EU PSD2 — Payment Services Directive (Directive (EU) 2015/2366)

Why does it matter?

PSD2 changed who may touch a customer's bank data and how a customer proves who they are. It opened payment accounts to regulated third parties with the customer's consent and tightened security and liability for everyone who processes payments.

Key benefits include:

• Regulated third-party access

Payment initiation and account information service providers can access payment accounts with the customer's explicit consent, and banks must allow it (Articles 36, 66 and 67).

• Strong customer authentication

Providers apply strong customer authentication when the payer accesses an account online, initiates an electronic payment or acts remotely in a way that may imply fraud risk (Article 97(1)).

• Fast refunds

The payer's provider refunds an unauthorized payment immediately and in any event by the end of the following business day (Article 73(1)).

• Capped consumer losses

A payer may bear losses from a lost or stolen payment instrument only up to EUR 50, with exceptions such as fraud (Article 74(1)).

• Incident reporting

Providers notify their authority without undue delay of a major operational or security incident and tell affected users if their financial interests may be affected (Article 96).

How does it work?

The Directive has six titles. Title I sets subject matter, scope and definitions. Title II covers payment service providers and their authorization, including capital (Article 7) and the rules for account information providers (Article 33). Title III covers transparency of conditions and information. Title IV covers rights and obligations, including access to accounts (Article 36), consent (Article 64), liability (Articles 73 and 74) and security (Articles 95 to 98).

Payment initiation and account information providers rely on the authentication procedures the account servicing provider offers its customer (Article 97(5)) and must identify themselves to the account provider. Account providers may deny access only for objectively justified and duly evidenced reasons relating to unauthorized or fraudulent access (Article 68(5)).

Article 98 mandates regulatory technical standards from the EBA on authentication and secure communication. Providers also keep records to prove authentication and execution of transactions (Article 72), and run complaints and dispute resolution procedures (Articles 99 to 101).

Key Elements

• Authorization and supervision (Titles I and II)

Payment institutions are authorized and supervised by home Member State authorities, with initial capital rules and a professional indemnity requirement for some providers.

• Access to accounts (Articles 36, 66 and 67)

Credit institutions give authorized payment initiation and account information providers access to payment accounts, on an objective, non-discriminatory and proportionate basis.

• Consent (Article 64)

A payment transaction is authorized only if the payer has given consent, in the form agreed, and consent can be withdrawn.

• Authentication (Article 97)

Strong customer authentication with dynamic linking to the amount and payee for remote electronic payments, and protection of personalized security credentials.

• Liability and refunds (Articles 71 to 74 and 89)

Payers notify unauthorized or incorrect transactions, providers bear the burden of proof of authentication, refund promptly and the payer's liability is capped at EUR 50 in defined cases.

• Operational and security risk and incidents (Articles 95 and 96)

A risk framework, an annual assessment of risks provided to the authority, and notification of major incidents without undue delay.

What does it cover?

PSD2 applies to payment service providers listed in Article 1: credit institutions, electronic money institutions, post office giro institutions, payment institutions, and the ECB, national central banks and Member State authorities when they are not acting as public authorities. It covers payment services provided in the Union, with different rules where only one provider is in the Union. It excludes activities listed in Article 3 such as some cash and commercial agent activities.

What are its objectives?

PSD2 aims for a safer and more competitive payments market with better consumer protection.

Make payments safer through strong customer authentication and security requirements.

Open payment accounts to regulated providers with the customer's consent.

Give consumers clear refund rights and capped liability for unauthorized payments.

Harmonize authorization and supervision of payment institutions.

Increase competition and innovation in payment services.

Framework in Context

PSD2 is a directive that Member States transposed into national payment services law, so the exact rules depend on the country. It works with the EBA's technical standards on authentication, with the GDPR for the data it processes (Article 94) and with the DORA and NIS2 rules on operational resilience. The Commission has proposed replacing it with a new payment services directive and a payment services regulation; those were not in force on 14 Oct 2026.

Common Framework Mappings

Payment service providers map PSD2 to the regulations and standards they already run so one control set covers authentication, access, security and reporting obligations.

Mapped frameworks include:

EU Digital Operational Resilience Act (DORA)

EU General Data Protection Regulation (GDPR)

EBA Guidelines on ICT and security risk management (EBA/GL/2019/04)

NIS2 Directive

PCI DSS v4.0.1

ISO/IEC 27001:2022