Glossary: What are PSD3 and PSR?

PSD3 is the EU's third Payment Services Directive, a new rulebook (paired with a companion regulation, the PSR) that will replace PSD2 and reshape how payment institutions are licensed, supervised, and held accountable for fraud across Europe.

Note on timing: as of October 2026, PSD3 and the PSR have not yet been formally adopted. The European Parliament and Council reached political agreement in November 2025 and published final compromise texts in April 2026, but the package still needs a formal adoption vote and publication in the EU's Official Journal (the EU's official gazette, where laws are formally published before they take effect), expected in the second half of 2026. Full application is expected around 2027 to 2028.

Why the EU created PSD3

PSD2, introduced back in 2015, gave us open banking and Strong Customer Authentication. It was a good start, but it left gaps. Fraudsters got smarter, while open banking connections have not always delivered the availability and performance they were meant to provide. At the same time, PSD2 has been applied differently across EU countries. PSD3 and the PSR are the European Commission's answer: one harmonised rulebook, tighter fraud protections, and clearer accountability for everyone who moves money. We covered some of the early thinking behind this in our earlier look at what PSD3 might bring, back when the shape of the reform was still taking form.

PSD3 vs PSR: what is the difference

It helps to think of them as two halves of the same reform.

PSD3, the Payment Services Directive (the directive)

PSD3 is one half of the EU's payment services reform. It covers the institutional side: who can become a payment institution or e-money institution, how they're licensed, and how they're supervised. It's a directive, a type of EU law that sets the goal but leaves each country to write its own implementing legislation, so every EU member state will transpose it into national law on a similar timeline to the PSR.

PSR, the Payment Services Regulation (the regulation)

PSR is the other half of the reform. Unlike PSD3, it's a regulation, a type of EU law that applies directly and identically in every member state, with no national transposition needed. It covers the operational rules: authentication, fraud liability, verification of payee, and open banking API performance, with technical standards to be finalised by the European Banking Authority (EBA).

Together, PSD3 and the PSR replace PSD2 and also the current Electronic Money Directive, EMD2 (Directive 2009/110/EC), bringing its rules directly into PSD3 and merging payment institutions and e-money institutions into a single, simpler licensing framework.

What changes under PSD3 and the PSR

A few of the headline shifts:

• Fraud liability shifts: If a bank or provider misses an obvious spoofing attempt (a scammer impersonating a trusted source, like a bank or supplier, to trick someone into paying), liability can move away from the person who got scammed. In the Netherlands, this is already an emerging practice; PSD3 and the PSR make it a binding, EU-wide rule rather than a case-by-case one.

• Stronger open banking APIs: Since 2018, banks have often been able to fall back on a broken or slow connection instead of fixing it. The PSR requires banks to make these connections perform at least as well as their own banking app or website; no more excuses for a second-class connection.

• A single PI (payment institution) / EMI (e-money institution) licence: Payment institutions and e-money institutions will sit under one harmonised authorisation regime instead of two separate ones. In practice: a company that wants to offer both payment services and e-money, like prepaid balances or digital wallets, no longer needs two separate licences and two sets of paperwork; just one covers both.

• Tighter scrutiny for marketplaces: Marketplaces already can't hold customer funds without a licence or a valid exemption, but some platforms have leaned on the commercial agent exemption in ways that stretch its intent. PSD3 tightens that definition further, and the first platforms are already shifting to a licensed setup, either acquiring their own licence or partnering with a platform PSP.

• Platform liability for fraudulent content: Major online platforms will only be allowed to advertise financial services from providers authorised in that market. If a payment provider reimburses a defrauded customer after the platform was told about fraudulent content and didn't remove it, the platform can be held liable to that provider.

We go much deeper on what this means in practice, for both marketplaces and SaaS platforms embedding payments, in How PSD3 and PSR affect marketplaces and SaaS platforms.

Who does PSD3 affect?

• Payment institutions, e-money institutions, and banks carry the heaviest compliance load, since they hold the licence. Being in scope for authorisation and supervision isn't new; that was already true under PSD2. What changes is the shape of it: a single, harmonised PI/EMI licence instead of two separate regimes, and strengthened cross-border supervision.

• Marketplaces may be affected by the narrowing of the commercial agent exclusion. Some marketplaces could rely on this exclusion under PSD2, depending on the approach taken by their national regulator. Under PSD3/PSR, marketplaces acting on behalf of both buyers and sellers will generally no longer be able to rely on it.

• SaaS platforms (ISVs) embedding payments are indirectly affected. While the licensed payment partner remains responsible for regulated activities such as merchant onboarding and KYC, the ISV may face stricter requirements from its payment partner around the information it collects from merchants, how that information is verified, and the fraud signals it provides.

• Merchants and online sellers feel this mostly through their payment provider: checkout verification steps may shift slightly, statement descriptors will show your real trading name more clearly, and fraud disputes should resolve faster.

What this means for you

If you're running a marketplace or SaaS platform, you may need to reassess whether your current payment setup still qualifies for an exemption under the new rules. What is on you: check now whether your fund flows and onboarding actually hold up under the narrower rules, and start the conversation with a regulated payment partner if you're not sure they do. 

How OPP helps

At OPP, onboarding is built with exactly this kind of regulatory shift in mind, whether you're verifying sellers on a marketplace or onboarding merchants through your SaaS platform.