PSD2 is the second Payment Services Directive, Directive (EU) 2015/2366, setting licensing, conduct and security rules for payment services across the European Economic Area. It applied from 13 January 2018, replaced the 2007 directive, and is best known for opening bank accounts to regulated third parties and making strong customer authentication mandatory. It added account information and payment initiation services, requiring banks to give AISPs and PISPs API access without separate contracts. Article 97 requires two independent authentication factors, with dynamic linking for remote payments, under Delegated Regulation (EU) 2018/389. It also covers safeguarding, incident reporting and a €50 payer liability cap. Buyers of an EMI or PI check that permissions list each PSD2 service performed.
What is PSD2 trying to fix
The first directive created payment institutions but left gaps. Fintechs were already reading customers' bank data through screen scraping with no legal status, and card fraud in online channels kept rising. PSD2 brought the scrapers into the regulated perimeter and tied authentication to the payment itself.
It also narrowed exclusions that had let large players avoid a licence. The commercial agent exclusion now requires the agent to act for only one side, and the limited network exclusion triggers a notification to the regulator once volumes pass €1 million over 12 months.
What are PSD2 requirements for providers
The directive lists eight payment services, and two were new: account information services and payment initiation services. A firm offering them must be registered as an AISP or authorised as a PISP, or hold a full payment institution or e-money licence that covers them. Banks, in turn, must give those licensed providers access to payment accounts through a dedicated interface, in practice an API, without requiring a separate contract.
Other obligations: safeguarding of client funds, incident reporting to the national authority, a cap of €50 on a payer's liability for unauthorised transactions (with exceptions for gross negligence), and a ban on surcharging consumer cards covered by the Interchange Fee Regulation.
SCA requirements under PSD2
Article 97 requires strong customer authentication when a payer accesses an account online, initiates an electronic payment, or does anything remotely that carries fraud risk. SCA means two independent elements from different categories: knowledge (a PIN), possession (a phone), inherence (a fingerprint). Remote payments add dynamic linking, binding the code to the exact amount and payee.
The technical standards, Delegated Regulation (EU) 2018/389, applied from 14 September 2019. Card e-commerce enforcement was deferred across the EEA until the end of 2020, and the UK until March 2022. The same standard lists the exemptions: low-value payments under €30, contactless under €50, trusted beneficiaries, recurring payments of the same amount, and transaction risk analysis.
How does PSD2 affect payments day to day
For cardholders the visible change is the challenge screen delivered through 3-D Secure 2. For merchants it is exemption management: a €90 order from a low-fraud acquirer can be sent under transaction risk analysis and skip the challenge, while the same order via a high-fraud acquirer cannot.
For buyers of an EMI or PI, the practical question is whether the target's permissions list the specific PSD2 services it actually performs. PSD3 and a directly applicable Payment Services Regulation have been politically agreed in the EU to succeed the directive.