What PSD3 means for UK businesses taking payments in Europe

The European Union is moving towards formal adoption of a provisionally agreed package of payment rules known as PSD3 and the Payment Services Regulation (PSR). Neither has been adopted into EU law as at 13 October 2026, and neither will automatically change UK law. But UK businesses that take payments from customers in the EU, or that rely on EU-based acquirers, banks or open-banking providers, may still feel the effects once the rules do apply, because the EU package reaches parts of a payment chain, not just EU-resident merchants.

This explainer sets out what PSD3 and the PSR would do, how far the EU process has actually got, and where a UK merchant or payment firm might be exposed even though the rules are not British ones.

What PSD3 and the Payment Services Regulation are

The European Commission proposed two separate instruments on 28 June 2023: a Directive on payment services and electronic money services (PSD3), and a Regulation on payment services in the internal market (the PSR). The split matters. PSD3 mainly covers authorisation and supervision of payment and electronic-money institutions, the licensing side. The PSR would be directly applicable across EU member states and carries most of the conduct, user-rights and operational detail: authentication, fraud liability, payee verification and open-banking access.

When people say "PSD3", they often mean the whole package. Official EU documents keep the two instruments distinct, and this article does too.

At the time of the 2023 proposal, the Commission's own factsheet said the package was intended to create fairer competition among more than 1,000 non-bank payment service providers, around 270 electronic-money institutions and around 800 payment institutions in the EU, figures current to the factsheet's June 2023 publication date.

Current status and the timetable

The European Parliament and the Council of the EU reached a provisional political agreement on the package on 27 November 2025, a negotiating milestone rather than enactment. The Council dated its final-compromise texts 17 April 2026, and the Parliament's responsible committee approved the agreement on 5 May 2026. As at 13 October 2026, the Parliament's own procedure file still listed the PSR as awaiting the Council's first-reading position, with 14 December 2026 shown only as an indicative, unconfirmed plenary date. The package has not completed formal adoption or been published in the Official Journal, so the dates and periods below remain provisional.

Both instruments would enter into force 20 days after Official Journal publication. From that point, the April 2026 compromise texts set out these periods:

No calendar date can be calculated until the Official Journal publishes the final texts. Older summaries based on the Commission's 2023 proposal cite 18 months for the PSR and 24 months for PSD3 transposition; the April 2026 compromise instead uses 21 months generally, with 27 months for the payee-verification provisions, so figures should be dated to the version of the text they come from.

Why these are EU rules, not new UK rules

Since the UK left the EU, PSD3 and the PSR will not automatically become part of UK law. UK payment services continue to be governed by the Payment Services Regulations 2017 and the UK's own technical standards. The Financial Conduct Authority (FCA) states that the UK made its own strong customer authentication and secure-communication standards after EU withdrawal and revoked the corresponding EU standards in UK law.

HM Treasury opened a separate consultation on modernising UK payment-services regulation on 14 July 2026, covering possible changes to open-banking definitions and a future UK framework under the Data (Use and Access) Act 2025. This is a domestic UK reform programme, not the UK implementing PSD3, and the packet does not indicate HM Treasury's timetable for a response or the shape of any final framework.

When a UK merchant or payment firm may still be affected

Selling to a customer in the EU does not by itself bring a UK merchant within the PSR. The regulation would apply to payment services provided within the EU by specified providers, and parts of it would also cover the EU-carried-out portion of a transaction, in any currency, where only one provider involved is located in the EU, subject to listed exclusions.

In practice, exposure depends on where the relevant payment services are provided, which portions of the transaction are carried out in the EU, and whether each entity in the chain, including the acquirer and any payment-initiation or account-information provider, is itself an EU-regulated payment service provider. A gateway or other technical service provider is not necessarily a payment service provider in its own right, so its location alone does not settle scope. A UK merchant using a UK-based acquirer may have little direct exposure even with EU customers; one whose acquirer or other provider is EU-regulated, or where part of the payment service is provided in the EU, is more likely to see the EU rules reflected in its checkout, contracts and reporting.

