PSD3 and PSR: new payment services rules crack down on fraud, hidden fees and weak open banking
The EU's payment services framework is undergoing a major rewrite. The new Payment Services Directive PSD3 and the Payment Services Regulation PSR that accompanies it are reshaping the day-to-day business of banks, payment service providers (PSPs), fintech companies and merchants alike. The European Commission proposed the package in June 2023, the European Parliament adopted its position in spring 2024, and during 2025 the Council's position and the so-called trilogues have been progressing in parallel.
By the end of the year, EU institutions had reached a political agreement on the main elements of PSD3/PSR, focusing on reducing payment fraud, IBAN/name-check (verification of the recipient's name), full fee transparency, and harmonising and strengthening open banking rules. The final legal texts are still being “hammered out”, but the direction is clear enough for market participants to begin making systematic preparations.
Below, we look at what PSD3 and PSR mean in practice – and what PSPs/fintechs and merchants should already be doing.
What are PSD3 and PSR – and why are they being talked about so much?
PSD3 is a new directive on payment services and electronic money services, focusing primarily on licensing, authorisations and the supervisory framework. It brings payment service providers and electronic money institutions under one umbrella and updates the definitions and list of which services exactly fall within the scope of the regulation.
PSR, by contrast, is a directly applicable regulation that governs the conduct of payment service provision:
-
customer protection and allocation of liability,
-
prevention of payment fraud (including SCA – strong customer authentication),
-
fee transparency,
-
standardisation of open banking, i.e. account and payment initiation services.
An important difference from the earlier PSD2 era is that many of the day-to-day rules are being moved into the regulation itself – meaning a framework harmonised across the entire EL, with fewer “national idiosyncrasies” and complex interpretations in cross-border business models.
The topic has also been covered in detail by international law firms such as Taylor Wessing and, in the Baltic context, Ellex, highlighting that PSD3/PSR is one of the most significant financial sector reforms of the current decade.
The fight against fraud: IBAN/name-check and a new liability framework
One of the most visible changes in PSD3/PSR is mandatory IBAN/name-check, i.e. verification of the recipient's name and account number for so-called push payments (SEPA credit transfers and instant payments). Before initiating a payment, the payment service provider must compare the recipient's name with their IBAN and give the customer a clear signal if they do not match.
In addition:
-
Fraud prevention becomes a “by design” obligation. PSPs must implement a comprehensive fraud risk management framework encompassing strong customer authentication, real-time risk scoring, freezing suspicious transactions, and warning messages to customers before risky transfers.
-
APP fraud (authorised push payment fraud) and identity theft will no longer be just a “lesson” for the customer. The new framework shifts some of the liability to PSPs, especially in cases where the bank/PSP has not properly implemented the required anti-fraud measures (e.g. name-check, timely warning, detection of suspicious patterns).
-
Spoofing – a situation in which fraudsters impersonate a bank or payment platform – is becoming a separate focus; in certain cases, the PSP must compensate the customer for fraud even if the customer “authorised” the payment.
The practical message for PSPs and fintech companies is clear: anti-fraud checks are no longer “good practice” but a strict regulatory obligation with clear rules on liability.
Fee transparency: the end of hidden exchange rates and checkout surprises
The PSR also strengthens the rules on transparency of fees and commissions. The aim is for the customer to see exactly the following as soon as the payment is initiated:
-
how much they pay for currency exchange,
-
which ATM fees or “service fees” apply,
-
which intermediaries are involved in the payment chain and what they charge.
This also directly affects merchants and online stores:
-
the customer must not be given the impression that the payment “is free” if it actually incurs a hidden cost arising from the exchange rate spread;
-
discriminatory or hidden surcharges that would distort the customer's choice must not be applied between different payment methods;
-
pricing information must also be easy to understand on mobile devices, not only buried somewhere in a lengthy PDF.
According to studies, hidden fees and “additional costs appearing at the final step” are among the main reasons why customers abandon their carts—so transparency is a requirement that works both as a means of reducing regulatory risk and as a conversion booster.
Open Banking 2.0: strengthened open banking and new API requirements
PSD2 brought the first wave of open banking to Europe; PSD3/PSR aim to turn it into a mature standard, rather than “minimum compliance”. The main directions are:
-
Standardized APIs and better access to data. The rules for account information and payment initiation services (AIS/PIS) will be clarified; banks will no longer be allowed to “indirectly hinder” third-party services through unstable or inconvenient APIs.
-
Permission management “permission dashboard”. Users must be provided with a clear overview of which applications and service providers have gained access to their account/data, together with a simple option to revoke permission. Such a solution has been described as one of the key elements of PSR for increasing trust in open banking.
-
Fairer competition between banks and fintechs. The aim is to ensure that new market participants can access data and payment infrastructure under clear and enforceable rules, without hidden technical barriers or discriminatory pricing.
For fintech companies, this represents both an opportunity and an obligation:
no serious player can continue to accept an incomplete API solution or vague consent logic.
What does PSD3/PSR mean for PSPs and fintech companies?
From a direct “what to do” perspective, the PSD3/PSR message to PSPs and fintechs is quite specific.
