PSD2: EU Payment Services Directive Guide

The Second Payment Services Directive (PSD2) transformed the European payments landscape by introducing open banking requirements and strong customer authentication (SCA). By requiring banks to share account data with authorized third parties and mandating two-factor authentication for electronic payments, PSD2 opened the door to a new generation of financial services while raising security standards.

What PSD2 Covers

PSD2 creates two new categories of regulated payment service providers: Account Information Service Providers (AISPs) that can access account data with customer consent, and Payment Initiation Service Providers (PISPs) that can initiate payments directly from customer bank accounts. Banks must provide secure APIs enabling these services.

Strong Customer Authentication requires that electronic payments use at least two of three authentication factors: knowledge (something the user knows), possession (something the user has), and inherence (something the user is). Exemptions exist for low-value transactions, trusted beneficiaries, and certain merchant-initiated transactions.

Who Needs PSD2 Compliance

PSD2 applies to all payment service providers operating in the EU/EEA, including banks, payment institutions, electronic money institutions, AISPs, and PISPs. E-commerce merchants are indirectly affected through SCA requirements on customer-initiated payments. The UK retained PSD2 post-Brexit with plans for its own open banking evolution.

Implementation Approach

For banks, the primary obligation is building compliant open banking APIs and implementing SCA across payment channels. For fintechs seeking AISP or PISP authorization, the process involves regulatory licensing, building secure API integrations, and implementing customer consent management. For merchants, integration with SCA-compliant payment flows is essential.

Cost Considerations

Banks typically invested $1 million to $50 million in PSD2 compliance including API infrastructure, SCA implementation, and fraud monitoring systems. Fintech startups entering as AISPs or PISPs can expect $50,000 to $300,000 for licensing, API development, and compliance infrastructure. The proposed PSD3 will bring additional changes that organizations should factor into their planning.