In the first article of this series, The Road to PSD3: Why Europe’s Payments Framework Needed Reform, we examined the shortcomings of Directive (EU) 2015/2366, also known as the Second Payment Services Directive (“PSD2”)and the developments that prompted the European Union (“EU”) to reconsider its approach to payment services regulation. While PSD2 established the foundations for open banking, strengthened payment security and promoted competition, its implementation also exposed practical limitations, particularly in relation to fraud, regulatory consistency and consumer protection.
The proposed Third Payment Services Directive (“PSD3”) and Payment Services Regulation (“PSR”) seek to address these shortcomings. While the first article considered why reform was necessary, this article focuses on how the new framework seeks to operate in practice, with particular emphasis on fraud prevention, Strong Customer Authentication (“SCA”), liability and consumer protection.
PSD3 and the PSR: Two Instruments, One Framework
One of the most important features of the new framework is the complementary role of PSD3 and the PSR. PSD3 will take the form of a directive, meaning that its provisions will need to be transposed into the national laws of Member States. The PSR, by contrast, will operate as a directly applicable regulation, creating a common set of rules across the EU without requiring national transposition.
This structure is intended to address some of the fragmentation that emerged under PSD2. The PSR will establish greater uniformity in the core rules governing payment services, while PSD3 will continue to provide the legislative framework for matters that require implementation through national law.
For PSPs operating across multiple jurisdictions, the distinction is particularly important. Compliance will no longer be assessed solely by reference to national implementing legislation; PSPs will also need to assess the directly applicable requirements of the PSR and how these interact with the national framework established under PSD3. The reforms also seek to bring payment services and electronic money services into a more coherent regulatory structure, reflecting the increasing convergence between the two areas.
From Authentication to Active Fraud Prevention
A central feature of the new framework is the move towards a more proactive approach to fraud prevention. Under PSD2, SCA represented a major enhancement to payment security. However, as discussed in the first article, fraudsters have increasingly developed methods that do not require them to circumvent authentication controls. Instead, they manipulate customers into authorising transactions themselves.
PSD3 and the PSR respond to this changing risk environment by placing greater emphasis on the Payment Service Provider’s (“PSP”) ability to identify, monitor and prevent potentially fraudulent activity. PSPs will be expected to maintain appropriate transaction-monitoring and fraud-detection mechanisms capable of identifying suspicious activity. The emphasis is therefore shifting from asking whether a payment was properly authenticated to considering whether the transaction itself presents indicators of fraud.
This distinction is particularly important in cases where the customer has technically authorised the transaction. A valid authentication process does not necessarily mean that a payment is legitimate. Effective fraud prevention may require PSPs to consider factors such as transaction patterns, behavioural indicators and other relevant risk signals.
The framework also promotes greater cooperation and information sharing between PSPs. This is intended to enable institutions to identify wider patterns of fraudulent activity and respond to threats that may otherwise remain visible only at an individual institution level. For PSPs, this means that fraud prevention will increasingly need to be embedded within the payment process itself rather than treated primarily as a post-transaction compliance function.
Strong Customer Authentication: A More Sophisticated Approach
SCA remains a fundamental component of the EU payment security framework. Under PSD2, SCA introduced the requirement for authentication based on at least two independent elements relating to knowledge, possession or inherence. PSD3 and the PSR do not abandon this approach. Instead, they seek to clarify and strengthen the existing framework and address some of the practical difficulties that have emerged in its application.
The reforms also recognise that authentication technology has evolved considerably since PSD2 was adopted. PSPs can increasingly combine traditional authentication methods with technologies such as risk-based authentication, behavioural analysis and transaction monitoring. The objective is to maintain a high level of security while avoiding unnecessary authentication requirements for legitimate transactions. In other words, the regulatory challenge is no longer simply to make payments more difficult to fraudulently execute; it is to make them secure without making them unnecessarily burdensome for legitimate customers.
This will require PSPs to look beyond the authentication mechanism itself. The effectiveness of SCA will increasingly depend on how it interacts with transaction monitoring, fraud detection, customer alerts and other security controls.
Verification, Warnings and Customer Protection
The new framework also strengthens the role of preventative measures designed to assist consumers before a fraudulent payment is completed. Among the measures introduced or strengthened under the reforms are mechanisms intended to help customers identify potential fraud, including verification of Payee, enhanced fraud warnings and greater consumer awareness.
