top of page

PSD3 and PSR: Why Europe’s New Payments Framework Is More Than a PSD2 Update

Sep 28
10 min read

Europe is not simply revising PSD2. The new framework separates the regulation of payment institutions from many of the rules governing payment services themselves, with consequences for authorisation, safeguarding, fraud controls, open banking and the way payment and e-money firms operate.


PSD2 reshaped European payments by opening payment accounts to third-party providers, introducing strong customer authentication and creating a common framework for payment services across the EU. The PSD3 and Payment Services Regulation package takes that framework further by reorganising the regulatory architecture itself rather than simply adding another layer of requirements.


Under the agreed structure, PSD3 will primarily govern the institutions providing payment and electronic money services, including authorisation, prudential requirements, safeguarding, governance, passporting and supervision. The PSR, by contrast, will contain much of the operational rulebook governing how those services are delivered, covering areas such as customer rights, payment execution, fraud prevention, authentication, open banking, transparency and liability.


This division matters because PSD3 will remain a Directive requiring national implementation, while the PSR will apply directly across the EU. In principle, that should reduce some of the national variation that developed under PSD2. For firms, however, the practical challenge remains integrated: institutional requirements, customer-facing obligations and operational controls will still need to function as one coherent framework.


From one directive to two regulatory layers


Under PSD2, authorisation requirements and many conduct-of-business rules sit within the same Directive and are then transposed into national law. PSD3 and PSR separate those functions more clearly, creating one regulatory layer focused on the institution and another focused more directly on how payment services are provided.


In practical terms, PSD3 asks whether the firm is appropriately structured, governed, resourced and controlled to provide payment services. PSR deals much more closely with how those services reach the customer and how transactions are handled. The distinction is useful legislatively, but inside a payment firm the two layers remain closely connected. A fraud-control requirement under PSR still needs an accountable owner, reliable data, escalation procedures and management oversight; an open-banking access requirement still depends on technology, authentication and operational processes; and safeguarding requirements ultimately rely on banking relationships, treasury arrangements and reconciliation.


The legislation may therefore be divided between a Directive and a Regulation, but the business cannot implement them as separate projects.


E-money moves into the same institutional architecture


One of the more structural changes is the treatment of electronic money institutions. PSD3 is intended to repeal both PSD2 and the existing E-Money Directive, bringing electronic money services into the payment institution framework rather than maintaining a separate EMI regime under EMD2.


Over time, this should create a more coherent institutional framework for firms providing payment and electronic money services. The transition itself, however, will require careful mapping because many firms have built their licences, governance structures, safeguarding arrangements, prudential processes and internal documentation around the existing distinction between a PI and an EMI.


This is therefore more than a change in regulatory terminology. Existing permissions, governance responsibilities, safeguarding models, capital calculations, passporting arrangements and reporting structures will need to remain consistent as the legal framework changes around them. For firms operating across several Member States or through group structures, the exercise may be particularly important because regulatory categorisation, legal-entity responsibilities and operational delivery may not currently sit in the same place.


Existing PIs and EMIs will be reassessed rather than starting again


The transition for firms already authorised under PSD2 or the E-Money Directive is not designed as a completely new licensing gateway. Existing payment institutions will be assessed by their competent authorities against the PSD3 requirements, and where the regulator already holds sufficient evidence that a firm meets those requirements, the agreed text allows for authorisation under the new framework without reconstructing the entire regulatory history from the beginning. A similar mechanism is envisaged for existing electronic money institutions as they move into the payment institution framework.


That makes the quality of existing regulatory evidence particularly important. Firms may already have established procedures, supervisory history and years of operating data, but the practical question will be whether those arrangements can be shown to satisfy the new framework and whether the evidence available to the competent authority remains current, coherent and complete.


For that reason, a useful transition exercise is likely to look less like preparation of a new licence pack and more like a structured gap analysis. Firms need to identify which elements of the current authorised model remain suitable, where genuine changes are required and what evidence will support the regulator's reassessment.


Governance needs to follow the regulated activity


The agreed PSD3 framework retains familiar elements of authorisation, including the programme of operations, business plan, capital requirements, safeguarding arrangements and internal controls. What matters increasingly, however, is whether those elements describe the same business.


