---
title: "PSD2"
url: "https://mahouse.world/glossary/psd2"
type: "glossary term"
topic: "Open banking & APIs"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-06"
---

# PSD2

PSD2 — the second Payment Services Directive (EU 2015/2366, in force from January 2018) — is the EU law that regulates payment services and payment institutions and, in its best-known provisions, required banks to give licensed third parties access to customers' account data and payment initiation with the customer's consent (open banking) and required strong customer authentication for electronic payments. Its successor, PSD3 with the Payment Services Regulation, will replace it around 2027.

**Also known as:** Payment Services Directive 2, Second Payment Services Directive, PSD3, Open banking (EU)

## Key facts

- **Used at:** every payment service in the EU and EEA — acquiring, money remittance, issuing, account information, payment initiation, e-money (under the parallel EMD2, folded into PSD3) — and, through the UK's transposition retained after Brexit, in the UK's Payment Services Regulations 2017 and its open-banking regime
- **Binding:** an EU directive transposed into national law and supervised by national competent authorities, with the European Banking Authority's regulatory technical standards on strong customer authentication and secure communication (the SCA rules, in force September 2019, enforced from 2021); PSD3 and the PSR replace it with a directly applicable regulation for most provisions
- **Typical provisions:** licensing and capital for payment institutions; safeguarding of customer funds; conduct rules on transparency, charges and execution times; liability rules (unauthorised transactions refunded, with a €50 customer excess); open banking access via APIs for account information and payment initiation service providers; strong customer authentication (two of knowledge, possession, inherence) with exemptions for low-value, low-risk, recurring and trusted-beneficiary transactions; passporting across the EEA
- **Typical effects:** a licensed fintech sector of hundreds of payment institutions; open-banking APIs at every bank, of uneven quality; SCA that cut card fraud and initially cut conversion, until exemptions and 3-D Secure 2 restored it; account-to-account payments that grew slowly; and PSD3's response — stronger fraud-liability rules (impersonation fraud, IBAN-name checks), tighter open-banking API standards, and the merger of e-money and payment institutions into one regime
- **Parties:** the European Commission and Parliament, the EBA, national regulators (BaFin, ACPR, DNB, the Central Bank of Ireland, Lithuania's central bank as a licensing hub), banks as account providers, licensed fintechs, and the card schemes whose rules run alongside

## How PSD2 works in practice

A fintech wants to offer a budgeting app that reads customers' bank accounts and lets them pay bills from it. Under PSD2 it applies for authorisation as an account information and payment initiation service provider: capital, governance, professional indemnity insurance, security policies, and a year of the regulator's questions. Licensed, it connects to banks' PSD2 APIs — each bank's own implementation of the standard, with its own quirks — and, with the customer's explicit consent renewed every 90 days (extended to 180 in 2022), retrieves transactions and initiates payments. The bank must allow it, may not charge for it, and applies strong customer authentication when the customer consents. The fintech passports the licence to serve customers across the EEA. What it built on is a legal right of access that did not exist before 2018 and a licence regime designed for exactly this business.

For a merchant, PSD2 arrived as strong customer authentication: from 2021, most online card payments required two-factor authentication through 3-D Secure, and conversion fell until issuers, acquirers and merchants learned the exemptions — transaction risk analysis below €500 for low-fraud acquirers, low-value under €30, recurring payments, trusted beneficiaries — and frictionless 3-D Secure 2 flows. Fraud fell; the operational cost of managing exemptions became a specialism. PSD3 and the PSR keep SCA and add what PSD2 missed: liability for banks that fail to check payee names against IBANs, obligations on platforms whose users are defrauded, standardised open-banking API performance, and a single licensing regime for payment and e-money institutions. Fintechs licensed under PSD2 will re-authorise under the new rules.

For a fintech, PSD2 is the licence it holds, the APIs it depends on and the authentication rules its checkout lives with; for a buyer, the target's PSD2 authorisation, its safeguarding audits and its SCA exemption performance are read before the product is.

## Example

A payments fintech licensed as a payment institution in Lithuania passports to 20 EEA states and processes €2 billion a year for online merchants. Its SCA programme: transaction-risk-analysis exemptions on 55% of transactions (its fraud rate qualifies it for the €250 threshold), low-value exemptions on a further 15%, and frictionless 3-D Secure 2 on most of the rest; authorisation rate 93% against 86% in the first year of SCA. A buyer's diligence in 2025 reads the licence conditions, the last safeguarding audit (clean), the regulator's correspondence (one query on agent oversight, closed), the SCA exemption performance and fraud rates by quarter, and the fintech's plan for re-authorisation under PSD3 — and prices the target at a premium to a rival whose fraud rate has lost it the higher exemption threshold.

## Common mistakes

- Treating open-banking APIs as uniform; each bank's implementation differs and breaks.
- Applying SCA to every transaction and losing the conversion the exemptions were written to preserve.
- Reading an EMI or PI licence as equivalent to a bank's; safeguarding is not deposit insurance.
- Ignoring PSD3's re-authorisation and new liability rules in a plan that runs past 2027.
- Buying an EU payments fintech without reading its safeguarding audit and regulator correspondence.

## Related terms

- [Strong Customer Authentication](https://mahouse.world/glossary/strong-customer-authentication.md)
- [SCA Exemption](https://mahouse.world/glossary/sca-exemption.md)
- [E-Money](https://mahouse.world/glossary/e-money.md)
- [Account-to-Account Payment](https://mahouse.world/glossary/account-to-account-payment.md)
- [Payment Service Provider](https://mahouse.world/glossary/payment-service-provider.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov