand
PSD3 is the draft third EU directive on payment services, and PSR is the draft regulation that accompanies it. 21 months after PSD3 enters into force, it will repeal PSD2 (Directive (EU) 2015/2366) and Directive 2009/110/EC on electronic money.
The PSD3 directive governs market entry: the authorisation and supervision of payment institutions. The PSR regulation sets the rules for providing services: disclosure of information, the rights of the parties, liability and fraud prevention. The regulation will apply directly in all EU Member States, without transposition into national law.
Timeline: from proposal to application
- On 28 June 2023 the European Commission tabled the PSD3 and PSR proposals.
- On 23 April 2024 the European Parliament adopted its first-reading position.
- On 18 June 2025 the Council of the EU agreed its negotiating mandate, and trilogues began on 9 July 2025.
- On 27 November 2025 the Council and Parliament reached a provisional political agreement.
- On 22 April 2026 the Committee of Permanent Representatives (COREPER) confirmed the final compromise texts.
- On 5 May 2026 Parliament's Economic and Monetary Affairs Committee (ECON) approved these texts.
The procedure now follows the early second reading route: the Council adopts its first-reading position, and Parliament then approves it at second reading. As of 15 October 2026, both procedures, 2023/0209(COD) and 2023/0210(COD), are awaiting the Council's first-reading position in Parliament's OEIL database.
Deadlines run from publication in the Official Journal. Both acts enter into force on the twentieth day after it. Member States must transpose PSD3 into their law and apply it 21 months after entry into force. The PSR applies from the same date, and the rules on matching the payee's name with the IBAN (Art. 50 and 57 PSR) after 27 months.
Even if publication followed immediately after 15 October 2026, the new rules would not apply before the second half of 2028. Until then PSD2, Directive 2009/110/EC and the national laws transposing them apply.
What PSD2 requires today
PSD2 has applied since 13 January 2018 and remains binding until the end of the transitional period. The main points for a payment company:
- a payment institution licence with initial capital of EUR 20,000 for money remittance only, EUR 50,000 for payment initiation and EUR 125,000 for services 1–5 of Annex I (Art. 7);
- for an electronic money institution, initial capital of at least EUR 350,000 (Art. 4 of Directive 2009/110/EC);
- strong customer authentication (SCA) when the payer accesses the account online, makes an electronic payment or takes a risky action through a remote channel (Art. 97);
- a reply to a customer complaint within 15 business days at the latest, and in exceptional cases within 35 business days at the latest (Art. 101).
Two more requirements apply under Regulation (EU) 2024/886. Since 9 October 2025, euro-area PSPs must offer payers verification of the payee for credit transfers in euro; outside the euro area the deadline is 9 July 2027. Since 9 April 2025, payment institutions and electronic money institutions may request participation in systems designated under Directive 98/26/EC.
PSD2 today and the agreed PSD3/PSR text
The right-hand column of the table does not apply yet: it becomes binding only after publication and the transitional period.
| Topic | PSD2 today | Agreed PSD3/PSR text (not yet applicable) |
|---|---|---|
| Licences | Two separate ones: payment institution (PSD2) and electronic money institution (Directive 2009/110/EC) | One authorisation as a payment institution; issuing electronic money is the service in point 8 of Annex I to PSD3 |
| Initial capital | EUR 20,000, EUR 50,000 or EUR 125,000 depending on the services; EUR 350,000 for an electronic money institution | EUR 40,000, EUR 50,000 or EUR 150,000 depending on the services; EUR 250,000 for issuing electronic money (Art. 5 PSD3) |
| Strong customer authentication (SCA) | Online account access, electronic payment, risky actions through a remote channel (Art. 97) | The same cases with clarifications, and at least one free method that does not need a smartphone (Art. 85 and 88 PSR) |
| Fraud by impersonating a bank | No specific rule; the general rules on unauthorised transactions apply (Art. 73 and 74) | Full refund to the consumer who notifies the provider and reports to the police (Art. 59 PSR) |
| Name and IBAN matching | For credit transfers in euro under Regulation (EU) 2024/886 | For all credit transfers, 27 months after the PSR enters into force (Art. 50 PSR) |
| Sharing of fraud data | No obligation | PSPs take part in data-sharing arrangements (Art. 83a PSR) |
| Bank account for a payment institution | Access on an objective, non-discriminatory and proportionate basis; the bank gives the regulator its reasons for a refusal (Art. 36) | A closed list of grounds for refusal, a reply within a month, notice of closure 4 months in advance (Art. 32 PSR) |
| Independent ATMs | Outside the scope of PSD2, but charges are disclosed to the customer (Art. 3(o)) | Registration with the regulator (Art. 38 PSD3), charges on the screen before the transaction (Art. 7 PSR) |
Key changes of PSD3 and PSR under the agreed text
Below is only what the compromise texts expressly say. Article numbers follow these texts; the numbering in the published version may differ.
