PSD2 Compliance: Revised Payment Services Directive
Directive (EU) 2015/2366 has applied since 13 January 2018, expanding open-banking access and strong customer authentication across the EEA. It obliges banks to grant licensed third-party providers (TPPs) secure API access and to apply two-factor SCA for most electronic payments, slashing fraud and boosting competition. A 2023 package proposes PSD3 and an accompanying Payment Services Regulation to reinforce these protections.
What is PSD2?
PSD2 modernises EU payments by mandating secure, standardised account-access APIs so that payment-initiation and account-information service providers can innovate on top of bank data. It introduces Strong Customer Authentication (SCA), two independent factors for most card and online payments, and sets clear liability rules to protect consumers from unauthorised or push-payment fraud. All payment service providers must report major incidents to regulators and follow new transparency rules on disputes and charges. A 2022 EBA RTS amendment added an SCA exemption for account access, while the 2023 PSD3/PSR draft aims to tighten fraud refunds and widen direct access to EU settlement systems.
Key Features of PSD
PSD2 Regulation explores various facets of financial services compliance:
Open Banking to allow TPP access to bank data
This feature mandates banks to provide Third-Party Providers (TPPs) access to their customers' financial data, given the customers' consent. It paves the way for a more integrated financial ecosystem, where consumers can benefit from personalized financial services, including budgeting, financial management tools, and more competitive payment solutions.
Enhanced Customer Protection with strong customer authentication (SCA)
To increase the security of electronic payments and reduce the risk of fraud, PSD introduces strict customer authentication requirements. These requirements ensure that electronic payments are performed with multi-factor authentication, providing an additional layer of security that protects consumers' financial data.
Increased Competition by enabling third-party payment services
By requiring banks to open their payment services to third parties, PSD fosters a competitive environment where non-bank financial service providers can offer payment and account services. This competition is intended to lead to better services, lower costs, and innovation in the payments industry.
Stricter Security Requirements for electronic payments
PSD sets out higher security standards for electronic payments and the protection of financial data. These include rigorous technical and operational requirements for all parties involved in electronic payments, aiming to ensure the integrity and security of payment services and protect users against fraud and other security risks.
Implications of PSD
PSPs must deploy secure REST APIs, embed SCA flows, update customer consent terms, monitor fraud in real time and store incident logs. Banks should prepare for PSD3 by validating confirmation-of-payee checks and reviewing APP-fraud refund processes well ahead of the expected 2026 application date.
.png)
Grand: Enhancing PSD Compliance
-p-1080.png)
-p-1080.png)
-p-1080.png)
-p-1080.png)
.png)
How Grand Helps
Each component of Grand.io's GRC software suite is designed to seamlessly align with the PSD2 regulation, targeting critical areas such as transaction security, third-party provider (TPP) access management, customer authentication protocols, and ongoing adjustments to legislative updates.
Frequently Asked Questions
EU Directive 2015/2366 that opened banking data and enforced two-factor authentication across EU payments.
PSD strengthens consumer protection and security by requiring strong customer authentication for electronic payments and setting clear rules for the liability of unauthorized transactions. It mandates that payment service providers apply measures to safeguard the confidentiality and integrity of users' security credentials and personal data
Two independent factors (knowledge, possession, inherence) required for most online or card payments and account access. (European Banking Authority)
A 2023 proposal would merge PSD2 e-money rules into a new Payment-Services Regulation, enhance fraud refunds and extend settlement access, target application 2026.
