Payment regulation: from PSD1 to the PSD3/PSR package. 7 chapters and a final quiz.

Chapter 1. Why regulate payments?

Payments are critical infrastructure. Every euro of wages, rent, or revenue moves through private systems (banks, card networks, PSPs), and a failure or abuse in any of them would have systemic effects. The market is also driven by strong network effects: the more widely a payment method is accepted, the more it gets used. Left alone, it drifts toward oligopoly. Payments are also a target for fraud at industrial scale. Since 2007, European regulation has pursued the same three objectives.

• Protect: ring-fence customer funds (safeguarding), refund victims of unauthorized transactions, and require strong authentication.
• Open up: break the banking monopoly (PI and EMI status), cap interchange fees, and force access to accounts (open banking) and to payment systems.
• Secure the system as a whole: operational resilience (DORA), Eurosystem oversight of payment systems, and rules for crypto-assets used for payments (MiCA).

Who does what in European payment regulation

Directive or regulation: a difference that changes everything

A directive (PSD1, PSD2, the future PSD3) sets objectives that each member state transposes into national law; in France, into the Monetary and Financial Code. Timelines vary, and sometimes so do interpretations. A regulation (the IFR, the IPR, MiCA, DORA, the future PSR) is directly applicable across the EU, with no transposition. The same rules apply on the same timeline everywhere. The PSD3/PSR package makes exactly this shift. Most of the conduct rules move from the directive into a regulation, to end national divergence.

Chapter 2. From PSD1 to PSD2: PI and EMI status and licensing.

Before 2007, you had to be a bank to collect funds on behalf of others. PSD1 (Directive 2007/64/EC, transposed in France in 2009) created payment institution (PI) status. The license is lighter, in proportion to a payments business that takes no deposits and extends no credit. The second E-Money Directive, EMD2 (2009/110/EC), did the same for electronic money with e-money institution (EMI) status. Europe's PSPs, wallets, and neobanks grew on this foundation; PSD2 (Directive 2015/2366, in effect since January 13, 2018) then expanded and tightened it.

The eight payment services in Annex I of PSD2

• Cash deposits to a payment account
• Cash withdrawals from a payment account
• Execution of payment transactions (credit transfers, direct debits, card payments) on an account
• Execution of transactions covered by a credit line
• Issuing payment instruments and/or acquiring payment transactions
• Money remittance
• Payment initiation (PIS), new in PSD2
• Account information (AIS), new in PSD2

Exemptions, agents, and passporting

• Limited network: cards usable only within a restricted network (a retailer's gift card, a fuel card) are exempt from licensing, but must be notified above €1 million in annual volume.
• Commercial agent: an intermediary that negotiates for only one of the two parties can be exempt. Marketplaces long relied on this loophole until PSD2 closed it, which is why so many marketplaces now safeguard their funds with third-party PIs and EMIs.
• Agents and distributors: a PI can operate through registered agents, and an EMI through distributors, with the principal institution fully liable.
• European passport: a license obtained in one member state lets a firm operate across the EU and EEA, either cross-border or through a branch. That explains the rise of Luxembourg, Lithuania, and Ireland as hubs.

PSD2 also tightened ongoing requirements: governance, the AML/CFT program, systems security (reporting of major incidents), and fraud reporting to the ACPR and the EBA. A license brings permanent supervision; it is not a one-time formality.

Chapter 3. Open banking and strong authentication: the core of PSD2.

PSD2's most radical change is access to accounts (XS2A). Account-holding banks (ASPSPs) must open access to payment accounts without a prior contract and free of charge. Two new regulated types of firm benefit: payment initiation service providers (PISPs, art. 66) and account information service providers (AISPs, art. 67). The RTS require secure access interfaces (APIs). In practice, their uneven quality remains the Achilles' heel of European open banking, and the PSD3/PSR package aims to fix it.

SCA: two factors and dynamic linking

Strong customer authentication (SCA) requires at least two factors from different categories: knowledge (a password or PIN), possession (an enrolled phone, a card), and inherence (biometrics). Remote payments also require dynamic linking: the authentication code is cryptographically bound to the amount and the payee, so any change invalidates it. SCA has applied since September 14, 2019 (RTS 2018/389) and was fully enforced for e-commerce in early 2021.

Don't confuse exemptions with transactions that are out of scope for SCA: MOTO payments (mail order or telephone order), one-leg-out transactions (issuer or acquirer outside the EEA), anonymous cards, and above all MITs (merchant-initiated transactions). The merchant initiates an MIT under a mandate, such as a variable-amount subscription. SCA is required when the mandate is set up, not on each payment.

Chapter 4. The Interchange Fee Regulation (IFR): caps and brand choice.

Interchange is the fee the acquirer pays the issuing bank on every card payment, and it is passed on to the merchant in the MSC. After 15 years of litigation over its anticompetitive effects, Regulation (EU) 2015/751 (the IFR) capped it for consumer cards. The caps have applied since December 9, 2015, and the business rules (brand choice, itemized billing) since June 9, 2016.

The caps do not cover commercial cards (business and corporate), three-party schemes such as American Express when they use no third-party issuers, or cards issued outside the EEA. Interchange on commercial cards is often 3 to 5 times higher. Interregional transactions are capped separately, through commitments by Visa and Mastercard, at 1.15% to 1.5% online.

