The PSD trilogy: what you should know about PSD3

In the beginning, there was the Payment Services Directive — PSD1.

Introduced in 2007 and in force in 2009, PSD1 laid the foundation for a unified European retail payments market. It aimed to make cross-border payments within the European Union (EU) as seamless, efficient, and secure as domestic ones. Simultaneously, it sought to boost innovation and competition in a space long dominated by traditional banks. For the first time, non-bank providers could enter the market, bringing more choice and price competitiveness to consumers.

Then in 2018 came PSD2, which built on PSD1's goals and responded to a rapidly changing payments landscape. Strong Customer Authentication (SCA) is a European regulatory requirement designed to reduce fraud and make online and contactless payments more secure. The introduction of Open Banking and SCA were headline features. PSD2 enhanced consumer protection, improved security, and made space for new technologies and payment methods.

But it also came with growing pains—implementation was inconsistent, APIs were unreliable, and customer experiences suffered.Enter PSD3, which introduces new rules, broader scope, and stronger expectations for transparency, innovation, and security. In this blog, we'll break it down: what's changing, who's affected, how it compares to PSD2, and when it comes into effect.

What is PSD3, and why should you care?

The third Payment Services Directive is the EU's latest move to modernize financial services. It's designed to improve consumer protection, support Open Banking, enable new payment methods like Buy Now Pay Later (BNPL), instant payments, and crypto, enhance fraud prevention, and level the playing field between banks and fintechs.If you're in the UK, PSD3 doesn't apply directly. However, if you operate in or serve the EU market, it matters. PSD2 was adopted into UK law post-Brexit, and UK regulators may choose to align future UK frameworks with PSD3.

PSD2 vs PSD3: What's new and noteworthy?

We all remember the promise of PSD2. Open Banking, third-party access, and new security requirements. But it wasn't perfect. Banks were slow to comply, API reliability was patchy, and consumer data practices were inconsistent.PSD3 attempts to address these issues. Key changes include:

Stronger consumer protection

Consumers will have more rights, including easier refunds for fraudulent transactions, clearer account statements, and greater transparency on fees (e.g. hidden ATM charges).

A modernized payment landscape

PSD3 covers emerging payment methods, such as BNPL, and ensures that the regulatory framework evolves with the way people actually pay.

Open Banking 2.0

PSD3 builds on the Open Banking model:

• Banks must improve API reliability and publish quarterly performance reports
• If bank APIs are non-functional, third-party providers can build their own interfaces
• Customers gain permission dashboards to manage third-party access

Increased transparency

Financial institutions must be clearer than ever about fees, currency conversion rates, and terms of service.

Enhanced fraud prevention

PSD3 strengthens liability rules for providers who fail to prevent fraud, improves data sharing across providers, and adds support measures for users who don't own smartphones or need accessible services.

Safeguarding customer funds

Non-bank payment institutions can now hold customer funds directly with central banks, a move aimed at increasing trust and stability.

Strong Customer Authentication (SCA): new rules, new flexibility

SCA requires authentication using at least two of the following three elements:

• Knowledge – something only the user knows (e.g., password or PIN)
• Possession – something only the user has (e.g., phone or hardware token)
• Inherence – something the user is (e.g., fingerprint or facial recognition)

When is SCA required?

SCA applies when both the business and the cardholder's bank are located in the European Economic Area (EEA). It covers customer-initiated online payments and contactless transactions above certain thresholds.

How is SCA implemented?

3D Secure 2 (3DS2) is the primary method for authenticating online card payments and meeting SCA requirements. It enables real-time authentication during checkout while supporting a smoother user experience than its predecessor.Digital wallets like Apple Pay and Google Pay already include built-in authentication layers (biometric or password), making them SCA-compliant by default.

SCA exemptions and out-of-scope transactions

Not all transactions require SCA. The table below distinguishes between exemptions (where SCA can be waived) and out-of-scope transactions (where SCA doesn't apply):

Liability shift: who bears the cost of fraud?

When a merchant requests SCA and the cardholder successfully authenticates, liability for fraud shifts to the card issuer. If the merchant applies an exemption and fraud occurs, the merchant typically bears responsibility. This framework incentivizes proper authentication while allowing flexibility for low-risk transactions.

PSD3 updates to SCA

PSD3 retains SCA but introduces adjustments:

• Subscriptions only require authentication for the first payment
• Two authentication factors from the same category (e.g., two passwords) are allowed
• MOTO and MIT remain exempt
• Accessible SCA methods must be offered for the elderly or those with disabilities

PSD3 and open banking: better, faster, stronger

If PSD2 was a revolution, PSD3 is an evolution. Common pain points are directly addressed:

How Marqeta supports SCA and PSD3 compliance

Marqeta's platform provides the tools card programs need to meet SCA and PSD3 requirements:

• 3D Secure 2 support – Enable real-time authentication for e-commerce transactions
• Hosted SCA controls – Manage authentication flows and contactless transaction limits
• Digital wallet integration – Support Apple Pay, Google Pay, and other tokenized payment methods that meet SCA requirements by default
• E-commerce monitoring – Track and manage online transaction authentication
• Flexible exemption handling – Apply appropriate exemptions based on transaction risk

What should you do now?

If you're still reading and haven't yet Googled "PSD3 compliance checklist," you could be at risk of falling behind.Here's a starting point:

• Review and update authentication flows
• Audit API performance and plan improvements
• Prepare for custom third-party interfaces
• Ensure accessibility compliance for SCA
• Monitor legislative developments closely
• Consult legal and regulatory experts

Above all, don't wait until 2026. Start planning now.

PSD3 isn't just an update - it's an evolution

PSD3 represents a leap forward for digital finance in Europe. It puts consumers first, enforces fairness, and promotes innovation. Yes, it will demand investment. Yes, it will introduce complexity. But it also presents a chance to build better, smarter, more inclusive financial products.

And in a fast-moving market, those who prepare early won't just comply, they'll lead.PSD3 may bring changes, but Marqeta is here to help. Whether you're just diving into new regulations, looking to refine your payments strategy, or explore opportunities in Open Banking, our team is here to help.

Get in touch to explore how we can help support your business through the PSD3 transition.