PSD3 and PSR: an evolution, not a revolution

Why PSD3 and PSR matter

PSD2 transformed European payments by encouraging innovation, open banking and introduced Strong Customer Authentication (SCA) mandate to further secure e-commerce transactions. PSD3 and especially PSR take the next step by addressing some of the practical challenges that emerged over the past few years.

While PSD3 focuses on supervision, licensing aspects and needs to be transposed in the diverse national legislations, PSR introduces directly applicable rules across EU Member States. Together, they aim to achieve the main following objectives:

• Better protection for end users against payment fraud
• Greater transparency around payment services fees
• Eased access to cash, notably through cash provision services for merchants
• Improvement of Open Banking
• Further harmonisation and consistency of operational rules across the EU

These priorities reflect the realities of today's payments market, where digital transactions continue to grow and fraud prevention has become increasingly important to keep the consumer trust.

Stronger fraud protection without adding unnecessary friction

Fraud remains one of the biggest challenges facing the payments industry with fraudsters creating ever more sophisticated schemes, and with the actual success of technical improvements (SCA for instance), focusing on the weakest link of the chain: the consumer. Indeed, impersonation fraud through end user manipulation has become, with tremendous personal information’s easily available on social networks, the main source of payment fraud and distrust. Therefore, to further protect the consumer, PSR is introducing a set of prevention measures across the payment’s ecosystem.

• Clarification of rules regarding SCA application, notably on non-payment risky transactions (like changing the address)
• Strengthened transaction monitoring for both payer and payee PSPs, including data sharing
• Inclusion of social media platform and telco providers in the liability chain
• Immediate refund right for the consumer in case of PSP impersonation, even if a proper SCA has applied

Consumers expect payments to be both safe and effortless, and regulation increasingly reflects that expectation.

For PSPs, this means continuing to invest in technologies, processes and collaboration that help detect and prevent fraud, especially the one linked to impersonation, without creating unnecessary friction for legitimate customers as they still expect a seamless payment experience

More transparency and cash services for consumers

Another important pillar of the new framework is transparency. PSD3 and PSR seek to make payment services easier to understand for end users, with clearer information about fees, rights and responsibilities. Greater transparency helps build trust, particularly as consumers use a growing number of digital payment methods across borders. It is also true for cash withdrawal, where specific fees will have to be clearly shared with consumer, for both traditional ATM and coming cash provision services possibility provided by merchants, outside of any purchase context.

What businesses should expect

Worldline operates across virtually every European market and works with a broad range of customers, from merchants to financial institutions and payment service providers. That gives us a unique perspective on how regulatory changes affect different parts of the payments value chain.

The good news is that businesses should not expect a complete overhaul of their payment infrastructure. Much of the existing PSD2, open banking and SCA frameworks remains in place. However, organisations should expect updates to compliance processes, customer communication, fraud management and operational requirements as the new rules come into force. Preparation will be key. Even if implementation happens gradually, understanding the direction of travel now allows businesses to plan investments and avoid last-minute adjustments.

Where are we in the legislative process?

The legislative process is still ongoing. At the time of writing, a final vote in EU Parliament is expected in December for the PSD3/PSR package. If adopted as planned, publication at the Official Journal is set in early 2027. And the associated second/third level texts (Regulatory Technical Standards, guidelines, implementing act...) expected in 2028. Once the legislation is officially published, the implementation timeline and applicability dates will become clear. That means businesses still have time, but they should use it wisely.

Looking ahead

PSD3 and PSR are not the only regulatory developments shaping the future of payments: the single currency package (legal tender of cash and regulations establishing a digital euro), the review of the Markets in Crypto-Assets Regulation (MicaR) will also structure the payment ecosystem.

At Worldline, our experts have actively contributed to discussions throughout the legislative process, helping shape conversations around the future of European payments. We remain committed to helping businesses understand what the changes mean in practice and prepare for the next phase of payments in Europe: a more secure, transparent and interoperable ecosystem to the benefit of society, and more particularly to consumers and merchants.