PSD2 Compliance Requirements: The Full Checklist

If you run compliance or risk at a payment institution, an e-money institution or a payments fintech, PSD2 compliance comes down to ten areas of work, each with its own evidence and its own clock: authorisation and governance, capital and own funds, safeguarding of users' funds, agents and outsourcing, operational and security risk, incident reporting, strong customer authentication, the SCA exemptions and the fraud rates behind them, the access interfaces for third-party providers, and the conduct rules for users, complaints and reporting. This guide gives you every duty with its article, the deadline attached to it and the evidence a supervisor will ask to see, so you can check your programme against the law itself and close the gaps before an inspection finds them.

It reads PSD2 as it stands today. Two later acts changed it in ways most guides still miss. Directive (EU) 2022/2556 moved major incident reporting for payment and e-money institutions to DORA from 17 January 2025. The Instant Payments Regulation rewrote the safeguarding article and opened designated payment systems to non-banks, for Member States to apply by 9 April 2025. On top sit the SCA regulatory technical standards as amended in 2022, the parts of the second E-Money Directive that an e-money institution adds, and the one section of the EBA's ICT and security guidelines that survived the arrival of DORA.

What is PSD2 compliance, and who has to comply?

PSD2 is Directive (EU) 2015/2366 on payment services in the internal market, adopted by the European Parliament and the Council on 25 November 2015. It repealed the first Payment Services Directive, 2007/64/EC, and Member States have applied it since 13 January 2018 under Article 115. Because it is a directive, your obligations sit in your Member State's transposing law, and so do the penalties. Compliance means meeting those national rules, the directly applicable RTS on strong customer authentication and secure communication, and the guidelines your authority has adopted.

Article 1(1) names six categories of payment service provider: credit institutions, e-money institutions, post office giro institutions, payment institutions, the ECB and national central banks when not acting as authorities, and Member States or their authorities when not acting as public authorities. Annex I lists eight payment services: placing cash on a payment account, cash withdrawals, executing payment transactions such as direct debits, card payments and credit transfers, the same where the funds are covered by a credit line, issuing payment instruments and acquiring payment transactions, money remittance, payment initiation, and account information.

A merchant that accepts card payments is a payment service user. It meets PSD2 through its acquirer, which is why the many merchant checklists on this subject cover strong customer authentication at checkout and little else. If you hold a licence, the rest of this page is your work.

What does authorisation require, and what must you keep up to date?

Article 5(1) lists seventeen items, (a) to (q), that an application for authorisation must contain. The list matters long after the licence is granted, because Article 16 requires you to tell your authority without undue delay about any change that affects the accuracy of the information and evidence you provided. The authorisation file is a living document, and a supervisor will compare it with how the firm actually runs today.

Article 11(4) adds the governance test: a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective procedures to identify, manage, monitor and report risks, and adequate internal control mechanisms, all proportionate to the nature, scale and complexity of the services. The authority must decide on a complete application within three months (Article 12). After authorisation, Article 17 requires audited annual accounts and separate accounting information for the payment services, covered by an auditor's report, and Article 21 requires records to be kept for at least five years. Article 13 lets the authority withdraw an authorisation that is unused for 12 months, obtained by false statements, or whose conditions are no longer met.

For an e-money institution, Article 3(1) of EMD2 applies PSD2 Articles 5, 11 to 17, 19(5) and (6) and 20 to 31 mutatis mutandis, so the same authorisation, governance and passporting rules apply to you, with EMD2's own capital and safeguarding rules on top.

How much capital does a payment or e-money institution need?

Initial capital is set by business model and must be held at all times, from authorisation onwards. Own funds then sit on top: Article 8(1) requires them never to fall below the higher of initial capital and the amount calculated under Article 9, using whichever of three methods your authority prescribes. E-money institutions use Method D for issuing e-money and add Method A, B or C for payment services unrelated to e-money.

A worked example shows why the calculation matters more than the headline capital. A payment institution that executed EUR 600 million of payment transactions last year has a monthly payment volume of EUR 50 million. Under Method B it needs 4% of the first 5 million (EUR 200,000), 2.5% of the next 5 million (EUR 125,000) and 1% of the remaining 40 million (EUR 400,000): EUR 725,000 of own funds, almost six times its EUR 125,000 initial capital. An e-money institution with EUR 40 million of average outstanding e-money needs EUR 800,000 under Method D. In both cases the authority may require up to 20% more, or allow up to 20% less, based on its view of your risk management (PSD2 Art. 9(3); EMD2 Art. 5(5)).

What are the PSD2 safeguarding requirements?

Safeguarding is what protects users' money if the firm fails. Article 10(1), as rewritten by the Instant Payments Regulation for Member States to apply by 9 April 2025, applies to payment institutions providing services 1 to 6 of Annex I and now names e-money institutions directly. It covers all funds received from users, or through another payment service provider, for the execution of payment transactions, and offers two methods.

