From PSD2 to PSD3 and the PSR.

The political agreement dates from 27 November 2025. On 23 April 2026 the Council published the final compromise texts, and on 5 May 2026 the European Parliament’s ECON committee approved the negotiated text; on 18 May 2026 the committee chair confirmed that Parliament will adopt the text at second reading without amendment once the Council formally adopts its position. The substance is therefore settled; what remains is formal adoption, signature and publication in the Official Journal. As at 7 October 2026 PSD3 and the PSR had not yet been published; publication is still expected in the second half of 2026, but no date is known. The EBA lists preparation for the new payment services framework as a priority in its 2027 work programme. For firms, 2026 is the year of impact analysis and planning, with implementation in 2027 and 2028.

PSD3 is a directive, the PSR is a regulation. That difference shapes how the rules work in practice. PSD3 covers licensing, prudential matters and supervision of payment institutions and EMIs — areas where national supervisors retain discretion, so the rules are transposed into national legislation (such as the Dutch Wft). The PSR covers conduct rules: transparency, user rights, liability, strong customer authentication, open banking and operational requirements. As a regulation the PSR applies directly in all Member States without national implementation. The effect is far-reaching harmonisation of conduct rules and the end of divergent national interpretations that drove forum shopping under PSD2.

In its evaluation of PSD2 the European Commission found that the directive’s goals — open banking, fraud prevention and market integration — were insufficiently achieved. Open banking worked poorly due to inconsistent APIs and legal obstacles, fraud kept rising despite SCA, and national variation in implementation led to forum shopping. Separately, EMIs under a stand-alone directive (EMD2) had become outdated as payment services and e-money converged. The reform bundles conduct rules into a single directly applicable regulation, folds EMIs into the payment institutions regime, tightens fraud prevention and strengthens the position of consumers and non-bank players.

Licensing requirements are tightened and harmonised. PSD3 raises the bar on governance, outsourcing policy, sound business operations and recovery planning. Prudential requirements — capital, liquidity, safeguarding — are clarified and in some cases increased. A notable change is the amendment of the Settlement Finality Directive: payment institutions gain the right to direct participation in designated payment systems, a break from current dependence on banks. On the other hand many conduct obligations shift to the PSR, so the operational compliance architecture of payment institutions changes substantially. The licence itself must be reassessed within 27 months of PSD3’s entry into force.

PSD3 repeals the second e-money directive (EMD2) and folds EMIs into the payment institutions regime as a sub-category. That means one shared licensing, governance and supervision framework. For existing EMIs there are two consequences. Substantive: requirements for issuance of e-money, redemption and safeguarding remain, but are now placed within the PSD3 framework and supplemented with the general payment institution obligations. Procedural: existing EMI licences must be re-applied under PSD3 within the 27-month grandfathering period. The distinction between “payment institution” and “EMI” stays relevant for operations, but disappears as a separate licence type.

Account information service providers (AISPs) and payment initiation service providers (PISPs) gain a stronger position under PSD3/PSR. Account-servicing payment service providers — usually banks — are required to maintain a dedicated, secured API for access to account information, with stricter quality requirements on availability and performance. The fallback mechanisms that drove legal disputes under PSD2 largely disappear. There will also be mandatory permission dashboards allowing consumers to monitor and withdraw their consents. For AISPs and PISPs this means better access to high-quality interfaces, but also new obligations on consent transparency, data use and alignment with standardised governance mechanisms.

Yes, provided it is re-applied in time. PSD3 includes a grandfathering regime: existing payment institutions and EMIs may continue operating under their current licence for up to 27 months after PSD3’s entry into force, on condition that within that period they submit the information that allows the supervisor to assess whether the institution meets the PSD3 requirements. If the institution shows compliance it is deemed authorised under PSD3. If it does not, or not in time, the licence lapses at the end of the transition. So this is not an automatic conversion but an active re-application process.

