PSD2 (Second Payment Services Directive)

PSD2, the Second Payment Services Directive (Directive (EU) 2015/2366), is the European Union law that governs payment services and payment service providers. It defines which payment activities require authorization, sets the rules for licensing and supervising payment institutions, gives regulated third parties a right to access customers' online bank accounts with their consent, and requires strong customer authentication for most electronic payments. It also sets conduct rules on transparency, charges, execution times and liability that apply to every payment service provider, banks included.

PSD2 was adopted in November 2015 and member states had to transpose it into national law by 13 January 2018. It applies across the European Economic Area, and the United Kingdom implemented it through the Payment Services Regulations 2017, which remain in force there after Brexit.

The first Payment Services Directive (2007/64/EC) created a common licensing regime for non-bank payment providers and laid the legal groundwork for SEPA. By the early 2010s new services had appeared that it did not cover, notably firms that initiated payments directly from a customer's bank account or aggregated account information, often by asking customers for their online banking passwords. Some exclusions in the first directive had also been interpreted broadly. PSD2 was designed to bring these services into regulation, tighten the exclusions, and improve security.

Annex I of PSD2 lists eight payment services, including cash placement and withdrawal, execution of payment transactions, issuing of payment instruments and acquiring of payment transactions, money remittance, payment initiation services and account information services. A firm providing them must be a credit institution, an electronic money institution, or an authorized payment institution, unless an exemption applies.

Minimum initial capital depends on the service: EUR 20,000 for money remittance only, EUR 50,000 for payment initiation, and EUR 125,000 for the other services. Account information service providers need no initial capital but must hold professional indemnity insurance. Payment institutions must also meet ongoing own-funds requirements and safeguard customer funds. Member states may register small payment institutions under a lighter regime, but these cannot use passporting to serve other member states. Firms may distribute services through registered agents.

PSD2 created two regulated roles, the payment initiation service provider and the account information service provider, and required banks and other account servicers to give them access to online payment accounts when the customer consents. This is the legal foundation of open banking in Europe. A payment initiation service can instruct a credit transfer from the customer's account to a merchant, and an account information service can retrieve balances and transactions. The detailed technical rules were set in a regulatory technical standard, which led most banks to build dedicated interfaces based on an API.

PSD2 requires payment service providers to apply strong customer authentication when a payer accesses an account online, initiates an electronic payment, or carries out any remote action that may imply a risk of fraud. Authentication must combine at least two independent factors from knowledge, possession and inherence. The technical standard, Commission Delegated Regulation (EU) 2018/389, applied from 14 September 2019, although national authorities allowed extra time for card-based e-commerce, generally until the end of 2020. Exemptions cover low-value payments, trusted beneficiaries, recurring transactions and low-risk transactions assessed by transaction risk analysis.

• Charges: the "SHA" charging principle is the default for intra-EEA payments in EEA currencies, and surcharging on most consumer card payments is banned.
• Liability: a payer's liability for unauthorized transactions is capped at EUR 50 unless the payer acted fraudulently or with gross negligence.
• Refunds: payers have an unconditional right to a refund of authorized direct debits for eight weeks after the debit.
• Execution time: euro credit transfers within the EEA must reach the payee's provider by the end of the next business day.

In June 2023 the European Commission proposed replacing PSD2 with a third Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation, intended to address fraud, improve open banking performance and merge the e-money regime into the payment services framework. Until those texts take effect, PSD2 and the national laws transposing it remain the governing framework. In the UK, the FCA supervises payment firms under the Payment Services Regulations 2017, alongside the FCA's own rules.

• Directive (EU) 2015/2366 on EUR-Lex
• European Banking Authority