A guide to PSD3 compliance: what businesses need to know

It might sound like the third instalment of a popular movie series. But, the 3rd Payment Services Directive (PSD3) is the latest EU regulation to modernise and streamline electronic payments by building on the foundation originally laid down by PSD2.

PSD3 is going to mandate some key changes in the European payments industry, particularly in open banking over the next three years. In this blog, we'll look at how they are going to impact your business operations.

What are the Payment Services Directive 3 (PSD3) and the Payment Services Regulation (PSR)?

The evolution of the 2nd Payments Directive, or PSD2, has resulted in two components: PSD3 and the PSR. Whilst actual enforcement of PSD3/PSR is not expected to take effect before 2027, there are steps that you should take now to prepare.

But firstly, what are PSD3 and the PSR?

PSD3

Introduced in June 2023, PSD3 is an EU directive that applies to banks and Payment Service Providers (PSPs), including electronic money institutions (EMIs), payment institutions (PIs), and payment initiation service providers (PISPs), operating within the EU and EEA. Additionally, non-bank PSPs will also be required to comply with the directive, as it aims to improve their access to payment systems and bank accounts.

The directive also includes third-party service providers under its scope, emphasizing their role in combating payment fraud and enhancing access to innovative financial services. This inclusion under PSD3 seeks to foster competition by allowing these non-bank entities equal access to payment systems.

It is aimed at improving consumer protection, boosting market competition, and strengthening payment security within the EU. This will be achieved by improving open banking accessibility and adoption, clarifying rules for PSPs, and increasing transparency in cross-border payments and financial data access.

PSR

In the context of PSD3, the PSR is separate but closely aligned payment services regulation that sets out the specific rules and standards for how PSPs must operate within the EU.

The PSR empowers them to share fraud-related information, improve competition between banks and non-banks, and facilitate more innovative financial services through open banking, ultimately enhancing consumer protection and user experience.

Its key objective is to enhance consumer protection regarding payments, data and security, combat fraud and promote open banking by further closing the gap between traditional banks and non-bank PSPs.

PSD3 vs PSR

PSD3 is a directive focused on licensing and supervision, meaning it must be enacted within each EU member state’s local law before it can be enforced.

In contrast, the PSR introduces the requirements for security, Strong Customer Authentication (SCA), and PSP responsibilities. It doesn’t need to be enacted within local law.

Additionally, PSD3 and PSR address open banking services differently, with PSD3 facilitating secure financial data sharing between banks and payment service providers, thereby increasing electronic payment options and addressing new types of fraud.

Whilst both PSD3/PSR apply in Europe, it is also important for informing future U.S. regulatory approaches.

What is PSD3 and why is it needed?

The Payment Services Directive 3 (PSD3) is a regulatory framework aimed at enhancing the security, efficiency, and innovation of payment services within the European Economic Area (EEA). PSD3 is needed to address the evolving needs of the payment industry, including the rise of new payment technologies and increased competition. It also ensures ongoing consumer protection and data security to help build confidence in new payment services.

The European Commission proposed PSD3 in June 2023 to update the existing Payment Services Directive (PSD2) and introduce a new Payment Services Regulation (PSR). PSD3 aims to create a more integrated, efficient, and secure payments ecosystem, promoting financial inclusion, competition, innovation, and stability.

What is the difference between PSD2 and PSD3?

PSD2 came into force on January 13, 2028, and set out requirements for PSPs. It was an update to the original Payment Services Directive (PSD), which was adopted in 2007.

It revolutionized the financial services industry facilitating innovation and increasing efficiency in payment processing. PSD2 directly addressed the explosive growth of fintechs, in answer to the monopoly of legacy banking institutions.

PSD2 mandated that banks must allow access to customer data via APIs (Application Programming Interfaces) when requested by Third Party Providers (TPPs) following the customer's consent.

PSD2 also introduced opening banking to the EU and established Strong Customer Authentication to beef up security measures for electronic payments.

However, with the rapid evolution of payments, particularly during the COVID-19 pandemic, areas for the improvement and expansion of PSD2 became apparent to achieve a level playing field for PSPs.

Welcome PSD3! The primary goal of PSD3 is to clear up any inconsistencies and remove boundaries to avoid silos. Whilst it follows the themes of the previous directives it goes much further to implement SCA rules, open banking integration and enhanced security measures.

What are the key changes from PSD2 to PSD3?

So, what are the most important changes you can expect from the new directive?

1. Greater consumer protection

Many people believe that customer adoption of open banking has been impeded due to a lack of trust and insufficient consumer protections. Consumers are demanding more control and transparency of their data.

According to research by American Express, 41% of UK consumers would use Pay with Bank Transfer payments if they believed they were more secure. You can read more about this in our white paper, Reaching the tipping point. How to realize the potential of Open Banking payments.

Therefore, PSD3 will place an even stronger emphasis on protecting consumer rights and personal information, to help improve trust in online payments and, in turn, encourage the open banking adoption rate to flourish.

