The EBA and the ECB put payment fraud in the EEA at EUR 4.2 billion in 2024, and manipulation of the payer was "more than half of the total value of fraudulent credit transfers" (2025 Report on Payment Fraud, December 2025). PSD2's refund right covers unauthorized payments, and a manipulated payer has authorized the transfer.
That gap shaped the agreed Payment Services Regulation: refunds when fraudsters pose as the payer's own provider (Article 59) and monitoring before execution as a liability rule (Article 83(1a)).
What is PSD2?
PSD2 is Directive (EU) 2015/2366, adopted by the European Parliament and the Council on 25 November 2015 and published in the Official Journal on 23 December 2015. Member states applied it from 13 January 2018, the day the first Payment Services Directive (PSD1, Directive 2007/64/EC) was repealed (Articles 114 and 115).
As a directive it needs national law, and its security detail sits in a regulation: Delegated Regulation (EU) 2018/389, the technical standards on strong customer authentication and secure communication, applying from 14 September 2019. That pair is what "PSD2 regulation" usually means.
Its stated goal, in recital 109, is "the further integration of an internal market in payment services". Against PSD1, PSD2 brought payment initiation and account information into regulation (Annex I, points 7 and 8), services its recitals say emerged after PSD1 was adopted. It also made strong customer authentication a legal duty (Article 97) and applies parts of its rules to payments where only one provider is in the EU (Article 2(4)).
Who does PSD2 apply to?
PSD2 applies to payment service providers, among them banks, payment institutions and electronic money institutions, when they provide the eight services in Annex I: cash placed on or withdrawn from a payment account, the execution of transfers, direct debits and card payments (with or without a credit line), issuing cards and acquiring, money remittance, payment initiation and account information.
For payments in any currency where only one provider is in the EU, parts of it apply "in respect to those parts of the payments transaction which are carried out in the Union" (Article 2(4)). Each member state names the authority that licenses and supervises providers, with penalties that are "effective, proportionate and dissuasive" (Article 103), and the EBA keeps a central public register built from the national ones (Article 15), which recital 42 calls necessary for "easy public access" to the list of providers.
It does not reach the UK or the US: the UK has its own Payment Services Regulations 2017, and US payment firms follow US federal and state rules.
How does a payment work under PSD2?
Table 1. One payment under PSD2, stage by stage (illustrative). Sources: Directive (EU) 2015/2366, Articles 66, 67, 73 and 97; Delegated Regulation (EU) 2018/389, Article 2.
| Stage | What happens | Rule | Who decides |
|---|---|---|---|
| Account information | An app reads the customer's account with explicit consent | Article 67 | The customer |
| Payment initiation | A payment initiation provider asks the customer's bank to send EUR 120 to the shop | Article 66 | The customer, by explicit consent |
| Strong customer authentication | The bank checks two independent elements; the code is linked to the amount and payee | Article 97 | The bank |
| Fraud monitoring | The bank screens the payment for stolen credentials, amount, known fraud scenarios and malware | RTS Article 2 | The bank |
| Refund if unauthorized | Refund by the end of the following business day, unless fraud is suspected and reported to the authority | Article 73; unauthorized payments | The bank |
Take an online shop (illustrative) that takes a EUR 120 payment by payment initiation instead of a card. The third party provider reaches the account through the bank's dedicated interface (an API) under the RTS rules on secure communication, and the customer authorizes the transfer at the bank, which also runs the fraud checks.
Strong customer authentication means two or more elements from different categories, knowledge, possession and inherence, so independent that the breach of one leaves the others reliable (Article 4(30)). Multifactor authentication (MFA) is the generic idea; the law adds dynamic linking for remote payments. The RTS exempts trusted beneficiaries (Article 13), remote payments up to EUR 30 until EUR 100 or five payments have passed since the last check (Article 16), and low risk payments under transaction risk analysis (Article 18). The 2025 report found lower fraud rates on authenticated payments in general, "especially for card payments", and card fraud about seventeen times higher when the counterpart was outside the EEA, the territory of card not present fraud.
What must a payment provider have to comply with PSD2?
- Authorization with an AML plan. The application describes the internal controls for AML duties under Directive (EU) 2015/849 (Article 5(1)(k)), so the license and the AML program are read together.
- Security risk management. Mitigation measures and control mechanisms for operational and security risks (Article 95).
- Incident reporting. Notice to the home authority of a major operational or security incident without undue delay (Article 96).
- Strong customer authentication. On online account access, electronic payments and risky remote actions (Article 97).
- Secure third party access. Account access for payment initiation and account information providers through the RTS's secure communication standards.
- Fraud monitoring. Mechanisms that detect unauthorized or fraudulent payments (RTS Article 2), which the transaction risk exemption relies on (Article 18).
