At the end of June 2023, the European Commission published proposals to revise payment services legislation: the PSD3 Directive and the PSR Regulation. These proposals are not just an update to the existing PSD2 framework but a fundamental transformation of the regulatory architecture of Europe’s payment market.
Last month, on 18 June 2024, the Council of the EU adopted its “General Approach” to PSD3 and PSR (LINK). This document sets the stage for the upcoming interinstitutional negotiations (trilogues between the European Parliament, Council, and Commission) and confirms the key directions of reform in payment services.
The FinTech Poland Foundation team is closely monitoring these regulatory developments. In a series of upcoming posts, we will summarize and discuss the most important changes.
Key Reforms Introduced by PSD3/PSR:
- Stronger consumer protection against financial fraud via stricter liability rules for unauthorized transactions and faster, more transparent complaint-handling procedures.
- Enhanced payment security through updated Strong Customer Authentication (SCA) standards.
- Boosted open banking by improving API access quality and reducing technical barriers for Third-Party Providers (TPPs).
- Stronger regulatory oversight, with authorities gaining more powers to monitor, respond to incidents, and enforce rules, all aimed at increasing market stability and trust in the EU payments ecosystem.
Focus: New Strong Customer Authentication (SCA) Requirements
As per Article 3(35) of PSR, SCA is defined as authentication based on at least two elements from the following categories:
- Knowledge (something only the user knows)
- Possession (something only the user has)
- Inherence (something the user is)
These elements must be independent, such that compromising one does not compromise the others. The design must also ensure the confidentiality of authentication data. Notably, PSD3 allows for two factors from the same category (e.g., two biometrics or two possession-based elements) as long as their independence is maintained.
Examples:
- Fingerprint + facial recognition (if managed by separate systems)
- Digital signature on a chip + separate mobile device authentication
This marks a departure from PSD2’s stricter requirement for SCA elements to come from different categories, offering greater flexibility for PSPs, banks, and fintechs. It allows for modern, integrated, and user-friendly authentication solutions without compromising security.
Practical Implications:
Under Article 85 PSR, PSPs must apply SCA when users:
- Access payment accounts online
- Request account information
- Initiate electronic payment transactions
- Perform any remote action with fraud or abuse risk
For contactless payments that rely on internet access (e.g., via mobile apps), SCA must dynamically link the transaction to both the amount and payee, ensuring confidentiality, authenticity, and integrity.
Additional requirements apply when:
- Transactions are initiated by a Payment Initiation Service Provider (PISP).
- AISP accesses data: SCA is required on first access only, unless there is a justified suspicion of fraud.
- Data is accessed more than 180 days after the last SCA.
PSD3 clarifies rules for Merchant-Initiated Transactions (MITs) and mail/telephone orders, specifying when SCA is and is not required.
Inclusion & Accessibility:
PSPs must offer at least one accessible SCA method for people with disabilities, elderly users, those with limited digital skills, or without digital access. SCA must not require a smartphone, nor be limited to a single authentication method
Technical Providers & Monitoring:
New rules require outsourcing agreements with technical providers involved in SCA. PSPs remain fully liable and must have audit rights over security. PSPs must also implement transaction monitoring systems based on behavioral and environmental characteristics (e.g., time, device, geolocation, shopping habits).
If a PSP fails to enforce required SCA measures, the payer bears no financial loss, unless acting in bad faith. This applies even when SCA exemptions are misused.
Dr. Anna Rozendaal
Senior Lawyer
FinTech Poland
