EU payments reform: PSD3, the Payment Services Regulation and instant payments

EU payments law is changing on two tracks at once. One reform is already in force: the Instant Payments Regulation, which makes instant euro transfers and payee verification standard across the market. The other, PSD3 and the Payment Services Regulation (PSR), has been agreed politically but is still going through formal adoption.

This guide sets out what each reform requires, when, and who it affects. The licensing side of payments, including the capital and safeguarding rules for payment and e-money institutions, is covered in the separate guide on e-money and payment institutions.

Why the rules are changing

PSD2 has applied since member states transposed it by 13 January 2018. It opened the market to payment initiation and account information providers and introduced strong customer authentication.

Its weaknesses have since become clear. The Council’s April 2026 note describes the aims of the new package as tackling payment fraud, increasing consumer protection, boosting transparency, improving access to cash and adapting the rules to new technology.

Instant payments followed a separate path. Instant euro transfers had existed for years, but uptake was uneven and many providers did not offer them, so the EU chose to mandate them by regulation.

The Instant Payments Regulation

Regulation (EU) 2024/886 was published on 19 March 2024. It amends the SEPA Regulation (EU) No 260/2012, PSD2 and the Settlement Finality Directive, and applies to credit transfers in euro.

Core obligations

The regulation imposes four main duties on payment service providers that already offer credit transfers:

1. Offer instant transfers to everyone. Any provider offering credit transfers must offer sending and receiving instant credit transfers to all its customers, with accounts reachable 24 hours a day on any calendar day (Article 5a).
2. Ten seconds. The payee’s provider must make the funds available, and confirm completion, within 10 seconds of the payer’s provider receiving the order.
3. Price parity. Charges for instant transfers may not exceed charges for standard credit transfers of the same type (Article 5b).
4. Verification of payee. Before the payer authorises a transfer, the provider must check the payee’s name against the account identifier, free of charge (Article 5c).

Instant transfers must also be available through every channel through which the customer can place an ordinary credit transfer.

Verification of payee in practice

Under Article 5c, the payee’s provider confirms whether the name and IBAN supplied by the payer match. If they almost match, the payer is shown the correct name; if they do not match, the payer is warned that the money may go to an account not held by the intended payee.

The check cannot block the payment. The payer may still authorise it, and must be told what ignoring a warning means for refund rights.

Business customers sending payments in bulk may opt out of the check, and opt back in at any time. A provider that performs the check correctly is not liable for a transfer to the wrong payee caused by a wrong identifier. If the check fails because of a provider’s error, the payer’s provider must refund the payer and can recover the loss from the payee’s provider.

Sanctions screening

The regulation changed how sanctions screening works for instant payments. Under Article 5d, providers must screen their own customers against EU targeted financial sanctions at least once every calendar day and immediately after new or amended listings.

They may not also screen the payer or payee during each instant transfer for those targeted measures. Screening for other reasons, including other sanctions regimes and anti-money laundering rules, is unaffected.

Deadlines

The regulation staggers its deadlines by the currency of the provider’s member state.

Obligation	Providers in euro-area member states	Providers in other member states
Receive instant transfers	9 January 2025	9 January 2027
Send instant transfers	9 October 2025	9 July 2027
Price parity	9 January 2025	9 January 2027
Verification of payee	9 October 2025	9 July 2027
Daily sanctions screening	9 January 2025	9 January 2025

Payment institutions and e-money institutions have their own dates for the instant transfer obligation in Article 5a. In the euro area they must send and receive instant transfers by 9 April 2027; elsewhere they must receive by 9 April 2027 and send by 9 July 2027.

Providers in non-euro member states may, with the supervisor’s prior permission, cap instant transfers in euro from national-currency accounts. That limit is set by the supervisor and may not be lower than EUR 25,000.

Opening payment systems to non-banks

The regulation also addressed a long-standing obstacle for payment and e-money institutions. It amended the Settlement Finality Directive so that PIs and EMIs can participate in designated payment systems, and amended PSD2 to allow safeguarded funds to be held at a central bank at that bank’s discretion. Member states had to apply these changes by 9 April 2025.

For non-banks, this is significant. Direct access to clearing and settlement reduces dependence on a sponsor bank, although each system and each central bank still sets its own admission criteria.

PSD3 and the Payment Services Regulation

The European Commission proposed the package on 28 June 2023. It has two parts:

Instrument	Type	Main content
PSD3	Directive, transposed by member states	Licensing and supervision of payment institutions, including e-money issuance; cash services
PSR	Regulation, directly applicable	Conduct rules: transparency, rights and obligations, fraud, open banking, strong customer authentication

Moving conduct rules into a regulation is intended to remove differences in national transposition. Licensing stays in a directive because it sits more closely with national supervisory structures.

Legislative status

The political agreement came at the final trilogue on 26 November 2025, according to the Council’s note. The compromise texts were sent to Coreper in April 2026 for approval “with a view to reaching an agreement at second reading”.

As of 7 October 2026, the Legislative Observatory shows that the Parliament’s ECON committee approved the agreed texts on 5 May 2026. The files are awaiting the Council’s first-reading position, and the Observatory shows an indicative plenary date of 14 December 2026.

Neither instrument has been published in the Official Journal. The article numbers and figures below come from the April 2026 compromise texts and may be renumbered or adjusted in legal-linguistic finalisation.

