Payment Services Directive 2 (PSD2)

The second Payment Services Directive (PSD2) is the EU framework governing payment services. It did two significant things: it required strong customer authentication for electronic payments and account access, and it obliged banks to open account data and payment initiation to licensed third parties, which created European open banking.

PSD2 applied from January 2018, with the authentication rules phased in later. It is now in the process of being replaced.

What strong customer authentication requires

SCA requires two or more independent elements drawn from different categories:

• Knowledge — something only the user knows, such as a password or PIN.
• Possession — something only the user has, such as a registered device.
• Inherence — something the user is, such as a fingerprint or face.

The elements must be independent, so that compromising one does not compromise another. For remote payments there is an additional requirement — dynamic linking — under which the authentication code must be tied to the specific amount and payee, so a code captured for one payment cannot authorize a different one.

The exemptions are where the operational detail sits: low-value transactions, recurring payments to the same payee, merchants the customer has whitelisted, and transaction risk analysis, which allows SCA to be skipped for lower-value payments when the provider’s measured fraud rate stays beneath set thresholds. That last one is the direct regulatory anchor for risk-based authentication: the exemption is earned by fraud performance, not by owning a risk engine.

Where PSD3 and the PSR now stand

PSD2 is being replaced by a two-instrument package — a third directive (PSD3) and a directly applicable Payment Services Regulation (PSR), which together also absorb the E-Money Directive.

The status as of late 2026: political agreement was reached in November 2025 and final compromise texts were published in April 2026, but the package is not yet adopted or in force. Publication in the Official Journal is expected in the second half of 2026, with entry into force twenty days later. The PSR is then expected to apply roughly eighteen months after that, and member states have around twenty-four months to transpose PSD3. Verification of payee obligations follow on a longer timeline again.

The practical reading: PSD2 remains the operative regime today, and firms have a defined runway rather than an immediate change. The direction is toward a regulation rather than a directive, which removes much of the national divergence that made PSD2 compliance uneven across member states.

Why it matters for identity verification

SCA is an authentication rule, and it inherits an identity question it does not itself answer.

The inherence factor is a biometric match against a template, and the template was enrolled at some earlier point. If that enrollment happened without establishing who the person was, SCA runs perfectly against a face that was never verified — two independent factors, correctly checked, belonging to whoever enrolled. The same applies to possession: a device is bound to a customer at a moment that precedes every authentication it later performs.

PSD2 does not specify how the underlying identity is established, because that sits with the AML and customer due diligence rules rather than the payments directive. The consequence for a payment institution is that two separate regimes meet at onboarding, and the strength of the authentication regime is capped by the quality of the identification one.

What PSD2 did not achieve

Open banking uptake was uneven. Access was mandated; the quality of the interfaces was not consistent, and implementation differences between banks limited what third parties could build. Improving this is an explicit objective of the successor package.

SCA did not stop authorized fraud. It substantially reduced unauthorized remote card fraud and has no effect where the customer is deceived into authorizing the payment themselves — the customer authenticates correctly, because they are the customer. Addressing that is why verification of payee appears in the successor rules.

A directive produced divergence. National transposition meant different interpretations and timetables across member states, which is the specific problem a directly applicable regulation is intended to solve.

Frequently asked questions

Is PSD2 still in force?

Yes. The PSD3 and Payment Services Regulation package was politically agreed in November 2025 with final texts published in April 2026, but it has not yet been adopted or entered into force. PSD2 remains the operative framework, with the successor rules expected to apply from around 2028.

What counts as strong customer authentication?

Two or more independent elements from different categories — knowledge, possession and inherence — such that compromising one does not compromise the others. Remote payments additionally require dynamic linking, tying the authentication to the specific amount and payee.

What is the transaction risk analysis exemption?

It allows a provider to skip SCA on lower-value remote payments where its own measured fraud rates stay below defined thresholds, with the permitted value ceiling depending on the rate achieved. The exemption is earned through demonstrated fraud performance and is withdrawn if performance deteriorates.

Does PSD2 apply to firms outside the EU?

It applies to payment services provided within the EU and EEA, which brings non-EU firms into scope for their European operations. Where only one leg of a transaction is in the EU, some provisions apply partially — an area the successor regulation clarifies.

Related reading

• European Banking Authority — the body that wrote the technical standards behind SCA
• Multi-factor authentication — the general concept SCA specifies in law
• Risk-based authentication — how the transaction risk analysis exemption is operated
• EU eIDAS regulation — the parallel EU framework for digital identity