PSD2: Meaning, Features, Benefits & PSD3 Explained
TL;DR - Summary
- What is PSD2? - PSD2 is the EU's Payment Services Directive. It introduced stronger payment security requirements and allows regulated third parties to access customers' payment-account data and initiate payments with their consent.
- What are the key features of PSD2? - Key features include Strong Customer Authentication (SCA), open banking, Account Information Services (AIS), Payment Initiation Services (PIS), greater payment transparency, and restrictions on certain payment surcharges.
- What are the benefits of PSD2? - PSD2 makes electronic payments more secure and transparent while giving consumers greater control over their payment data and encouraging competition from regulated fintech providers.
- How is PSD3 different from PSD2? - PSD3 builds on PSD2 with stronger fraud protection, improved open banking, clearer payment-service rules, and measures such as Verification of Payee. It is part of a broader EU payments reform that also includes the Payment Services Regulation (PSR).
What Is PSD2?
PSD2, or the Revised Payment Services Directive, is the European Union's framework for regulating payment services and creating a more open, competitive, and secure payments market. It introduced stronger security requirements for online payments while opening the market to regulated third-party payment providers.
PSD2 applies to payment service providers and banks within its scope across the EU and European Economic Area. Among other requirements, it introduced Strong Customer Authentication (SCA) for many electronic payments and established rules governing regulated third-party providers that access payment accounts through open banking.
The directive was adopted in 2015, and EU member states were required to transpose it into national law by 13 January 2018. The SCA requirements subsequently came into force in September 2019, completing the main PSD2 implementation.
✅ PRO TIP
Verification of Payee (VoP), which checks whether the payee's name matches the account details before a transfer, is already being rolled out under the EU's Instant Payments Regulation. For euro-area payment service providers, the VoP requirement took effect on 9 October 2025. It is designed to reduce fraud and payment errors by warning payers about mismatches before they send a payment.
What Are the Key Features of PSD2?
PSD2's key features include strong customer authentication, open banking through regulated third-party providers, rules for payment initiation and account information services, and restrictions on certain payment surcharges. Together, these measures were designed to make electronic payments safer while opening the market to new payment providers.
- Strong Customer Authentication: PSD2 requires at least 2 independent factors from three categories, something the user knows, such as a password; something the user possesses, such as a phone; and something the user is, such as a fingerprint. 3D Secure is a common way of applying SCA to online card payments.
- Account Information Services (AIS): Regulated Account Information Service Providers can (with the customer's consent) access information from eligible payment accounts and bring it together across multiple banks. This gives users a consolidated view of their finances.
- Payment Initiation Services (PIS): Regulated Payment Initiation Service Providers can initiate a payment from a customer's bank account to a specified recipient with the customer's authorisation. The service provider acts as the link between the customer and the bank holding the payment account.
- Open Banking: Banks and other account-servicing payment providers must provide regulated AIS and PIS providers with access to eligible online payment accounts, subject to the customer's consent and authentication. This opened the door to new payment and financial-management services beyond traditional banks.
- Surcharge Restrictions: PSD2, together with the EU's interchange-fee rules, restricted merchants from adding surcharges for certain consumer debit and credit card payments. The restriction does not apply universally to every payment method or transaction.
- Clearer Rules for Platforms: PSD2 brought certain businesses such as online marketplaces within payment-services regulation where their activities fall within the regulated payment services. For example, a marketplace that receives customer money before passing it to a seller may be providing a payment service and may need authorisation, subject to applicable exclusions.
- Post-Brexit Separation: The UK implemented PSD2 through its Payment Services Regulations 2017, but following Brexit it now operates its own payment-services regime rather than participating in the EU's single-market framework. UK payment providers therefore cannot rely on EU passporting in the same way as before, while the UK's own SCA and open-banking rules remain broadly aligned with the former PSD2 framework.
Who Does PSD2 Apply To?
PSD2 applies to payment service providers operating within the EU and EEA, including banks and regulated payment institutions. The EEA includes the EU member states plus Iceland, Liechtenstein, and Norway.
The UK is no longer part of the EU's PSD2 framework or its payment-services passporting system. It now operates under its own Payment Services Regulations, although many of its payment rules remain closely aligned with PSD2.
PSD2 does not directly regulate an Indian freelancer or exporter simply because they receive a payment from Europe. However, the European payment provider handling the transaction may have to follow PSD2 requirements such as strong customer authentication when the customer authorises the payment.
What Are the Benefits of PSD2?
PSD2 makes payments safer and more transparent for consumers while giving regulated non-bank providers more room to compete with traditional banks. Its main benefits include wider open banking access, greater control over account data, clearer payment information, stronger refund protections, and improved security.
- Open Banking and Competition: With the customer's consent, regulated third-party providers can access eligible payment-account data or provide payment services using that access. This has made it easier for payment providers, financial-management tools, and other fintech services to compete and build products around banking data that was previously much harder to access.
- Consumer Data Ownership: PSD2 gives consumers greater control over access to their payment-account data. Banks cannot simply share this information with third-party providers without the customer's permission, and regulated providers can access it only within the scope of the consent given.