When the rules would apply

The PSR compromise text applies 21 months after entry into force. Articles 50 and 57, which extend payee verification, apply after 27 months.

PSD3 must be transposed and applied within 21 months of entry into force. Existing payment and e-money institutions have until 27 months after entry into force to show their supervisor that they meet the new requirements.

Fraud: the centre of the PSR

Fraud prevention is the most visible change for customers. The PSR compromise text adds several tools.

Payee verification for all credit transfers

PSR Article 50 applies the Instant Payments Regulation’s verification of payee rules to all credit transfers, including those outside the SEPA Regulation’s scope. Where an account is identified by something other than an IBAN, the check applies to that identifier.

Article 57 mirrors the liability rule. If a provider fails to perform the check correctly and the payment goes wrong, the payer’s provider must refund the payer without delay and may recover from the provider at fault.

Bank impersonation fraud

PSR Article 59 addresses fraud where a criminal pretends to be the consumer’s own bank, using communication channels attributed to it. If that manipulation leads the consumer to authorise payments, the provider must refund the full amount, provided the consumer promptly notified it and reported the fraud to the police.

The provider has 15 business days to refund or to justify a refusal. It may refuse only for suspected fraud or gross negligence by the consumer, and it bears the burden of proving it.

Spending limits and data sharing

The compromise text gives customers more control and gives providers more information:

• Spending limits. Customers can set limits per transaction or per period. Remote increases take effect only after a four-hour delay, unless the customer opts out (Article 51).
• Fraud data sharing. Providers must take part in information-sharing arrangements on suspected fraud, with data kept for no more than five years.
• Telecoms and platforms. Electronic communications providers must take measures against caller ID and email spoofing, and very large online platforms must cooperate with payment providers.
• Financial advertising. Very large online platforms and search engines must ask advertisers of regulated financial services for evidence that they are authorised (Article 59b).

A comparison: the UK approach

The UK chose a broader model for authorised push payment fraud. Since 7 October 2024, the Payment Systems Regulator has required reimbursement of Faster Payments APP scams up to GBP 85,000 per claim, with the Bank of England applying the same level to CHAPS.

The EU text is narrower in scope. It focuses on impersonation of the consumer’s own provider rather than all authorised push payment fraud, and where it applies, Article 59 requires a refund of the full amount.

Open banking under the PSR

PSD2 created rights for customers to use payment initiation and account information providers (Articles 66 and 67). In practice, interface quality and obstacles placed by banks limited uptake.

The PSR compromise text keeps the model and tightens it:

• Dedicated interfaces. Account servicing providers must offer a dedicated data access interface, with performance and availability requirements (from Article 35).
• Prohibited obstacles. A list of practices that obstruct access by third-party providers is banned (Article 44).
• Consent dashboard. Banks must give customers a dashboard in their own interface to see and withdraw consents given to account information and recurring payment initiation services (Article 43).

The dashboard is meant to be neutral. The text forbids banks from designing it in a way that discourages customers from using third-party services.

Access to bank accounts for payment institutions

PSD2 already required access to bank accounts for payment institutions on an objective, non-discriminatory and proportionate basis. In practice, refusals remained common.

PSR Article 32 narrows the grounds on which a bank may refuse or close an account for a payment institution, its agents or an applicant. Permitted grounds include breach of the EU AML Regulation, material breach of contract, missing documents and refusal or withdrawal of the institution’s licence.

A refusal must be notified within one month of a complete application, with reasons specific to the applicant’s risks rather than generic ones.

Cash and other changes in PSD3

PSD3 Article 37 lets retailers provide cash without a purchase, outside the licensing regime, up to EUR 150 per withdrawal. Member states may set a lower limit of no less than EUR 100, and the withdrawal must be subject to strong customer authentication.

PSD3 also merges e-money into the payment institution licence and sets new capital levels. Those changes, and the transitional rules for existing licence holders, are covered in the guide on e-money and payment institutions.

Crypto and stablecoins

Electronic money tokens under MiCA are also “funds” for payments law. The EBA gave crypto-asset service providers until 2 March 2026 to obtain PSD2 authorisation for payment services involving those tokens, and in a February 2026 opinion advised supervisors on how to proceed after that date.

The PSD3 compromise text provides a shorter route. Supervisors should decide within 60 business days on a complete application from a MiCA-authorised CASP that wants to provide payment services only with e-money tokens.

What firms should do now

Planning for both reforms runs in parallel:

1. Instant payments. PIs and EMIs that offer euro credit transfers should be building instant capability for their Article 5a deadlines, together with payee verification and daily sanctions screening.
2. Fraud controls. Banks and payment providers should map their fraud monitoring, customer communications and refund processes to PSR Articles 50, 57 and 59.
3. Open banking. Account servicing providers should review their dedicated interfaces and design the consent dashboard.
4. Licensing. Existing PIs and EMIs should prepare the evidence their supervisor will need under the PSD3 transitional rules.
5. Watch the final text. Dates in the PSR and PSD3 run from entry into force, which depends on publication in the Official Journal.

Outside the EU, the direction is similar even where the instruments differ. Firms with customers in several regions should expect instant payments, payee checks and fraud reimbursement to become standard features rather than optional extras.