Question 1

What is the difference between PSD3 and the PSR?

Accepted Answer

The reform comes as two texts. PSD3 is a directive. It governs the authorisation and supervision of payment institutions, and it lists the issuing of electronic money among payment services, which ends the separate status of e-money institution (Annex I). Each Member State has to transpose it.

The PSR is a regulation and applies as it stands across the Union. It carries the rules that apply to payments themselves: information to customers, rights and obligations, account access by AISPs and PISPs, strong customer authentication and fraud prevention. An API or compliance team works mostly with the PSR, a team preparing an authorisation with PSD3.

Question 2

When do PSD3 and the PSR apply?

Accepted Answer

Neither text has a date yet. Everything is counted from entry into force, the twentieth day after publication in the Official Journal. The PSR applies 21 months later, its Articles 50 and 57 on verification of payee at 27 months, and its Articles 85a and 108a from entry into force (Article 112). PSD3 must be transposed and applied at 21 months, the date on which PSD2 is repealed. Institutions already authorised keep their authorisation until 27 months.

For publication on 22 December 2026, the calculation puts general application on 11 October 2028. That is an assumption: no institution has published a timetable.

Question 3

What changes compared with PSD2?

Accepted Answer

For open banking, a dedicated interface becomes mandatory for every provider holding payment accounts accessible online, and the fallback through the customer interface goes away (Articles 35 and 38). Article 44 lists twelve prohibited obstacles, and the bank must give its customers a dashboard of their consents (Article 43). The limit of four accesses a day without the user is not carried over.

On fraud, verification of payee extends to all credit transfers, impersonation of the customer's bank opens a right to a refund, and sharing fraud data between providers becomes mandatory (Article 83a). The period to dispute a transaction goes from 13 to 18 months (Article 54). National law must provide for fines whose maximum is at least 10% of annual turnover (Article 97).

Question 4

What changes for strong customer authentication?

Accepted Answer

The definition does not change. SCA still takes two independent elements among knowledge, possession and inherence (Article 3(35)). The one opening is that a provider may use two inherence elements if it shows its authority they remain independent (Article 85(12)). The list of actions that require SCA grows, for example raising a limit or changing contact details online (Article 85(1)(d)).

For account information, the bank applies SCA only on an AISP's first access, and the AISP repeats it every 180 days (Article 86). Exemptions and their thresholds are left to the Article 89 RTS. Every provider must offer free of charge at least one SCA method suited to each customer, and SCA cannot depend on owning a smartphone, except for a mobile-only service the customer has accepted (Article 88).

Question 5

What happens to verification of payee?

Accepted Answer

The Instant Payments Regulation already requires checking the payee's name for euro credit transfers. Article 50 of the PSR extends the check to all credit transfers, in other currencies too, and where the account has no IBAN it covers the identifier used. A name mismatch does not block the payment.

Article 57 sets the liability. If the check was not carried out as required, the payer's bank refunds first, then turns to the payee's bank, or to the PISP when the failure is its own. Both articles apply 27 months after entry into force, six months after the rest of the regulation.

Question 6

What does the PSR provide when a fraudster poses as the bank?

Accepted Answer

This is the only new right to a refund in the text (Article 59). It covers a consumer who authorises a payment because a third party posed as their bank, using channels attributed to it such as its phone number, email address or app, fraudulent copies included. The bank refunds the full amount if the customer told it without delay and filed a police report.

It has 15 business days to refund or to justify a refusal, and the burden of proving fraud or gross negligence by the customer is on the bank. Other scams, such as fake investments or fake invoices, do not open this right. They fall under the liability of a bank that failed to monitor the transaction, or under national law.

Date	What applies or falls due
TJanuary 11, 2027	Entry into force. PSR Articles 85a and 108a apply.
T + 9 monthsOctober 11, 2027	EBA draft RTS on interface statistics and recovery time (PSR Art. 38(5)).
T + 12 monthsJanuary 11, 2028	Main block of EBA drafts, including the PSR Article 89 RTS on SCA, communication standards and transaction monitoring.
T + 15 monthsApril 11, 2028	Commission delegated act on information about card scheme fees (PSR Art. 31a(4)).
T + 18 monthsJuly 11, 2028	Guidelines on two inherence elements (PSR Art. 85(12)), RTS on TPP access data (PSR Art. 48(8)), central register and passporting (PSD3).
T + 21 monthsOctober 11, 2028	General application of the PSR. Transposition and application of PSD3. Repeal of PSD2 and of the second E-Money Directive.
T + 27 monthsApril 11, 2029	PSR Articles 50 and 57 on verification of payee. End of the grandfathering of existing authorisations (PSD3 Art. 44 and 45).
T + 30 monthsJuly 11, 2029	Limit of the exceptional extension of existing authorisations (PSD3 Art. 45a).

Text	Type	Subject	Draft due	Status
PSR 2(7)	Guidelines	Commercial agent exclusion	T + 12 monthsJan 11, 2028	Nothing published
PSR 2(8)	RTS	Conditions of the limited network exclusion	T + 12 monthsJan 11, 2028	Nothing published
PSR 32(5)	RTS	Format for banks refusing or closing payment institutions' accounts	T + 12 monthsJan 11, 2028	Nothing published
PSR 38(5)	RTS	Quarterly interface statistics and recovery time after an outage	T + 9 monthsOct 11, 2027	Nothing published
PSR 39(2)	RTS	Criteria for exempting an ASPSP from any interface	T + 12 monthsJan 11, 2028	Nothing published
PSR 48(8)	RTS	Data on TPP access to report to the authorities	T + 18 monthsJul 11, 2028	Nothing published
PSR 82(2)	RTS	Statistical data on fraud	T + 12 monthsJan 11, 2028	Nothing published
PSR 82(3)	ITS	Templates for reporting fraud data to the EBA	T + 12 monthsJan 11, 2028	Nothing published
PSR 85(12)	Guidelines	Independence of two inherence elements	T + 18 monthsJul 11, 2028	Nothing published
PSR 89(1)	RTS	SCA, exemptions, credential protection, outsourcing, communication standards, dedicated interfaces, transaction monitoring	T + 12 monthsJan 11, 2028	Nothing published
PSR 91(6)	Guidelines	Complaint procedures with the authorities	T + 21 monthsOct 11, 2028	Nothing published
PSD3 3(5)-(6)	RTS	Authorisation and registration files, assessment method, guarantee comparable to insurance	T + 12 monthsJan 11, 2028	Nothing published
PSD3 7(6)	RTS	Criteria for a business model of few high-value transactions, for the own funds method	T + 12 monthsJan 11, 2028	Nothing published
PSD3 9(7)	RTS	Safeguarding of client funds	T + 12 monthsJan 11, 2028	Nothing published
PSD3 13(1)	Guidelines	Governance and internal control assessed at authorisation	T + 12 monthsJan 11, 2028	Nothing published
PSD3 18(5)	RTS	Operation of the EBA central register	T + 18 monthsJul 11, 2028	Nothing published
PSD3 18(6)	ITS	Information the authorities notify to the register	T + 18 monthsJul 11, 2028	Nothing published
PSD3 30(5)	RTS	Cooperation between authorities on passporting	T + 18 monthsJul 11, 2028	Nothing published

PSD3 and PSR: where do things stand?

Status

The procedure

The timeline

The 18 EBA mandates

The texts

Frequently asked questions