What PSD2 covers
- Payment services: eight are listed in Annex I, from payment accounts and transfers to card issuing, acquiring, money remittance, payment initiation and account information.
- Licensing: a payment institution is authorised in one Member State and may then serve the others.
- Safeguarding of customers' funds (Article 10).
- Liability: an unauthorised payment is refunded by the end of the following business day, and the payer bears at most EUR 50 for a lost or stolen instrument (Articles 73 and 74).
- Security: strong customer authentication (Article 97).
What PSD2 changed
PSD2 replaced the first directive, of 2007, which was repealed on 13 January 2018. It brought two new services under licence: payment initiation, where a provider starts a payment from an account the payer holds elsewhere, and account information, which gathers a user's account data in one place.
Users have the right to use those providers on any payment account that is accessible online (Articles 66 and 67), which is the legal basis of open banking in the EU. The technical standards on strong customer authentication, Delegated Regulation (EU) 2018/389, have applied since 14 September 2019.
What replaces PSD2
The EU has agreed a third directive, PSD3, and a Payment Services Regulation, but had not adopted them on 13 October 2026: the texts were awaiting the Council's first-reading position. Until they apply, PSD2 is the law.
PSD2 is a directive, so each Member State wrote it into national law, and the UK did so in its Payment Services Regulations 2017. A product that moves money in the EU meets PSD2 as a licensed institution, as an institution's agent, or as a technical provider outside its scope.
PSD2, PSD3 or open banking?
- PSD3 and the Payment Services Regulation
- The successors, agreed but not adopted. The directive would cover licensing, and the regulation would carry the rules on strong customer authentication.
- Open banking
- The practice that PSD2's account access rules made possible. PSD2 is the law, and open banking is what was built on it.
- E-Money Directive
- Governs the issuing of e-money. PSD2 governs the payment services an e-money institution provides with it.
Where PSD2 shows up in a platform
Modules that do the work
- Accounts & IBANsCustomer accounts with their own IBANs, on the partner bank and the rails you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- PayoutsMoney out to bank accounts, cards and wallets, on the rail that fits each payment.
Platforms that need it
Guides that go deeper
- EMI or payment institution licence in the EU, and the agent routeWhat an e-money institution and a payment institution may do in the EU, the capital each needs, safeguarding, passporting, and launching as an agent first.
- How to become a PSP or a payment facilitatorGateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, consolidated (EUR-Lex)
- Delegated Regulation (EU) 2018/389, the technical standards on SCA, consolidated (EUR-Lex)
- PSD3, procedure 2023/0209(COD) (European Parliament, Legislative Observatory)
General information, not legal advice: what applies to you depends on your services and your market.