- Faster and More Transparent Payments: PSD2 strengthened rules around how payment providers process transactions and what information they must give customers. Fees, charges, execution times, and other important transaction details must be communicated more clearly, giving customers greater visibility into a payment before and after it is made.
- Strengthened Refund Rights: PSD2 expanded consumer protections around unauthorised transactions and certain authorised payments. Depending on the circumstances, customers can be entitled to a refund, giving them stronger safeguards when a payment goes wrong.
- Security: Strong customer authentication requires at least 2 independent authentication factors for many electronic payments. Although the extra verification can add some friction, it makes it significantly harder for someone to make an unauthorised payment using stolen credentials.
PSD2 vs PSD1: What Changed?
PSD2 expanded on PSD1 by making payments more secure, opening bank-account access to regulated third parties, strengthening consumer protection, and bringing newer payment services into the regulatory framework.
PSD1 was approved in 2007 and came into effect in 2009. It created a common legal framework for electronic and non-cash payment services across the EEA, opened the market to new payment service providers, and helped establish the regulatory foundations for the Single Euro Payments Area (SEPA).
Why PSD1 Became PSD2
By 2013, the growth of digital commerce and new payment services had exposed gaps in PSD1. The European Commission proposed PSD2 to extend consumer protection, improve payment security, and create a more competitive market for newer payment providers. PSD2 was approved in 2015, with EU member states required to implement it by 13 January 2018.
| Dimension | PSD1 | PSD2 |
|---|---|---|
| Consumer protection | Basic protections under a common payment-services framework | Broader protections covering additional payment services and transactions |
| Open banking / third-party access | No equivalent framework for regulated third-party access | Regulated TPPs can access payment-account data and initiate payments with customer authorisation |
| Strong Customer Authentication | No SCA requirement | Introduced SCA for many electronic payments, subject to permitted exemptions |
| Payment services | Primarily covered established payment services | Expanded the framework to services such as Account Information and Payment Initiation Services |
| Competition | Opened the market to new payment service providers | Further opened payment services to regulated non-bank providers |
How Is PSD2 Relevant to Stop Hidden Fees?
PSD2 makes payment costs more transparent by requiring clear disclosure of charges and exchange rates, restricting certain surcharges, and giving consumers greater visibility into their account activity through open banking. It offers:
- Surcharge Ban: Merchants cannot add surcharges to covered consumer card payments, while separate SEPA rules require cross-border euro payments to cost the same as equivalent domestic payments.
- Cross-Border Fee Transparency: Payment providers must disclose applicable charges and the exchange rate used for currency conversion. PSD2 does not ban FX markups, but it makes the applicable rate and charges more transparent.
- Open Banking as a Transparency Tool: Regulated Account Information Service Providers can consolidate a customer's payment-account information with their consent, making transactions and charges across different accounts easier to review.
How Does PSD2 Affect Indian Freelancers and Exporters Receiving International Payments?
PSD2 can affect Indian freelancers and exporters indirectly through the European payment provider handling the transaction, particularly when that provider applies Strong Customer Authentication (SCA). The Indian recipient does not have a direct PSD2 compliance obligation simply because they receive a payment from Europe. Some challenges include:
- Strong Customer Authentication (SCA) Friction: When a European client initiates a payment, their bank or payment provider may require additional authentication before authorising it. If the client fails to complete the required verification, the payment may not be authorised and the Indian recipient may simply see the payment delayed or fail to arrive.
- One-leg-out Transactions: A payment involving an Indian recipient and an EEA payment service provider can fall under PSD2's rules for transactions where only one payment service provider is located in the EEA. The exact requirements depend on the payment service and transaction structure, so PSD2 does not automatically apply in full to the entire payment.
- No Direct Indian Compliance Burden: An Indian freelancer or exporter does not need to implement PSD2 protocols simply because a European client is paying them. The relevant PSD2 obligations generally sit with the payment service providers covered by the directive.
- Choosing a Compliant Payment Intermediary: Using a payment provider that can handle the relevant European payment requirements can reduce friction for the payer and make the payment flow easier to track, although PSD2 compliance does not guarantee that every cross-border payment will settle without delays.
Practical Example
A Mumbai-based UX designer invoices a Berlin startup. When the startup initiates the payment, its European bank may require SCA before authorising the transaction. If the client does not complete that verification, the payment may not be sent. The designer therefore sees a delay without necessarily knowing that the problem occurred during the client's bank-side authorisation.
What are the Challenges and Concerns With PSD2?
The main PSD2 challenges fall into two groups, i.e., customers face more choice, data-privacy concerns, and extra authentication steps, while businesses face compliance costs, technical integration work, stronger competition, and the need to educate customers.
Challenges for Customers
- Overwhelming Choices: More regulated third-party providers and new financial services give customers more options, but also make it harder to distinguish between providers and decide which ones to trust.
- Data Privacy Concerns: Open banking allows regulated third-party providers to access financial information with the customer's permission. This creates understandable concerns about how that data is stored, protected, and used.
