Shaping the Future of Payments: Insights into the EU Proposal for the Payment Services Directive 3 and the Payment Services Regulation

Introduction

There have been significant strides in the payment services sector, with electronic payment transactions across the EU, soaring to €240 trillion in 2021, a growth largely fuelled by the COVID-19 pandemic [1]. However, this growth has been accompanied by increasingly complex forms of fraud, threatening consumer security and eroding confidence in the electronic payments’ ecosystem.

Background and Objectives

On 28 June 2023, the European Commission (“EC”) announced its plans to modernise the financial and payment sectors for the digital era. The EC has presented proposals for the Payment Services Directive 3 (“PSD3”) and a new Payment Services Regulation (“PSR”) aiming to strengthen the foundations laid by earlier PSDs. In particular, the proposal for a Directive of the European Parliament and of the Council on Payment Services and Electronic Money Services seeks to amend Directive 98/26/EC and repeal Directives 2015/2366/EU (“PSD2”) and E-Money Directive 2 2009/110/EC (“EMD2”), signalling a significant update to the legal framework for payment services and electronic money within the internal market.

The proposal for a Directive and a Regulation on payment services in the internal market was based on an impact assessment [2] which identified four key problems in the EU payment market:

• consumers are at risk of being victims of fraud and lack confidence in electronic payments;
• the open banking sector functions imperfectly;
• the powers granted to, and the obligations imposed on EU supervising authorities vary;
• there is an uneven playing field between banks and non-bank payment service providers (PSPs).

The PSD3 and the PSR introduce several key changes and innovations to combat the problems identified.

Proposed Key Changes and Innovations

Consolidation of the legal framework for e-money and payment institutions

Under PSD3, e-money institutions (“EMIs”) will be integrated into the same regulatory framework as payment institutions (“PIs”) through a unified licensing system.  As a result, EMIs will be licensed as PIs under PSD3, and existing PIs will be granted authority to issue e-money, significantly expanding their capabilities and enabling them to offer a wider range of financial services.

Under the new framework there will be a single set of requirements for licensing, conduct of business and prudential supervision for both payment and e-money services.

The repeal of EMD2 and its incorporation into PSD3 will therefore streamline the regulatory landscape, reducing redundancy and promoting greater regulatory clarity.

Enhancement of fraud prevention measures to improve consumer protection

Fraud remains a serious concern, with new and sophisticated methods being increasingly used in the payments industry even after the implementation of PSD2. Fraud incidents erode consumer confidence in the financial system, necessitating the introduction of protective measures.

PSD3 and the accompanying PSR aim to address these challenges by introducing stronger consumer protections and modernising fraud prevention mechanisms. These include,

• strengthening customer authentication rules by requiring more robust methods to verify users’ identities during transactions, such as: (i) requiring PSPs to offer a range of authentication methods suitable for individuals with disabilities and elderly individuals; and (ii) introducing provisions for auditing and controlling security measures when technical service providers are involved in customer authentication.
• promoting greater collaboration among PSPs by facilitating the exchange of fraud-related information, facilitating early detection and coordinated responses to potential threats.
• introducing IBAN/name matching, which helps to ensure that payments are directed to the correct recipients, reducing errors and preventing fraud involving misdirected payments.
• improving consumer rights by enhancing transparency in payment processes and extending the right to refunds in cases of fraud, ensuring that consumers are better protected and informed throughout the payment process.

Enhanced Consumer Rights under PSD3

PSD3 aims to strengthen consumer rights across the EU by promoting transparency, and fairness. The key areas of focus include:

• Transparency in Currency Conversion Charges: PSPs will be required to disclose estimated currency conversion charges and transfer times for credit transfers and remittances outside the EU.
• Clear Identification of Payees: To reduce confusion and unnecessary fraud concerns, PSD3 mandates that payment account statements include clear payee information, ensuring consumers can easily recognise legitimate transactions.
• ATM Fee Disclosure: Consumers will gain greater clarity on ATM fees, as PSPs must inform users about charges from all ATM operators in their member states.
• Fairness in Temporarily Held or Blocked Funds: New rules will ensure that funds temporarily blocked by merchants (e.g., at petrol stations, hotels, or car rental agencies) are proportionate to the final transaction amount and released promptly, minimising delays and financial inconvenience for customers.

