EU reaches agreement on PSR and PSD3

The European Parliament and the Council have reached a final agreement on the Payment Services Regulation (PSR) and the Third Payment Services Directive (PSD3). The new rules aim to open up the EU payments market, strengthen consumer protection, and enhance the sector’s resilience to payment fraud and data breaches.

What new mechanisms will payment service providers introduce to protect customers from fraud?

Payment service providers will be required to implement advanced fraud-prevention mechanisms, including mandatory checks ensuring that the payee’s name matches their unique identifier. If discrepancies arise, the payment must be rejected.

Transactions initiated or altered by a fraudster will be considered unauthorised, with full financial responsibility resting on the payment service provider. The provider receiving the payment will also be obliged to freeze any transaction deemed suspicious.

In cases of impersonation fraud – when someone pretends to be an employee of a payment institution- the provider will have to refund the customer in full, provided the incident is reported to the police and the institution is notified.

Online platforms will be held liable to payment service providers if they fail to remove fraudulent content after being notified, complementing the obligations set out in the Digital Services Act. The agreement also introduces mandatory access to human customer support and public education initiatives on how to avoid payment fraud.

What changes will increase fee transparency and improve access to cash?

Consumers must receive full and clear information about all charges before making a payment, including currency-conversion costs and ATM withdrawal fees- regardless of the ATM operator.

To improve access to cash, especially in rural and remote areas, retail stores will be allowed to offer cash withdrawals of up to €150 (with a minimum of €100) without requiring a purchase.

How will the new regulations strengthen competition and facilitate the development of open banking?

The agreement restricts the ability of account-servicing providers to discriminate against open banking services. Authorised providers will gain access to payment account data under the new rules, while users will have a dashboard to manage the permissions they have granted.

Manufacturers of mobile devices and digital service providers will be required to allow user-interface service providers to store and transmit payment-related data on fair, reasonable, and non-discriminatory terms.

What does simplified authorization of payment institutions entail in light of the new regulations?

The new rules introduce harmonised timelines and proportionate capital requirements for payment institutions. Providers offering services related to crypto-assets and already authorised under MiCA will benefit from a simplified procedure, while maintaining appropriate risk controls.

All payment service providers will be required to participate in alternative dispute-resolution procedures if chosen by the consumer. The agreement must now be formally adopted by the European Parliament and the Council.

Ensure compliance with new regulations!

Contact us to check whether your institution is ready for new obligations- from anti-fraud safeguards to simplified authorization.
Our team of lawyers will provide you with full regulatory support.