- SCA Friction: Strong Customer Authentication adds verification steps such as entering a code or using a biometric check. While these measures improve security, they can interrupt the payment journey when authentication fails or takes too long.
Challenges for Businesses
- Regulatory Compliance Costs: Meeting PSD2 requirements can require investment in technology, security controls, compliance processes, and ongoing monitoring, which can be particularly demanding for smaller businesses.
- Increased Competition: Traditional banks and established financial institutions now compete with more regulated fintech and payment providers, putting pressure on them to improve their services and adapt faster.
- Integration Challenges: Connecting open-banking and third-party payment services to existing systems requires technical work and careful implementation to avoid disrupting existing payment flows.
- Security Risks: Giving regulated third parties access to financial information creates additional points that businesses must consider when managing data security and choosing technology partners.
- Customer Education: Businesses need to explain new authentication steps, consent requests, and third-party payment services clearly so customers understand what they are being asked to authorise.
What Does the Global Payments Landscape Look Like With PSD3?
PSD3 and the accompanying PSR are set to make Europe's payment market more connected, more tightly regulated, and harder to exploit. The changes affect how banks share account data, how payment fraud is detected and handled, and how non-bank providers participate in payment infrastructure. As of August 2026, however, the new framework is not yet in force.
From Open Banking to Enforceable Infrastructure
The reforms aim to make account-data sharing work more consistently while giving users more say over access to their information.
- No More Fallback Mechanisms: Banks will have to maintain proper interfaces for third-party connections instead of depending on temporary alternatives. Those interfaces should offer access comparable with the bank's own digital channels.
- Permission Dashboards: Users will have a central place to review which companies can use their account information and control the duration of that access.
- Open Finance Expansion: The same push for data sharing is extending into other financial products through FiDA, taking the concept beyond ordinary payment accounts.
Anti-Fraud and Risk Management
Fraud prevention is becoming a larger part of the payment framework, with checks and provider responsibilities changing alongside it.
- Verification of Payee (VoP): Payment details can be checked against the intended recipient's name before funds leave the account, helping catch impersonation and simple payment errors.
- Contextual SCA: Providers can assess the circumstances surrounding a transaction, including the device, a customer's normal behaviour, and their location, when determining authentication risk.
- Expanded Liability: Providers will have greater responsibility for losses arising from certain authorised push payment (APP) scams, including cases where customers are entitled to repayment.
Levelling the Playing Field
The changes also make it easier for some non-bank firms to participate in payment infrastructure while tightening the boundaries around exemptions.
- Direct System Access: Eligible payment firms and EMIs will be able to connect to relevant European clearing and settlement infrastructure without depending entirely on a bank to provide that access.
- Narrowed Agent Exclusions: Some online marketplaces and other multi-party platforms may no longer be able to use the commercial-agent exemption to stay outside the payment-services authorisation regime.
- Direct EU Regulation (PSR): Businesses operating in several EU countries will increasingly work under one directly applicable set of payment rules instead of navigating different national implementations.
How Does Skydo Help Receive Payments from Europe?
For Indian freelancers and exporters, Skydo offers a digital way to collect money from European clients without dealing with the usual bank paperwork and uncertainty. It combines local EUR receiving details, upfront pricing, payment visibility, automated FIRA generation, and export-compliance support in one platform.
With Skydo, you can get paid through a EUR account. Skydo gives you EUR receiving details at no account or maintenance cost. You can also open accounts in USD, GBP, SGD, AUD, and CAD. Your European client can pay using a local transfer method such as SEPA, while setup takes about five minutes and does not require a relationship manager.
Additionally, you know the cost before you transact. Payments with Skydo are:
- Under $2,000 cost $19
- Those from $2,001 to $10,000 cost $29
- Larger payments are charged at 0.3%.
There is no monthly fee or FX markup, so the exchange rate does not come with an additional percentage margin. Also, Skydo's live tracking shows the progress of an incoming transfer, including when a payment is held up during processing. This gives you visibility instead of having to repeatedly check with banks or the payer.
Additionally, Skydo generates an instant FIRA at no extra charge for each payment automatically. The certificate provides a record of the inward remittance that can be used for GST, tax, and other compliance requirements.
Exporters can connect their DGFT account, upload shipping bills in bulk, and use Skydo's payment mapping to generate eBRCs. The platform also provides support for closing relevant EDPMS entries. Alongside this, once Skydo receives the payment, funds are transferred to the user's Indian bank account within 24 hours, giving businesses a more predictable payout window.
What is PSD2 in simple terms?
PSD2, the Payment Services Directive 2, is an EU directive that sets rules for payment services and electronic payments. It opened parts of the banking system to regulated third-party providers, strengthened security requirements for online payments, and introduced greater transparency around payment fees. It was adopted in 2015, and EU member states were required to transpose it into national law by 13 January 2018.
Is PSD2 mandatory?
What does PSD stand for in finance?
What does it mean to be PSD2 compliant?
Does PSD2 affect Indian freelancers directly?
What is SCA under PSD2?
What is the difference between AIS and PIS under PSD2?
What is PSD3 and how is it different from PSD2?