- Refunds and complaints. Unauthorized payments refunded by the end of the following business day (Article 73); complaints answered within 15 business days, 35 in exceptional cases (Article 101).
Where does PSD2 stop and AML law begin?
PSD2 licenses and governs payment services; a payment institution's AML duties come from Directive (EU) 2015/849 and, from 10 July 2027, from Regulation (EU) 2024/1624.
PSD2 transaction monitoring is fraud monitoring: Article 2 of the SCA rules asks a provider to catch unauthorized or fraudulent payments from signals such as stolen credentials, unusual amounts and malware. Checking whether a customer's activity fits the firm's knowledge of that customer, and reporting suspicion, comes from the AML rules (Article 13(1)(d) of the 2015 directive, as the fifth AML directive amended it) and is what AML transaction monitoring does. A payment institution needs both, and from 10 July 2027 the AML Regulation leaves account information services out of its financial institution definition while PSD2 still requires them to register.
complead, formerly Sanction Scanner, runs the AML side for payment providers: payer and payee are screened in real time with fraud signals scored in the same decision, and monitoring looks across accounts, wallets and merchants for mule networks and structuring. AI joins related alerts into one case and writes a first summary, and the analyst decides.
What are PSD3 and the Payment Services Regulation, and when do they apply?
Table 2. PSD2's successors and the instant payments rule, status on 29 October 2026. Sources: Legislative Observatory files 2023/0209(COD) and 2023/0210(COD); agreed text PE787.675; Regulation (EU) 2024/886.
| Instrument | Status on 29 October 2026 | What changes | Applies |
|---|---|---|---|
| PSD3, 2023/0209(COD)) | Agreed text approved in committee on 5 May 2026; awaiting the Council's first reading position | Authorization and supervision of payment institutions; repeals PSD2 and the Electronic Money Directive (2009/110/EC) | After adoption and transposition |
| Payment Services Regulation, 2023/0210(COD)) | Same stage; plenary indicated for 14 December 2026 | Name and identifier checks (Article 50), impersonation refunds (Article 59), monitoring before execution (Article 83(1a)), fraud data sharing (Article 83a) | 21 months after entry into force; Articles 50 and 57 after 27 months (agreed text787675_EN.pdf)) |
| Regulation (EU) 2024/886 | Adopted 13 March 2024, in force | Verification of the payee for credit transfers (new Article 5c of Regulation (EU) No 260/2012) | Euro area by 9 October 2025; other member states by 9 July 2027 |
Until both texts are adopted and apply, PSD2 and the 2018 RTS remain the law. The impersonation refund is narrow: a consumer manipulated by someone posing as their own provider, through channels attributed to it, is refunded if they notified the provider and reported to the police, unless they acted fraudulently or with gross negligence, and the provider decides within 15 business days. Other authorized push payment fraud stays outside it. SEPA, the single area for euro credit transfers and direct debits, runs on Regulation (EU) No 260/2012, a separate layer that 2024/886 amended.
Where did PSD3 get to in 2026?
- 5 May 2026. Parliament's Economic and Monetary Affairs Committee approved the agreed texts of PSD3 (PE787.673) and the Payment Services Regulation (PE787.675).
- 29 October 2026. The Legislative Observatory lists both as "Awaiting Council's 1st reading position".
- 14 December 2026. The indicative plenary date for both.
What a payment provider has to settle now is whether its two monitoring controls are written up as two, the fraud monitoring the SCA rules require and the AML monitoring the AML rules require, each with an owner, before monitoring before execution becomes a refund rule.
Related terms
- Transaction fraud. A payment made without the account holder's authority or obtained by deceiving them.
- APP fraud. Authorized push payment fraud, in which the payer is tricked into sending the money.
- Card not present fraud. Card fraud in online, phone or mail payments where the card is not shown.
- Account takeover fraud. A criminal gains control of a real customer's account and uses it.
- 5AMLD. The fifth AML directive, an amendment to the 2015 EU AML directive.
- Money services business. The US term for money transmitters, check cashers and similar firms under FinCEN rules.
How this entry was checked. For this entry Melis Alparslan (Regional Sales Manager, complead) opened Directive (EU) 2015/2366, Delegated Regulation (EU) 2018/389, the EBA and ECB 2025 Report on Payment Fraud, the Legislative Observatory files on PSD3 and the Payment Services Regulation with the agreed text PE787.675, Regulation (EU) 2024/886, Directive (EU) 2015/849, Regulation (EU) 2024/1624 and the UK Payment Services Regulations 2017. The definition rests on the directive's own articles; the shop and its EUR 120 payment are illustrative, and the status of PSD3 and the Payment Services Regulation is the Observatory's as of 29 October 2026. Ufuk Gürdaş, Compliance Specialist, checks each article reference against the Official Journal text ahead of publishing. Last reviewed: 30 October 2026.