1. Improve KYC/AML and fraud-risk processes
-
Update the know-your-customer (KYC) flows so that they are risk-based, digitally traceable and verifiable.
-
Integrate real-time fraud detection tools into payment flows (including instant payments), including behavioral patterns and device identifiers.
-
Ensure that AML monitoring works together with the new anti-fraud requirements – PSD3/PSR expects fraud risk management not to be a separate “island”, but part of a broader risk management system.
2. Take a critical look at SCA and UX
PSD3/PSR is not just about adding more layers of security – it is about smarter SCA, which would not drive customers crazy but would meet stricter requirements.
-
Map your existing strong customer authentication (SCA) flows: when you request a PIN, an SMS code, or biometric authentication, and in which cases you use exemptions.
-
Test whether, in light of the new rules, the transaction decline rate becomes too high—especially for mobile and instant payments.
-
Update the UX of digital channels so that warnings (e.g. an IBAN/name-check mismatch) are clear, concise, and readable on mobile devices, rather than merely a block of legal text.
3. Invest in APIs and open banking infrastructure
-
Make sure that your APIs comply with the new standards and are documented in a way that allows third parties to actually use them, rather than merely “tick a checkbox”.
-
Plan the creation of a permission dashboard (or the redesign of an existing one) where customers can view and manage their permissions.
-
Map which partners (fintechs, platforms) use your APIs – and whether they are ready for the post-PSD3/PSR world.
Merchants and online stores: what will change regarding payments, SCA, and the display of fees?
For merchants, PSD3/PSR may seem like “a banking matter”, but in reality the changes will very directly affect checkout and payment solutions that customers use in your online or physical store.
1. SCA and checkout flows: lost payments = lost revenue
-
Under the new rules, PSPs must ensure effective SCA—if your checkout solution is “sensitive”, there may be additional authentication steps or existing exemptions may be removed (e.g. transactions involving smaller amounts).
-
This means that the merchant must review the following with their payment service provider:
-
how many steps are involved in the checkout process;
-
whether any additional authentication screens are required; and
-
how these are integrated on mobile and desktop devices.
-
Each additional step may reduce conversion, so it is worth testing different checkout flows before the new rules take full effect.
2. Displaying fees and exchange rate differences
-
If you sell to customers in the currencies of other countries or use dynamic currency conversion (DCC), you must ensure together with the PSP that exchange rate information and the service fee are clearly visible before the payment is confirmed.
-
If you use different payment methods (card, “pay later”, international digital wallets), check that there are no “default surcharges” anywhere that may conflict with PSR transparency requirements.
3. Agreements with PSPs and risk sharing
PSD3/PSR partially changes the allocation of liability in cases of fraud. Merchants should review their PSP agreements:
-
who is liable in the event of APP fraud;
-
when the PSP may suspend or reverse a transaction;
-
how liability is apportioned if the bank has failed to perform the name check or other mandatory steps.
This is not merely a legal exercise – it is directly related to your financial risk and brand reputationin cases of fraud.
Timeline: when are PSD3 and PSR actually expected to start having an impact?
As the EU institutions moved towards trilogue negotiations and a political agreement during 2025, it is expected that the final legislation will be formally adopted and published in the Official Journal of the EU around 2026, followed by a transition period (typically 18–24 months, depending on the requirement).
This means:
-
PSPs and fintechs have time to plan and implement, but not indefinitely;
-
merchants would be wise to ask their payment solution partners for a concrete PSD3/PSR action plan now rather than wait until the “last minute”.
5 practical steps to get started now
-
PSD3/PSR gap analysis
Together with the legal and compliance team (or an external adviser), conduct a quick comparison: what you already have in place today from the PSD2 era, what meets the new requirements, and where the biggest gaps are (fraud systems, APIs, SCA, display of fees). -
Map out KYC/AML and anti-fraud processes
Document the entire customer journey – from onboarding to payment disputes – and identify where something needs to be strengthened due to PSD3/PSR (for example, integrating name checks, automatically blocking suspicious transactions, and providing customers with real-time alerts). -
Technical Action Plan for UX and API
Agree with the development team on a timeline by which:-
the cash flow will be updated in accordance with the SCA,
-
clear fee display solutions are implemented, and
-
the permission dashboard is launched.
-
-
Review contracts and partners
Merchants: discuss with your PSP how the new liability model affects you.
PSPs/fintechs: map out how to reflect the PSD3/PSR requirements in customer and partner agreements. -
Communication and training
The new rules must not take either customers or employees by surprise. Prepare internal training (risk, customer service, IT) and customer communications explaining why a new warning appeared on the screen, why additional confirmation is requested, and why information about fees has become more detailed.
PSD3 and PSR are not a “minor technical update”, but a new version of the payment services market, subjecting fraud, hidden fees and inconsistent interpretations of open banking to stricter oversight than before.
Those PSPs, fintech companies and merchants that use the transition period proactively will achieve not only regulatory compliance but also business success: greater customer trust, better conversion and easier cross-border growth.
Current offers on Easyfind
How much will your job cost?
Choose a service and its scope to get an estimated price.