After almost three years of negotiation, the European Union has settled the substance of its next generation of payments law. The package has two parts: the third Payment Services Directive (PSD3), which covers the licensing and supervision of payment firms, and the Payment Services Regulation (PSR), which sets the rules that apply directly to every payment provider in the EU.

Timeline

• 27 November 2025: Parliament and Council negotiators reached a provisional political agreement.
• 23 April 2026: the agreed final texts were published, a day after member states’ representatives endorsed them.
• 5 May 2026: the Parliament’s Economic and Monetary Affairs Committee approved both texts.

Formal adoption and publication in the EU’s Official Journal were expected to follow during 2026. Most obligations under the regulation apply around 21 months after it enters into force, which points to late 2027 or early 2028 as the practical compliance date.

What changes

• Fraud liability. Payment providers take on more responsibility for losses when customers are tricked by fraudsters impersonating the provider, and when required safeguards were not in place.
• Name and account checks. Checking that the payee’s name matches the account number becomes a general requirement for credit transfers, building on the rules already in force for euro payments.
• Fraud data sharing. Providers get a legal basis to share fraud information with each other, and a European platform on combating payment fraud is to be set up.
• Open banking. Banks must offer better-performing data interfaces to licensed third parties, and customers get a dashboard to see and withdraw the permissions they have granted.
• One licensing regime. The separate regime for e-money institutions is folded into the payment institution framework.

What it means for businesses

For payment providers, the fraud provisions are the most demanding part of the package: they require investment in transaction monitoring, customer warnings and data sharing well before the application date. For merchants, the practical effects will come through their providers, in the form of changes to authentication flows, clearer fee information and wider availability of account-to-account payment options. Twenty-one months is a short window for changes of this size, so planning should start now.

Sources: Morrison Foerster, Arthur Cox, European Parliament Legislative Train.