This is a payment-flow question, not a customer-location question. Establishing whether a business is directly or only contractually affected means mapping its acquirer and any payment-initiation or account-information providers, their place of establishment and regulatory status, and which parts of the transaction take place in the EU. Specialist advice may be needed for a firm-specific conclusion; firms should check with their acquirers and payment providers rather than assume a position.

Authentication changes for checkout, subscriptions and account access

The compromise PSR clarifies strong customer authentication (SCA) for merchant-initiated transactions. Authentication would be required when a remote payment mandate is first established with the payer's payment service provider, for example when a customer sets up a subscription. Subsequent payments initiated by the merchant without the payer's direct involvement would not require fresh authentication each time. This is relevant to subscription billing, though classification and technical implementation would need to be confirmed with the merchant's acquirer.

Mail-order and telephone-order transactions would stay outside SCA where the payment order itself is placed non-digitally, although the payer's provider would still have to run security checks that allow some form of authentication.

For account-information services, the account-servicing provider would authenticate the customer's first access and could re-authenticate if it reasonably suspected fraud. The account-information provider itself would apply SCA when the customer accesses account information at least 180 days after authentication was last carried out.

The compromise text also requires EU payment service providers to offer authentication methods suitable for disabled people, older people, people with low digital skills and people without digital access, and would generally stop providers making authentication depend exclusively on owning a smartphone, unless the customer had agreed to a service delivered only through a mobile app.

Fraud controls, payee verification and the impersonation refund

The compromise PSR would extend free name-to-account-identifier verification, checking that the name on an account matches the one the payer expects, to credit transfers not already covered by the EU Instant Payments Regulation. Business users could opt out in circumstances set by the text. For merchants, this points toward onboarding and legal-name data becoming more important for avoiding mismatch warnings on EU transfers, once the relevant provisions apply, 27 months after entry into force.

The text also creates a consumer refund right for a specific type of fraud: where a fraudster impersonates the consumer's own payment service provider using channels attributed to that provider, and the consumer authorises a payment as a result. Consumers would be entitled to a full refund unless they acted fraudulently or with gross negligence, provided they notified their provider promptly and filed a police report. The provider would then have 15 business days after notification and the police report to refund the consumer or give objectively justified reasons for refusal.

This is narrower than a general right to reclaim money lost to any authorised push payment scam. It is specifically tied to impersonation of the consumer's own provider through communication channels attributed to that provider, and it carries notification and reporting conditions that a consumer must meet.

Open-banking interfaces and permission dashboards

The compromise PSR would require account-servicing payment service providers to offer a dashboard through which customers can view, withdraw or restore ongoing permissions they have given to third-party providers to access their account data. The text separately lists obstacles that providers would be prohibited from placing in the way of payment-initiation and account-information services.

How the EU proposals compare with current UK rules

These are separate regimes with separate legal bases. The EU impersonation-fraud refund does not replace the UK's Faster Payments reimbursement requirement, and the two should not be conflated. Any scheme that can result in a refund being refused, delayed or capped carries a risk that an eligible claimant does not recover the full amount lost to fraud.

What to watch next

The near-term markers are the Council's first-reading position on the PSR, still pending on 13 October 2026, and the indicative, unconfirmed Parliament plenary date of 14 December 2026. Formal adoption and Official Journal publication would follow, starting the 21-month and 27-month clocks above; the EBA must still produce technical standards on authentication exemptions and interface specifications, and drafting may change before final adoption. On the UK side, watch for HM Treasury's response to its July 2026 consultation on modernising payment-services regulation and any resulting UK legislation or framework, not published as at the research date. For the underlying legal detail, and before relying on any date above, the primary sources are the European Commission's original proposals, the Council's compromise texts, and the European Parliament's Legislative Observatory procedure file.