PSD2 for payment service providers.
PSD2 (Directive (EU) 2015/2366) is the current European payment services framework, implemented in the Netherlands in the Wft (Dutch Financial Supervision Act). It determines who needs a licence as a payment or e-money institution, and contains exemptions whose scope — ’the perimeter’ — is often debated. PSD2 is being succeeded by PSD3 and the PSR.
Status · last updated 7 October 2026.
What we do for you.
Three ways we help you with PSD2.
Whether your service falls under PSD2, which exemption applies and what that means for the DNB licence or registration.
File, safeguarding, SCA, incident reporting and DNB returns — from application to ongoing supervision.
FX, crypto services, credit and agents alongside payment services: what is allowed, what must be notified and where MiFID II or MiCAR comes in.
Frequently asked questions.
What is PSD2?
PSD2 is the EU directive regulating payment services: licensing for payment and e-money institutions, strong customer authentication (SCA) and third-party access (AIS/PIS). Implemented in the Netherlands in the Wft.
When do I fall under PSD2?
As soon as you provide payment services commercially — transferring funds, offering payment accounts, initiating payments or accessing account information. Whether an activity falls in scope depends on the perimeter and the exemptions (such as the commercial-agent and limited-network exemptions).
What is happening around the PSD2 perimeter and ancillary activities?
In BGN v DNB (C-51/25) the advocate general clarifies when escrow and intermediary fund-holding fall outside PSD2. This directly affects payment institutions, EMIs and guarantee or escrow structures.
What is the difference between a payment institution and an e-money institution?
An e-money institution (EMI) may additionally issue electronic money; both hold a DNB licence with their own prudential requirements.
What changes with PSD3 and the PSR?
PSD3 (directive) and the PSR (regulation) replace PSD2. See the PSD3 & PSR pillar for the timeline and the consequences for your licence.
Which payment services require a licence under PSD2?
Annex I to PSD2 lists eight payment services, including executing payment transactions, issuing payment instruments, acquiring, money remittance, payment initiation services (service 7) and account information services (service 8). Anyone providing one or more of these services commercially in the Netherlands in principle needs a DNB licence as a payment institution — or a registration as an AISP for service 8 only.
What is the difference between an AISP and a PISP?
An AISP (account information service provider) reads account data with the user’s consent and only needs a DNB registration; a PISP (payment initiation service provider) initiates payments from the user’s account and needs a full licence. The distinction carries through to capital requirements, insurance obligations and — from 10 July 2027 — the AMLR: AISPs fall outside it, PISPs within.
What does safeguarding of client funds involve?
Payment institutions and EMIs must safeguard users’ funds: segregated from own funds, via a separate account (in the Netherlands typically a foundation for third-party funds) or via a guarantee or insurance. DNB scrutinises the robustness of the arrangement — including in exit scenarios, where repayment down to the last euro is a condition for surrendering the licence.
What is strong customer authentication (SCA)?
SCA requires authentication with at least two of three factors (knowledge, possession, inherence) when accessing the account online, initiating electronic payments and performing actions with fraud risk. The technical detail sits in the RTS under PSD2, including exhaustive exemptions such as low-value contactless and trusted beneficiaries.
May a payment institution offer FX services under its PSD2 licence?
Yes, as an operational and closely related ancillary service to payment execution (Article 18(1)(a) PSD2). According to the AG opinion in Iulicris v Ibanfirst (C-339/25) this extends to flexible FX forwards, without a separate MiFID II licence; the judgment is expected in Q3 or Q4 of 2026. See our article on this via the MiFID II knowledge pillar.
Which outsourcing rules apply alongside DORA?
For non-ICT outsourcing the EBA published new guidelines on the management of third-party risk on 18 September 2026 (EBA/GL/2026/09), addressed to payment institutions and e-money institutions among others. They replace the 2019 outsourcing guidelines once they apply and give two years to review existing critical or important arrangements. For ICT services DORA remains the lead framework.