PSD3 and PSR: Are you ready for Europe’s next payments reform?

Europe is preparing for its next major update to payments regulation. In June 2023, the European Commission proposed a new Payment Services Directive (PSD3) and Payment Services Regulation (PSR), building on the framework established by PSD2. The proposals address regulatory gaps that have emerged as payments have evolved since PSD2 took effect. They aim to harmonize how rules are applied across the EU, strengthen fraud prevention and consumer protection, and advance open banking.

The key PSD3 and PSR proposals

The first proposal, PSD3, updates licensing and authorization frameworks and supervision rules. This includes licensing, safeguarding requirements, enforcement, and sanctions. The core proposal, PSR, sets operational rules for payment services, including transparency, fraud prevention, definitions for strong customer authentication, liability, and open banking protocols.

The reform uses two types of EU legislative acts, and the distinction between the two matters. PSD3 is a directive, so each EU Member State must incorporate its requirements into national law. This can lead to differences in how the underlying rules are implemented. The PSR is a regulation, so its requirements apply, and are enforced, directly across the EU. By placing more of the rules in the PSR, the reform aims to reduce national differences and create a more consistent payments framework across Europe.

PSD3 and PSR evolution and timeline

PSD3 and PSR build on earlier versions of the EU payments framework. Looking at the framework’s development history helps put the proposed changes in context. The first Payment Services Directive (PSD1), introduced in 2007, established the original legal framework for payment services. PSD2 followed in 2013, introducing open banking and stronger customer authentication (SCA), while broadening competition and establishing open API protocol specifications.

The European Commission published its PSD3 and PSR proposals in June 2023. In April 2026, the Council’s Permanent Representatives Committee (COREPER) endorsed the trilogue texts, and the agreed compromise texts were published.

Formal adoption and publication of the final compromise texts in the Official Journal are expected in late 2026. Once published, the legislation is set to enter into force 20 days later.

Payment providers are expected to have an 18- to 24-month transition period before the rules become fully applicable, with implementation currently targeted for 2028.

Main reasons why payments reform is needed

PSD2 significantly changed Europe’s payments market and strengthened protections for payment users. Since its introduction, however, the way people and businesses pay has continued to evolve, making limitations in the framework more apparent. Some of these limitations include the following:

• Fragmentation: Because PSD2 was implemented through a directive, EU Member States adopted the rules in different ways. For organizations operating across borders, these differences can create legal uncertainty and add operational complexity.
• Open banking friction: PSD2 opened the door to open banking, but the experience has varied across the market. Differences in API quality, interface design, performance, and access standards have made it harder for third-party providers to deliver and scale services consistently.
• Changing fraud patterns: PSD2 helped address many types of unauthorized payment fraud, particularly through strong customer authentication (SCA). Fraud has since evolved. Scams, impersonation, and social engineering can persuade people to approve of a payment themselves, even when they have been manipulated into doing so.
• Consumer protection gaps: Payments have become faster, more digital, and more complex, yet much faster. The rules around liability, fraud handling, and payment transparency therefore need to reflect how customers use payment services today.

Key changes for fraud prevention and transaction monitoring

The reform takes a broader approach to payment fraud, covering how providers authenticate customers, verify recipients, detect suspicious activity, and share information. It also seeks to clarify how responsibility is shared when a scam results in a payment. Key fraud-related changes include the following:

• Strong customer authentication (SCA): SCA remains a cornerstone of the EU payments framework. The reform is expected to clarify how it’s applied across the market and reduce avoidable friction, while maintaining appropriate security.
• Liability: Liability is likely to be one of the most consequential areas of change. The reform is expected to clarify responsibility in scam-related cases and strengthen providers’ role in identifying suspicious transactions earlier. It’s also expected to clarify how liability is shared, including the responsibilities of the receiving payment provider.
• Payee verification: The proposals place greater emphasis on checking that payment details match the intended recipient before a transaction is completed. This is part of a broader effort to prevent fraud before money leaves a customer’s account.
• Fraud detection and monitoring: PSD3 and the PSR are not anti-money laundering legislation. They do, however, reinforce expectations for fraud prevention and transaction monitoring, including the use of appropriate controls to identify suspicious payment activity.
• Data sharing: The proposals also recognize that providers cannot prevent fraud in isolation. Sharing relevant information across payment providers is likely to become a more important part of the framework.
• Other key changes: greater consistency, accountability and control

The reform also includes broader changes, including more harmonized rules through the PSR, clearer compliance requirements for payment and e-money institutions, and improved access for non-bank providers to payment infrastructure and bank accounts. Providers can also expect stronger transparency requirements and increased supervisory scrutiny across the payments and fraud detection ecosystem.

Together, these measures point toward a more consistent framework, clearer accountability, and stronger controls across the market.

What PSD3 and the PSR mean for payment providers

PSD2 has been a significant reform. It helped strengthen payment protections, supported the growth of digital payments, and contributed to Europe’s leadership in open banking. Its influence has also reached beyond the EU, including the UK, Canada, and parts of Asia.

PSD3 and the PSR are intended to build on that foundation. Their focus is on strengthening fraud prevention, clarifying liability, improving how open banking works, and creating a more consistent regulatory framework across the EU.

For payment providers, the direction is clear: expectations for fraud prevention, transaction monitoring, and customer protection are continuing to rise. Preparing for the new framework means understanding how these requirements may affect operations, technology, and relationships across the payments ecosystem.

CGI works with financial institutions to modernize payment capabilities and strengthen fraud prevention and transaction monitoring as requirements evolve. Learn more about our payments and fraud detection solutions and expertise.