The Payment Services Directive (PSD) is the European Union legislation that sets the rules for payment services across the European Economic Area. It defines which activities count as payment services, who may provide them, what information customers must be given, and how responsibility is divided when a payment goes wrong. The first directive, Directive 2007/64/EC and now usually called PSD1, was adopted in 2007 and had to be written into national law by November 2009.
The name is used in two ways: for the original 2007 directive specifically, and for the legislative framework as a whole through its successive versions. PSD1 was replaced by the second directive, PSD2, which has applied since January 2018, and a third generation of rules has since been negotiated. As directives, these laws bind member states to achieve a result but are implemented through national legislation, such as the United Kingdom's Payment Services Regulations.
Background and aims
Before 2007, payment law in Europe was national. Rules on who could offer payment services, how fast a transfer had to arrive and what a customer could claim after an unauthorised payment differed from country to country, and in most countries only banks could hold payment accounts. This fragmentation stood in the way of the single market and of the industry's project to create common euro payment instruments.
PSD1 had two aims. The first was to open the market to competition by creating a licence for non-bank providers. The second was to harmonise the conduct rules so that a payment user had the same basic rights anywhere in the Union. In doing so it supplied the legal foundation for the Single Euro Payments Area, whose credit transfer and direct debit schemes rely on the directive's common rules.
What PSD1 introduced
- A list of payment services. The directive defined the regulated activities, including operating payment accounts, executing credit transfers and direct debits, issuing payment instruments, acquiring payment transactions and money remittance, and listed exclusions such as cash-only payments and limited networks.
- Payment institutions. It created the payment institution, a new category of regulated firm that can provide payment services without being a bank. An authorised payment institution must meet requirements on governance, own funds and the safeguarding of customer money.
- Passporting. A firm authorised in one member state can provide services in all others, directly or through branches and agents, under passporting.
- Transparency. Providers must disclose charges, exchange rates and execution times before and after a payment.
- Execution rules. Payments in euros within the area must reach the payee's provider by the end of the next business day, the full amount must be transferred without deductions, and funds must be made available to the payee immediately on receipt.
- Liability. A customer who reports an unauthorised transaction is entitled to a prompt refund, with their own loss limited to a fixed amount unless they acted fraudulently or with gross negligence. Payers by direct debit gained a refund right for a set period.
PSD2
The first directive was reviewed after a few years. New services had appeared that it did not cover, notably firms that initiated payments from customers' bank accounts or aggregated account information using the customers' online banking credentials, and card fraud online was growing. The second directive, Directive (EU) 2015/2366, was adopted in 2015 and repealed PSD1 when it took effect in January 2018.
PSD2 brought those new providers into regulation and required banks to give them access to customer accounts with the customer's consent, creating the legal basis for open banking. It made strong customer authentication mandatory for most electronic payments, lowered the customer's maximum liability for unauthorised payments, narrowed several exclusions, extended the transparency rules to payments with one leg outside the area, and prohibited card surcharging on consumer cards covered by the interchange fee caps. The European Banking Authority was given the task of writing detailed technical standards.
The next generation
In June 2023 the European Commission proposed to replace PSD2 with two instruments. A new directive, PSD3, would cover the licensing and supervision of payment institutions and absorb the separate regime for the electronic money institution. A directly applicable Payment Services Regulation would contain the conduct rules, so that they no longer vary with national transposition. The package responds to the growth of scams in which customers are tricked into authorising payments, to uneven enforcement between member states, and to practical problems with open banking interfaces. The Parliament and the Council reached a provisional agreement in November 2025, the Council adopted its position at first reading in October 2026, and the Parliament's final vote was scheduled for December 2026, with the new rules due to apply 21 months after they enter into force.
Assessment
The directive is generally credited with enabling a large non-bank payments sector in Europe: thousands of payment and e-money institutions operate under its licences, including money remitters, card acquirers, wallet providers and fintech companies offering account-like services. Its consumer protections, particularly the refund right for unauthorised payments, became a reference point for other jurisdictions.
Criticism has focused on inconsistent national implementation and supervision, which allowed firms to choose lenient jurisdictions; on the complexity of the exclusions; on friction and abandoned purchases when strong authentication was introduced; and on the fact that liability rules built around unauthorised payments gave little help to victims of authorised scams. These points shaped the proposals for the successor legislation.