A complete policy suite is not particularly persuasive if the organisation behind it cannot show who makes decisions, who owns the relevant controls and how management knows whether those controls are working. This becomes especially important in groups where product, technology, treasury, operations and compliance responsibilities sit across different entities or jurisdictions.


The regulatory chain therefore needs to remain coherent from the regulated service through to the evidence available to supervisors:


regulated service → legal entity → accountable management → customer journey → systems and controls → management information → escalation → evidence


A governance document can describe responsibility, but it cannot compensate for unclear accountability in the actual operating model. Where the documentation and the way the business operates diverge, the problem is no longer editorial.


Safeguarding becomes a concentration-risk question


Safeguarding remains one of the most operationally significant elements of the payments framework. The agreed PSD3 text retains segregation and insurance or guarantee-based approaches while giving greater attention to concentration risk where customer funds are placed with credit institutions.


Where appropriate, payment institutions using segregation are expected to avoid excessive concentration and, in particular, to endeavour not to place all safeguarded funds with a single bank. The regulatory rationale is straightforward, but implementation can be considerably more complicated.


Diversifying safeguarding funds may require relationships with several banks, multiple account structures, changes to treasury processes and reconciliations across more than one institution. It also raises continuity questions that cannot be answered by policy wording alone. If one safeguarding bank exits the relationship, the firm needs to know how quickly balances can be moved, whether customer payments and redemptions can continue and whether the alternative provider is genuinely operational rather than simply named in a contingency plan.


Safeguarding diversification therefore sits at the intersection of treasury, banking access, reconciliation and operational resilience. It is not simply a decision about where cash is deposited.


Banking access is moving closer to the regulatory perimeter


This leads to one of the more interesting aspects of the new framework. A payment institution may be fully authorised and still depend on commercial banks for much of the infrastructure required to make that authorisation usable in practice.


The agreed PSR seeks to address this tension by requiring access to payment accounts for payment institutions, their agents and certain applicants to be provided on an objective, non-discriminatory and proportionate basis. Banks will still be able to refuse access where legitimate grounds exist, including AML concerns or insufficient information, but refusals are expected to be reasoned and subject to greater regulatory scrutiny.


The provision does not guarantee that every payment institution will obtain every banking relationship it seeks, nor does it remove banks' own risk-management obligations. It does, however, recognise something fundamental about the payments market: access to bank accounts is not peripheral infrastructure for a PI. It may determine whether the institution can safeguard customer funds, settle transactions and maintain the liquidity required to operate.


The distinction is therefore important:

Regulatory permission provides access to the payments perimeter. It does not, by itself, provide the infrastructure needed to operate within it.

That issue will remain relevant even under a more harmonised European rulebook and provides a useful bridge between regulatory authorisation and the commercial reality of payment infrastructure.


Fraud prevention moves into the transaction journey


Fraud is likely to be one of the areas where PSR produces the most visible operational change. The agreed package brings together verification of payee, fraud-related information sharing, transaction monitoring, strong customer authentication, customer controls and a broader liability framework.


What changes is not simply the number of fraud requirements but their position in the payment journey. Fraud prevention increasingly becomes part of the transaction decision itself, with several controls potentially contributing to the outcome before a payment is executed.


A transaction may move through a chain such as:


payment initiation → payee verification → authentication → transaction monitoring → fraud assessment → execution or intervention → customer communication → liability assessment


Those stages need to work together without becoming mechanically dependent on a single indicator. A payee-name mismatch may be relevant to a fraud assessment without proving that fraud is taking place. A transaction-monitoring alert may justify additional scrutiny without automatically justifying rejection. Authentication may establish that the customer performed an action while leaving unanswered whether the customer was manipulated into doing so.


For PSPs, this means that the quality of the decision-making between controls becomes as important as the controls themselves.


Verification of payee affects more than the customer warning


The agreed PSR extends verification-of-payee requirements for credit transfers and connects them to a specific liability framework. Under the current compromise text, those provisions are expected to receive additional implementation time compared with the main Regulation, reflecting the fact that this is not simply a front-end change.

Verification of payee can affect payment engines, reference data, API connectivity, fraud rules, exception handling, customer communications, complaint handling and reimbursement processes. It also requires firms to decide how much weight a verification result should carry within the wider fraud framework.


That is a subtle but important design issue. A mismatch can be a meaningful warning signal, but it should not automatically become a fraud decision. The objective is to make controls inform one another while preserving enough context for proportionate decision-making.


