PSD3 and PSR: new payment services rules crack down on fraud, hidden fees and weak open banking

The EU payment services framework is set for a major overhaul. The new Payment Services Directive PSD3 and the accompanying Payment Services Regulation PSR will reshape the day-to-day business of banks, payment service providers (PSPs), fintech companies, and merchants alike. Euroopa Komisjon proposed the package in June 2023, Euroopa Parlament adopted its position in spring 2024, and during 2025 both the Nõukogu position and the so-called trilogue negotiations have progressed in parallel.

As of the end of the year, the EU institutions have reached a political agreement on the main outlines of PSD3/PSR – the focus is on reducing payment fraud, IBAN/name checks, i.e. verification of the recipient’s name, full fee transparency, and harmonising and strengthening open banking rules. The “fine-tuning” of the final legal texts continues, but the direction is sufficiently clear for market participants to begin systematic preparations.

Below, we examine what PSD3 and the PSR mean in practice—and what PSPs/fintech companies and merchants should already be doing.

What are PSD3 and PSR—and why are they being discussed so much?

PSD3 is a new directive on payment and e-money services, focusing primarily on licensing, authorisations and the supervisory framework. It brings payment service providers and e-money institutions under one umbrella and updates the definitions and list of services that fall within the scope of the regulation.

PSR, on the other hand, is a directly applicable regulation that governs the rules of conduct for providing payment services:

• customer protection and allocation of liability,

• prevention of payment fraud (including SCA – strong customer authentication),

• fee transparency,

• standardisation of open banking, i.e. account information and payment initiation services.

An important difference from the previous PSD2 era is that a large proportion of the day-to-day rules will be set out in the regulation itself – this means a harmonised framework across the EU, fewer “national specificities” and fewer complex interpretations in cross-border business models.

The topic has also been covered in greater detail by international law firms such as Taylor Wessing and, in the Baltic context, Ellex, emphasising that PSD3/PSR is one of the most important financial sector reforms of the current decade.

Combating fraud: IBAN/name check and a new liability framework

One of the most visible changes introduced by PSD3/PSR is the mandatory IBAN/name check, i.e. verification of the payee's name and account number for so-called push payments (SEPA credit transfers and instant payments). Before a payment is initiated, the payment service provider must compare the payee's name and IBAN and give the customer a clear warning if they do not match.

In addition:

• Fraud prevention becomes a “by design” obligation. PSPs must implement a comprehensive fraud risk management framework that includes strong customer authentication, real-time risk scoring, the freezing of suspicious transactions, and warning messages to customers before risky transfers.

• APP fraud (authorised push payment fraud) and identity theft will no longer remain merely a “lesson learned” for the customer. The new framework shifts part of the liability to PSPs, particularly in cases where the bank/PSP has not properly implemented the prescribed anti-fraud measures (e.g. name check, timely warning, detection of suspicious patterns).

• Spoofing—a situation in which fraudsters impersonate a bank or payment platform—is becoming a separate area of focus; in certain cases, a PSP will have to reimburse the customer in the event of fraud even if the customer “authorised” the payment themselves.

The practical message for PSPs and fintech companies is clear: anti-fraud controls are no longer “good practice”, but a strict regulatory obligation with clear liability rules.

Fee transparency: an end to hidden exchange rates and surprises at checkout

The PSR also strengthens the rules on transparency of fees and commissions. The aim is for the customer to see exactly the following as soon as the payment is initiated:

• how much they pay for currency exchange,

• which ATM fees or “service fees” apply,

• which intermediaries are involved in the payment chain and what they charge.

This also directly affects merchants and online stores:

• the customer must not be given the impression that the payment “is free” if it actually incurs a hidden cost arising from the exchange rate spread;

• discriminatory or hidden surcharges that would distort the customer's choice must not be applied between different payment methods;

• pricing information must also be easy to understand on mobile devices, not only buried somewhere in a lengthy PDF.

According to studies, hidden fees and “additional costs appearing at the final step” are among the main reasons why customers abandon their carts—so transparency is a requirement that works both as a means of reducing regulatory risk and as a conversion booster.

Open Banking 2.0: strengthened open banking and new API requirements

PSD2 brought the first wave of open banking to Europe; PSD3/PSR aim to turn it into a mature standard, rather than “minimum compliance”. The main directions are:

• Standardized APIs and better access to data. The rules for account information and payment initiation services (AIS/PIS) will be clarified; banks will no longer be allowed to “indirectly hinder” third-party services through unstable or inconvenient APIs.

• Permission management “permission dashboard”. Users must be provided with a clear overview of which applications and service providers have gained access to their account/data, together with a simple option to revoke permission. Such a solution has been described as one of the key elements of PSR for increasing trust in open banking.

• Fairer competition between banks and fintechs. The aim is to ensure that new market participants can access data and payment infrastructure under clear and enforceable rules, without hidden technical barriers or discriminatory pricing.

For fintech companies, this represents both an opportunity and an obligation:
no serious player can continue to accept an incomplete API solution or vague consent logic.

What does PSD3/PSR mean for PSPs and fintech companies?

