Payment Services Regulation and PSD3 near final adoption

The EU is replacing its main payments law with two texts: the Payment Services Regulation (PSR), which applies directly in every member state, and the third Payment Services Directive (PSD3), which each state writes into national law. Together, PSD3 and the Payment Services Regulation (PSR) set the rules for payment accounts, card and transfer services, fraud protection and access to account data (Council position on the PSR (external site)).

The package replaces the second Payment Services Directive (PSD2) of 2015 and the second Electronic Money Directive of 2009 (Council statement of reasons on PSD3 (external site)). On 29 October 2026 the Council adopted its position at first reading on the PSR, which reflects the compromise agreed with Parliament (Council statement of reasons (external site)).

Under the agreed text, providers check that the IBAN matches the name of the beneficiary before executing a credit transfer (Council statement of reasons (external site)). EU law today requires this check only for euro transfers under the Instant Payments Regulation.

The text sets a liability regime for spoofing fraud, where a criminal poses as a bank employee or an official to persuade a customer to pay (Council statement of reasons (external site)). As an illustrative example only: a customer receives a call from a false bank employee and moves EUR 3,000 to a safe account; the regime sets when the provider bears that loss.

Providers also exchange fraud-related information with each other. Automated teller machine (ATM) users see all fees and exchange rates before a withdrawal, and shops can offer cash withdrawals without a purchase up to EUR 150 (Council press release, 27 November 2025 (external site)).

PSD3 covers the licensing and supervision of payment institutions and brings electronic money institutions under the same regime (Council statement of reasons on PSD3 (external site)).

The rules apply to banks, payment institutions and electronic money institutions that offer payment services in the EU (Council position on the PSR (external site)).

• Fraud Analyst: applies the IBAN and name check results and shares fraud data with other providers.
• Chargeback & Disputes Analyst: assesses customer refund claims under the spoofing liability rules.
• Payments Operations Analyst: runs the name check before executing every credit transfer.
• Cash Management Product Manager: updates fee disclosures and payment products to the new rules.
• Financial Crime Investigations Associate: investigates impersonation cases with information received from other providers.

The file follows the ordinary legislative procedure. The Commission proposed the package in June 2023, and Parliament adopted its first-reading position on 23 April 2024 (Council position on the PSR (external site)).

• 27 November 2025: provisional agreement between Council and Parliament (Council press release (external site)).
• 22 April 2026 and 5 May 2026: the compromise text was approved by Council ambassadors and by Parliament's economic affairs committee (Council statement of reasons (external site)).
• 29 October 2026: Council position at first reading adopted (confirmed).

Parliament now holds its second reading on the Council position (Council statement of reasons (external site)). The texts then appear in the Official Journal of the European Union (OJ). The application dates run from entry into force and are set in the final text.

PSD2 opened payment accounts to licensed third parties and introduced strong customer authentication. Parliament's committee report of 2024 on the PSR covers fraud, fees and access to account data (Parliament committee report on the PSR (external site)).

The Commission reviewed PSD2 and proposed in 2023 to move most rules into a regulation, so that they apply in the same words in every member state (Council statement of reasons on PSD3 (external site)).