2. Wider reaching SCA rules

The European Commission’s evaluation of PSD2 confirmed that SCA has been effective in reducing fraud. Consequently, PSD3/PSR aims to strengthen and refine SCA in the following ways:

By clarifying essential definitions.

Outlining further exemptions for lower-risk transactions.

Sustaining the balance between security and the adoption of user-friendly, innovative, and accessible payment solutions.

PSD3 also expands SCA regulations to bolster the security of payment transactions and enforces stricter requirements on access to payment systems account data, thus enhancing protective measures. The introduction of the PSR is likewise intended to directly improve consumer protection.

However, if not managed prudently, these measures could undermine conversion rates. Businesses should work closely with their payment provider to ensure authentication is performed only when necessary while maximizing the overall user experience.

There is still active debate regarding the application of SCA to refunds. One perspective is that merchant-initiated refunds represent distinct payment transactions in which the merchant is the payer, therefore necessitating SCA.

From the merchant’s standpoint, however, this may simply add unwelcome friction to an already slow payout process, potentially jeopardizing customer satisfaction.

3. Improved APIs & experiences

The proposed changes show that the European Commission understands the practical challenges that open banking is facing, and how to solve them.  

PSD3 focuses on further levelling the playing field by improving APIs and setting out minimum open banking functionality requirements. This aspect of PSD3 is focused on consumers: it improves the customer experience and encourages adoption of bank transfers and real-time payments.

Ultimately, this encourages real-time payments to become a credible alternative to the card schemes.

Earlier in 2024, the European Council adopted a regulation that will make instant payments fully available in euros for consumers and businesses in the EU and EEA countries.

The instant payments regulation will allow people to transfer money within ten seconds at any time of day, including outside business hours. This will not only transfer within the same country, but also to another EU member state.  

4. Enhanced inclusivity

Finally, PSD3 aims to be more inclusive, considering authentication methods for the elderly, those living with disabilities, and individuals lacking digital skills. The directive requires PSPs to create access for these demographics, ensuring universal SCA methods.  

At its core, this largely means providing authentication methods that don’t rely solely on smartphones.  

What is the implementation timeline for PSD3?

Expectations are that the formal adoption of this new directive will take place in the first half of 2025.

After this, there is anticipated to be an 18-month transition period for member states, suggesting potential implementation of PSD3 in or around 2027.  

How will PSD3 impact merchants?

After a huge spike in electronic payments and the market entry of new open banking service providers, PSD2 was seen as an important addition to EU payment services. Now, PSD3 aims to create a level playing field between existing and new providers in card, internet, and mobile payments.

PSD3 also addresses the evolution of banking services, emphasizing the need for compliance with security measures to mitigate fraud risks associated with third-party providers.

PSD3 is aimed at consumers - it aims to protect consumers’ rights and personal information. Whilst merchants are concerned about sacrificing experience for authentication, it doesn’t necessarily mean the knock-on effects will come at the cost of profitability for businesses.

Either way, the implementation requirements and impact of PSD3 will be felt by online merchants and other key players in the industry.

Reduced fraud, but potentially more false declines

The EU PSR introduces a set of measures designed to prevent or reduce payment fraud, including verification of payee details for credit transfers. Where the relevant details do not match, the payer’s PSP must notify the payer of such discrepancy before finalizing the payment.

Meanwhile, businesses will need to share more data with issuers, allowing them to monitor environmental and behavioral characteristics. These could include user location, transaction time, devices used, spending habits, transaction history, session data, and device IP. As a result, they can increase approval rates by better determining which transactions to approve and which to decline.

While merchants should benefit from these changes, many are likely to also experience more false declines if not carefully managed. Merchants often classify false declines as an inherent cost of fraud prevention, which generally stands as their primary concern. However, applying some subtle payment optimization rules should help offset the impact.

While fraud prevention is important from both cost and reputational perspectives, our latest research shows that merchants may be overvaluing it compared to dollars lost to false declines.

To maximize profitability, merchants could make payment optimization decisions based on the contribution margin (that is, the revenue remaining after subtracting the variable costs that go into producing a product) of the incremental sales that are likely to result.

Read more about payment optimization in our whitepaper, Accelerating Revenue Growth.

More seamless recurring payments & subscriptions

Whilst PSD3 largely sees the addition of more rigorous SCA, there are some exemptions which can benefit certain businesses. Merchant-initiated transactions (MIT), such as subscriptions, are now excluded from SCA. Only the first transaction requires SCA.

At the same time, card-based mail orders and telephone orders (MOTO transactions) no longer require authentication via SCA. This exemption will greatly benefit merchants in sectors such as the travel industry.

Promoting choice & fairer pricing

PSD3 is expected to inspire innovation in the payments industry. This could lead to the development of new payment services and business models, which could benefit merchants by increasing competition and providing more payment options.

