Europe – October 31, 2026 -- The EU's Council Permanent Representatives Committee (COREPER) endorsed the trilogue texts of the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR) in April 2026, with implementation targeted for 2028.
Adoption expected in late 2026, with 18-24 months to comply
The European Commission proposed both measures in June 2023. The agreed compromise texts have since been published. Formal adoption and publication in the Official Journal are expected in late 2026, and the legislation is set to enter into force 20 days after publication.
Payment providers are expected to receive a transition period of 18 to 24 months before the rules become fully applicable.
Split between directive and regulation targets national divergence
PSD3 covers licensing, authorization, safeguarding requirements, supervision, enforcement and sanctions. As a directive, it must be transposed into national law by each Member State, which can lead to differing implementations.
The PSR sets operational rules, including transparency, fraud prevention, strong customer authentication (SCA) definitions, liability and open banking protocols. As a regulation, it applies and is enforced directly across the EU. Placing more rules in the PSR is meant to reduce the national differences that emerged under PSD2.
Reform addresses fragmentation, open banking friction and evolving scams
The Commission's proposals respond to four gaps under PSD2: fragmented national implementation, uneven open banking performance, changing fraud patterns and consumer protection shortfalls. Differences in API quality, interface design, performance and access standards have made it harder for third-party providers to scale services. Scams, impersonation and social engineering can now lead customers to approve payments themselves, which SCA alone does not prevent.
Liability and payee verification lead the fraud changes
Liability is likely to be one of the most consequential areas of change. The reform is expected to clarify responsibility in scam-related cases, including that of the receiving payment provider, and to strengthen providers' role in identifying suspicious transactions earlier.
The proposals also stress checking that payment details match the intended recipient before a transaction completes. SCA remains a cornerstone, with the reform expected to clarify its application and reduce avoidable friction.
PSD3 and the PSR are not anti-money laundering legislation, but they reinforce expectations for fraud prevention and transaction monitoring. Data sharing across payment providers is likely to become a more important part of the framework.
Non-bank providers gain access while supervisory scrutiny rises
The reform brings clearer compliance requirements for payment and e-money institutions and improved access for non-bank providers to payment infrastructure and bank accounts. Providers can also expect stronger transparency requirements and increased supervisory scrutiny across the payments and fraud detection ecosystem.