One authorisation instead of two licences
PSD3 will merge the regimes for payment institutions and electronic money institutions: issuing electronic money will become one of the payment services. An electronic money institution that passes the regulator's review will be deemed authorised as a payment institution (Art. 45 PSD3). The new capital amounts are in the table. Where an institution combines two or more of these: payment initiation, the services in points 1–5, issuing electronic money, the amounts are added together (Art. 5 PSD3).
Strong customer authentication (SCA)
SCA will also be needed when creating a tokenised payment instrument, raising spending limits, or changing a password or contact details online (Art. 85 PSR). A remote payment is still linked to the amount and the payee.
A new requirement is accessibility. Every customer must have at least one free way to perform SCA that suits their situation. SCA may not depend only on a smartphone unless the customer has agreed to be served exclusively through an app (Art. 88 PSR).
Liability for fraud by impersonating a bank
If a fraudster posing as a consumer's bank or payment company deceives the consumer through that provider's channels, the provider refunds the full amount of the transaction (Art. 59 PSR). The customer must promptly tell the provider about the fraud and report it to the police.
The provider has 15 business days to decide after the notification and the police report. It may refuse on objectively justified grounds to suspect fraud or gross negligence by the customer, and must prove them. The rule adds to the consumer rights to a refund of unauthorised payments that PSD2 already provides.
Sharing fraud information between PSPs
PSPs must take part in arrangements for sharing fraud data (Art. 83a PSR). Sharing is allowed where there are objectively justified grounds to suspect fraud by a customer, and after a data protection impact assessment under the GDPR. The data may be kept for no longer than 5 years after the suspicious transaction. An account may not be closed only on the basis of another provider's data: the provider must assess it itself.
In COREDO's practice, implementing centralized data exchange systems between PSPs reduced incident response time from 72 to 18 hours.
Fee transparency and ATMs
Anyone providing cash withdrawals at an ATM must show all charges on the screen before the transaction starts, including conversion charges (Art. 7 PSR). According to the Council of the EU, companies that accept cards for merchants will have to disclose their fees clearly.
The project implemented at COREDO to automate tariff disclosure for one of the large PSPs reduced the number of customer complaints by 27% already in the first quarter after implementation.
Matching the payee's name with the IBAN
The PSR will extend the verification of the payee to all credit transfers, including those outside the scope of Regulation (EU) No 260/2012 (Art. 50 PSR). If a provider fails to carry out the check and the payment is therefore executed defectively, it refunds the amount to the payer without delay (Art. 57 PSR). Both articles will apply 27 months after the PSR enters into force.
Access to bank accounts and payment systems
A bank will be able to refuse or close an account for a payment institution only on the grounds in Art. 32 PSR. They include a breach of Regulation (EU) 2024/1624 on anti-money laundering, a material breach of contract and missing documents. The bank gives specific reasons for a refusal within a month of a complete application, and gives at least 4 months' notice of a closure. For the anti-money laundering ground, the bank gives no details and may close the account at shorter notice.
Payment system operators must publish their admission rules and risk assessment criteria (Art. 31 PSR). Participation may be refused only where there are risks to the system and with full reasons.
Open banking and data access
A provider that maintains a payment account accessible online must have at least one dedicated interface for payment initiation and account information service providers (Art. 35 PSR). Obstacles in the interface are prohibited (Art. 44 PSR). The customer will get a consent dashboard: they will see whom they gave access to and will be able to withdraw it (Art. 43 PSR).
