Summary of the PSD3 Proposal

Introduction

On 28 June 2023, the European Commission published a proposed legislative package that seeks to modernise and harmonise the existing regulatory framework for electronic payments throughout the European Union (EU) and European Economic Area (EEA), currently regulated by the Second Payment Service Directive (PSD2).

The legislative package included the Third Payment Service Directive (PSD3) and the Payment Services Regulation (PSR1). Together these proposals seek to modernise and strengthen the existing framework with the aim of spurring further innovation and bringing the payments and the broader financial sector into the ‘digital age’.

Brief overview of the preceding regulations

The first version of Payment Services Directive was introduced in 2007. Over the past 16 years, PSD has evolved, responding to changing needs and threads in payments market.

Rationale for the new regime

PSD3 itself covers the authorisation and supervision of payment institutions and e-money issuers, whilst conduct of business requirements for payment services (including the rights and obligations of the parties involved) are set out in the PSR.

• Strengthen user protection and confidence in payments by increasing the security of payments, improving the transparency of fees, and giving consumers more control over their data.

• Improve the competitiveness of open banking services by making it easier for third-party providers (TPPs) to access customer data and by creating a single set of rules for open banking across the EU.

• Streamline supervisory powers and obligations to improve enforcement in EU Member States. Achieved by by creating a single European supervisory authority for payments and by strengthening the powers of national regulators.

• Tackle the perceived unlevel playing field between banks and non-banks by improving access to payment systems and bank accounts for non-bank PSPs. This will be done by making it easier for non-bank PSPs to access payment systems and by requiring banks to open their APIs to third parties.

Specific changes introduced by PSD3

• Fraud and Liability

  The European Commission emphasises the need to update the PSD2 liability framework in response to the increasingly sophisticated types of fraud which are being utilised. The requirement for Strong Customer Authentication (SCA) has been efficient in preventing crime over the past years, but it needs updating to be effective with evolving and increasingly sophisticated methods used to commit financial crime. As such, PSD3 proposes several new anti-fraud measures for payment service providers operating within the EU:

  • IBAN and name-matching verification services for all credit transfers for instant payments in Euro,

  • Exchange of fraud-related information between Payment Service Providers (PSPs) through authorised digital platforms,

  • Stronger monitoring of transaction data,

  • Responsibility for educating consumers and employees on payments fraud to increase their awareness,

  • Expansion of customers' rights to refunds in defined cases,

  • Simpler application for SCA.

• Customer Rights & Information

  The European Commission noted a demand for improvement of ‘Consumer rights and information’. This includes:

  • Transparency for ATM charges – PSPs will need to inform consumers about any charges for payment services,

  • Increased clarity on Credit Transfers and money remittances (transfers from EU to third countries),

  • Transparency for payment account statements – PSPs will be obligated to include the information to explicitly recognise the payee.

• Improvements to Open banking

  PSD2 was the first regulation to introduce open banking rules by enforcing clarification to the previously unregulated environment. Current open banking regulations lay under Regulatory Technical Standards (RTS), which is a part of PSD2, and will be moved to Payment System Regulator (PSR). PSD3 is proposing further expansion of changes with the aim of increasing Open Banking competitiveness, availability and interoperability:

  • Proposal on Financial Data Access (FIDA) which explains how customers’ financial information may be shared, accessed and used,

  • Requirements for payment account providers and banks to provide customers with access to dashboards where they can decide whether to give access to their data,

  • Account Servicing Payment Providers (ASPPs) will not need to permanently keep fall-back interface in most cases. ASPPs will be required to provide customers with an interface enabling clients to manage Open Banking provider’s access to data,

  • Support growth and innovation of Open Banking firms by creation of a framework which provides regulatory clarity, simplifying the rules for those firms when sharing data,

  • Set minimum standards and requirements of application programming interfaces (APIs) for banking industry,

  • Removing obstacles faced by Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) when accessing dedicated data interfaces, by defining new requirements for retrieving those interfaces.

• Competition & Simplification

  E-money institutions (EMIs) and Payment institutions (PIs) who are in competition with banks have significantly evolved in recent years but often are not able to compete on a level playing field with banks. They are required to obtain a licence by opening an account with a commercial bank, but often face refusal from the bank's side. Non-banks also face friction since the existing Settlement Finality Directive does not allow EMIs and PIs access to payment systems. Key proposed changes include:

  • Bank will have to provide an explanation on access refusal for PIs, with the possibility for them to appeal to a national authority,

  • Payment institutions will be able to directly access EU’s payment systems including central bank and four-party card schemes after adjustments made to Settlement Finality Directive (SFD),

  • Creating a framework for financial data access as currently clients of open banking firms cannot control who accesses their data The regulation is needed to propose a secured access to customers data across different financial services, giving clients and organisations an effective tool to manage utilisation of their information.

What is expected to happen next?

The publication of the payments package marks the commencement of the EU legislative process. They will need to be approved by the European Parliament and the Council of the European Union. Since PSD3 is a directive and not a regulation like PSR, which once approved is directly applicable, PSD3 will also need to be transposed into national law by each EU member state. At best case the package will be passed into EU law by summer of 2024. However, it is more likely that it will not be in effective until 2025 or later due to European Parliamentary elections scheduled for May 2024 which may slow the process.

Next steps for financial service firms providing payments services

Understand the requirements of PSD3

• The full text of the directive is not yet available, but the European Commission has published a draft proposal, which provides a good starting point for understanding the requirements of PSD3.

Start planning for compliance

• PSD3 is a complex piece of legislation, and compliance will require significant effort. Financial services firms should start planning for compliance now, so that they are ready when the directive comes into force.

Consider using a trusted change management consultant

• A practitioner led change management consultant, such as New Link Consulting, can help financial services to understand the practical requirements of PSD3, develop an compliance plan, and support the delivery of changes required to comply with the directive.