PSD3 and PSR1: What UK Payment Firms Should Know

The European Commission published its proposals for PSD3 and the Payment Services Regulation (PSR, sometimes called PSR1) on 28 June 2023. The European Parliament and the Council reached political agreement on 27 November 2025, and the Council published the final compromise texts on 23 April 2026. Once formally adopted and published in the Official Journal, both enter into force 20 days later and apply 21 months after that. The UK is not bound by them, but they apply directly to UK groups with EU-authorised subsidiaries and shape competition for EU customers. This guide explains what is changing and what UK firms should do.

Why Is the EU Replacing PSD2?

PSD2 has been in force since January 2018 and has driven significant innovation in the EU payment sector, particularly through open banking and strong customer authentication (SCA) requirements. However, the European Commission identified several shortcomings: inconsistent implementation across member states due to PSD2's status as a directive (requiring national transposition); gaps in fraud prevention and liability frameworks; uneven access to payment systems and bank accounts for payment institutions; and insufficient consumer protection in certain areas, including credit transfers and account information services.

The solution is a two-instrument approach: PSD3 as a directive (governing authorisation and supervision) and PSR1 as a directly applicable regulation (governing conduct rules, SCA, transparency and fraud liability). The regulation format for PSR1 means its rules will apply uniformly across all EU member states without the need for national transposition: eliminating much of the inconsistency that plagued PSD2.

Key Changes in PSD3

Merged licensing framework: PSD3 repeals the Electronic Money Directive (EMD2) along with PSD2 and brings e-money services into the payment institution framework. Existing payment institutions may continue operating during a transitional period of up to 27 months after entry into force, provided they give their regulator the required information, and are deemed authorised under PSD3 once they show compliance. A broadly similar transitional approach applies to existing EMIs.

Enhanced safeguarding: PSD3 strengthens safeguarding requirements, building on lessons from firm failures, including how safeguarded funds are held and the treatment of concentration risk.

Access to payment systems: PSD3 includes provisions to improve payment institutions' access to payment systems and bank accounts, addressing the 'de-risking' problem where banks have refused to provide accounts to payment firms.

Key Changes in PSR1

Stronger SCA framework. The PSR refines strong customer authentication. Fraud prevention and impersonation scams. The PSR requires payment service providers to monitor transactions and share fraud data, and gives consumers a refund right where they are tricked by someone impersonating their payment service provider, subject to conditions. Verification of payee: Before executing a credit transfer, the payer's provider must check that the payee's name matches the account identifier, such as the IBAN. This applies 27 months after the PSR enters into force, for transfers not already covered by the Instant Payments Regulation. Open banking evolution: Account providers must maintain a dedicated, secure interface for account information and payment initiation providers, and users get a dashboard to see and withdraw data access permissions. Transparency: Enhanced transparency requirements for fees, charges and exchange rates, including pre-transaction disclosure of total costs for cross-border payments.

Implications for UK Firms

Although the UK is not directly affected by PSD3/PSR1, the proposals are significant for UK firms for several reasons:

UK firms with EU operations. Firms operating through EU-authorised subsidiaries or branches will be directly subject to the new framework. The merger of PI and EMI licensing may require firms to restructure their EU authorisations. Safeguarding changes will require operational adjustments. Competitive dynamics: PSD3/PSR1 will shape the competitive landscape in Europe. UK firms competing with EU-authorised firms should understand the new framework to identify competitive advantages and disadvantages. Regulatory divergence. The UK retained PSD2 and EMD2 in domestic law after Brexit and is now moving on its own path: CASS 15 safeguarding rules from PS25/12 took effect on 7 May 2026, mandatory reimbursement of APP scam losses has applied since 7 October 2024, and since 28 April 2026 payment service providers must give at least 90 days' notice, with reasons, before closing a framework contract (regulation 51B of the PSRs 2017). PSD3/PSR1 creates a divergence trajectory: UK firms operating in both jurisdictions will need to comply with two evolving and potentially conflicting frameworks. Customer expectations: EU regulatory developments influence customer expectations globally. Enhanced fraud protection, improved transparency and better open banking services mandated by PSR1 may raise the bar for UK firms even in the domestic market.

Timeline and UK Response

UK firms should: read the final texts against their EU entity's current authorisation; plan the re-authorisation information pack; build verification of payee and impersonation fraud controls into EU product roadmaps; and keep UK and EU safeguarding processes aligned where possible. UK groups setting up a new EU entity should build the application to the PSD3 standard. Our pages on UK authorised payment institutions and UK EMIs cover the UK side.

Regulatory Counsel advises UK payment institutions and EMIs on cross-border regulatory compliance, EU licensing and the implications of PSD3/PSR1. Contact us for a written proposal. See our PI licensing and EMI authorisation pages for more.