The European payments market is getting a new set of rules, and this time the bar is clearly higher for platforms and marketplaces that facilitate money flows, directly or indirectly. On November 27, 2025, the European Parliament and the Council reached a political agreement on PSD3 and the related Payment Services Regulation (PSR). Publication in the Official Journal is expected soon. After that, member states will have eighteen months to transpose PSD3 into national legislation, which will happen in late 2027 / early 2028.
At its core, PSD3/PSR is about how money moves through chains. It therefore affects your onboarding, fraud prevention, payment flows, exemptions, and accountability. If you are still relying on gray areas or “this is how we have done it for years,” this is the moment to take a fresh look at your model.
From PSD1 to PSD3: a logical line
The direction has been clear for years. PSD1 (2007) created one European payments market. PSD2 (2018) added security and innovation, including Strong Customer Authentication (SCA) and Open Banking. PSD3 builds on this, but focuses more explicitly on the reality of digital payments today.
What is important to know: PSD3 is a directive (transposed into law by each member state). In addition, the PSR is a regulation that applies directly across the EU. Together, they replace PSD2 and form the new legal framework for payment services in Europe.
The 5 key themes emerging from PSD3
1. Stronger fraud prevention (higher bar for fraud controls)
Consumers will be better protected against fraud and unauthorized payments. PSD3/PSR puts a clear focus on tougher requirements around fraud prevention and authentication: more emphasis on end-to-end monitoring, better detection of (social engineering) fraud, and sharper expectations around how parties in the chain detect, block, and handle fraud. This affects not only banks and PSPs, but also platforms that initiate payments, orchestrate them, or design customer interaction and transaction flows.
In short: “we have SCA, so we are covered” becomes harder to defend. You need to be able to demonstrate that your processes and tooling keep up with today’s fraud landscape.
2. Fairer competition
Access to payment systems and banking infrastructure will be expanded for non-bank players. This should lead to more innovation and a more level playing field. For the non-bank sector, this is a major step forward!
3. Open Banking gets stronger foundations
While PSD2 opened the door to Open Banking, PSD3/PSR sets clearer rules. In practice, Open Banking has not delivered much so far. PSD3 changes this with clearer requirements, such as better standards for data exchange and more legal certainty for both banks and third parties. There will also be requirements for (user) interfaces around Open Banking to drive broader adoption.
4. Supervision becomes more European
The European Banking Authority (EBA) will play a larger role in harmonizing supervision. This means less room for different interpretations per member state. This will make cross-border payments even easier and more standard.
5. Technical service providers come into scope
The scope becomes broader. In addition to banks and payment institutions, certain technical service providers and platforms will also fall under the new rules.
What does PSD3/PSR mean for platforms and marketplaces?
If your platform handles third-party money flows, customer onboarding, or complex payment flows, these changes affect you directly. And for marketplaces, the bar is often even higher: money flows will be monitored more closely and exemptions will be applied more strictly.
One key example is the commercial agent exemption (the exemption where a platform could act as a commercial agent and therefore fall outside certain payment service rules). Under PSD3/PSR, supervisors are expected to interpret these types of exemptions more consistently and more strictly. In practice, this means some marketplace models may no longer fit comfortably under an “exemption” approach, and a regulated payments setup (for example via a licensed partner/PSP, or through your own licensing path) is more likely to become necessary.
In practical terms:
- Onboarding and KYC processes may be affected by tighter requirements around customer identification and fraud prevention. This also aligns with the upcoming implementation of the AMLR.
- Payment statuses and traceability become even more important. The new rules require more transparent reporting and better audit trails. One of the most visible examples is the requirement to include the name of the beneficiary in the description of a bank transaction.
- Allocation of responsibilities shifts. Platforms will need to document more clearly who is responsible for what in the payments chain.
The key question is not whether PSD3 has an impact, but how well your organization is prepared for the specific changes that matter for your model.
Timeline
- November 2025: political agreement reached between the European Parliament and the Council.
- Expected Q2 2026: publication in the EU Official Journal.
- 18 months after entry into force: deadline for national transposition of PSD3.
- Around Q2 2028: expected date when PSD3 is fully applicable.
The PSR will apply directly after publication, although some parts will have longer transition periods.
How do you prepare?
Three steps you can take now:
- Map which parts of PSD3/PSR affect your organization. This differs by business model. For the non-bank sector and anyone planning to use Open Banking, there will be relevant areas.
- Review your current processes around onboarding, authentication, and transaction monitoring. Where are potential gaps versus the tightened requirements?
- Talk to your payment service provider. A strong PSP actively follows these developments and can help you assess what will change for you.
Want to discuss what PSD3 means for your specific situation? Call or email us. We are happy to think along.
Contact
What can we do for you? Contact us!
Stay up to date: Follow us on LinkedIn!