⚖️ Payment regulation

Who regulates what

European payments are regulated at three institutional levels. The European Union sets the framework through its directives and regulations, and through the EBA's technical standards. National authorities license and supervise payment firms, while central banks oversee infrastructures and payment instruments. France adds an oversight body of its own, the OSMP.

From PSD1 to PSD2: opening up the market

PSD1 (Directive 2007/64/EC, transposed into French law in 2009) laid the foundations of the single market for payments. It created the payment institution license, ending the banks' monopoly on payment services. It also set the legal basis for SEPA, with common rules on execution, timelines and liability. That license opened the way for Europe's first non-bank PSPs.

PSD2 (Directive 2015/2366, in force since January 13, 2018) extended the framework to access to bank accounts themselves. It created two new regulated activities: payment initiation (PISP) and account information (AISP). Banks must serve both through dedicated APIs, and cannot require the third-party provider to sign a contract first. European regulatory open banking grew out of this obligation.

• Strong customer authentication (SCA) required for account access and electronic payments (covered in the next section).
• Limits on charges: a ban on surcharging consumer card payments (Art. 62), and SHA (shared) charges by default within the EU.
• Stronger liability rules: the cardholder's maximum loss cut from €150 to €50, refunds of unauthorized transactions by D+1, and the burden of proof shifted to the PSP.
• A narrower commercial agent exemption, which sent a regulatory shockwave through marketplaces (see the merchant-acquirer-PSP topic).
• Stronger passporting and an EBA register: coordinated supervision of pan-European firms.

SCA: strong customer authentication

SCA (Strong Customer Authentication) requires at least two independent factors from three categories: knowledge (PIN, password), possession (an enrolled phone, a card) and inherence (biometrics). The EBA's RTS that implement it have applied since September 14, 2019. France completed its e-commerce migration plan in 2021. In practice, French online card payments run on 3-D Secure v2: the cardholder approves in their banking app with biometrics, or with a one-time code combined with a password.

From 2023 to 2026, fraud shifted toward manipulating the customer directly. Phone spoofing by fake bank advisers, CEO fraud and fake delivery links all fall into this category, in which the victim personally authenticates the transaction they later dispute. The PSD3/PSR package plans a response: refunds when a fraudster impersonates bank staff, fraud data sharing between PSPs, and obligations for telecom operators and online platforms.

The Interchange Fee Regulation (IFR, 2015)

Regulation (EU) 2015/751 of April 29, 2015 (the Interchange Fee Regulation) directly regulates the price of interchange in the four-party model. Before it, interchange was set collectively and acted as a price floor passed on to merchants. EU lawmakers capped it for consumer cards: 0.2% of the amount for debit cards and 0.3% for credit cards. The caps have applied since December 9, 2015.

• Separation of scheme and processing (Art. 7): schemes must keep brand management and transaction processing separate, in their accounts and their organization, to open processing to competition.
• Brand choice on co-badged cards (Art. 8): neither the scheme nor the issuer can impose routing; the merchant and the cardholder each have a say. This is the cornerstone that lets Cartes Bancaires (CB), France's domestic card scheme, coexist with Visa and Mastercard.
• A looser “honor all cards” rule (Art. 10): a merchant can accept a brand's debit cards without having to accept its credit or commercial cards (acceptance remains bundled within each category).
• Transparency (Arts. 9 and 12): billing itemized by card category (unblending) at the merchant's request, and transaction-level information.

The Instant Payments Regulation (2024)

Regulation (EU) 2024/886 of March 13, 2024, the Instant Payments Regulation, entered into force on April 8, 2024. It turns instant credit transfers from a commercial option into a legal obligation for every EU PSP that offers standard credit transfers. SCT Inst, the EPC scheme launched in 2017, makes funds available in under 10 seconds, 24/7/365. The regulation tackles two long-standing obstacles: reachability, since not every bank could receive instant transfers, and price, often around €1 per instant transfer in France before the regulation.

POST /verification-of-payee HTTP/1.1
Host: api.payee-bank.example

{
  "iban": "FR7630004000050000123456789",
  "name": "SARL DUPONT ET FILS"          <- name entered by the payer
}

--> 200 OK
{
  "result": "CLOSE_MATCH",               <- near match
  "matched_name": "DUPONT & FILS SARL"   <- actual name, shown to the payer
}
// MATCH      : transfer goes through with no friction
// CLOSE_MATCH: payer confirms, knowing the name differs
// NO_MATCH   : strong warning; if the payer overrides it, their liability grows

The effects of this mandate ripple through the whole ecosystem. Now universal and priced no higher than a standard transfer, the instant credit transfer becomes a payment rail that competes with cards in e-commerce, which is the premise behind Wero. It also underpins payment requests (Request-to-Pay) and is the likely foundation for the digital euro the ECB is preparing. For corporate treasurers, it changes cash management: payroll can be paid as it falls due, and refunds go out instantly.

PSD3/PSR and the 2026–2028 outlook

The Commission presented its package revising PSD2 on June 28, 2023. It centers on a PSD3 directive, refocused on licensing and supervising payment firms, and a directly applicable PSR (Payment Services Regulation) that takes over most conduct rules: SCA, user rights and open banking. The package folds the e-money regime (EMD2) into the payment services framework, and the EMI license is set to be absorbed.

• Fighting manipulation fraud: refunds, under conditions, for customers deceived by fraudsters impersonating their bank (spoofing); fraud data sharing between PSPs; an extended VoP.
• Stronger open banking: API performance and availability requirements, a consent dashboard for users, and a ban on unjustified obstacles (frictions). No single technical standard is imposed, but outcomes are mandated.
• Access for PIs and EMIs to payment systems and central bank accounts: a response to banks de-risking fintechs (with regulated access to infrastructures such as TARGET).
• SCA fine-tuned: clarifications on exemptions, on outsourcing authentication (delegating it to wallets), and on accessibility for users without a smartphone.
• In parallel: the FIDA regulation (access to financial data beyond payment accounts, such as savings, insurance and credit), plus DORA (digital operational resilience, applicable since January 2025) and MiCA for crypto-assets, including payment stablecoins, coming into application.