Beyond compliance: the strategic impact of PSD3 and PSR

Scott McInnes from Bird & Bird explores the commercial and operational implications of PSD3 and PSR, from Open Banking to fraud prevention.

You’ve followed this legislation from the June 2023 drafts through three years of trilogues. Do you see PSD3/PSR as evolutionary or revolutionary?

At Bird & Bird, we have indeed followed the package throughout the legislative process and have seen the many changes that happened between the 2023 Commission drafts and the versions of the texts that are about to be adopted by the EU legislator. 

PSD2 was considered revolutionary in particular because it introduced open banking and strong customer authentication (SCA).

By contrast, PSD3 and PSR are often described as an evolution, rather than a revolution, because they do not fundamentally redesign the payments landscape. Their main purpose is to address the weaknesses identified under PSD2 and make the framework work more effectively; in other words, to deliver more fully on PSD2’s original promises. Open banking is a good example: the new rules seek to improve the quality and reliability of interfaces for access to payment accounts, remove obstacles to that access, clarify authentication responsibilities, give users greater visibility and control over the permissions they have granted through so-called “permission dashboards”, etc. The package also brings into the legislative text a number of requirements that previously appeared only in level-2 measures or in non-binding EC and EBA guidance (e.g. EBA opinions, EC and EBA Q&As).

That does not mean the changes are insignificant. Most conduct-of-business rules will now be set out in a directly applicable EU regulation (PSR). Fraud-prevention obligations will become more prescriptive, including through data-sharing arrangements not only between PSPs, but also between PSPS and non-PSPs (e.g. telecom service providers and large online platforms). Liability will also be more closely linked to compliance with preventive obligations, including through new responsibilities for certain actors outside the traditional payments chain.

The Commission said Open Banking under PSD2 didn’t work. What actually failed: technology, enforcement, or the commercial model? Which of these does PSR address, and which does it not?

All three elements probably contributed to the apparent disappointment with the level of adoption of Open Banking under PSD2.

First, there are technological issues. While PSD2 created a right of access for TPPs, the interfaces exposed by the entities that maintain payment accounts (e.g. banks) were sometimes unreliable, the data available to TPPs was sometimes incomplete, authentication journeys were sometimes overly cumbersome, implementation differed significantly between institutions and across EU Member States, etc.

Second, enforcement was difficult and therefore sometimes didn’t happen, or at least was slow. For example, the prohibition on “obstacles” was difficult to enforce consistently by national regulators.

Third, there was an incentives problem. Institutions that maintain payment accounts (e.g. banks) were required to build an infrastructure largely for the benefit of potential competitors (i.e. TPPs), without being able to charge TPPs for that access. This naturally encouraged minimum compliance, rather than the creation of premium-quality infrastructure.

The PSR seeks to address the first two items more directly (i.e. technology and enforcement). It strengthens interface and performance requirements, identifies prohibited obstacles, reinforces non-discrimination, requires permission dashboards through which users can monitor and withdraw third-party access, etc. The political agreement explicitly seeks to reduce barriers affecting open banking providers. The PSR also introduces a much more detailed and harmonised enforcement framework for national competent authorities. For example, broad investigatory and inspection powers, cooperation and information-sharing between authorities, minimum sanctions for certain infringements (e.g. fines, public statements, cease-and-desist orders, periodic penalty payments).

The third issue above (i.e. the commercial model) is a different matter. Like PSD2, under PSD3 and PSR institutions that maintain payment accounts will not be allowed to charge a fee to TPPs for statutory access to payment accounts. That’s obviously good news for TPPs. However, free-of-charge access to payment accounts does not in itself create a profitable service for TPPs. Basic aggregation has become commoditised, while payment initiation must compete with cards, wallets and other instant payment solutions that consumers already know and trust. The PSR may improve the underlying infrastructure, but it cannot create customer demand, sustainable pricing or compelling use cases. The longer-term commercial opportunity is more likely to depend on value-added services and commercial access arrangements that go beyond the statutory minimum and therefore for which TPPs may have to pay fees to institutions that maintain payment accounts?

Where does strong customer authentication create the most friction for PSPs today, and how is the balance between security and accessibility expected to shift under the new framework?

SCA is a high EU-level security standard introduced by PSD2. SCA is required when a user accesses a payment account online, initiates an electronic payment, or carries out, through a remote channel, an action that may involve a risk of payment fraud or other abuse.

The most significant friction arises when SCA is required when the payer seeks to perform a payment, especially in an ecommerce environment. SCA necessarily requires the payer’s involvement and, if the process is too cumbersome, may result in payment failure or customer abandonment. That friction can be significant for PISPs in particular: when a payment is initiated through a PISP, the institution that maintains the payment account (e.g. a bank) remains in charge of SCA (not the PISP). The payer is typically required to move from the PISP’s environment to e.g. the bank’s environment to authenticate, and then return to the PISP’s domain. Redirects, technical hand-offs and differences between e.g. banks’ authentication methods can make the PIS journey less seamless. So, the challenge is to strike the right balance between maintaining a high level of security and providing a sufficiently smooth payment experience. That was already the objective under PSD2, essentially through exemptions from SCA, as well as guidance issued by the EBA.

PSD3 and PSR will now seek to make the framework clearer and more proportionate. It seeks to provide greater legal certainty regarding transactions that fall outside the scope of the SCA requirements, including merchant-initiated transactions (MITs), mail-order or telephone-order (MOTO) transactions, etc. It will also introduce a specific exclusion for certain payee-requested recurring credit transfers, including variable recurring payments. Further exemptions, and the conditions governing them, will be developed by the EBA through level-2 measures.

