PSD3 gets discussed constantly in open banking conversations, without most people being able to say clearly what it actually changes from PSD2.
What PSD2 actually established
PSD2, in force since 2018, is what created open banking as it exists today. It mandated that banks open up account data and payment initiation to licensed third parties through secure APIs, creating the foundation that A2A payments and most open banking products are built on.
Before PSD2, a bank's account data and payment rails were entirely closed to outside providers. PSD2 forced that open, under strict security and consent requirements, and the resulting ecosystem of open banking apps, payment initiation providers, and account information services is a direct product of that regulatory shift.
What PSD3 actually is
PSD3, alongside the accompanying Payment Services Regulation (PSR), is not a full rewrite of the open banking model. It's a refinement addressing specific gaps that became obvious once PSD2 was actually implemented at scale across 27 different member states, each with somewhat different interpretations and enforcement approaches.
What's actually tightening under PSD3
Authentication consistency. Strong customer authentication requirements existed under PSD2, but implementation varied significantly bank by bank and market by market. PSD3 pushes toward more consistent authentication standards across the EU, reducing the situation where the same open banking flow behaves meaningfully differently depending on which bank is involved.
Fraud liability clarity. PSD2 left genuine ambiguity around liability for certain fraud types, particularly authorised push payment scams, where a customer is tricked into authorising a payment themselves rather than having their credentials stolen. PSD3 aims to clarify who bears liability in these scenarios more consistently.
API quality enforcement. This is arguably the most practically significant change for anyone building on open banking infrastructure. Under PSD2, some banks built the bare technical minimum required to be "compliant" without much incentive to make the API genuinely good to work with, technically compliant but practically difficult to integrate. PSD3 introduces stronger enforcement mechanisms specifically targeting this gap.
What PSD3 does not change
The fundamental open banking model, third parties can access account data and initiate payments with customer consent through regulated APIs, stays intact. This is evolution within an established framework, not a new foundation requiring architectural rethinking.
For businesses already building on open banking infrastructure, PSD3 should make the underlying rails more consistent and reliable over time, rather than requiring you to redesign how your product works.
What this means in practice for anyone building on open banking rails
If your product depends on open banking APIs, the practical implication of PSD3 is mostly positive: better, more consistent authentication experiences for your end users, clearer rules around fraud liability that reduce ambiguity in dispute scenarios, and stronger enforcement against banks whose APIs have historically been technically compliant but genuinely painful to integrate with.
The timeline for these changes to fully take effect and for enforcement to catch up varies, and different member states will move at different paces implementing the updated requirements, which is worth tracking if API consistency across multiple markets matters to your specific product.
Frequently asked questions
Do I need to change my integration if I'm already building on PSD2-compliant open banking APIs? In most cases, no significant architectural change should be required. PSD3 refines requirements around authentication, liability, and API quality rather than changing the fundamental technical model third parties integrate against.
Does PSD3 affect account information services the same way it affects payment initiation? Both categories of regulated open banking activity are covered by PSD3's provisions, though the specific requirements that apply differ somewhat depending on whether a provider is initiating payments or simply accessing account information.
When does PSD3 actually take full effect? Implementation timelines vary by specific provision and by member state, since EU directives require national transposition into local law, which doesn't happen simultaneously and identically across all 27 markets. Worth checking current status for markets that specifically matter to your business.
Be1B's open banking infrastructure is built to track regulatory evolution like this as it happens, so the businesses building on top of it don't need to independently monitor every regulatory update themselves.
If you're building a product on open banking rails, explore Be1B's open banking infrastructure to see how this works in practice.