PSD3 and open banking: how the payments package changes interfaces for businesses and consumers

Background: from PSD2 to the payments package

The second Payment Services Directive (PSD2, Directive (EU) 2015/2366) opened banks' payment accounts to authorised third parties and made strong customer authentication a basic requirement for electronic payments. During its application, however, several shortcomings became apparent: the quality of bank interfaces varied, national interpretations diverged, and fraud increasingly shifted from technical attacks to manipulation of the user.

On 28 June 2023 the European Commission proposed a new payments package consisting of a third Payment Services Directive (PSD3) and a Payment Services Regulation (PSR). The package does not abandon the core idea of PSD2 but refines it. For open banking, the most important change is that the rules on interfaces, consents and authentication move largely into a directly applicable regulation.

This guide examines the structural changes in the package and how they affect the interfaces between banks, payment institutions, merchants and consumers. As background, we recommend our guides on open banking networks and instant transfers.

Directive and regulation: a new division of labour

PSD2 was a directive that each Member State had to transpose into national law. This led to differences, for example in how exemptions from strong customer authentication or interface requirements were interpreted. The payments package splits the rules into two parts:

From the perspective of developers and providers, this means that the same interface rules will apply uniformly across the EU. National differences will remain mainly in authorisation and supervisory procedures.

For e-money institutions the change is significant: their separate regulatory framework is merged into the framework for payment institutions. According to legal commentators, existing firms will need to seek re-authorisation during the transitional period. According to Addleshaw Goddard, the transitional regime is staged at 21, 27 and up to 30 months: a cut-off for applying, a deadline for demonstrating compliance, and a possible extension where the supervisor has not been able to process an application submitted on time.

Legislative process and timeline

The package has progressed as follows:

• 28 June 2023 – the Commission published its proposal.
• 27 November 2025 – the European Parliament and the Council reached a provisional political agreement.
• 22 April 2026 – the Committee of Permanent Representatives (COREPER) endorsed the outcome of the trilogue negotiations.
• 23 April 2026 – the final compromise texts were published (Council documents ST-8222-2026-INIT, PSD3, and ST-8221-2026-INIT, PSR).

At the time of writing, formal adoption and publication in the Official Journal of the European Union were still pending. According to legal briefings published in September 2026, publication was expected by the end of 2026. Commentators indicate that the new rules will largely apply around 21 months after publication, which would push full application into 2028.

Open banking interfaces

Under PSD2, banks had two ways of giving third parties access to payment accounts: a dedicated interface or an adapted version of the customer interface. A fallback mechanism was also required alongside the dedicated interface unless the supervisor granted an exemption.

Under Article 35 of the compromise text, an account servicing payment service provider that offers payment accounts accessible online must provide at least one dedicated interface. The automatic right to use an adapted customer interface as an alternative is removed; exemptions can be requested from the supervisor. The change clarifies the position of developers: access to account information and payment initiation takes place primarily through a documented interface.

The package also tightens the requirements on interface quality:

• Performance and availability. More detailed requirements are set for interface performance and availability, and supervisors are expected to act on shortcomings without delay.
• Justified restrictions. If an account servicing provider restricts a third party's access to a payment account, it must give a specific, documented justification.
• Re-authentication. According to Freshfields, users of account information services must re-authenticate every 180 days for access to remain valid.

In practice, the change reduces the need for screen-scraping solutions and improves predictability. On the other hand, harmonising interfaces across banks still depends on which technical standards the market and the EBA adopt as their basis.

The permission dashboard

One of the changes most visible to consumers is the permission dashboard. Under Article 43 of the compromise text, the account servicing provider must offer a dashboard in its user interface where users can manage the permissions they have given to account information and payment initiation services.

Technically, the dashboard requires a reliable way of communicating the status of permissions between the account servicing provider and third parties. When a user withdraws a permission at their bank, the provider must be informed in time and stop retrieving data. This underlines the importance of event-based notifications and consistent status codes in interfaces.

Strong customer authentication and accessibility

Strong customer authentication (SCA) remains the cornerstone of payment security, but the Payment Services Regulation places more emphasis on its accessibility. According to Freshfields, the compromise text includes the following principles, among others:

• Payment service providers must offer several free means of authentication, suitable also for people with disabilities, limited digital skills or no smartphone.
• No authentication method may depend on a single device or technology unless the user agrees.
• Authentication based on two inherence elements is permitted, provided their independence can be demonstrated to the supervisor.
• Detailed written agreements must be concluded with technical service providers that carry out authentication on behalf of a payment service provider.

These changes directly affect the architecture of authentication services. A model relying solely on a mobile app is no longer sufficient on its own; alternative authentication methods are needed alongside it. We discuss the role of biometrics in more detail in the guide Biometric authentication and strong customer authentication and in the technology area Secure authentication protocols.

Fraud prevention and allocation of liability

The most significant changes in the Payment Services Regulation concern fraud in which the payer is manipulated into authorising a payment themselves. Under PSD2, such cases often left the loss with the payer, because the payment was technically authorised.

Payee name check

The EU Instant Payments Regulation introduced verification of payee for euro credit transfers. The Payment Services Regulation extends the principle: according to the compromise text, the payment service provider must check, before executing a credit transfer, whether the payee's name matches the account identifier. If a discrepancy has not been shown to the payer and the payment is misdirected as a result, the provider has a refund obligation.

Impersonation of the provider

According to the compromise text, a payment service provider must refund the full amount to a consumer if a fraudster has impersonated that provider using its own channels and manipulated the consumer into authorising a payment. The consumer must report the case to the provider and to the police without undue delay. The burden of proving fraud or gross negligence by the consumer lies with the provider.

Unauthorised payments and information sharing

The obligation to refund unauthorised payments remains, but the provider may defer the refund by up to 15 business days where it has objectively justified suspicions of fraud by the payer. The package also enables fraud-related information to be shared between payment service providers, which requires careful data protection design.

The focus of fraud prevention shifts from authentication towards risk management across the entire payment journey: who the payee is, how the payer came to make the payment and what information is shared between providers.

How to prepare

Although the rules will only apply after the transitional period, they affect systems that take time to develop. Different actors should assess at least the following:

1. Account servicing providers: performance of the dedicated interface, measurement of availability, implementation of the permission dashboard and documentation of restrictions.
2. Account information and payment initiation services: permission lifecycle management, re-authentication user journeys and responses to withdrawals made in the bank's dashboard.
3. Payment service providers in general: alternative SCA methods, agreements with technical service providers, payee name checks and fraud information sharing.
4. E-money institutions: authorisation strategy and transitional deadlines.
5. Merchants: consistency between the name used in invoicing and the account holder's name, so that name checks do not cause unnecessary warnings for customers.

The final impact of the package depends on the text published in the Official Journal and on the EBA's technical standards. We will update this guide once the official text is available.

Sources and further reading

1. Directive (EU) 2015/2366 (PSD2), EUR-Lex
2. Council of the European Union: press releases and documents
3. Freshfields: PSD3/PSR – what the EU’s new payments rules mean for your business
4. Addleshaw Goddard: PSD3 – a new era for EU payment services regulation (September 2026)
5. Morrison Foerster: PSD3 and the Payment Services Regulation – key developments