PSD3 and Open Banking: What Finance Teams Need to Know

Open banking is entering its next phase. PSD3, alongside its companion regulation the Payment Services Regulation (PSR), will replace the current PSD2 framework and reshape how banks, payment firms and finance teams handle account access, fraud liability and customer data. Political agreement was reached in late 2025, and firms across the payments value chain now have a multi-year runway to prepare.

What are PSD3 and the PSR?

PSD3 and the PSR are a paired package of EU legislation that together replace the second Payment Services Directive (PSD2), which has governed European payments and open banking since 2018. The split matters: PSD3 is a directive covering authorisation, supervision and prudential requirements for payment institutions, and requires transposition into national law by each member state. The PSR is a regulation setting conduct-of-business rules, and applies directly and uniformly across the EU without needing national transposition — which should reduce the fragmentation seen under PSD2.

Provisional political agreement on the package was reached in late November 2025, with final texts expected in the Official Journal during 2026. Based on the standard transition period built into the agreement, firms should plan for application landing around mid-to-late 2027 — later than some early industry commentary suggested, but close enough that preparation needs to start now.

What's actually changing from PSD2

A single licensing regime

PSD3 merges the separate Payment Institution and Electronic Money Institution authorisation regimes into one unified category. Firms already licensed under either regime are expected to be grandfathered in, needing to update their authorisation files rather than reapply from scratch — a welcome simplification for firms that have historically had to manage two overlapping licence types.

Stronger open banking access

The PSR removes the fallback interface exemption that let some account-servicing payment service providers avoid building a dedicated API under PSD2. Under the new regime, dedicated APIs become effectively mandatory, and account information service providers get longer consent cycles — extending from 180 days to 365 days — reducing how often customers need to re-authorise data sharing. The regulation also pushes for data access parity, meaning third-party providers should get functionally comparable access to what an institution offers its own direct customers.

APP fraud liability shifts to providers

Authorised push payment (APP) fraud — where a customer is deceived into authorising a payment to a fraudster — has been a growing problem that PSD2 never adequately addressed. Under the new framework, payment service providers face reimbursement liability for APP fraud victims where the provider failed to meet expected fraud-detection and prevention standards. This mirrors the UK's existing Contingent Reimbursement Model and represents a meaningful shift in commercial risk for banks and payment firms, who will need real-time transaction monitoring capable of flagging fraud patterns before funds leave the account.

IBAN-name verification

Firms will be expected to deploy IBAN-name matching (confirming that the account name matches the IBAN provided) across payment rails, closing a gap that has made social engineering fraud easier to execute.

Why this matters beyond payments firms

PSD3 and the PSR aren't only a concern for banks and licensed payment institutions. Finance teams more broadly should care for a few reasons:

• Any business relying on open banking connections for treasury, reconciliation, or accounting software integrations will be affected by how account-servicing providers redesign their APIs.
• Fraud liability changes affect commercial risk assessments and insurance considerations for any organisation processing high volumes of push payments.
• Finance and audit professionals advising payment institutions, fintechs or e-money issuers need to understand the licensing consolidation and the compliance timeline their clients are working to.
• The shift sits alongside other EU financial resilience regulation — including DORA — as part of a broader push toward operational and fraud resilience in financial services.

Preparing for 2027

With final application still a couple of years out, firms have time to prepare properly rather than scrambling. Priorities identified by legal and industry commentary include:

• Mapping which licence category your organisation (or your client) currently holds, and what the merged PI/EMI category means for authorisation files
• Reviewing API architecture ahead of the mandatory dedicated-interface requirement
• Upgrading fraud monitoring and transaction screening to meet the new APP fraud reimbursement standard
• Assessing safeguarding arrangements for customer funds, including diversification across institutions
• Building IBAN-name verification into payment initiation flows

FAQ

When does PSD3 take effect?
Final texts are expected during 2026, with a transition period pointing to application around mid-to-late 2027. Exact dates will firm up once the legislation is formally published.

Does the PSR need to be transposed into national law?
No — as a regulation, the PSR applies directly and uniformly across all EU member states. PSD3, as a directive, does require national transposition.

Who is liable for APP fraud under the new rules?
Payment service providers can be required to reimburse APP fraud victims where they failed to meet expected fraud-detection standards, shifting more of the burden onto firms rather than customers.

Open banking and payments regulation continues to evolve quickly, and it's a topic worth building into ongoing CPD alongside other financial crime and fraud-related training, such as our guide to the UK's failure to prevent fraud offence. Explore Learnsignal's full range of CPD courses to keep pace with regulatory change across finance and payments.