More choice means merchants can look forward to greater competition when it comes to fees and pricing models available.

A SCA liability shift to increase cooperation

Ultimately, the SCA changes will contribute to safer buying experiences and data-sharing enhancements for better transaction monitoring.

There is a liability shift in fraud cases which emphasizes accountability; the new proposals also suggest that the schemes, technical service providers (such as wallet providers), and payment gateways will be liable for fraud if they fail to apply SCA. This is to ensure increased cooperation among all players involved in performing SCA.

The new SCA rules are likely to improve the experience of customers at the point of payment. They give more clarity to financial institutions, card networks, and payment providers to apply SCA exemptions for transactions with lower risk, or recurring transactions.

Penalties for non-compliance with PSD3

Non-compliance with PSD3 can result in significant penalties, including fines and potential license removal.

Institutions and service providers that fail to comply with PSD3 requirements may face reputational damage, loss of customer trust, and financial losses.

The European Banking Authority (EBA) and national competent authorities will monitor compliance with PSD3 and enforce penalties for non-compliance.

PSPs must take PSD3 compliance seriously, investing in the necessary resources and expertise to ensure they meet the new regulatory requirements.

Failure to comply with PSD3 can have severe consequences, making it essential for PSPs to prioritize compliance and risk management.

Overcoming merchants’ concerns about PSD3

Merchants’ primary concern around PSD3 is that it could have an impact on their customer relationships. If the new security measures are too complicated, it could lead to frustration and dissatisfaction among customers, resulting in reduced conversions and revenue.

Merchants are also considering the potential cost of implementing the changes; PSD2 compliance was expensive for merchants to roll out due to the heavy SCA requirements. It is unclear whether the new security measures under PSD3 will be any more cost-effective.

Payment services providers (PSPs) play a crucial role in this context, as they are responsible for advancing consumer protection, improving competition, and enhancing the security of electronic payments.

The new rules aim to update financial services to the latest developments in digital age, address fraud, and ensure a level playing field for both bank and non-bank PSPs in the evolving financial landscape.

However, it is worth noting again, that PSD3 is widely about enforcing PSD2 regulations more uniformly across member states, so will be a smaller step change rather than PSD2.

How Nuvei can help

Importantly, PSD3 is expected to reinforce consumer rights and protection. This could involve clearer terms and conditions, better dispute resolution mechanisms, and increased transparency in payment services. Naturally, there will be a knock-on effect on merchants and payment service providers, but with the right partnerships and preparation in place, the impact will be minimal.

Successfully navigating these challenges, therefore, requires a partnership or defined strategy, operational changes, risk assessment, and meticulous execution.

Ultimately, merchants want to increase conversions while minimizing the risk of fraud. Working closely with their payment service providers will be critical throughout the rollout.

The Nuvei Payments Optimization suite, for example, applies functionality and features at every stage; pre-transaction, during transaction routing, and post-transaction to achieve the highest approval rates possible.  

Importantly, PSD3 is expected to reinforce consumer rights, protection and ultimately their confidence in modern financial services. This could involve clearer terms and conditions, better dispute resolution mechanisms, and increased transparency in payment services.

Naturally, there will be a knock-on effect on merchants and payment service providers, but with the right partnerships and preparation in place, the impact will be minimal.

At Nuvei, we're committed to guiding our merchants through these transformative changes. Our experts are on hand to discuss regulatory updates and ensure a seamless transition. We will support merchants as they navigate key aspects of PSD3 like Strong Customer Authentication (SCA), data sharing, and instant transfers.

Nuvei and rank case study: optimization during PSD2

Rank has been entertaining the British public since 1937 and now serves over 2.7 million customers per year. Rank Interactive, its digital channel, offers online bingo, casino, slot gaming, poker and sportsbooks.  

The implementation of PDS2 legislation posed a significant challenge to both operators and customers within the iGaming sector due to new authentication requirements.

Throughout the implementation of PSD2, Nuvei worked closely with Rank to optimize payment performance and qualify large volumes of low-risk transactions for frictionless flow. At the same time, we helped Rank manage high-risk deposits with authentication step-ups, delivering a single view of data across markets.

Payment friction was mitigated while customer experience, deposit values and revenues were protected. Rank was pleased to see steady approval rates after PSD2 was implemented.  

In the last four years alone, Rank transaction volumes have seen an average 17% year-on-year growth, despite the major regulatory change posed by PSD2. Read the full case study.

What should merchants do next?

Merchants must stay informed about PSD3 and PSR developments to prepare for compliance requirements, payment processes, and consumer rights.  

As a human-led payment provider, Nuvei has dedicated teams and real experts supporting your shift to PSD3.  We are committed to navigating the evolving regulatory landscape of PSD3 and PSR, ensuring compliance and optimal service for our partners and merchants.

We actively collaborate with regulators and card schemes for PSD3 readiness. If merchants have any questions or concerns, we have experts ready to help. Existing customers should contact their relationship managers.