PSD3 and the Payment Services Regulation: what payment providers should prepare

Short answer: PSD3 and the Payment Services Regulation (PSR) replace the second Payment Services Directive (PSD2) and the E-Money Directive. The PSR applies directly and tightens fraud prevention, liability and open banking rules. As of 10 November 2026 neither text has been adopted: the Council published its position on 5 November 2026 and Parliament is expected to vote on 14 December 2026.

This briefing is for legal and compliance teams at banks, payment and e-money institutions and fintechs in Germany, and for Swiss groups with business in the EU. It sets out what PSD3 and PSR compliance will require, which dates are fixed and what capacity the preparation takes.

What are PSD3 and the PSR about?

PSD3 and the PSR are a directive-and-regulation package that the European Commission proposed on 28 June 2023. They split the work as follows:

• PSD3 (directive, COM(2023) 366): covers authorisation and supervision of payment institutions and brings e-money institutions into the same framework. It repeals Directive (EU) 2015/2366 (PSD2) and Directive 2009/110/EC and has to be transposed into national law.
• PSR (regulation, COM(2023) 367): governs the rights and obligations between payment service providers and their users, including information, authorisation, liability, fraud prevention and data access. It applies in every Member State without transposition.

In practice, the PSR carries most of the work. The Council's position (document 8543/1/26) includes the following obligations:

• Unauthorised transactions: a payment is unauthorised where a third party initiates or modifies it without the payer's consent, including with fraudulently obtained security credentials (Art. 50(2)).
• Bank impersonation fraud: where a fraudster poses as the consumer's payment service provider using channels attributed to that provider, the provider refunds the full amount. The consumer must report the fraud to the provider without undue delay and to the police. Within 15 business days the provider must refund or give reasons for refusing (Art. 61(2) and (3)).
• Transaction monitoring: providers need mechanisms to prevent and detect fraudulent payments, taking into account at least compromised authentication elements, the amount and known fraud scenarios (Art. 87).
• Fraud information sharing: providers take part in information-sharing arrangements, limited to defined data categories (Art. 88).
• Spending limits: users can set limits per payment instrument in the framework contract. A limit raised remotely only takes effect after four hours (Art. 52).
• Bank accounts for payment institutions: credit institutions must grant payment institutions access to payment accounts on an objective, non-discriminatory and proportionate basis and may refuse only on specified grounds (Art. 33).

Article numbers follow the Council's position and may change in the version published in the Official Journal.

Who is affected by PSD3 and the PSR?

Every payment service provider in the EU is in scope: credit institutions, payment institutions, e-money institutions and providers of payment initiation and account information services. The PSR also places duties on third parties, such as technical service providers and operators of payment schemes (Art. 59) and hosting providers, which payment service providers must notify when fraud originates in online content (Art. 61(1)).

Source: Council position 8543/1/26 of 5 November 2026; compiled by Alpinum Solutions, November 2026.

PSD3 timeline: deadlines and current status

No date of application has been fixed yet. The PSR enters into force 20 days after publication in the Official Journal and its obligations apply after a transition period counted in months from entry into force (Art. 124). PSD3 has to be transposed into national law after publication. The exact periods will only be certain once the final text is adopted.

Source: European Parliament Legislative Observatory (procedures 2023/0209(COD) and 2023/0210(COD)) and European Commission, accessed 10 November 2026. Further EU, German and Swiss deadlines are listed in the regulatory calendar for legal and compliance teams.

What firms should do now

Payment service providers should use the time before publication for a gap analysis. The Council's position is based on the text negotiated by Parliament and Council, which ECON approved on 5 May 2026. A proven approach:

1. Map the scope: record which entities, products and services fall under PSD3 and the PSR, including EU entities of Swiss groups.
2. Run a gap analysis: compare framework contracts, customer information, liability and refund processes with the Council's position.
3. Review fraud prevention: assess transaction monitoring, spending limits, notifications to hosting providers and fraud data sharing together with data protection.
4. Prepare the refund process: set up a workflow that decides and documents impersonation fraud cases within 15 business days.
5. Plan the implementation: prioritise measures, secure budget and people, and add the deadlines once the text is published in the Official Journal.

