PSD2 (Second Payment Services Directive)

What it is

The second Payment Services Directive, Directive (EU) 2015/2366 (PSD2), is the EU law for payment services and the firms that provide them. It applies from 13 January 2018. It sets who may provide payment services (banks, payment institutions, e-money institutions and a few others), how they are authorised, what they must tell customers, how fast payments must be executed and who bears losses when things go wrong. It also brought two new regulated services, payment initiation and account information, and required strong customer authentication.

Why it matters

PSD2 created open banking in the EU: banks must let authorised third parties access payment accounts, with the customer’s consent, through a secure interface. It shapes daily operations through execution times (credit transfers reach the payee’s bank by the next business day), value dating, refund rights and liability rules. For an unauthorised payment, the payer’s bank must refund by the end of the next business day, and the payer bears at most 50 euro unless there was fraud or gross negligence. A new directive (PSD3) and a directly applicable Payment Services Regulation (PSR) are due to replace PSD2; the Council and the Parliament reached a provisional agreement on them in November 2025.

Worked example

Illustrative numbers. A customer’s card details are stolen and used for 400 euro of online purchases. She reports it the same day. Unless the bank can show fraud or gross negligence by the customer, it must refund the 400 euro by the end of the next business day. If the purchases went through without strong customer authentication where it was required, the customer bears nothing, not even the first 50 euro. If it was the merchant’s provider that failed to accept strong customer authentication, the customer’s bank can claim the 400 euro back from that provider.

Who uses it

Regulatory change analysts (COMPL-REG) track the PSD2 rules and their successors. Compliance officers (COMPL) check disclosures, complaints handling and authorisation conditions. Cash management product managers (PCMPROD) design products within execution time and fee rules. Payments partnerships managers (ACQPART) build integrations with third-party providers and gateways. Fraud analysts (AML-FRAUD) apply the liability and reporting rules after fraud. Legal counsel (LEGAL) interpret liability and contract terms.

Common confusions

PSD2 is a directive, so each Member State transposed it into national law and details differ by country. Many technical rules sit in other texts, such as the Regulatory Technical Standards on strong customer authentication and guidelines of the European Banking Authority. Card fee caps sit in the Interchange Fee Regulation, and SEPA formats in the SEPA Regulation. Finally, the 50 euro limit is the maximum loss for the payer in normal cases; it does not apply when the payer could not detect the loss before the payment or when the bank’s own staff caused it.