PSD2 (the Revised Payment Services Directive) is the EU rulebook that modernised payments across Europe. It made online payments more secure, opened up bank data (with consent) to regulated third parties, and accelerated open banking. In practice, PSD2 created two big shifts:
- Strong Customer Authentication (SCA) for safer online payments, and
- Access to account (XS2A) so licensed third-party providers can build new payment and money-management services.
Key Objectives of PSD2
- Security: Reduce fraud in online payments through SCA (two-factor/multi-factor authentication).
- Competition & innovation: Let regulated third parties build services on top of bank infrastructure (open banking).
- Consumer protection: Clearer rights around refunds, transparency and complaints.
- Market integration: Harmonised standards across the EU/EEA for cross-border payments.
According to the European Commission’s official PSD2 Q&A, the directive aims to strengthen security and open competition in Europe’s payments market.
Strong Customer Authentication (SCA)
SCA requires at least two of the following:
- Knowledge (something you know): password/PIN
- Possession (something you have): phone/device/token
- Inherence (something you are): fingerprint/biometrics
SCA applies to most electronic payments, with specific exemptions (e.g., certain low-value transactions, trusted beneficiaries, corporate setups).
Open Banking: AISPs and PISPs
PSD2 introduced two regulated roles:
- AISPs (Account Information Service Providers): consolidate balances, categorise spending, provide insights and verification based on bank account data with user consent.
- PISPs (Payment Initiation Service Providers): initiate payments directly from a bank account (e.g., SEPA Credit Transfers), offering a card-alternative at checkout.
What PSD2 Changed for Banks, Fintechs, and Merchants
- Banks had to expose secure APIs and support common/secure communication standards.
- Fintechs gained a clear regulatory path to launch services across the EU/EEA.
- Merchants benefited from more payment options, a surcharge ban on consumer card payments, and potentially lower costs via account-to-account payments.
PSD1 vs PSD2 (Quick View)
- PSD1 (2007–2009) built the single market foundations for payments in the EU.
- PSD2 (2016–2019+) added SCA, formalised open banking, clarified liability and refunds, and banned consumer card surcharges—bringing stronger security and more choice.
What’s Next: PSD3 and the Payment Services Regulation (PSR)
The European Commission has proposed PSD3 (an updated directive) and a Payment Services Regulation (PSR) to further strengthen fraud prevention, clarify data access, and tighten supervision. For businesses and providers, that means continuing to align with evolving authentication, API, and reporting standards.
Related Reading (Regulations Cluster)
- MiCA: EU Crypto Rules (2025 Guide) – what changes for exchanges, investors, and users:
https://fintechobserve.com/mica-eu-crypto-regulation-guide/ - Digital Euro Explained (2025) – timeline, use cases, and privacy:
https://fintechobserve.com/digital-euro-explained-2025/ - ECB Digital Euro: Next Phase & 2027 Pilot – status and what to expect:
https://fintechobserve.com/ecb-digital-euro-next-phase-2027-pilot/
