# PSD3: What you need to know *October 2, 2025* • *6 min read* New proposals for PSD3/PSR are being made. Discover what this means, how it changes the payments industry, and how it impacts your business. **Key changes**: - The EU Payment Services Directive 3 (PSD3) is an updated version of the Payment Services Directive 2 (PSD2). - PSD3 proposes to replace PSD2 and strengthen the regulations with a new, directly applicable EU Regulation.   - PSD3 and PSR set out more extensive regulations on numerous topics, including Strong Customer Authentication (SCA), fraud prevention, data sharing, and open banking.  - Proposed tighter rules on the commercial agent exemption may impact marketplaces and platforms, making it more difficult for such businesses to offer payment services without a license. The latest draft proposed by the European Council rolls back these amendments, leaving the exemption’s status uncertain until the final version is agreed upon by EU lawmakers.  - The European Commission proposed PSD3 and PSR in June 2024; they have since been reviewed by the European Parliament and European Council, each proposing a draft of the texts. The three parties will seek political agreement, and a final version is expected in Q1 or Q2 of 2026.  The EU payment services market has transformed since the introduction of the Second Payment Services Directive (PSD2) in 2018.  The rules and regulations were calling for an update. On June 28, 2024, the European Commission proposed PSD3 and PSR to replace PSD2. These proposals are set to reshape the payments landscape and aim to enhance security, reinforce consumer protection, and promote innovation across the industry. If you are operating in the payments, fintech, or ecommerce space, these changes will directly affect your business model, compliance strategy, and customer experience. This blog outlines the key changes to be introduced by PSD3 and PSR, how they impact your business, and what you need to do to stay compliant. ![PSD3 Editorial Illustration](https://media.ffycdn.net/eu/adyen/uCGdVhAA7C53uyUUq7UU.svg) --- ## What is PSD3? [PSD3](https://ec.europa.eu/commission/presscorner/detail/en/qanda_23_3544) is a proposed EU Directive that sets more robust licensing and supervision requirements on EU payment service providers (PSPs) and banks. For the rules to become legally effective, EU Member States must transpose PSD3 into their national laws.   PSD3 sets out rules for licensing and supervision, outsourcing, use of payment services agents and distributors, and operating cross-border within the EU.  ## What is PSR? PSR is a proposed EU Regulation that will apply directly in all EU Member States.  Most of the substantial regulatory requirements are set out under PSR. These include the regulatory authorisation requirements (including exemptions) and rules relating to data sharing, SCA and transaction authentication, and fraud prevention. ## PSD2 vs PSD3/PSR PSD3’s and PSR’s wider scope makes the new regime more suitable for today's payment landscape.  PSD2 required each EU country to implement the directive themselves, causing uneven implementation of the rules across the EU, increasing the risk of regulatory arbitrage.  PSD3 will cover the most important parts of PSD2: transparency, liability, and open banking. In addition, it introduces a number of significant changes, explained below. ## Key changes of PSD3 and PSR ### Strong Customer Authentication PSD3 will require businesses to share more data with issuers, allowing them to monitor environmental and behavioral characteristics like user location, transaction time, devices used, spending habits, transaction history, session data, and device IP. This will make it easier to quickly determine which transactions to accept and which to decline, leading to increased approval rates. The rules also state that under GDPR, personal data can be processed without user consent if it is strictly for fraud prevention. Responsibility for applying SCA correctly now lies with payment service providers, who will be held liable if it is implemented incorrectly. In addition, the new requirements make SCA more accessible for all users and provide authentication methods that don't rely on smartphones. The new rules clarify that SCA must be applied when adding a card to a digital wallet like Apple Pay or Google Wallet. Businesses need to support SCA at enrollment time, not just at checkout.  ### Open banking The PSR introduces changes to the existing open banking framework. It will remove obstacles to providing open banking services and increase uptime for banking and financial services. Payment initiation service providers (PISPs) and account information service providers (AISPs) will be able to build custom interfaces that connect to banks and other financial institutions. Banks and financial institutions must publish their API performance statistics quarterly, covering interface availability and performance. In addition, banks must offer consent dashboards that allow users to view and revoke data access granted to third parties. This benefits merchants relying on account information service providers (AISPs), as better visibility and control can improve trust in open banking flows. In case of bank downtime or disruptions, banks need to allow third parties (AISPs and PISPs) to use their own banking interfaces. This leads to more efficient payment processes for digital businesses and their customers. Following applicable civil law, businesses also retain the right to claim damages for losses incurred. ### Fraud PSD3 also involves a liability shift in terms of fraud. PSPs must verify the person paying through IBAN/name, extend PSP liability and shopper refund rights for social engineering scams, and support mandatory fraud education initiatives. Schemes, technical service providers (such as wallet providers), and payment gateways will be liable for fraud if they fail to apply SCA. This protects payers from technical malfunctions and encourages providers to maintain a high quality of service.  