PSD2

PSD2
Name	Payment Services Directive 2
Jurisdiction	European Union
Adopted	2015
Effective	2018
Legal basis	Directive (EU) 2015/2366
Replaced	Payment Services Directive
Subject	Electronic money; Payment systems
Keywords	Open banking; Strong Customer Authentication

PSD2 is a European Union directive that reformed rules for payment services and providers across the European Union and the European Economic Area. The directive sought to modernize the regulatory framework established by the earlier Payment Services Directive by promoting competition among banks, fintech firms and payment initiation providers while strengthening customer rights and security. PSD2 also enabled the rise of open banking through mandated access to customer account data under regulated conditions.

Background and objectives

PSD2 was adopted amid rapid technological change in the payments sector and lobbying by established institutions such as European Central Bank, European Commission, and industry bodies including European Banking Authority and European Payments Council. Objectives included enhancing consumer protection after incidents connected to SWIFT and payment card disputes, fostering market entry for startups like Revolut, TransferWise (now Wise), and supporting integrated markets as envisaged in directives like the Markets in Financial Instruments Directive. Policymakers referenced cross-border frameworks such as the Single Euro Payments Area and legislative precedents including the Consumer Credit Directive.

Key provisions and requirements

Major provisions require account servicing payment service providers (ASPSPs)—typically incumbent banks such as Deutsche Bank, Santander, BNP Paribas—to grant regulated third-party providers (TPPs) access to customer payment accounts via application programming interfaces (APIs). PSD2 defines categories of providers: payment initiation service providers (PISPs) and account information service providers (AISPs). It mandates Strong Customer Authentication (SCA) measures comparable to standards used by Visa, Mastercard, and instruments recognized by SWIFT. The directive updates consumer rights including liability caps for unauthorized transactions, refund rights for credit transfers, and transparency requirements consistent with Consumer Rights Directive and Electronic Commerce Directive precedents.

Impact on banks, fintechs and consumers

Banks faced both competitive pressure and new interoperability obligations, prompting strategic shifts at institutions such as Barclays, ING Group, UBS, and HSBC. Many incumbents invested in developer portals and API platforms similar to efforts by BBVA and Nordea to retain customer relationships. Fintech entrants including Stripe, Adyen, N26, and Monzo leveraged PSD2 to offer payment initiation, aggregation, and personal financial management services. Consumers gained expanded choices and new services from aggregators like Plaid and Yodlee-analogues in Europe, though uptake varied by market and trust in providers such as Revolut and Wise. Cross-border competition influenced pricing and innovation in corridors served by firms like PayPal and Western Union.

Security, authentication and fraud prevention

PSD2’s SCA requirement compelled multi-factor authentication combining two of three elements: knowledge, possession, and inherence—concepts used in authentication systems by Microsoft, Apple, and Google. SCA implementation intersected with biometric technologies from vendors such as Fingerprint Cards and Synaptics and with tokenization models promoted by EMVCo. Payment fraud mitigation drew on analytics and machine learning approaches employed by IBM, Palantir-style firms, and specialized providers like Kount. Schemes for exemption and transaction risk analysis referenced the operational standards of Swift and infrastructure considerations from TARGET2 and national central banks.

Implementation, enforcement and compliance

Implementation required transposition into national law by member states and coordination among regulators including European Banking Authority, national competent authorities like the Financial Conduct Authority and data protection authorities such as national offices aligned with the General Data Protection Regulation. Compliance encompassed licensing regimes for TPPs, regulatory technical standards (RTS) for SCA issued by the European Banking Authority, and supervisory actions comparable to enforcement by authorities in France, Germany, and Italy. Market interoperability involved industry consortia and standard-setting organizations such as ISO and payments infrastructure providers including SWIFT and clearing houses like Euroclear.

Criticisms and controversies

PSD2 attracted critique from legacy institutions over implementation costs and from privacy advocates concerned about third-party access to account data, with commentators comparing issues raised in debates around Cambridge Analytica and data portability in the context of the General Data Protection Regulation. Technical disputes emerged over mandated API specifications, pitting banks against fintechs and intermediaries such as Plaid over practical access and liability. Small banks and credit unions raised concerns similar to those voiced in discussions involving Community Reinvestment Act-era regulatory burdens, while some consumer groups argued exemptions and complex SCA flows could reduce access for elderly or disabled users, echoing accessibility debates seen with Section 508 and Web Content Accessibility Guidelines.

Category:European Union directives