Payment Services Directive (PSD3)

Our Fintech team considers the future of the EU retail payments industry in light of the European Commission’s recent proposals to overhaul the existing payments legislation.

The European Commission, recognising advancements in payment technologies and the rise of fraud, proposed a modern legislative framework intending to replace PSD2 with a new Payment Services Directive (PSD3) and introduce a Payment Services Regulation (PSR).

PSD3 is intended to deal primarily with the authorisation and supervision of payment service providers, while PSR will govern other relevant areas. These include customer transparency and standardised rules for the use of payment services.

Market developments not covered by PSD2

In its review, the Commission identified a number of issues that are not adequately addressed by PSD2, including the following:

• New and more sophisticated types of fraud continue to emerge, including for example, social engineering fraud and impersonation fraud.
• The current Open Banking framework is not competitive. Non-banks must contend with obstacles to providing open banking services, such as issues with data access permissions, which do not arise for banks.
• There is an unlevel playing field between bank and non-bank payment service providers (PSPs) like electronic money institutions (EMIs) and payment institutions (PIs). Non-bank PSPs do not have direct access to certain payment systems and also face difficulties when opening and closing bank accounts.
• There is a lack of harmonisation and consistency across Member States in terms of the implementation and use of enforcement powers by regulators.

Objectives of PSD3 and PSR

The main objectives of the Commission’s proposals include:

• Strengthening user protection and confidence, by introducing measures to combat and mitigate payment fraud. Examples of these measures include:
  • Giving victims of fraud a right of refund by their bank or other PSP in certain circumstances
  • Helping banks and other PSPs cooperate against fraud through increased fraud-related information sharing, and
  • Imposing obligations on banks to improve customers’ awareness about fraud.
• Improving consumer rights, by proposing more transparency for credit transfers/money remittances from the EU to third countries, payment account statements, and ATM charges.
• Further levelling the playing field between banks and non-bank PSPs. This would be achieved by widening accessibility to bank accounts for PIs and EMIs and granting them the ability to participate directly in all payment systems. Banks will be required to provide justification for refusing a non-bank PSP access to a bank account.
• Improving the functioning of Open Banking to better facilitate innovative payment services, for example via state-of-the-art dedicated interfaces. Other measures will allow customers more control over their data, including the ability to grant or withdraw data access permission from any PSP.
• Improving the availability of cash, by allowing retailers to provide cash services to customers without requiring a purchase and by clarifying the rules for ATM operators.
• Strengthening harmonisation and enforcement. This would be done by enacting payment rules in a directly applicable regulation, i.e., the PSR, and by merging the legal frameworks applicable to electronic money and to payment services.

EMIs

Perhaps one of the most notable changes proposed is the streamlining of rules for EMIs and PIs. Currently, the Second E-Money Directive (EMD2) governs the rules on authorisation and supervision of EMIs, while PSD2 governs the rules on authorisation and supervision of PIs. A merger of the two regimes is proposed to provide for a consolidated set of rules for PIs and EMIs under one piece of legislation. It is envisaged that EMIs will no longer operate as EMIs but as PIs in accordance with PSD3.

A limited transition period will be in place during which existing EMIs and PIs can continue to provide services but will likely have to “reapply” for authorisation under PSD3. We can advise PIs and EMIs regarding the information and documentation to be submitted to the Central Bank to obtain a new authorisation under PSD3 in due course.

Conclusion

The proposals published by the Commission will now undergo a review by the Council and the European Parliament. Once adopted, PSD3 must be transposed into Irish law.

Banks and PSPs should be mindful that the PSR will not require implementation and will have direct application in Ireland, albeit with a specific transitional period. The new regime is likely to come into effect sometime in 2026.

We can assist existing PIs and EMIs in assessing the impact that PSD3 and the PSR will have on their authorisation and recommend that firms start to take the time now to consider the implications of the proposals on their business.

If you require more information, please contact a member of the Financial Services Regulation team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.