These measures are particularly relevant to authorised push payment (“APP”) fraud because the payment may appear legitimate from a technical perspective while being the result of deception. Providing customers with additional information at the point of payment can therefore form an important part of the PSP’s overall fraud-prevention strategy.
The underlying approach is one of shared responsibility in that the consumers remain an important part of the security process, but PSPs are expected to provide the systems, information and safeguards necessary to enable consumers to make informed decisions and to detect suspicious activity where possible.
Liability for Fraudulent Payments
The allocation of liability is another significant area of change. Under the new framework, greater emphasis is placed on determining responsibility according to the circumstances in which fraud occurred and the extent to which the relevant parties complied with their obligations.
For PSPs, this means that compliance with fraud-prevention and authentication requirements is not simply a matter of avoiding regulatory sanctions. The effectiveness of those controls may also have consequences for the allocation of financial liability where fraud occurs. This creates a stronger incentive for PSPs to ensure that their fraud-prevention measures are not merely formally compliant but effective in practice.
The reforms are particularly significant in the context of fraud involving impersonation and other forms of social engineering. Where a consumer is induced to make a fraudulent payment, the question of who should bear the resulting loss becomes more complex than in a conventional unauthorised transaction. The new framework seeks to provide clearer rules for determining responsibility in these circumstances. For consumers, the objective is to ensure that they are not disproportionately exposed to losses where the payment ecosystem or the PSP’s security measures have failed to provide appropriate protection.
The Balance Between Security and Customer Experience
A recurring theme throughout the new framework is the need to balance security with usability. Increasing authentication requirements and fraud controls can strengthen payment security, but excessive friction can also negatively affect legitimate customers and undermine the convenience that digital payments are intended to provide.
PSD3 and the PSR therefore encourage a more risk-sensitive approach. PSPs will need to distinguish between transactions that present genuine risks and those that can safely proceed with limited intervention. This places greater importance on the quality of the underlying data, monitoring systems and risk-assessment processes used by PSPs. Effective compliance will increasingly require institutions to understand customer behaviour and transaction risk rather than relying solely on standardised authentication procedures.
What Does the New Framework Mean for PSPs?
The practical impact of PSD3 and the PSR will extend across the PSP’s wider operational and compliance framework. PSPs should consider whether their existing systems and procedures are capable of meeting the enhanced expectations in areas including:
- fraud detection and transaction monitoring;
- SCA and authentication processes;
- Verification of Payee and other payment-verification mechanisms;
- customer warnings and fraud awareness;
- information sharing and cooperation with other PSPs;
- the handling of fraudulent transactions and liability claims;
- customer communications and transparency; and
- internal governance, risk management and compliance arrangements.
Importantly, these measures should not be implemented as isolated controls. The direction of the reforms is towards a more integrated fraud-management framework, in which authentication, transaction monitoring, customer communication and liability processes operate together. PSPs should therefore consider not only whether individual controls are compliant, but whether the overall framework is capable of identifying and responding to evolving fraud risks.
Preparing for the New Rulebook
The transition from PSD2 to PSD3 and the PSR is not simply a legislative exercise. It will require PSPs to assess how their existing systems, policies and customer journeys operate against the requirements and expectations of the new framework. The key change is one of emphasis. The regulatory framework is moving from a model focused heavily on authentication and protection against unauthorised payments towards a broader model centred on proactive fraud prevention, risk management and shared responsibility.
For PSPs, this means that compliance should be approached as an ongoing process rather than a one-off implementation exercise. Fraud controls will need to evolve alongside new technologies and fraud techniques, while authentication systems will need to remain sufficiently robust without creating unnecessary friction for customers.
Ultimately, PSD3 and the PSR seek to create a payment environment in which innovation and convenience are supported by effective safeguards. For PSPs, the challenge will be to translate these regulatory expectations into practical systems that are capable of preventing fraud, protecting consumers and maintaining trust.
At Zerafa Advocates, we are committed to keeping businesses informed as the EU payment services framework continues to develop. The transition to PSD3 and the PSR provides PSPs with an opportunity to review their existing regulatory and operational frameworks, identify areas requiring enhancement and take proactive steps towards ensuring readiness for the new regime.
