PSD2 (Payment Services Directive 2)

PSD2, the Payment Services Directive 2, is the European Union's regulatory framework for payment services, which came into force in January 2018 and fundamentally reshaped the European payments landscape. It superseded the original PSD (2007) with significantly expanded scope, introducing Strong Customer Authentication (SCA) for electronic payments, mandating access to bank account data for licensed third parties (the foundation of open banking), establishing new categories of regulated payment service providers, and strengthening consumer rights in electronic payments.

PSD2's three most commercially significant requirements for payments businesses are: first, SCA, requiring two-factor authentication for customer-initiated electronic payments above defined thresholds; second, open banking access, requiring banks to provide licensed Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) with access to customer account data and the ability to initiate payments through regulated APIs; and third, liability rules, clarifying when payment service providers are liable for unauthorized transactions and establishing stronger consumer protections.

PSD2 applies to payment service providers established in the EEA. Following Brexit, the UK implemented its own equivalent framework, largely mirroring PSD2, under the FCA's oversight. The legislation has generated a substantial compliance and implementation industry: banks have built PCI-compliant open banking APIs, payment providers have built SCA-compliant authentication flows, and a new category of fintech business (open banking providers) has emerged.

PSD3, the successor directive, has been proposed by the European Commission and is expected to address gaps and inconsistencies in PSD2 implementation, strengthen open banking obligations, and harmonize SCA requirements further. As of early 2026, PSD3 is still progressing through the EU legislative process.