Open banking is becoming an access-governance issue


PSD2 established the legal basis for account information and payment initiation services, but much of the subsequent industry debate focused on whether third-party access worked reliably in practice. PSD3 and PSR move the discussion further toward the quality and governance of that access.


The agreed framework addresses obstacles that account-servicing PSPs may place in the way of AISPs and PISPs and introduces permission dashboards through which customers can view and manage access they have granted. The technical availability of an API is therefore no longer the whole issue.


Firms need to understand the lifecycle of the permission itself: what the customer has authorised, how long that authority remains valid, how revocation is communicated between providers and how quickly systems reflect a change. They also need to distinguish legitimate restrictions prompted by fraud or security concerns from practices that effectively obstruct third-party access.


Open banking is therefore evolving from a question of connectivity into one of access governance. That makes alignment between compliance, product and technology particularly important because all three functions need to work from the same interpretation of the customer's permission.


Direct applicability does not mean automatic implementation


Moving substantial parts of the conduct and customer-protection framework into a directly applicable Regulation should reduce some of the divergence created through national PSD2 transposition. That is one of the main structural advantages of PSR.

Direct applicability, however, addresses legal implementation rather than operational implementation. A common fraud rule still needs to be translated into transaction logic. A permission dashboard still requires interfaces and data flows. New liability provisions still need complaint and reimbursement processes, while safeguarding continues to depend on bank accounts, reconciliations and treasury procedures.


A more harmonised European rulebook may therefore reduce legal variation without removing operational complexity. In some areas, the opposite may occur initially: firms will need to adapt highly localised systems and processes to a more uniform regulatory expectation.


Level 2 will shape the detail


The final PSD3 and PSR texts will not complete the regulatory framework. A substantial EBA work programme is expected to follow, covering areas including authorisation, safeguarding, own funds, governance, passporting, payment security, fraud and access arrangements.


For firms, this creates a familiar implementation problem. Some elements of the future framework are already clear enough to map and assess, while others will depend on RTS, ITS or guidelines that have not yet been finalised.


A sensible readiness programme therefore needs to distinguish between changes that can be designed now and areas where the architecture should remain adaptable until Level 2 is settled. Waiting for every technical standard risks compressing implementation into an unrealistic period, while building detailed solutions around assumptions that later change creates unnecessary rework.


The objective should be to establish the structure early without hard-coding unresolved details.


What PSPs and EMIs should be mapping now


Formal application dates and transition periods will depend on completion of the legislative process, but the main operating-model questions are already visible.

Firms can begin by mapping the relationship between current permissions, future PSD3 services, customer journeys, safeguarding, fraud controls, authentication, payment execution, open-banking access, complaints and liability, governance and regulatory evidence.


The purpose is not to start rewriting every policy before the legislation is formally adopted. It is to identify where the existing business model already aligns with the agreed framework and where genuine process, system or governance changes may be required.


That distinction is important because documentary gaps and operating-model gaps have very different implementation timelines. Updating wording in a policy may take days. Replacing a safeguarding bank, changing a payment engine or resolving unclear accountability across a group can take months.


Lynsora perspective


PSD3 and PSR are often described as the successor package to PSD2, but that description understates the extent of the change. The reform reorganises European payments regulation by separating the institutional framework from much of the operational rulebook while bringing electronic money into the same institutional architecture.


At the same time, it strengthens fraud prevention and liability, develops the governance of open-banking access, gives greater attention to safeguarding concentration and places banking access for payment institutions more clearly within the regulatory discussion.


For firms, the practical challenge is therefore alignment rather than document replacement. Authorisation needs to reflect the business model; safeguarding needs to reflect real treasury arrangements and banking relationships; fraud policies need to match transaction logic; open-banking permissions need to match APIs and customer journeys; and governance needs to reflect where decisions are actually made.


The result should be an operating model that a competent authority can follow from the regulated service through to the evidence showing how that service is controlled.

PSD3 will define the institution. PSR will define much of the service. Readiness depends on making the two work as one operating model.

Official sources


Disclaimer


This article is based on the agreed PSD3/PSR compromise texts available as of 24 September 2026. The legislative package has not yet completed formal adoption and may remain subject to technical or procedural changes. This article is provided for general information only and does not constitute legal, regulatory or professional advice.


Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page