Issuers will be liable when spoofing fraud occurs. This is when a fraudster impersonates a bank's employee to make the user authenticate the payment. They will need to adapt fraud strategies to this evolving landscape. If the payer acts fraudulently or with gross negligence, they will remain liable. ### Payment and e-money institution licence regime PSD2 regulates payment institutions and e-money institutions under separate licenses. These separate licenses allow e-money institutions to issue e-money and perform payment services, while payment institutions are only allowed to perform payment services.  PSD3 proposes to merge these licences under a single regime (but with stronger requirements for those that issue e-money). Existing e-money and payment institutions must engage with supervisors to ensure compliance with the new authorization requirements.  ### Currency conversion fees PSR increases disclosures that PSPs must make to customers, including disclosures of currency conversion charges for credit transfers and money remittance transactions. PSR mandates that any currency conversion fees must be disclosed as a percentage mark-up over the European Central Bank official FX rate, shown before the transaction is initiated. This means checkout flows and receipts must be updated to reflect foreign exchange costs transparently. ## Changes to the Commercial Agent Exemption and impact on platforms and marketplaces Under PSD2, many platforms and marketplaces rely on the Commercial Agent Exemption to offer financial services without needing a license. The Commercial Agent Exemption applies when the platform or marketplace only acts on behalf of the payer or the payee, but not both. If acting for both, a platform can only avoid a licensing requirement if it relies on a licensed payment service provider like Adyen.  The draft of PSR published by the European Commission significantly narrowed the Commercial Agent Exemption, meaning many platforms and marketplaces would no longer be able to rely on it.  However, in the latest draft of PSR proposed by the European Council, the Commercial Agent Exemption is reverted closer to its original position under PSD2.  As a result, the continued availability of the commercial agent exemption to marketplace platforms under PSR is currently uncertain and will be known only when the final text of PSR is agreed by the EU institutions. This is expected to be published during the first half of 2026. PSR also seeks to implement a more consistent approach to the commercial agent exemption across the EU by mandating the European Banking Authority to develop guidelines for national regulators on the application of the exemption. ## What are the next steps for PSD3 and PSR? PSD3 and PSR were proposed by the European Commission in June 2024. They have since been reviewed by the European Parliament and European Council, with each party proposing a draft of the texts. The three institutions now seek to find political agreement and a final version is expected in Q1 or Q2 of 2026.  The member states usually receive an 18-month transition period, suggesting that PSD3 and PSR could take effect around 2027 or early 2028. ## What do platforms and marketplaces need to do next? Platforms and marketplaces should begin to think about how this legislation change could impact their business set-up. Adyen is closely monitoring the legislative progress of PSD3 and PSR and will help you remain fully compliant. ## How can Adyen help? Whether you want to get your own payment license or use Adyen for Platforms, we’re here to help.  [Adyen for Platforms](https://www.adyen.com/platform-payments) lets you embed payments directly into your platform or marketplace, so your users can sign up, sell, and get paid through one simple integration, all while staying compliant with PSD3 and PSR.  Our unified platform lets you manage payments and finance in one place, through a single integration. This makes it easy to scale your businesses by easily expanding and launching new products across multiple markets.  Since Adyen is a licensed credit institution, you are compliant no matter where your business grows. This also means we don’t rely on third parties, eliminating third-party delays and enabling instant processing and payouts. Owning our entire tech stack also gives you full control and flexibility to white-label, localise, and deliver the customer experience you want. Want to offer financial services and comply with PSD3/PSR? Learn more about [Adyen for Platforms](https://www.adyen.com/platform-payments).