THE CONTEXT

On 29 October 2026, the EU Council unanimously adopted its position at first reading on the proposed third Payment Services Directive (the “PSD3”) and the Payment Services Regulation (the “PSR”). The Council’s position was endorsed by the Commission on 3 November 2026.

First proposed by the European Commission in June 2023, the new payments regime aims at addressing the emerging challenges identified in the context of the evaluation of the impact and application of Directive (EU) 2015/2366 (the “PSD2”) to new market developments, persistent fraud risks and practical shortcomings in the PSD2 regime.

The reform follows a two-track approach. The PSD3 will require national transposition and will govern licensing, authorisation, supervision and access to payment systems. The PSR will establish directly applicable operational rules on aspects such as strong customer authentication (“SCA”), fraud prevention mechanisms, and liability for customers’ losses.

KEY CHANGES

• A unified regime for payment and e-money institutions. The new rules will replace PSD2 and Directive 2009/110/EC (the Electronic Money Directive 2, EMD2), integrating e-money institutions into the payment institution regime while retaining specific requirements for e-money activities.
• The PSR retains the general requirement for SCA to combine two independent elements from different categories, such as knowledge and inherence. However, SCA would also be allowed based on two biometric factors, such as voice and facial recognition, provided that their independence is fully preserved at all times.
• IBAN name verification. The PSR will extend the payee verification obligation to all credit transfers, including non-SEPA transfers in currencies other than the Euro.
• Fraud prevention and liability. The new rules will require payment service providers to adopt transaction monitoring mechanisms and introduce specific liability for impersonation fraud. In addition, providers will be required to refund consumers tricked into authorising fraudulent payments by someone pretending to be the payment service provider through communication channels attributed to it. Refunds are conditional on consumers reporting the fraud to the police and notifying their provider without undue delay.
• Open banking. The PSR seeks to address technical barriers to open banking by enhancing API interoperability. For example, banks offering online payment accounts will need dedicated interfaces for account-information and payment-initiation providers, with availability and performance at least equivalent to their own customer channels.

THE POSITION OF THE COUNCIL

The position of the Council is consistent with the political agreement reached with the European Parliament in November 2025 in the context of the so-called trilogue negotiations and was endorsed by the Commission on 3 November 2026.

The amendments to the Commission’s initial PSD3 and PSR proposals agreed by the co-legislators include the following:

• Technical service providers. Providers that support payments without possessing transferred funds will remain outside the licensed payment-service perimeter but will be required to comply with specified PSR obligations such as those relating to outsourcing agreements for the application of SCA.
• MiCA boundaries. The agreed text expressly includes e-money tokens (“EMTs”) within the definition of “funds” which defines the boundary of regulated payment services but adds activity-specific exclusions for intermediary-free token transfers. In practice, while a service involving EMTs can qualify as a regulated payment service, disintermediated activities (such as direct EMT payments from payer to payee without intermediary intervention) are generally outside the scope of PSD3.

NEXT STEPS

The Council’s approval is an important legislative milestone but does not mark completion of the legislative process. The package remains subject to completion of the European Parliament’s second-reading procedure, followed by formal signature and publication in the Official Journal of the European Union.

Under the Council-approved texts, the PSR would generally apply 21 months after entry into force, subject to specific exceptions, including a 27-month implementation period for certain payee-verification requirements and the associated liability rules. PSD3 would require Member States to transpose and apply its provisions within 21 months of entry into force, with separate transitional arrangements for existing payment and e-money institutions.

The framework will be further elaborated through the European Banking Authority’s guidelines and technical standards addressing specified operational and supervisory requirements.