From a direct “what to do” perspective, the PSD3/PSR message to PSPs and fintechs is quite specific.

1. Improve KYC/AML and fraud-risk processes

• Update the know-your-customer (KYC) flows so that they are risk-based, digitally traceable and verifiable.

• Integrate real-time fraud detection tools into payment flows (including instant payments), including behavioral patterns and device identifiers.

• Ensure that AML monitoring works together with the new anti-fraud requirements – PSD3/PSR expects fraud risk management not to be a separate “island”, but part of a broader risk management system.

2. Take a critical look at SCA and UX

PSD3/PSR is not just about adding more layers of security – it is about smarter SCA, which would not drive customers crazy but would meet stricter requirements.

• Map your existing strong customer authentication (SCA) flows: when you request a PIN, an SMS code, or biometric authentication, and in which cases you use exemptions.

• Test whether, in light of the new rules, the transaction decline rate becomes too high—especially for mobile and instant payments.

• Update the UX of digital channels so that warnings (e.g. an IBAN/name-check mismatch) are clear, concise, and readable on mobile devices, rather than merely a block of legal text.

3. Invest in APIs and open banking infrastructure

• Make sure that your APIs comply with the new standards and are documented in a way that allows third parties to actually use them, rather than merely “tick a checkbox”.

• Plan the creation of a permission dashboard (or the redesign of an existing one) where customers can view and manage their permissions.

• Map which partners (fintechs, platforms) use your APIs – and whether they are ready for the post-PSD3/PSR world.

Merchants and online stores: what will change regarding payments, SCA, and the display of fees?

For merchants, PSD3/PSR may seem like “a banking matter”, but in reality the changes will very directly affect checkout and payment solutions that customers use in your online or physical store.

1. SCA and checkout flows: lost payments = lost revenue

• Under the new rules, PSPs must ensure effective SCA—if your checkout solution is “sensitive”, there may be additional authentication steps or existing exemptions may be removed (e.g. transactions involving smaller amounts).

• This means that the merchant must review the following with their payment service provider:

  • how many steps are involved in the checkout process;

  • whether any additional authentication screens are required; and

  • how these are integrated on mobile and desktop devices.

Each additional step may reduce conversion, so it is worth testing different checkout flows before the new rules take full effect.

2. Displaying fees and exchange rate differences

• If you sell to customers in the currencies of other countries or use dynamic currency conversion (DCC), you must ensure together with the PSP that exchange rate information and the service fee are clearly visible before the payment is confirmed.

• If you use different payment methods (card, “pay later”, international digital wallets), check that there are no “default surcharges” anywhere that may conflict with PSR transparency requirements.

3. Agreements with PSPs and risk sharing

PSD3/PSR partially changes the allocation of liability in cases of fraud. Merchants should review their PSP agreements:

• who is liable in the event of APP fraud;

• when the PSP may suspend or reverse a transaction;

• how liability is apportioned if the bank has failed to perform the name check or other mandatory steps.

This is not merely a legal exercise – it is directly related to your financial risk and brand reputationin cases of fraud.

Timeline: when are PSD3 and PSR actually expected to start having an impact?

As the EU institutions moved towards trilogue negotiations and a political agreement during 2025, it is expected that the final legislation will be formally adopted and published in the Official Journal of the EU around 2026, followed by a transition period (typically 18–24 months, depending on the requirement).

This means:

• PSPs and fintechs have time to plan and implement, but not indefinitely;

• merchants would be wise to ask their payment solution partners for a concrete PSD3/PSR action plan now rather than wait until the “last minute”.

5 practical steps to get started now

1. PSD3/PSR gap analysis
   Together with the legal and compliance team (or an external adviser), conduct a quick comparison: what you already have in place today from the PSD2 era, what meets the new requirements, and where the biggest gaps are (fraud systems, APIs, SCA, display of fees).

2. Map out KYC/AML and anti-fraud processes
   Document the entire customer journey – from onboarding to payment disputes – and identify where something needs to be strengthened due to PSD3/PSR (for example, integrating name checks, automatically blocking suspicious transactions, and providing customers with real-time alerts).

3. Technical Action Plan for UX and API
   Agree with the development team on a timeline by which:

   • the cash flow will be updated in accordance with the SCA,

   • clear fee display solutions are implemented, and

   • the permission dashboard is launched.

4. Review contracts and partners
   Merchants: discuss with your PSP how the new liability model affects you.
   PSPs/fintechs: map out how to reflect the PSD3/PSR requirements in customer and partner agreements.

5. Communication and training
   The new rules must not take either customers or employees by surprise. Prepare internal training (risk, customer service, IT) and customer communications explaining why a new warning appeared on the screen, why additional confirmation is requested, and why information about fees has become more detailed.

PSD3 and PSR are not a “minor technical update”, but a new version of the payment services market, subjecting fraud, hidden fees and inconsistent interpretations of open banking to stricter oversight than before.
Those PSPs, fintech companies and merchants that use the transition period proactively will achieve not only regulatory compliance but also business success: greater customer trust, better conversion and easier cross-border growth.