The European Union’s (EU) overhaul of its payments framework has taken a significant step forward, with the European Parliament and the Council of the EU reaching a provisional political agreement on the proposed Third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR). The package of final texts, originally published by the European Commission in June 2023, is expected to replace and modernise the existing Second Payment Services Directive (PSD2) and Second E-Money Directive (EMD2) framework.
Key Reforms
The proposed framework represents a major reform of the EU payments regime. It is intended to strengthen consumer protection and improve the functioning of the EU payments market. Key changes under PSD3 and the PSR include enhanced fraud prevention measures, greater transparency on fees and charges, improved access to cash, further development of open banking, streamlined authorisation requirements, increased harmonisation across Member States, and faster resolution of payment disputes.
Some of the principal reforms include:
- Fraud prevention. Payment service providers (PSPs) will be required to strengthen fraud prevention mechanisms, including transaction monitoring and fraud-related information sharing. PSPs will also be required to provide a verification-of-payee service that checks whether a payee’s name matches the relevant payment account identifier and warns the payer of a mismatch before the transfer is authorised.
- Transparency. Customers will need to receive all relevant information about charges before initiating a payment. This may include information about currency-conversion charges and fixed ATM cash withdrawal fees.
- Access to cash. To improve access to cash, particularly in underserved areas, retailers will be permitted to offer cash withdrawals without requiring a purchase. Under the agreed text, Member States must allow withdrawals of up to €150, or the equivalent in local currency, although they may set a lower limit provided it is no less than €100.
- Open banking. The reforms are intended to strengthen the EU’s open-banking framework by reducing barriers to account-data access, prohibiting certain obstacles imposed by account-servicing institutions, introducing customer permission dashboards and imposing more prescriptive requirements on access interfaces. The package also seeks to improve nondiscriminatory access to payment accounts and to certain device and technology infrastructure needed to deliver payment services.
- Authorisation and reauthorisation. PSD3 will create a more harmonised authorisation and prudential framework for payment institutions and electronic money institutions. Existing payment and electronic money institutions should prepare for a reauthorisation or reassessment process requiring them to demonstrate compliance with the new regime, including updated governance, safeguarding, own-funds, and operational requirements.
- Dispute resolution. All PSPs will be required to participate in alternative dispute-resolution procedures if a consumer chooses to use them.
Scope and Market Impact
The updated framework will affect a broad range of market participants, including banks, payment institutions, electronic money institutions, account information service providers, payment initiation service providers, and certain technology and communications providers subject to specific obligations.
To prepare for the implementation of PSD3 and the PSR, firms should begin assessing the operational, regulatory, and contractual changes that may be required under the new regime. As a preliminary step, firms may wish to conduct a gap analysis between PSD2 and the updated PSD3 and PSR requirements to identify areas requiring changes.
Implications for U.S. Businesses Operating in the EU
For U.S.-headquartered financial institutions and other payments businesses, the impact will depend on their EU nexus and operating model. The package will not apply to a U.S. parent merely because it is based in the United States, but it may apply directly to an EU branch or subsidiary providing in-scope payment or electronic money services. It may affect group arrangements supporting those EU activities.
- Licensing and entity structure. U.S. groups should identify which EU entities provide regulated payment or electronic money services and prepare affected payment institutions and electronic money institutions for the PSD3 reauthorisation process. Existing firms are expected to be required to demonstrate compliance with the new authorisation, governance, safeguarding, prudential, and operational requirements rather than relying on the automatic continuation of their current licences.
- Fraud controls and liability. EU-facing businesses should prepare for enhanced payee-verification, transaction-monitoring, strong customer-authentication, and fraud-reimbursement requirements. This may require changes to systems, customer journeys, operational procedures, reserves, and customer terms.
- Open banking and technology. Account-servicing institutions and open-banking providers should assess the more prescriptive requirements for interfaces, access to payment account data, and customer-permission dashboards. U.S. technology platforms supporting EU services may need to be updated even when the relevant technology is operated outside the EU.
- Prudential compliance. EU payment and electronic money businesses should review customer-fund safeguarding arrangements, regulatory capital and own-funds calculations, governance frameworks, and wind-down plans against the final PSD3 requirements. These changes will be an important compliance workstream for regulated EU entities, although they are more incremental than the headline reforms involving fraud, verification of payee, and open banking.
- Intra-group, outsourcing, and data arrangements. U.S. groups should map services provided to EU entities by the U.S. parent, affiliates, and third-party vendors and review whether outsourcing, information-sharing, audit, access, and regulatory-cooperation provisions remain adequate.
- UK and EU divergence. The package is an EU reform and will not automatically apply to UK-only operations. U.S. groups operating in both the UK and the EU may therefore need separate compliance workstreams while monitoring areas in which the UK framework remains aligned with, or diverges from, the EU regime.
- Customer and commercial documentation. Firms should review customer terms, fee disclosures, complaints and alternative dispute-resolution wording, payment-execution provisions, and liability allocations to reflect the final rules.
As an initial step, U.S. businesses should map the legal entities, services, and jurisdictions within their European operating models and allocate each requirement to the relevant licensed entity. The PSR will create directly applicable EU conduct requirements, while PSD3 will require national implementation, meaning local-law analysis will remain necessary.
Implementation Timeline
The substantive requirements of PSD3 and the PSR have largely been agreed at the EU level and are expected to be formally adopted and published in the Official Journal of the European Union in late 2026. The PSR, as an EU regulation, will apply directly across EU Member States, following the applicable transition period. PSD3, as an EU directive, must be implemented through national legislation in each Member State.
Under the agreed texts, most requirements are expected to apply 21 months after entry into force, with certain verification-of-payee requirements applying after 27 months.
Based on the current timetable, the PSD3 and PSR reforms are expected to start taking effect in late 2027 and continue to be implemented into 2028. Market participants should begin implementation planning now, including scoping affected entities, preparing for reauthorisation, conducting a gap analysis, and identifying legal, compliance, operational, and technology changes.
Please contact our team if you would like assistance navigating these upcoming changes.
If you have any questions, or would like additional information, please contact one of the attorneys on our Payments & Fintech team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.