Article 8: co-badging and brand choice

Nearly every French payment card is co-badged CB + Visa or CB + Mastercard (CB, or Cartes Bancaires, is France's domestic card scheme). The IFR bars schemes from imposing a brand. So the merchant sets the default brand on its terminal or payment page, often CB, which has historically had competitive fees. But the consumer keeps the right to choose the other brand for any transaction. This “routing” is a real cost lever for French merchants. The same battle is now playing out online in wallets, where Apple Pay has opened up a choice between CB, Visa, and Mastercard.

Article 9: the end of opaque bundled pricing (unblending)

By default, the acquirer must offer fees broken down by card category and brand: interchange, scheme fees, and its own margin. A merchant can explicitly request a single “blended” rate. Together with the caps, unblending pushed large merchants toward Interchange++ pricing, which passes interchange cuts straight through to them. The honor-all-cards rule is also limited: accepting a brand's debit cards no longer obliges a merchant to accept its credit or commercial cards.

Chapter 5. The 2024 Instant Payments Regulation: instant transfers for everyone, plus VoP.

SEPA Instant Credit Transfer is an EPC scheme launched in 2017. Funds are credited irrevocably in under 10 seconds, 24/7. Yet SCT Inst long remained a niche product, often priced at a premium; it still accounted for only 10% of credit transfers sent in France in 2024. Regulation (EU) 2024/886, the Instant Payments Regulation (IPR), which entered into force on April 8, 2024, makes it mandatory and brings its price into line with standard transfers.

Verification of Payee: the name is checked before every transfer

Since October 9, 2025, before executing a credit transfer (instant or standard), the payer's bank queries the payee's bank to check that the name entered matches the IBAN. There are three possible answers: match, close match (the actual name is displayed), or no match. The payer can still proceed, but does so with a warning. The service is free, and businesses sending bulk transfer files can opt out. It targets fraud using fake bank details and fake suppliers, the core of the €382 million in manipulation fraud recorded in France in 2024.

The IPR also fixes a long-standing asymmetry. It amends the Settlement Finality Directive to give PIs and EMIs direct access to designated payment systems. The Eurosystem opened TARGET to nonbank PSPs in 2025. Fintechs can now settle their flows without relying entirely on a sponsor bank.

Chapter 6. MiCA and DORA in brief: stablecoins and digital resilience.

MiCA: crypto-assets come within the scope of regulation

The MiCA regulation (Markets in Crypto-Assets, (EU) 2023/1114) is the world's first comprehensive framework for crypto-assets. For payments, the key part concerns stablecoins. Tokens backed by a single official currency are e-money tokens (EMTs) and can only be issued by a credit institution or a licensed EMI. Legally, a regulated euro stablecoin is tokenized electronic money, redeemable at par at any time. Tokens backed by a basket of assets (ARTs) have their own regime, with caps on their use for payments when they are not denominated in euros.

DORA: digital operational resilience

The DORA regulation ((EU) 2022/2554), in effect since January 17, 2025, sets a common resilience baseline against IT risk. It covers nearly all financial entities: banks, PIs, EMIs, insurers, and CASPs. Payment chains are directly affected, since an outage at a PSP or a critical cloud provider is now a regulated event.

• ICT risk management: governance and a map of critical assets and functions, under the direct responsibility of the management body.
• Incidents: major ICT incidents are classified and reported to the supervisor within harmonized deadlines.
• Resilience testing: a testing program, up to threat-led penetration testing (TLPT) for significant firms.
• ICT third-party risk: a register of information on all IT vendor contracts, mandatory contract clauses, and exit strategies.
• Oversight of critical providers: major vendors (especially cloud providers) designated as “critical third-party providers” come under the direct oversight of the European authorities, with the first designations made in 2025.

Chapter 7. The PSD3/PSR package: key changes, timeline, and impact.

Proposed by the Commission on June 28, 2023, the package revising PSD2 has two parts. The PSD3 directive now focuses on the licensing and supervision of payment institutions. The PSR (Payment Services Regulation), which applies directly, takes over all the conduct rules: SCA, open banking, transparency, and fraud. A third proposal, FIDA, on financial data access, or “open finance,” is following its own legislative track. After the provisional political agreement of November 27, 2025, formal adoption is expected in 2026.

Spoofing: the clearest sign of how fraud has shifted

SCA sharply reduced “technical” fraud, so fraudsters now target people instead. In France, manipulation fraud accounted for 32% of fraud losses by value in 2024 (OSMP). But a victim who approves a transaction under manipulation has legally “authorized” the payment, so the L. 133-18 refund does not apply. The PSR opens a targeted exception: when the fraudster posed as the bank itself (phone spoofing, a spoofed text message), the PSP will have to refund the victim. The balance was fine-tuned during the trilogue, and the final published text sets the exact conditions.

Practical impact for merchants

• Credit transfers and A2A: instant transfers at standard prices plus VoP create payment rails that compete with cards (Wero, open banking payment initiation) and belong in your checkout strategy.
• Supplier workflows: VoP becomes part of outgoing payment processes (any change to a supplier's bank details now triggers a check).
• PSP contracts: the 2026–2028 wave of relicensing is a natural window to renegotiate (pricing, DORA clauses, reversibility).
• Cash: cashback without a purchase becomes a local service stores can offer.

Practical impact for fintechs

• Relicensing: a full application must be filed again (governance, safeguarding across several banks, an orderly wind-down plan, DORA compliance). Start preparing as soon as the text is published.
• E-money: no more need for dual PI and EMI status, which simplifies things for wallets and issuers.
• Access to infrastructure: direct access to payment systems and a right to a bank account, with reasons required for any refusal, mean less dependence on sponsor banks.
• New obligations: VoP, fraud data sharing, and open banking permission dashboards are all product projects to budget for in 2027–2028.