The EU’s biggest payments rewrite since PSD2 is weeks from becoming law. On 23 April 2026 the Council invited final approval of PSD3 and the Payment Services Regulation (PSR), and the texts are expected in the Official Journal around the end of Q2, with some firms bracing for a slip to September. Either way, the drafting years are over. What starts next is a countdown.
For merchants, the instinct is to file this under “bank problem”. That instinct hurt last time. When PSD2’s SCA rules went live, conversion suffered most at merchants who had waited for their PSP to sort it out. PSD3 sets up the same test, this time with a clearer clock.
The directive just became a regulation, and that is the story
PSD3 splits the old rulebook in two. The prudential rules stay in a directive that each member state transposes into national law. The conduct rules, including everything that touches your checkout, move into the PSR, which applies directly and identically across the EU.
That structural change matters more than any single rule. Under PSD2, SCA arrived through 27 national transpositions, and exemption practice varied by market and by regulator. Under the PSR, the same text binds every issuer, acquirer, and PSP on the same day. The room for “our local regulator reads it differently” shrinks to almost nothing.
- Nov 2025
Provisional political agreement
Parliament and Council settle the substance of PSD3 and the PSR.
- 23 Apr 2026
Council invites final approval
The draft Directive and Regulation move to sign-off; the measures are close to coming into force.
- Q2/Q3 2026Next
Publication in the Official Journal
Entry into force follows 20 days after publication. This starts every clock below.
- +18 months
PSR applies EU-wide (est. early 2028)
Directly applicable conduct rules, including SCA. Same deadline for PSD3 national transposition.
- +24 months
Payee name and IBAN verification
The name-matching obligation applies and liability for failures shifts to providers.
The clock runs 18 months, and it is shorter than it sounds
The PSR applies 18 months after it enters into force, which happens 20 days after publication. Publish in July 2026 and the core rules bite in early 2028. The payee name and IBAN verification obligation, with its liability shift onto providers, follows at 24 months. Existing payment institution licenses are grandfathered for 24 months, extendable to 30, but every PSP you rely on must re-authorize under the new regime.
Months from entry into force to the PSR applying EU-wide
Every SCA exemption, fraud control, and PSP contract you run in Europe gets re-tested against one directly applicable text in that window.
What actually changes at your checkout
Three things deserve a merchant’s attention now.
SCA stays, but gets stricter edges. Authentication must remain accessible without a smartphone, and PSPs that delegate SCA to third parties keep full liability, with audit rights attached. If your conversion depends on exemption strategy (TRA thresholds, low-value exemptions, MIT flags), expect that playbook to be re-checked against a single EU-wide text. Our PSD2 and SCA guide covers the current baseline the PSR will replace.
Fraud liability expands. Providers must reimburse customers for authorized push payment scams where the fraudster impersonated the PSP, and failed name-to-IBAN matches shift losses onto providers. Expect banks to respond the way they always do: more friction on credit transfers. That touches every merchant taking account-to-account payments.
Open banking gets teeth. Dedicated interfaces must hit performance parity with the bank’s own customer channels, and customers get permission dashboards. For high-risk merchants leaning on A2A rails, as we covered in Where Open Banking Is Actually Winning Against Cards, API quality has been the ceiling. The PSR raises it.
Use the window
Eighteen months sounds generous. It is not. PSP re-authorization, exemption re-testing, and new fraud controls will queue behind every other bank project between now and 2028. Merchants who audit their SCA exemption mix and ask their acquirer for a PSR readiness position this year will negotiate from the front of that queue.
Key point
Do not repeat the PSD2 scramble. The merchants who lost conversion in 2021 were the ones who started testing after the deadline. Ask your PSP two questions now: when do you re-authorize, and what changes in our exemption mix under the PSR.
The rewrite will not change what you sell or where you sell it. It changes who carries liability and how uniformly the rules get enforced. Merchants who treat mid-2026 as the starting gun, rather than late 2027 as the deadline, keep their conversion when the rules flip.
- Norton Rose Fulbright, “PSD3 and PSR: From provisional agreement to 2026 readiness,” exact page, 2026.
- Morrison Foerster, “PSD3 and the Payment Services Regulation: Key Developments, Timeline, and Action Points for Firms,” exact page, 30 Apr 2026.
