PSD3 & PSR: What Financial
Institutions Must Do Now

The EU payments regulatory framework has not stood still since PSD2's core obligations became applicable in 2018. The intervening years brought the rise of open banking, the explosive growth of instant payments, the emergence of AI-driven fraud, and the arrival of crypto-asset services requiring intersection with payment rules. PSD2, as drafted, simply did not anticipate the world that followed it.

The European Commission recognised this gap in June 2023, publishing parallel proposals for a new Payment Services Regulation and a Third Payment Services Directive. What followed was over two years of intensive trilogue negotiation between the Parliament and the Council — a process concluded in November 2025 under the Danish EU Presidency, which pushed hard to secure agreement before its mandate expired on 31 December 2025.

The political agreement marks the end of the fundamental legislative debate. What remains now is the technical and legal-linguistic work before formal adoption — a process that, by reference to PSD2, typically takes around seven months. This places publication realistically in summer 2026, with the compliance clock starting immediately thereafter.

One of the most consequential structural decisions in the reform is the deliberate split between a Directive (PSD3) and a Regulation (PSR). This is not a technical legal detail — it has direct operational implications for every institution in scope.

The scope is also significantly broader than PSD2. Beyond banks, PIs, and EMIs, the PSR draws in technical service providers and — in certain defined circumstances — telecommunications providers and online platforms. If your institution sits adjacent to payments infrastructure, you need to assess whether you are now in scope.

3.1 Fraud Liability: A Fundamental Rebalancing

This is arguably the most operationally demanding change in the entire package, and the one with the most direct P&L implications. The PSR introduces mandatory reimbursement for Authorised Push Payment (APP) fraud — where a customer is manipulated into authorising a payment to a fraudster. Liability attaches to the institution if it fails to implement adequate fraud risk controls or fails to act on notifications of suspicious activity.

Critically, the reimbursement requirement now extends to employee impersonation fraud — a rapidly growing attack vector where fraudsters pose as bank staff to instruct customers to transfer funds. PSPs will also be required to offer customers spending limits and blocking measures as standard features, not optional add-ons. Failure to provide these controls shifts liability decisively to the institution.

3.2 Verification of Payee — Extended Scope

The Instant Payments Regulation already mandated VoP for instant credit transfers within the EU. The PSR now extends this obligation to all credit transfers, not just instant payments, with a 24-month transition period from entry into force to allow institutions to build the necessary system infrastructure. The extended timeline reflects the scale of change required — but it is not an invitation to wait. System development, vendor assessment, and testing programmes need to begin now to be credibly in place by the deadline.

3.3 Open Banking: From Compliance Exercise to Enforceable Obligation

PSD2's open banking chapter was plagued by inconsistent implementation, poorly performing APIs, and the proliferation of obstacles that frustrated third-party providers (TPPs) seeking access to account data. The PSR directly addresses this failure mode.

Dedicated interfaces — the API channels through which TPPs access account information — must now deliver performance parity with the customer-facing interfaces operated by account servicing payment service providers (ASPSPs). The regulation enumerates specific prohibited obstacles, making enforcement more straightforward for national competent authorities. Permissions dashboards, giving consumers clear visibility of who has access to their data and the ability to revoke that access in real time, become mandatory.

3.4 Strong Customer Authentication — Rebalanced for Usability

SCA has been one of PSD2's most contentious areas — balancing security against customer friction. The PSR takes a more nuanced approach, strengthening authentication requirements for high-risk transactions while expanding risk-based exemptions to improve user experience for lower-risk scenarios. Real-time fraud monitoring capabilities are explicitly embedded in the framework, recognising that static rule-based authentication is insufficient against modern fraud typologies.

An important governance change: where SCA is outsourced to a technical service provider, the issuer retains full regulatory responsibility. Detailed written agreements must be in place, granting the issuer and its regulators unrestricted audit rights. Institutions that have outsourced SCA without robust governance frameworks will need to remediate their contracts and oversight arrangements.

3.5 Fee Transparency and Consumer Rights

The PSR tightens transparency obligations across the board. Currency conversion fees, ATM withdrawal charges, and cross-border payment costs must be disclosed upfront and comparably — closing the loopholes that allowed some providers to bury costs in exchange rate margins. Estimated transfer times for cross-border payments must be disclosed. PSPs must provide access to human customer support. Alternative dispute resolution (ADR) participation becomes mandatory for consumer complaints.

The legislative journey from political agreement to full compliance obligation spans multiple years. Understanding where each obligation falls on that timeline is essential for resource planning and programme sequencing.

The instinct to wait for final text is understandable — but it is the wrong strategic posture. The political agreement provides sufficient certainty on the major obligations for institutions to begin meaningful preparation. Those that act in 2026 will have the implementation runway they need; those that wait for final publication risk compressing a complex, multi-year programme into an unmanageable timeframe.

