PSD3 and the Payment Services Regulation: status, timeline and what changes for merchants

What are PSD3 and the Payment Services Regulation?

The European Commission proposed the package on 28 June 2023 to replace PSD2, Directive (EU) 2015/2366, and to fold the E-Money Directive into the same framework. It is split in two. PSD3 is a directive about licensing and supervising payment institutions, including e-money issuers, and has to be transposed into national law. The PSR is a regulation that applies directly in every member state and contains the conduct rules: authentication, fraud, open banking, transparency and liability.

Splitting the rules this way is meant to end the national differences that PSD2 left, for example in how strictly strong customer authentication or open banking access were enforced. For merchants, the PSR is the part that matters most, because it governs how their PSPs authenticate, monitor and refund payments.

Where do PSD3 and the PSR stand in October 2026?

The Council and the European Parliament reached a provisional agreement on 27 November 2025. The Council published the final compromise texts on 23 April 2026, and Parliament's Economic and Monetary Affairs Committee approved them on 5 May 2026. As of 21 October 2026, Parliament's Legislative Observatory lists both files as awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026.

Neither act has been adopted or published in the Official Journal yet, so neither is in force. Each enters into force 20 days after publication. Under the agreed texts, most PSR rules and the PSD3 transposition deadline follow about 21 months later, and payee verification for transfers not already covered by the Instant Payments Regulation about 27 months later, which points to late 2028 and 2029 at the earliest.

What changes for merchants under the PSR?

The PSR keeps strong customer authentication and the card exemptions but tightens the edges, and it adds fraud and transparency duties that reach merchants through their PSPs. The list below summarises the agreed texts as described by the Council and Parliament; details can still change in legal-linguistic review before publication.

• SCA: clearer treatment of merchant-initiated transactions, and authentication methods that must not rely only on a smartphone so that older and disabled users can pay
• Fee transparency: providers of card acceptance must state their fees clearly to merchants
• Statement names: merchants must make sure the trading name shoppers know matches the name on their bank or card statement
• Fraud monitoring: PSPs must monitor transactions and share fraud-related information with each other
• Payee verification: the IBAN and name check required for euro transfers since October 2025 extends to other credit transfers
• Cash: shops may pay out cash without a purchase, up to €150 with chip and PIN

How does the PSR change fraud liability?

Impersonation fraud, where a scammer poses as the customer's bank, becomes the PSP's problem: according to Parliament, the PSP must refund the full amount if the customer reports the fraud to the police and informs the PSP. A PSP that fails to apply the required fraud prevention tools is liable for the resulting losses.

Online platforms can be held liable towards PSPs that reimbursed customers, if the platform was notified about fraudulent content and did not remove it. Advertisers of financial services must show that they are authorised. For merchants, expect more transaction monitoring, more name-check friction on refunds and payouts by transfer, and PSPs that ask harder questions about descriptors and business models.

What changes for open banking and pay by bank?

Banks must give payment initiation and account information providers access through a dedicated interface on a non-discriminatory basis, and must remove obstacles that make open banking journeys longer than direct online banking. Users get a dashboard at their bank to see, withdraw and re-establish the data access permissions they have granted.

For merchants that accept pay by bank, this should mean fewer broken redirects and more consistent bank coverage across countries. It does not change when the rules apply: until the PSR takes effect, PSD2 and its RTS on authentication and communication remain the law.

What changes for payment institutions and e-money institutions?

PSD3 merges the e-money regime into the payment institution regime, so e-money institutions become a category of payment institution. Existing licence holders must show their supervisor that they meet the new requirements within a transition period set in the directive; firms that do not will lose their authorisation.

Merchants should ask their PSPs how they plan to handle re-authorisation, safeguarding and the new fraud duties. A provider that is late or exits a market can force a migration at short notice, which is easier when the checkout is not tied to a single provider.

What should merchants do now?

Nothing changes legally before publication and the application date, but some of the work takes time. Map where you depend on PSD2 behaviour: exemption usage, merchant-initiated flags, descriptors, refunds by transfer and pay by bank coverage. Review contracts so fee disclosure and liability terms will follow the PSR.

If you work with several providers, OrsunPay connects the merchant's own PSP accounts through one integration as a technical service provider, which keeps a provider change manageable while each PSP adapts to the new rules. It does not hold funds and does not take over any PSP's regulatory duties.

How to prepare for PSD3 and the PSR

1. Track the legislative status Follow the Council's first-reading position, the Parliament plenary vote and publication in the Official Journal, then calculate the 21-month and 27-month dates.
2. Audit your authentication flows List where you use SCA exemptions and merchant-initiated flags, and check that authentication does not depend only on a smartphone.
3. Fix descriptors and fee data Make sure the trading name on statements matches your brand and that you receive a clear fee breakdown from each card acquirer.
4. Ask your PSPs for their plan Request each provider's timeline for re-authorisation, fraud monitoring, payee verification and open banking interfaces.
5. Reduce single-provider risk Keep a second provider connected for key methods so that a provider's delay or exit does not stop your checkout.