Encourage Open Banking (“OB”)

 Regulating OB was a significant innovation under PSD2. OB facilitates the secure sharing of financial data between banks and PSPs, strictly based on the consumer’s explicit request and consent. This empowers consumers to utilise their data for personal benefits, such as analysing spending patterns, tracking budgets, or managing savings through customised solutions provided by PSPs.

However, the EC has raised concerns about the accessibility of OB services for certain PSPs, such as Account Information Service Providers (“AISPs”) and Payment Initiation Service Providers (“PISPs”). Key issues include limited accessibility to OB services, suboptimal performance of data access interfaces, and insufficient control for consumers over their data permissions.

To address these issues and promote OB, PSD3 and PSR will:

1. introduce a list with prohibited obstacles to data access (e.g. removing restrictions on PISPs initiating payments to non-beneficiary payees).
2. introduce a permissions dashboard which will allow users to manage and withdraw data access to OB providers anytime.

The above measures will give consumers greater control over their payments data and transparency regarding the rights they have granted to PSPs; these should ultimately improve consumer trust in, and usability of, the OB ecosystem.

Creating a Level Playing Field Between Banks and Non-Bank PSPs

 Non-bank PSPs, (PIs and EMIs), compete with banks in offering payment services. However, since these services depend on access to a bank account, non-bank PSPs remain reliant on banks to function. This reliance often creates obstacles, as PIs and EMIs frequently encounter difficulties in obtaining bank accounts.

 To rectify this disparity, PSD3 and PSR aim to provide non-bank PSPs with better access to bank accounts, creating a more balanced competitive environment. Banks will be required to present stronger, well-founded justifications, such as verified suspicions of illegal activity, for denying bank accounts. These reforms strive to encourage fair competition and build a more inclusive and equitable payments landscape.

Improve the availability of cash in shops and via ATMs

Retail store operators are exempt from the requirement for a payment institution licence when offering cash withdrawal services without a purchase on their premises (on a voluntary basis), provided the cash withdrawn does not exceed EUR 50. This exemption is designed to prevent unfair competition with ATM operators.

Independent ATM deployers (distributors of cash via ATMs that do not service payment accounts) are also exempt from payment institution licensing requirements. Under PSD3 they will be subjected to a registration requirement, which must be accompanied by specific documentation.

Transitional Provisions under PSD3 and PSR

To ensure a smooth transition to the updated regulatory framework introduced by PSD3 and PSR, transitional measures have been put in place to accommodate existing activities regulated under PSD2. These measures are particularly important given the introduction of a new legal licensing regime, which requires adjustments for both PIs and EMIs.

One key provision is the grandfathering of existing licences for PIs and EMIs. Under this arrangement, licences issued under PSD2 will remain valid for an extended period—up to 30 months following the entry into force of PSD3. This period includes:

• 24 months to apply for a new licence: PIs and EMIs must submit their applications for a licence under PSD3 within two years of the directive coming into force.

• An additional 6 months of validity: Existing licences will continue to be valid during the final six months while applications are reviewed, and decisions are made.

Implementation Timeline

While the exact enforcement dates for PSD3 and PSR are still pending, industry experts anticipate the following timeline:

• The finalised versions of PSD3 and PSR are expected to be completed and published by early 2025, once the legislative process is concluded.
• EU Member States are likely to be given an 18-month transition period to implement the new regulations, allowing for necessary adjustments and compliance efforts.
• Full adoption and enforcement of the regulations across the EU are projected to take place around 2026, marking the point at which the new legal framework will be fully operational.

This timeline allows ample time for all stakeholders in the payments ecosystem to adapt to the changes and ensure smooth integration into the updated regulatory environment.

Conclusion – Challenges and Opportunities

PSD3 and PSR will introduce significant regulatory changes and PSPs will need to invest time and resources in understanding and implementing the new rules. It is expected that these changes will impact significantly their operational processes, technology infrastructure, and internal policies.  Adapting to the new licensing requirements, ensuring transparent communication with consumers, and upgrading security standards to meet the enhanced consumer protection measures may require substantial effort and costs.

However, these new regulations will also present opportunities for innovation and market expansion. PSPs that embrace the changes early on can position themselves as leaders in a more unified, transparent, and secure payments ecosystem.

Ultimately, those who view PSD3 and PSR as an opportunity for growth, rather than just a compliance burden, will be better positioned to thrive in the changing payments environment.