Additionally, where SCA is applied, PSD3 and PSR will now allow the payer’s PSP to use two inherent factors (e.g. facial recognition and fingerprint), which is not currently allowed under PSD2. This could materially reduce friction by allowing PSPs to design authentication journeys around technologies that customers already use.

The user experience will also improve where payment account information is accessed through an AISP. Under PSD2 and as already mentioned above, the institution that maintains the payment account (e.g. a bank) is in charge of SCA – but, subject to certain conditions being met, is only allowed to apply SCA every 180 days. Under PSD3 and PSR, the approach will change: following the initial access by an AISP for which SCA will remain the responsibility of e.g. the bank, the AISP will be responsible for applying SCA every 180 days. This is an important shift and should allow AISPs to manage their customer relationship and authentication journey more effectively, while reducing unnecessary dependence on e.g. banks’ interfaces.

Fraud in payments is increasingly cross-industry, including telecom scams and social engineering. How should PSPs think about fraud prevention beyond their own systems?

Fraud prevention can no longer be viewed solely as the responsibility of PSPs. Other actors involved in the fraud chain (e.g. telecom operators, online platforms) must also address the risks arising within their own sphere of activity. Many scams originate outside the payment ecosystem, e.g. via social media platforms. By the time the payment order reaches the PSP, the user may already have been manipulated over several days or weeks, and may appear to be giving a technically valid and properly authenticated instruction. That is why SCA alone cannot prevent authorised push-payment fraud. In many cases, the fraudster does not circumvent authentication at all; instead, the user is willing to authenticate the payment.

PSD3 and PSR recognise this broader ecosystem problem. The burden of prevention cannot fall exclusively on PSPs; each participant in the fraud chain must be expected to take proportionate measures within its own area of control. For PSPs, this means adopting layered controls combining transaction monitoring, behavioural analysis, verification of payee, targeted warnings, effective intervention procedures and fraud-information sharing. The new legal framework moves in this direction by strengthening preventive obligations and facilitating the exchange of fraud-related information between PSPs.

However, effective prevention also requires cooperation with non-PSPs (e.g. telecom operators, online platforms, law-enforcement authorities). Each participant sees a different part of the fraud chain: for example, a telecom operator may detect spoofed calls, an online platform may identify fraudulent advertisements, while a PSP may observe an unusual transfer to a newly added beneficiary. The key point is that fraud must be treated as an ecosystem risk. PSPs remain central to prevention, but they cannot be expected to solve, on their own, fraud that often originates and develops outside the payment system

What’s your realistic view on the legislative timeline? What should organisations be doing now, and what’s the most common mistake in how they interpret the direction of these rules?

The package is close to adoption. The European Parliament and Council reached a provisional political agreement on 27 November 2025, and the ECON Committee approved the agreed texts on 5 May 2026. Formal adoption is expected later in 2026 (although the latest I heard was perhaps not before December 2026?).

Of course, it doesn’t mean that the new rules will apply at that time. Following legal-linguistic review and publication in the Official Journal of the EU, the PSR will essentially apply after 21 months, while Member States will have the same period of time to transpose PSD3 into their national laws.

A lot of firms have already started their preparations. Regulated PSPs should perform a gap analysis, map the new fraud and liability rules, identify system and contractual changes, and assess transitional or PSD3 re-authorisation requirements. The new legal framework may also create opportunities to launch new services, and this may impact business models.

A common mistake is to treat PSD3/PSR as a mere “legal update”. In reality, they affect product design, technology, fraud operations, customer journeys, contracts and governance.

Which provision in PSD3/PSR is most likely being underestimated or misunderstood today, and later becomes a problem for firms that ignored it?

Firms may underestimate the interaction between fraud prevention, reimbursement and ultimate liability. The focus is often on the headline question of when the payer must be refunded. The more difficult questions are whether the PSP can demonstrate that it applied the required preventive controls, acted on relevant fraud indicators and provided effective warnings and, ultimately, which actor should bear the loss. Under PSD3/PSR, liability may extend across several participants: once the payer’s PSP has reimbursed the user, the dispute may shift to the allocation of liability between PSPs or, in some cases, between PSPs and non-PSPs such as, e.g. online platforms.

Controls that were previously treated primarily as matters of fraud policy will therefore have direct regulatory and financial consequences. Firms that wait for the first reimbursement dispute to test those controls may discover that the decisive issue is not simply whether the payment was authenticated, but whether the overall fraud-prevention framework was properly designed and operated.

About the interviewee

Scott McInnes is a partner in the Brussels office of Bird & Bird. With more than 15 years' experience of competition law and regulation, he has considerable expertise in payments regulation and competition law across Europe. He advises payment schemes, payments services providers, processors, merchants, as well as other stakeholders in the payments value chain. He advises on payments regulation such as PSD2, the EU Interchange Fee Regulation, the EU Cross-Border Regulation, the EU SEPA Regulation, etc. He also advises on AML regulations, outsourcing regulations, banking secrecy rules and other financial services regulations.

About the organisation

Bird & Bird is a truly international law firm with a full-service offering and extensive sector-focused expertise. The firm is recognised for its depth of expertise in complex, regulated and technology-driven markets. With more than 1,600 lawyers and legal practitioners across a worldwide network of 33 offices, Bird & Bird delivers expertise across a full range of legal services. Its sector-focused approach means it brings tailored, industry-specific knowledge to clients across a broad range of markets, including automotive, aviation and defence, energy and utilities, financial services, life sciences and healthcare, retail and consumer, media, entertainment and sport, and tech and comms. The firm has long-established experience advising all types of financial services organisations, including banks, insurers, funds and payment services providers, across the full range of financial regulation and compliance matters. This depth of expertise combined with the firm's international span makes Bird & Bird a leading adviser on FinTech and innovative payment services,  including as a trusted adviser on payment services law, PSD2, and the evolving PSD3/PSR framework.