Share this article

The Payment Services Directive 3 (PSD3), the latest iteration of the European regulatory framework, is poised to bring transformative changes to financial institutions (FIs) and payment service providers (PSPs) in Europe. As global financial ecosystems become more interconnected, its impact is set to ripple across U.S. financial firms, particularly in data security and data sharing practices.

A Brief History of PSD3

The European Commission initiated the PSD3 update in the summer of 2023, building upon its predecessor, PSD2, introduced in 2016. Alongside PSD3, the Commission also unveiled the Payment Services Regulation (PSR), which focuses on technical standards, and the Framework for Financial Data Access (FIDA), designed to govern customer-level data sharing. Final guidelines for PSD3 are anticipated this year, with implications for U.S. firms emerging over the next 18 months as draft adaptations are finalized.

Consumer-Centric Features: Permission Dashboards

PSD3 introduces significant consumer-focused enhancements, requiring PSPs with online account features to implement permissioned dashboards. These dashboards allow users to:

Grant and monitor consent for sharing their data with third parties.
Revoke or adjust access permissions easily.

Additionally, financial institutions will be mandated to provide non-banking payment firms access to account information and payment systems. This includes enabling non-bank entities to maintain bank accounts tied to EU-wide payment systems, fostering greater inclusivity and competition.

Strengthening Fraud Prevention and Data Security

The directive emphasizes collaborative efforts to combat fraud and bolster security. Key measures include:

Data sharing: PSPs will be permitted to share fraud-related data to enhance collective defenses.
Enhanced consumer protections: Extending refund rights for fraud victims, improving consumer awareness campaigns, and mandating “confirmation of payee” functions to ensure payee names align with their International Bank Account Numbers (IBAN).
Transaction monitoring: Firms must upgrade monitoring systems to detect suspicious activities effectively.
Strong Customer Authentication (SCA): Building on PSD2’s initial rollout, PSD3 aims to refine SCA requirements, including its application when enrolling cards in digital wallets.

Implications for U.S. Financial Firms

For payment firms operating exclusively within U.S. borders, PSD3 may not bring immediate changes. However, its global implications are significant for multinational firms. Open banking, facilitated under FIDA, establishes frameworks for securely sharing customer data, offering:

Insights into consumer purchasing behavior, enabling banks and FinTechs to tailor competitive products.
Clarification of compliance standards for cross-border operations, ensuring smoother adaptation to EU regulations.

Collaborative Compliance: The Road Ahead

PSD3’s far-reaching provisions highlight the importance of a collaborative regulatory approach, uniting PSPs, FIs, and consumers to create a more secure, transparent, and competitive financial ecosystem. U.S. firms with global operations must prepare to adapt to these changes, leveraging the directive to enhance their offerings while ensuring robust compliance.

As the regulatory landscape evolves, PSD3 represents a critical opportunity for financial entities to strengthen fraud prevention, improve data governance, and foster consumer trust—laying the groundwork for a more integrated global payments market.