Three workstreams run in parallel. One: a gap analysis on the licence dossier — which parts of the existing file meet PSD3 requirements, which need to be supplemented or updated. Two: adjustment of governance, policy and procedures to the new requirements on sound business operations, outsourcing, safeguarding and recovery planning. Three: timely submission of the re-application to the supervisor — DNB for Dutch payment institutions — within the 27-month grandfathering period. The practical pitfall is underestimating timelines: a dossier that needs to be ready in 2027 requires preparation starting in 2026.

Foreign fintechs: if you hold a licence elsewhere in the EU or outside it and want to operate from the Netherlands, see how a Dutch PSP or EMI licence works for foreign fintechs.

Verification of payee requires the payer’s PSP to check, before executing a credit transfer, whether the payee’s name matches the supplied unique identifier (typically the IBAN). On mismatch the PSP must inform the payer within seconds of the discrepancy and its degree. Under the Instant Payments Regulation this duty already applies to instant credit transfers. The PSR extends it to all credit transfers not already covered by the Instant Payments Regulation. Important for planning: this specific obligation has a different application date — 27 months after entry into force of the PSR, instead of direct application.

The liability split shifts materially in favour of consumers. For impersonation fraud — where the fraudster pretends to be the PSP itself — the PSP must refund the consumer, provided certain conditions are met. Where fraud monitoring fails or verification of payee is not correctly performed, losses fall on the PSP. Liability also extends to online platforms in specific situations, particularly where they do not remove fraudulent content after notification. The PSR also introduces a collaborative fraud data platform between PSPs, with data retention up to five years after an incident and strict privacy safeguards.

SCA remains the foundation, but is refined. The PSR clarifies when SCA must be applied, with sharper rules on merchant-initiated transactions and delegated authentication. New accessibility requirements oblige SCA methods to be offered free of charge, not exclusively via smartphone, and adapted to vulnerable users — an important point for groups without smartphones or with digital impairments. For PSPs this means a review of existing authentication processes and possibly additional channels or fallback methods. The exemption regime from the PSD2 RTS is updated; final technical standards follow after publication of the PSR.

Open banking is strengthened on four points. Mandatory dedicated interface: account-servicing PSPs must maintain a specific secured API for AISP and PISP access, with stricter quality and availability requirements. Permission dashboards: consumers have a right to a dashboard where they can monitor, withdraw and reinstate data accesses. Anti-discrimination: account-servicing PSPs may not disadvantage authorised open banking providers in access conditions. Alignment with FIDA: the broader Financial Data Access framework later extends the regime to other financial data beyond payment accounts. For banks this means substantial investment in API governance; for open banking providers, improved access and legal certainty.

The PSR introduces real-time transaction monitoring as a core obligation, explicitly for instant credit transfers. PSPs must take technical and organisational measures to detect and interrupt anomalous transaction patterns before harm materialises. Banks may temporarily delay or block suspect instant payments — a notable evolution in real-time payments. A collaborative fraud data platform is also introduced where PSPs share fraud signals, with privacy impact assessments and a retention period of up to five years after an incident. Failing monitoring leads to liability: the absence of adequate controls is directly linked to refund obligations toward victims.

That depends on the component. The PSR enters into force 20 days after publication in the Official Journal, but only becomes applicable 21 months after that entry into force — with publication in the second half of 2026, that means in the course of 2028. Verification of payee (Articles 50 and 57 PSR) has an extended deadline of 27 months. PSD3 must be transposed nationally within 21 months, and grandfathering of existing PI and EMI licences runs for up to 27 months from PSD3 entering into force. In practice: 2026 is impact analysis and planning, 2027 implementation, 2028 operational compliance across the board.

With the final compromise texts of 23 April 2026 the content of PSD3 and the PSR is stable enough for planning purposes. Waiting for the Official Journal costs at least two quarters that are better spent on preparation. A workable four-step approach: a gap analysis between the current licence dossier and PSD3 requirements to identify the heaviest gaps early, an impact assessment of the PSR conduct obligations across all customer-facing processes, prioritisation based on implementation lead time — IT and API work first, policy adjustments after — and an implementation plan that takes 2027 as the operational target year. This prevents 2026 being lost to waiting.