Digital payments, made understandable, one standard at a time.
Brevixoo brings together instant payment protocols, payment gateway security principles and open banking API standards. Our analyses are based on legislation, technical specifications and public sources.
- 01Payment initiationThe merchant creates a payment request via the APIAPI
- 02Bank selection and redirectThe payer is redirected to their own bankPISP
- 03Strong authenticationTwo mutually independent factorsSCA
- 04Verification of payeeName and IBAN are checked before approvalVoP
- 05Instant transferFunds reach the payee within secondsSCT Inst
- 06Status confirmationA signed notification to the merchant's systemWebhook
What modern payment infrastructure requires
A payment that looks like a single tap to the user is, behind the scenes, the combined work of several systems, agreements and regulations. We structure the whole into four mutually supporting areas.
Instant payment protocols
In an instant payment, funds move from the payer's account to the payee's account within a few seconds, around the clock. In the euro area this is done through the SEPA Instant Credit Transfer scheme (SCT Inst).
- EU Instant Payments Regulation (EU) 2024/886
- Settlement systems TIPS and RT1
- ISO 20022 message structure
- Verification of payee (VoP)
Payment gateway security
A payment gateway is the interface between the merchant and the financial system. Its security is built on encryption, authentication, integrity checks and continuous monitoring.
- TLS 1.2+/1.3 and mutual TLS (mTLS)
- Tokenisation and PCI DSS v4.0
- Signed webhook notifications
- Idempotency and retries
Open banking APIs
PSD2 required banks to open payment account interfaces to authorised third parties. Interoperability between these APIs relies on shared standards and certificates.
- Berlin Group NextGenPSD2
- OAuth 2.0 and FAPI security profiles
- eIDAS certificates (QWAC, QSealC)
- RTS (EU) 2018/389 – SCA and secure communication
Financial data privacy and compliance
Open banking moves financial data to new parties. Responsible processing requires a clear legal basis, data minimisation and technical safeguards across the entire value chain.
- GDPR (EU) 2016/679
- PSD2 explicit consent
- DORA (EU) 2022/2554
- PSD3 and the Payment Services Regulation (PSR)
Six controls every integration should include
The following principles are established good practice in the industry, whether you process card payments, credit transfers or both. They do not replace the provider's own documentation.
Transport-layer encryption
All traffic over TLS 1.2 or later, preferably TLS 1.3. For server-to-server traffic, mutual TLS authentication (mTLS) verifies the identity of both parties.
Tokenisation
Sensitive identifiers such as card numbers are replaced with tokens that have no value outside the processing environment. This narrows the scope of the PCI DSS assessment.
Message integrity
Webhook notifications reporting payment status are signed (e.g. HMAC-SHA256) and timestamped. The recipient verifies the signature and rejects stale messages.
Idempotency
Each payment request is given a unique idempotency key, so a retry after a network outage does not create a duplicate charge.
Key management
Encryption keys and API credentials are stored in a dedicated key management system or HSM, rotated regularly, and access is restricted on the principle of least privilege.
Monitoring and incidents
Risk-based transaction monitoring, centralised log collection and a documented incident process. In the financial sector, the DORA Regulation sets a binding framework for these requirements.
A common language for APIs
Open banking only works if hundreds of banks and providers speak the same technical language. Below are the key standards and regulations on which the European ecosystem relies.
- Directive (EU) 2015/2366 – PSD2
- Defines payment initiation services (PIS) and account information services (AIS), and the obligation of banks to give them access to payment accounts.
- Delegated Regulation (EU) 2018/389
- Regulatory technical standards for strong customer authentication and common and secure open standards of communication.
- Berlin Group NextGenPSD2
- A widely used European API framework that harmonises the structure of account, payment and consent interfaces.
- OAuth 2.0 and FAPI
- The authorisation protocol and the high-security profiles drawn up by the OpenID Foundation for the financial sector.
- eIDAS certificates
- Third parties identify themselves to banks with qualified website authentication certificates (QWAC) and qualified electronic seals (QSealC).
- ISO 20022
- The international financial messaging standard used by SEPA payments and European settlement systems.
Key dates of the Instant Payments Regulation and the payments package
The EU Instant Payments Regulation (EU) 2024/886 turns instant transfers from the exception into the baseline. At the same time, the successors to PSD2 – the PSD3 Directive and the Payment Services Regulation (PSR) – are being prepared.
Obligation to receive and price parity
Payment service providers in the euro area must be able to receive instant payments, and an instant payment may not cost more than a regular credit transfer.
Obligation to send and verification of payee
Payment service providers in the euro area must offer the sending of instant payments and verification of the payee's name (Verification of Payee).
PSD3 and PSR: provisional political agreement
The European Parliament and the Council reached a provisional agreement on the payments package. The final compromise texts were published in April 2026.
Non-euro Member States: receiving
The obligation to receive and price parity extend to Member States outside the euro area.
Payment and e-money institutions
The obligation to receive begins for payment institutions and e-money institutions; in the euro area, the obligation to send as well.
Sending and VoP outside the euro area
The obligation to send and verification of payee in Member States outside the euro area.
Sources: Regulation (EU) 2024/886; summaries published by the European Central Bank and legal experts. Detailed analysis: Instant transfers: SEPA Instant and the EU Instant Payments Regulation.
Deeper into the structures of payments
Each technology area examines one domain from the perspective of architecture, standards and risk management.
Digital payment processing
The payment lifecycle from initiation to settlement: gateways, processors, account-to-account payments and reconciliation.
Read more →Secure authentication protocols
Strong customer authentication (SCA), bank IDs, OAuth 2.0 / FAPI and dynamic linking in the PSD2 environment.
Read more →Transaction infrastructure
SEPA schemes, TIPS and RT1, ISO 20022 messages, idempotency, availability and operational resilience.
Read more →Latest analytical guides
In-depth, source-based guides on open banking, instant transfers and financial data privacy.
The ISO 20022 messaging standard and the future of real-time payments in Europe
The migration to ISO 20022, rich-data message structures and how SEPA and global clearing systems use standardised data flows.
Read the guide →Biometric authentication and strong customer authentication (SCA) in digital transactions
How biometrics, the FIDO2/WebAuthn standards and dynamic linking are combined to meet the SCA requirements of PSD2 and the forthcoming Payment Services Regulation.
Read the guide →DORA and digital operational resilience in finance: what payment service providers need to know
ICT risk management, incident reporting, resilience testing and third-party risk. A practical overview of the obligations under Regulation (EU) 2022/2554 from the perspective of payment infrastructures.
Read the guide →PSD3 and open banking: how the payments package changes interfaces for businesses and consumers
PSD3 and the Payment Services Regulation (PSR) reshape open banking interfaces, consent management, strong customer authentication and fraud prevention. An analysis of the structural shifts and their effect on the API ecosystem.
Read the guide →A question about payment technology?
We welcome topic suggestions, corrections and enquiries about research collaboration.