PSD2
The EU payment services directive that mandated strong customer authentication and forced banks to open account access to licensed third parties.
Industry & DomainPSD2 did two things that still shape European fintech. It required strong customer authentication for electronic payments, and it obliged banks to expose account data and payment initiation to licensed third parties through APIs — which is what made open banking a legal reality rather than a partnership negotiation.
For a product team the directive resolves into concrete constraints: which authentication applies and which exemptions you can claim, what licence or agent arrangement you need to touch account data, and what consent, disclosure and revocation must appear in the interface. Its successor package — PSD3 and the accompanying payment services regulation — is progressing through the EU legislative process and extends the same direction rather than reversing it.
In practice
A UK-based product assumed PSD2 no longer applied after Brexit and built a checkout without SCA handling for EEA cards. European issuers declined a material share of transactions with soft declines that the checkout surfaced as generic failures. The fix was configuration, but it took a quarter of lost conversion to find.
Where teams get it wrong
- Assuming it only applies to banks rather than to anyone handling electronic payments in scope.
- Treating it as a legal matter with no interface consequences — consent and authentication are both UI.
- Ignoring available exemptions and challenging all traffic.
- Assuming a non-EU base puts you out of scope when customers or issuers are inside it.
- Building to PSD2 without tracking the PSD3 package now in progress.
Learn more
You may ask
Frequently Asked Questions
What does PSD2 require?
Strong customer authentication for electronic payments, and bank APIs giving licensed third parties access to account information and payment initiation with the customer's explicit consent.
Is PSD3 replacing PSD2?
A successor package — a third directive plus a payment services regulation — is moving through the EU legislative process. It extends PSD2's direction on authentication, open banking and fraud rather than reversing it.
Related terms
All terms- Strong Customer Authentication (SCA)The EU requirement that electronic payments be authenticated with two independent factors — with a defined set of exemptions.
- Open BankingA regulatory framework letting licensed third parties access bank account data, and initiate payments, with the account holder's explicit consent.
- 3-D SecureThe card-network authentication step that shifts fraud liability from the merchant to the issuer — at a measurable cost in completed checkouts.
- Payment GatewayThe service that takes payment details from a checkout, passes them for authorisation, and returns the result.
Defined by Mara Last reviewed .
Let's talk about your product.
Happy to look at what you're building and say where design would move the needle.
Contact Us