Cash in shops and independent ATMs
Shops will be able to provide cash without a purchase and without authorisation as a payment institution (Art. 37 PSD3). The limit is EUR 150 per withdrawal; a Member State may lower it, but not below EUR 100. Strong customer authentication is required, and the charge is stated in advance.
ATM deployers that do not service payment accounts register with the regulator before starting business (Art. 38 PSD3). To register, they describe their organisation, audit and operational resilience measures under Regulation (EU) 2022/2554 (DORA).
Impact of PSD3 and PSR on cross-border payments
The Commission's evaluation found that PSD2 was applied and interpreted differently across Member States, which encouraged regulatory arbitrage. The compromise text expressly rules out "forum shopping": choosing the country with the most lenient application of the rules in order to operate in other Member States.
So the conduct-of-business rules will move into the PSR, uniform across the EU, while authorisation and supervision stay in the PSD3 directive. For a company passporting into several countries, this means the same requirements on disclosure, liability and SCA. Name and IBAN matching will become common to all credit transfers, not only those in euro.
Very large online platforms and search engines will have to refuse financial-service ads without the advertiser's licence or registration number or other proof of authorisation (Art. 59b PSR).
How to prepare for PSD3 and PSR
It is too early to rebuild processes: the final texts are unpublished. But a plan can already rest on the compromise text and the transitional deadlines.
Transitional period for existing licences
Payment institutions licensed under PSD2 may operate under that licence until 27 months after PSD3 enters into force (Art. 44 PSD3). They must give the regulator the information needed to check compliance with the new requirements. If they fully comply, the licence is deemed granted under PSD3; with evidence already available, the regulator may authorise the institution automatically.
The same procedure will apply to electronic money institutions (Art. 45 PSD3). Those that do not confirm compliance in time will be suspended until the missing information has been checked. If the information has been submitted but the regulator has not been able to process it, it may exceptionally extend the deadline by no more than 3 months (Art. 45a PSD3).
Gap analysis: where to start
- Compare your licence and services with Annex I to PSD3, and check the new minimum capital and the transition of an electronic money institution.
- Review your SCA scenarios: the new cases, a method without a smartphone, free access for all customers.
- Update your fraud procedures: refunds under Art. 59 PSR, data sharing, transaction monitoring.
- Plan name and IBAN matching for all credit transfers, including currencies other than the euro.
- Review fee disclosure in contracts, on the website and at ATMs.
Combine this analysis with a check of current compliance with PSD2 and AML requirements: regulators already check the rules in force. A separate article explains how to prepare for such a check and avoid fines.
A licence obtained before PSD3 applies is granted under PSD2 and will also go through the transition under Art. 44 or 45 PSD3. This is worth considering already when choosing a jurisdiction; see Licensing.
Innovations and the future of payments with PSD3 and PSR
Manufacturers of mobile devices and electronic communications providers must give PSPs access to the technical features needed for secure payments, on fair, reasonable and non-discriminatory terms (Art. 88a PSR).
The PSR will also cover transactions with electronic money tokens. If, for a transaction settled on a distributed ledger, a provider cannot give exact information for reasons beyond its control, it provides a reasoned estimate before the payment is authorised (Art. 67a PSR). The transitional rules for such tokens (Art. 108a PSR) apply from the day the regulation enters into force.
From the same day, an SCA exemption applies to certain recurring credit transfers based on an agreement between the payer and the payee (Art. 85a PSR). The details of SCA and of dedicated interfaces for open banking will be set by EBA technical standards (Art. 89 PSR).
Conclusions and recommendations for managers
- PSD3 and PSR are agreed but not adopted: PSD2, Directive 2009/110/EC and national laws apply today.
- Application will start 21 months after entry into force, and name and IBAN matching under the PSR after 27 months.
- Existing licences will continue during the transitional period, but the regulator will need information on compliance.
- The main changes: one authorisation, new capital, SCA, liability for fraud, access to accounts and data.
- It makes sense to start preparing with a gap analysis against the agreed text.
Since 2016 the COREDO team has supported payment companies in the EU. It can help compare your licence and processes with PSD2 and with the agreed PSD3/PSR text, draw up a transition plan and prepare documents for the regulator.