Payment Services Regulation (PSR)

The Payment Services Regulation (PSR) is a European Union regulation that sets the rules payment service providers must follow in their dealings with customers and with one another: what information they must give, how payments are authorised and executed, who bears losses from fraud, and how third parties gain access to payment accounts. The European Commission proposed it in June 2023 together with a new directive, PSD3, as the replacement for the second Payment Services Directive.

The important change is the legal form. The conduct rules in PSD2 sit in a directive, which each member state transposes into its own law, and the resulting differences in wording and enforcement were a main finding of the Commission's review. A regulation applies directly and identically in every member state. The abbreviation PSR should not be confused with the United Kingdom's Payment Systems Regulator, an unrelated body, or with the United Kingdom's Payment Services Regulations.

The package splits the content of the existing Payment Services Directive framework in two. PSD3 keeps what concerns the authorisation and supervision of firms: licensing of a payment institution, capital, safeguarding and the powers of national authorities. The regulation takes everything about how payment services are provided, and applies to all providers, including banks, payment institutions and electronic money issuers.

The most prominent measures address scams in which the customer is manipulated into making a payment, known as authorized push payment fraud, which the PSD2 refund rules for unauthorised payments do not cover.

• Payee verification. A check that the payee's name matches the account number, already required for euro instant transfers under the Instant Payments Regulation, is extended to credit transfers generally. A provider that fails to offer the verification of payee service is liable for resulting losses.
• Impersonation of the provider. Where a fraudster poses as the customer's own bank or payment provider and induces a payment, the customer is entitled to a refund from the provider, subject to conditions such as reporting the fraud promptly and not having acted with gross negligence.
• Fraud data sharing. Providers are given a legal basis to exchange information about suspect accounts and payees among themselves, within data protection limits set with reference to the General Data Protection Regulation.
• Monitoring and education. Providers must run transaction monitoring and alert customers to new forms of fraud. The legislators also brought telecommunications operators and online platforms into the picture, with duties to cooperate in tackling fraudulent content and spoofing.

The rules on unauthorised transactions are carried over from PSD2, with clarifications on what counts as authorisation and on the evidence a provider needs before refusing a refund.

Strong customer authentication remains the default for electronic payments. The regulation clarifies when it applies, including for merchant-initiated transactions, phone and mail orders and wallet enrolment, and requires providers to offer methods usable by people with disabilities, older customers and those without a smartphone. It also clarifies the allocation of liability between providers, technical service providers and payment schemes when authentication fails.

The regulation rewrites the access rules that underpin open banking. Banks must offer a dedicated interface for third-party providers that meets performance requirements, and the regulation lists practices treated as prohibited obstacles. The obligation to maintain a permanent fallback interface is removed in exchange. Customers gain a dashboard at their bank showing which providers they have granted access to and allowing them to withdraw it, a form of consent management. Wider sharing of financial data beyond payment accounts is left to a separate proposal on financial data access.

Further provisions improve the transparency of charges, including the estimated currency conversion cost and execution time of transfers sent outside the Union and clearer identification of payees on account statements. Rules on blocked funds for card payments where the final amount is unknown are tightened. The ban on surcharging is broadened, and retailers may offer cash withdrawals without a purchase up to a limit. The regulation also addresses the difficulty non-bank providers have had in obtaining and keeping bank accounts, requiring banks to justify refusals or closures.

The European Parliament adopted its position at first reading in April 2024, the Council agreed its negotiating mandate in June 2025, and the two institutions announced a provisional political agreement in late November 2025. The final compromise text was published in April 2026, the Council adopted its position at first reading in October 2026, and the Parliament's second-reading vote, the last step before signature and publication in the Official Journal, was scheduled for December 2026. The regulation enters into force twenty days after publication, and most provisions apply 21 months after that date, with the extended verification of payee rules following at 27 months. Readers should check the published text for the final wording and application dates, since details changed during negotiation.

The European Banking Authority is charged with drafting technical standards and guidelines under the regulation, which will determine much of the practical detail. The regulation also interacts with the MiCA regime where payments are made with electronic money tokens.

• European Commission: Financial data access and payments package
• European Banking Authority