6 Things You Need to Know About PSD3
PSD3 is coming in the near future, and businesses need to be ready for it. The eagerly-anticipated update to the Payment Service Directive is set to be hugely impactful on the EU payment regulatory framework and economy.
Using some of the latest information from the European Commission, we’re covering six things you need to know about PSD3; including what it is, when it’s coming, and how it might affect you. Read on to learn more.
The six main points about PSD3:
1. The Shift From PSD2 to PSR1 and PSD3
PSD2 was a key factor in the growth of open banking within the EU, coming into force in 2018. The legislation sought to create a more level playing field between existing banks and new financial service providers, as well as encouraging innovation within the industry.
The result was the legal right for consumers to control and leverage their personal data, initiate payments, and view financial data via third parties instead of banks themselves.
PSD3 will come as part of a legislative package that also includes the Payment Services Regulation (PSR1). Most of PSD2 will transform into the Payment Services Regulation (PSR1), ensuring a consistent application across all EU member states.
“The introduction of PSR1, alongside a third payment services directive, could play an important role in enhancing open banking innovation. Namely, by providing greater harmonisation across Europe.”
Lisa Edstrom, Director of Compliance, Brite Payments
As well as general improvements to open banking processes, PSD3 specifically targets licensing and authorisation for payment firms. These changes generally concern the provision of cash and payment initiation services.
2. Better Open Banking Services
PSD2 made significant improvements to how open banking works in the EU. For example, PSD2 made Application Programming Interfaces (APIs) an industry standard. However, there is much still to be done.
“We’re particularly heartened by the EC’s acknowledgement that open banking in Europe is imperfect. This seems to be part of the reasoning behind the PSR.”
Lisa Edstrom, Director of Compliance, Brite Payments
For example, the legal experts De Brauw refer to the “unlevel playing field” between new and incumbent payment providers, stating: “…account information services providers (AISPs) and payment initiation services providers (PISPs) are still experiencing obstacles in obtaining data access from banks. This hinders the development of open banking.”
PSR1 contains further rules on API performance and functionality, promising a move towards better open banking services. One key example is the proposal to make non-bank Payment Service Providers (PSPs) eligible for direct access to all EU payment systems. PSR1 will also likely reinforce their rights to open and maintain a bank account for their consumers.
3. Improved Strong Customer Authentication
One of the PSD3 proposals is that PSPs must ensure that Strong Customer Authentication (SCA) doesn’t depend on one single device. Diversity in devices and authentication gives stronger protection to payments and data.
PSD2 had a positive impact on fraud prevention through SCAs. For example, SCA-authenticated remote card payments have a 70-80% lower level of fraud than those without.
However, the requirements for authentication must also be balanced alongside the other proposals. The EU Banking Authority recommends that: “…authentication should not include unnecessary steps or require the user to provide unnecessary or superfluous information.”
As this recommendation will likely be part of PSR1, it will be interesting to see how PSPs avoid forcing their users through significantly longer authentication journeys than they would with a manual bank transfer.
4. IBAN and Name Matching
Initially, IBAN name checks were part of the proposal for a Regulation for Instant Credit Transfers in euro. These were first presented in October 2022.
To prevent fraud, PSR1 expands the IBAN and name check requirements. It’s now the payment provider’s responsibility to check that these conditions match. This will likely create a greater need for Confirmation of Payee services among PSPs to prevent misdirected payments and fraud.
5. Further improving consumer rights and access to information
Like the UK government’s New Payments Architecture, PSD3 and PSR1 include regulations that improve consumer rights. For example, PSR1 will enable PSPs to share fraud-related information between themselves. Doing so helps them increase consumer awareness of fraudulent tactics and extend the refund rights of fraud victims.
It is an aim of the PSD3 consultation to also improve transparency for consumers: more complete information on blocked funds and ATM charges will be available. Additionally, PSD3 proposals specifically highlight the use of AI, and how it might affect consumers. The proposals incorporate provisions to ensure any use of AI in payment services respects individuals’ privacy rights.
6. What to expect from the PSD3 changes? What they mean for you
So, now that we’ve covered what PSD3 aims to offer consumers, we can now discuss what PSD3 means for businesses, as well as how it will affect payments in the European Union going forward.
In summary – What are the main points of PSD3?
PSD3 comes as part of a legislative package that includes Payment Services Regulation (PSR1). As a regulation, PSD3 aims to:
- Strengthen consumer rights
- Combat payment fraud
- Grant non-bank payment service providers access to all EU payment systems and the right to a bank account
- Merge the legal frameworks applicable to electronic money and payment services
“Across the proposal, the European Commission showed it has listened and addressed feedback from the consultation.”
Lisa Edstrom, Director of Compliance, Brite Payments
Looking to the future of EU payments:
These changes will be positive for businesses:
- Those using PSPs will be able to access more streamlined, more secure payments.
- There will also be a more varied impact on the payments industry.
PSD3 seeks to level the playing field between banks and non-banks. However, it may require a significant investment of resources to meet the new requirements. For example, third-party payment providers (TPPs) will have to adhere to new EU rules named CESOP, which aim to further strengthen financial reporting – in particular, VAT.
Additionally, having the right PSP is vital to accessing the full benefits of PSD3. And finally, exactly when is PSD3 coming? The rollout of PSD3 is expected to begin around 2026.Â
Learn more about the future of payments with Brite
If you’re looking to stay up-to-date with PSD3 and ensure that your business can carry out fast, secure, safe transactions, Brite can help.
Our simplified API solution creates a single point of payment integration for merchants, with real-time updates to ensure that our partners remain fully compliant with all future regulatory requirements.
For a deeper look into Brite Payments’ take on PSD3 and PSR, check out our in-depth PSD3 Explainer.
