PSD2

PSD2, short for the Revised Payment Services Directive, is an EU directive designed to modernize payment regulation across the European Economic Area. It builds on the original Payment Services Directive by expanding competition, fostering innovation, and strengthening consumer protections in electronic payments. PSD2 was adopted in 2015 and implemented in EU member states through national transpositions by the late 2010s.

A central aim of PSD2 is to enable secure third-party access to payment accounts. With the user’s explicit consent, banks must provide access to payment accounts to licensed third-party providers, enabling two new types of services: payment initiation services (PIS), which start online payments directly from a user’s account, and account information services (AIS), which aggregate and present account data from one or more accounts. To facilitate this, banks are encouraged to offer secure interfaces, often standardized APIs, for these third parties.

PSD2 also introduces strong customer authentication (SCA) for electronic payments. SCA requires at least two of three elements from the user: something the user knows, something the user possesses, and something the user is. The directive is supported by Regulatory Technical Standards (RTS) on SCA and secure communication between banks and third-party providers, outlining when and how authentication should occur and how data must be securely exchanged.

Other provisions cover consumer protection, liability for unauthorized payments, and governance by national competent authorities with European coordination. PSD2 applies to payment service providers within the EU and EEA, and it has driven a rise in open banking, fintech competition, and improved security expectations in cross-border digital payments.