PSD3 and Payment Services Regulation (PSR)
- Official title
- Proposal for a Regulation on payment services in the internal market (2023/0210(COD)) and Proposal for a Directive on payment services and electronic money services (2023/0209(COD))
- Reference
- 2023/0210(COD), 2023/0209(COD)
- Status
- Not published in the Official Journal: not applicable law today. The Council adopted its first-reading position on 29 October 2026 (early second-reading procedure) and published it on 5 November; Parliament must approve it at second reading, with an indicative plenary date of 14 December 2026. Directive (EU) 2015/2366 (PSD2) still applies. PSD3 repeals PSD2: the PSD2 references in this entry will lapse once PSD3 applies.
- Who it reaches
- Strong customer authentication duties fall on payment service providers, not on the merchant. The merchant's exposure is indirect: if it or its provider fail to accept strong customer authentication, they are liable for the damage to the payer's provider. PSR and PSD3 obligations cannot be cited as in force until published and the application date set by the final text.
Dates
- : Commission proposal Official source
- : Parliament first-reading position Official source
- : Council adopts its first-reading position on the PSR (voting result) Official source
- : Council adopts its first-reading position on PSD3, which repeals Directive (EU) 2015/2366 (voting result) Official source
- : Council position published Official source
- : Indicative Parliament plenary date, second reading (not confirmed) Official source
What it means for your store
- Context: binds others, not you
Today (PSD2) strong customer authentication is applied by the payer's payment service provider when the payer initiates an electronic payment or acts through a remote channel with fraud risk. It does not bind you; it explains why your gateway requires it.
Art. 97(1) de la Directiva (UE) 2015/2366 · Official source
- Obligation
Under the national law transposing Art. 74(2) PSD2: where the payee (the merchant) or its payment service provider fails to accept strong customer authentication, it must refund the financial damage caused to the payer's payment service provider.
Art. 74(2) de la Directiva (UE) 2015/2366 (vía transposición nacional) · Official source
Where to start
- Level 4: ask your gateway how it handles agent-initiated payments (strong authentication, exemptions, merchant-initiated transactions) and who bears the risk if it is not applied.
- Level 4: do not disable or bypass strong authentication so the agent completes the purchase without friction: the transposition of Art. 74(2) PSD2 shifts the damage to you.
- PSR and PSD3: do not treat them as in force; prepare with the text of the Council position and set deadlines once they are published in the Official Journal with their application date.
Related levels
Level 4: Payable; Level 5: Trustworthy
Related tools
Verified on
All regulation