PSD2, PSD3 and Strong Customer Authentication — explained for product teams

The regulatory backbone of European payments is shifting from PSD2 to PSD3 and the new Payment Services Regulation (PSR1). Here is what changes, what does not, and what to design for now.

PSD2 — where we are

In force since 2018 (with SCA enforcement from 2019/2021 depending on market), PSD2 is the framework that mandates open banking access, payment institution licensing, and Strong Customer Authentication (SCA) for most consumer-initiated payments.

SCA requires two of three independent factors: knowledge (something the customer knows), possession (something the customer has), inherence (something the customer is). For SEPA, SCA matters most at mandate setup and at the first SDD collection.

PSD3 + PSR1 — what is coming

The replacement package (a directive for licensing, a regulation for conduct) lands across member states in 2026–2027. Highlights worth designing for now:

• Consolidation of e-money and payment institutions into one licence class — fewer regulatory categories, cleaner permissions.
• Stronger fraud-loss liability rules: where banks fail to implement Confirmation of Payee or fail SCA properly, customers can recover.
• Mandatory Confirmation of Payee for credit transfers across the SEPA zone — a meaningful uplift in IBAN-name matching coverage.
• Tighter SCA exemption regime: the low-value, trusted-beneficiary and corporate exemptions get clearer, but also better policed.
• Open banking 2.0: standardised APIs and dedicated dispute mechanisms when banks block legitimate access.

What this means for your product

• Plan for CoP everywhere by 2027 — design IBAN-name capture so it can plug into mandatory matching.
• If you rely on SCA exemptions, document them per transaction now — auditors will check, and so will your acquirer.
• Recurring SEPA remains the most SCA-friendly pattern in Europe: authenticate the mandate, ride the recurring exemption.
• Liability assumptions in your TOS may need updating once PSR1 transposes — flag with legal before 2027 contracts.