Immediate Actions (Now — Q3 2026)

• !
  Commission a regulatory gap analysis. Map your current state against the known PSD3/PSR obligations — fraud controls, VoP capability, open banking API performance, SCA governance, fee disclosure. This baseline is the foundation for everything that follows. Waiting for final text adds weeks of delay for marginal additional certainty.
• !
  Assess your fraud liability exposure. Model the financial impact of APP fraud reimbursement obligations under your current control environment. For many institutions, particularly those with high-volume retail payment books, this is a material P&L risk that warrants immediate Board-level attention.
• !
  Review SCA outsourcing contracts. Identify every agreement where SCA functions are delegated to a technical service provider. Assess whether current contracts provide the detailed governance requirements, service level commitments, and audit rights that the PSR will mandate.
• ✓
  Establish a PSD3/PSR programme governance structure. Designate a cross-functional programme owner. PSD3/PSR touches Compliance, Technology, Operations, Product, Legal, and Finance. Siloed responses will fail. Stand up an integrated programme board now.
• ✓
  Map your open banking API performance. Benchmark current API availability, response times, and error rates against your customer-facing interfaces. Where gaps exist, begin the technology investment case — VoP and open banking parity will require system-level changes, not configuration tweaks.

Medium-Term Actions (Q4 2026 — Q2 2027)

• →
  Build or procure Verification of Payee capability. VoP for all credit transfers requires infrastructure that most institutions do not currently have in place for non-instant payments. Define your build vs. buy decision, select a vendor or architecture approach, and begin development. The 24-month transition sounds generous — it is not, for complex multi-market institutions.
• →
  Redesign fraud monitoring and intervention frameworks. Implement spending limit management, real-time anomaly detection, and customer blocking mechanisms as product features. Ensure transaction monitoring rules are calibrated for the expanded SCA exemption landscape to avoid both over-authentication (friction) and under-authentication (fraud losses).
• →
  Engage with the EBA implementation roadmap. The EBA anticipates around 40 mandates under PSD3 and PSR and plans to publish its roadmap in Q2 2026. This roadmap will determine the sequencing and timing of Level 2 standards — participate in consultations where your business model is affected. Early engagement shapes better outcomes.
• →
  Update fee disclosure frameworks. Review all customer-facing fee schedules, FX margin practices, and ATM charge disclosure mechanisms against the PSR's upfront transparency requirements. Product teams and Legal need to work in concert to redesign disclosure journeys.
• →
  Train and upskill compliance and payments operations teams. The shift from directive to regulation eliminates many of the national implementation nuances that teams have navigated under PSD2. Direct familiarity with the PSR's conduct obligations — not filtered through national transposition — is the new baseline.

For institutions operating across both EU and UK markets, PSD3/PSR creates an increasingly complex bilateral regulatory environment. The UK's post-Brexit payment services reform is proceeding on a separate legislative track, with the FCA and PSR developing their own approach to open banking, APP fraud reimbursement (the UK's mandatory reimbursement regime is already live from October 2024), and payment system access.

The convergence assumption that underpinned many firms' compliance operating models during the PSD2 era no longer holds. EU and UK rules on VoP, SCA, open banking interface standards, and fraud liability will differ in design, threshold, and enforcement — requiring genuinely distinct compliance frameworks for each jurisdiction, not a single policy with minor carve-outs.

Institutions with cross-border payment books should now be conducting explicit divergence assessments: for each major obligation area, what is the EU requirement, what is the UK requirement, and what is the most efficient operating model that satisfies both without unnecessary duplication?

PSD3 and the PSR represent the most significant reform of EU payments regulation since the original PSD1 in 2007. They are not an incremental update to PSD2 — they are a structural redesign that shifts liability, extends scope, eliminates forum shopping, and hardwires open banking into the regulatory fabric of the single market.

The institutions that will navigate this transition most effectively are those that treat 2026 as the year to understand, plan, and begin — not the year to wait. The political agreement provides sufficient certainty for meaningful gap analysis and programme design. The EBA's implementation roadmap in Q2 2026 will add sequencing clarity. Official Journal publication in mid-2026 will start the compliance clock formally.

What it will not do is extend the runway for institutions that chose to delay. The technical work required — VoP infrastructure, API performance upgrades, fraud reimbursement frameworks, SCA outsourcing governance, fee disclosure redesign — takes time, budget, and organisational focus. The window to act without crisis is open now. It will not remain open indefinitely.

At CassConsult, our Payments Advisory Practice works with banks, payment institutions, and e-money institutions to translate regulatory complexity into clear, actionable programmes. We offer structured PSD3/PSR gap assessments, fraud liability modelling, open banking API audits, and implementation programme design — calibrated to your institution's specific business model, geographic footprint, and risk profile.