PSD3 and the Payment Services Regulation

The second Payment Services Directive (PSD2) of 2015 is the rulebook under which banks, payment institutions and e-money institutions offer payment services in the EU. Each member state carried it into its own law, Germany through the Zahlungsdiensteaufsichtsgesetz (ZAG) and the Civil Code. The European Commission proposed its successor on June 28, 2023, split into two texts, and on the same day proposed the Financial Data Access Regulation (FIDA) for open finance.

PSD3 is a directive on licensing and supervision. It repeals the E-Money Directive of 2009 and brings e-money institutions under the same regime as payment institutions. The Payment Services Regulation (PSR) holds the conduct rules: strong customer authentication, access to payment accounts, fraud liability and fee transparency. A regulation needs no national transposition law, so a payment institution in Frankfurt follows the same text as one in Paris or Vilnius.

The European Parliament and the Council reached a provisional political agreement on November 27, 2025. The Parliament's press release on the deal lists what changes for customers. The Council published the final compromise texts on April 23, 2026, and the Parliament's ECON committee approved the agreed text on May 5, 2026, as the legislative train of the Parliament records. The package enters into force 20 days after its publication in the Official Journal of the EU.

Most obligations start later. The law firm Arthur Cox reads the final texts as giving member states 21 months to transpose PSD3, with the PSR's payee name check applying 27 months after entry into force. Payment institutions licensed under PSD2 may keep operating for up to 27 months while they show their supervisor that they meet the new requirements. Iulia Cristian of Worldline lists five changes from PSD2 in a blog post for payment service providers.

Under the PSR a payment service provider checks that the payee's name matches the IBAN before a credit transfer goes out, and it refuses the order and tells the payer when the two differ. Euro transfers already have this verification of payee under the instant payments regulation, which the instant payments in Europe page explains; the PSR extends the check to other credit transfers. A transaction that a fraudster starts or changes counts as unauthorized.

In impersonation fraud a scammer poses as an employee of the customer's bank and talks the customer into approving a payment. According to the Parliament, the bank must then refund the full amount, as long as the customer reports the fraud to the police and informs the bank. A provider that did not run adequate fraud prevention covers the customer's loss. Online platforms enter the chain for the first time: a platform that is told about fraudulent content and does not remove it is liable to the payment provider that refunded the victim, and very large platforms must check that an advertiser of financial services holds a license. The fraud prevention in Germany page covers how German banks detect fraud today.

PSD2 gave licensed third parties access to payment accounts. The new package keeps that access and sets firmer terms for it. Banks must give payment institutions access to payment accounts on a non-discriminatory basis, run a dedicated interface (API) for data access and give their customers a dashboard that shows which providers can read their accounts, where the customer can also withdraw that permission. The open banking in Germany page explains the Berlin Group API standard most German banks use.

Strong customer authentication stays, with clearer treatment of merchant-initiated transactions. Providers must offer authentication methods free of charge that do not depend solely on a smartphone. Before a payment, customers see all charges, including currency conversion charges and fixed fees for cash withdrawals. Shops may pay out cash of up to 150 euros without a purchase, which the Parliament presents as a way to keep cash available outside cities.

In Germany PSD3 goes into the ZAG, and BaFin licenses and supervises payment and e-money institutions under it. BaFin expects new authorization files to follow the direction of PSD3 already, as Freshfields reported from its guidance. An institution with a ZAG license will have to show that it meets the new PSD3 requirements, such as the rules on safeguarding customer funds, to keep its license. The payments regulation in Germany page covers the ZAG license, safeguarding of customer funds and DORA duties.

Finance Loop is the meeting place for people who turn payments rules into products and processes: compliance and legal teams at banks, payment and e-money institutions, and the fintechs and consultancies that work with them. It connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop supports When Banks Say 'No', a payments seminar in Frankfurt for compliance, treasury and legal teams on blocked payments, de-risking and sanctions. Sopra Steria, which names PSD3, the Payment Services Regulation and FiDA among its banking topics in Germany, had a speaker at the Digital Finance Night that Finance Loop hosted in Frankfurt. During Sibos in Frankfurt, Finance Loop organized a side event at TechQuartier on payments and blockchain.

Capital & Code is a one-day conference in Frankfurt on stablecoins, tokenized funds and payments, hosted by the euro stablecoin issuer AllUnity. Its panel on the future of payments brings Mastercard, AllUnity, Worldline and PayPal on stage. Finance Loop is a media partner of the conference.

PSD2 is one directive that each member state transposed on its own. Its successor comes in two parts: PSD3, a directive on licensing and supervision that also absorbs the E-Money Directive, and the Payment Services Regulation, which holds the conduct rules and applies directly. The package adds a payee name check for credit transfers, refunds for bank impersonation fraud, liability for online platforms, permission dashboards for open banking and authentication that works without a smartphone.

The package enters into force 20 days after publication in the Official Journal. Member states then have 21 months to transpose PSD3, and the PSR's payee name check applies 27 months after entry into force, according to Arthur Cox's reading of the final texts. Payment institutions licensed under PSD2 have up to 27 months to show that they meet the new rules.

Yes. PSD3 repeals Directive 2009/110/EC and puts e-money institutions under the same licensing and supervision rules as payment institutions. Issuing e-money stays a licensed activity, but under one framework for both kinds of institution.

No. The Financial Data Access Regulation was proposed on the same day as PSD3 and the PSR and would extend data access beyond payment accounts to savings, investment, pension and insurance data. It is a separate legislative file. The rules on access to payment accounts sit in the PSR.