PSD3 and PSR: What Europe's Next Payments Framework Means for Fintech

Understanding legislative status matters because product roadmaps, contractual clauses, and customer communications must reflect what is legally binding today—not what negotiators intend to adopt later. The European Commission published its legislative proposal in June 2023. The European Parliament and Council subsequently negotiated through trilogue discussions.

In 2026, the institutions announced a provisional agreement on the combined PSD3 and PSR package. That agreement indicates political alignment on the main policy choices, but several formal steps remain: final legal-linguistic review, adoption by Parliament and Council, publication in the Official Journal, and entry into force followed by application dates and any transitional periods defined in the final texts.

Until those steps are complete, firms should not describe PSD3 or PSR obligations as current legal duties. Internal planning documents can reference expected themes from the provisional agreement, but engineering specifications, regulatory filings, and customer-facing claims should remain anchored in PSD2, the EU Instant Payments Regulation, AML frameworks, and applicable national law.

The current PSD2 model combines broad authorization principles, conduct rules, and detailed operational requirements inside one directive that member states transpose differently. The reform package separates concerns. PSD3, as a directive, is expected to focus on authorization, supervision, and structural elements that member states transpose into national law. PSR, as a regulation, is expected to apply directly and uniformly across the EU for detailed operational and conduct rules.

For fintech product teams, the split has two implications. First, some requirements may become more harmonised because they sit in PSR rather than divergent national transpositions. Second, compliance mapping becomes more granular: teams must track which provisions live in directive-level authorization law versus regulation-level operational detail, and how national competent authorities interpret overlapping areas during any transition.

The package should be read alongside adjacent EU reforms—notably instant payments and verification-of-payee requirements—that already impose concrete product obligations independent of PSD3/PSR timing.

Payment fraud—particularly authorised push payment fraud, impersonation, and merchant spoofing—has been a central driver of the reform. The provisional agreement is expected to introduce stronger fraud-prevention measures, clearer allocation of liability between payment service providers and users in defined scenarios, and frameworks for sharing fraud-related information among firms subject to appropriate governance and data-protection safeguards.

Verification workflows, payer warnings, payee confirmation, and transaction-risk scoring may need to connect across mobile apps, web banking, and API-initiated flows. Platforms routing payments through multiple partners must decide which entity performs each control and how disputes are reconstructed later.

Information-sharing provisions, if adopted as currently envisaged, could reduce repeated fraud across the ecosystem but also require robust access controls, purpose limitation, and auditability. Product teams should treat fraud controls as shared infrastructure—spanning Payments Core orchestration and Risk Shield intervention logic—rather than as isolated UI copy changes.

PSD2 established the account information and payment initiation framework that shaped Europe's open-banking market. The PSD3/PSR package is expected to refine access scope, consent mechanics, and responsibilities among account servicing payment service providers, third-party providers, and users.

Policy discussions have included clearer user permission dashboards, improved transparency on third-party access, and updated rules on dedicated payment-account access for payment institutions. For infrastructure providers, that translates into API lifecycle management, consent record retention, token rotation, and fine-grained scoping of access to accounts and payment instruments.

Even where detailed technical standards will follow secondary legislation, product architects should plan for more explicit user-facing permission management and easier revocation paths. Multi-brand portfolios sharing open-banking connectors must isolate consent state and credentials per brand and per regulated entity.

Consumer-facing transparency has been another major theme. Expected PSR provisions include clearer presentation of payment charges, improved information when consumers choose among payment methods at checkout, and stronger rules on merchant statement descriptors so cardholders can recognise legitimate transactions.

For card and wallet programmes, descriptor consistency affects chargeback rates, customer support load, and fraud-model performance. For payment orchestration layers, fee transparency may require normalising pricing components from multiple acquirers, schemes, and FX providers into comparable customer-facing summaries without hiding material variability in commercial arrangements.

Merchant-facing products should also prepare for additional disclosure obligations when offering branded payment experiences powered by partner institutions, ensuring the end customer understands who provides the regulated payment service.

PSD3 is expected to update authorization and prudential requirements for payment institutions and electronic money institutions, including areas such as safeguarding, governance, and supervisory reporting. While details will be confirmed only in final texts, the direction of travel is tighter alignment between payment-sector authorization and broader financial-regulation expectations on risk management and outsourcing.

Fintech groups operating through multiple EU entities should map which activities each license covers, how passporting supports cross-border services, and where agent or distributor arrangements shift conduct obligations. Technology platforms that are not themselves licensed payment institutions may still inherit contractual pass-through requirements from sponsor banks and EMIs.

Supervisors have increasingly focused on operational resilience and third-party dependency in parallel with payments reform. Firms should read PSD3/PSR planning together with DORA obligations applicable to regulated entities and with outsourcing guidelines from the European Banking Authority.

Because final PSD3/PSR texts are not yet law, preparation should emphasise capability building over premature compliance claims. Teams can inventory payment flows, fraud controls, consent records, and fee disclosures against both current PSD2 requirements and the policy direction reflected in public summaries of the provisional agreement.

Priority engineering investments that remain valuable regardless of final wording include: normalised payment status and audit logs, configurable payer warnings, partner-agnostic verification hooks, permission dashboards for account access, and reconciliation of multi-provider fee components. These capabilities support today's obligations and reduce rework when PSR application dates arrive.

Legal and compliance teams should maintain a clause library for partner contracts that can absorb pass-through regulatory updates, and product communications should avoid promising specific PSD3/PSR features until application dates and regulatory technical standards are known.

A shared payments infrastructure—such as a modular Payments Core with integrated Risk Shield controls—can help multi-brand fintech portfolios implement policy changes once and reuse them across products. That reuse is valuable only if tenant isolation, audit trails, and partner boundaries remain explicit.

FinDech's Seven Cores model is designed to separate reusable payment and risk capabilities from brand-specific experiences. Where regulated payment services are required, they would be delivered through appropriately authorized partners rather than substituted by technology alone.

PSD3 and PSR represent a substantial planned upgrade to Europe's payments rulebook, with emphasis on fraud reduction, clearer conduct standards, and refined open-banking access. As of August 2026, however, the package remains pre-adoption: useful for strategic planning, but not yet a source of direct legal obligations.

Fintech teams should continue executing against PSD2, instant-payments requirements, and AML rules while building flexible fraud, consent, and transparency capabilities that will adapt to final PSR text. Treat provisional agreement summaries as directional, verify application dates when published, and keep customer and partner communications strictly aligned with what is legally in force on each date.

Shared infrastructure can reduce duplicate implementation work across brands, provided compliance ownership and partner arrangements remain transparent throughout the payment lifecycle.