PSD2 (Second Payment Services Directive)

PSD2 applied from 13 January 2018, replacing the first Payment Services Directive of 2007. It defines which activities are regulated payment services, including acquiring, money remittance, payment initiation and account information, and who may provide them: banks, e-money institutions and payment institutions authorised by a national regulator. An authorisation in one EEA country can be passported to the others.

For merchants, the most visible effects are strong customer authentication for online payments, which applied from September 2019 under separate technical standards; the rules that let regulated third parties initiate payments from bank accounts; and a ban on surcharging consumer card payments covered by the EU interchange caps. PSD2 also sets transparency requirements, refund rights for direct debits and a 13-month limit for reporting unauthorised transactions.

The UK implemented PSD2 through the Payment Services Regulations 2017 and has kept that framework since leaving the EU. In the EU, the Council and Parliament reached a provisional agreement in November 2025 on a new Payment Services Regulation and a third directive (PSD3), aimed at fighting fraud and improving fee transparency; the new rules apply only after formal adoption and a transition period.