Several obligations overlap with anti-money laundering compliance. A credit institution may, for example, refuse an account for a payment institution where opening it would breach Regulation (EU) 2024/1624 (AMLR). What the AMLR itself requires is covered in AMLR and AMLA: what compliance teams face from 2027.

Which roles and how much capacity are needed?

PSD3 and PSR compliance needs payments law expertise and project capacity over several months. Typical roles are:

• Legal counsel for payments and banking law: analyses the text and updates framework contracts and customer terms.
• Regulatory specialist: tracks the procedure, prepares supervisory documents and coordinates the gap analysis.
• Fraud and AML compliance officer: shapes transaction monitoring, fraud reporting and refund decisions.
• Data protection specialist: reviews fraud data sharing and data access in open banking.
• Project lead: connects legal, compliance, product and IT and reports to senior management.

An experienced specialist working part-time is often enough for the gap analysis. Implementation across contracts and processes usually needs a team. One example of a team working on transaction analysis is the case study on a KYC taskforce of eight compliance officers at a Swiss financial institution.

How interim support helps

Interim specialists close the gap between day-to-day work and a regulatory project. They work inside the institution's team; the institution directs the work and remains responsible for implementation.

Alpinum Solutions provides lawyers with banking and payments experience, regulatory specialists and compliance officers through staff leasing and freelancing, part-time or full-time and from junior to senior level. Alpinum Solutions typically presents two to four profiles per search; selected profiles are usually available within 48 hours, and the start date is agreed between the client and Alpinum. Specialists can also take on formal functions, such as money laundering reporting officer. For the MLRO role, regulatory restrictions may rule out an external appointment or require staff leasing. How fintechs plan capacity for licensing and MiCA is covered in fintech and crypto: legal and compliance capacity for licensing and MiCA.

Frequently asked questions about PSD3 and the PSR

When will PSD3 and the PSR apply?

That is not yet fixed. As of 10 November 2026 the Council's position is available and Parliament is expected to vote at second reading on 14 December 2026. Publication in the Official Journal follows. The PSR enters into force 20 days later and applies after a transition period counted in months. PSD3 first has to be transposed into national law.

What is the difference between PSD3 and the PSR?

PSD3 is a directive covering authorisation and supervision of payment and e-money institutions; each Member State transposes it into national law. The PSR is a regulation and applies directly. It contains the rules on the relationship with users, including information, fraud liability, transaction monitoring and open banking.

Who is liable for bank impersonation fraud under the PSR?

Under the Council's position, the payment service provider refunds the consumer in full where a fraudster has posed as the provider using channels attributed to it. The consumer must report the fraud without undue delay and file a police report. Where there are objectively justified grounds to suspect fraud or gross negligence by the consumer, the provider can refuse within 15 business days, giving reasons.

Do PSD3 and the PSR apply in Switzerland?

No. As EU legislation, PSD3 and the PSR do not apply directly in Switzerland. Swiss banks, payment providers and groups are affected, however, where they have EU entities or offer payment services in the EU. They should check which products, contracts and processes fall under the new framework and staff the work with specialists who know both regimes.

What should payment service providers do before publication?

A gap analysis based on the Council's position makes sense: framework contracts, customer information, refund processes, transaction monitoring and fraud data sharing. Measures and budget are then ready when the deadlines appear in the Official Journal. Article numbers may still change before publication.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides specialists for PSD3 and PSR projects in Germany, Switzerland and Austria. Discuss your requirements with us and we will show you suitable profiles.

• Banking, finance and capital markets: specialists for banking and financial markets law
• Fintech and crypto: legal and compliance capacity
• AMLR and AMLA: what compliance teams face from 2027
• Regulatory radar: all articles on regulatory change
• Discuss your needs

Last updated: 10 November 2026.