The law states the outcome and leaves the mechanics to you, so the evidence is yours to design. In practice that means a board-approved safeguarding policy, a daily calculation of the amount to be safeguarded and a reconciliation against the safeguarding account, account documentation that shows the funds are held for users, a record of every break and how it was fixed, and, for the insurance method, a reconciliation showing the cover is enough at all times. Some national supervisors have also required independent safeguarding audits; check what yours expects.

In Ireland the Central Bank has gone further and made the person who oversees safeguarding a pre-approval controlled function: since 10 February 2026, a payment or e-money institution's head of safeguarding (PCF-56) needs the Central Bank's approval before appointment. Our guide to fitness and probity at the Central Bank of Ireland covers the application and the yearly certification that follows.

The Instant Payments Regulation added a reason to get this right. Article 35a of PSD2 lets payment and e-money institutions participate in payment systems designated under the Settlement Finality Directive, provided they hold three documents: a description of the safeguarding measures, including the investment policy, the people with access to the safeguarding account and the reconciliation process; a description of governance, internal control and ICT arrangements linked to DORA Articles 6 and 7; and a winding-up plan in case of failure. The ECB states that since October 2025 non-bank providers that meet the TARGET Guideline requirements can access TARGET services, including the instant payment settlement service.

What do agents, branches and outsourcing require?

Payment firms grow through agents, distributors and outsourced platforms, and PSD2 treats each one as an extension of the licence. Before an agent provides payment services you must give your home authority its name and address, a description of its anti-money laundering controls, the identity and fitness of its managers, the services it is mandated for and its identification number (Article 19(1)). The authority has two months to register it, and the agent may start only once it is in the register (Article 19(2)). Agents and branches must tell users that they act on your behalf (Article 19(7)).

Article 19(6) requires you to inform the authority before you outsource operational functions of payment services. Outsourcing of important operational functions, now expressly including ICT systems, must not materially impair the quality of your internal control or the authority's ability to monitor you. A function is important if a defect in it would materially impair your continuing compliance, your financial performance, or the soundness or continuity of your payment services, and four conditions apply: senior management keeps its responsibility, your obligations to users do not change, the conditions of your authorisation are not undermined, and none of them is removed or modified. Changes to agents or outsourced entities are notified without undue delay (Article 19(8)).

Article 20 makes you fully liable for any act of your employees, agents, branches or outsourcees, and requires reasonable steps to make sure third parties comply. The Article 5(1)(l) authorisation file promises off-site and on-site checks of agents and branches at least yearly, so a missed annual review is a breach of your own file. Passporting into another Member State follows Article 28: the home authority forwards your notification within one month and decides within three months. For ICT services, DORA adds the register of information and contract terms; our guide to building a DORA ICT vendor register covers that layer, and our guide to performing a third-party risk assessment covers how to assess agents and processors.

What are the PSD2 operational and security risk requirements now that DORA applies?

Article 95(1) requires a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks of your payment services, including incident management procedures that detect and classify major incidents. Since 17 January 2025 it applies without prejudice to Chapter II of DORA, which means credit institutions, payment and e-money institutions, account information service providers and the exempted and waived firms run their ICT risk management framework under DORA and their payment-specific controls under PSD2.

Article 95(2) did not move. You must give your authority, at least once a year or more often if it asks, an updated and comprehensive assessment of the operational and security risks of your payment services and of the adequacy of your mitigation measures and controls. It is easy to miss, because DORA absorbed so much of the rest of the Directive's ICT and incident regime.

The EBA's Guidelines on ICT and security risk management, EBA/GL/2019/04, were amended by EBA/GL/2025/02, which applies from 20 May 2025 and deleted every section except 3.8, on payment service user relationship management. Paragraphs 92 to 98 still expect you to:

• give users assistance and guidance on the security risks of your payment services, and update it as threats change;
• let users disable specific payment functions where the product allows it;
• let users adjust agreed spending limits up to the maximum agreed under Article 68(1);
• offer alerts on initiated and failed attempts to initiate payments;
• tell users about changes to security procedures that affect them; and
• help users with security questions, support requests and reports of anomalies, and tell them how to get that help.

They are guidelines, so your authority applies them through comply or explain, but they are the yardstick an inspector will use for your customer-facing security controls.

How does PSD2 incident reporting work after DORA?

Article 96(1) used to require payment service providers to notify their home authority of a major operational or security incident without undue delay, under the EBA's 2021 guidelines on classification and templates. Directive (EU) 2022/2556 added Article 96(7), which requires Member States to switch off paragraphs 1 to 5 for credit institutions, e-money institutions, payment institutions, account information service providers, exempted payment institutions and waived e-money institutions. It has applied since 17 January 2025, and on the same day the EBA repealed its PSD2 major incident reporting guidelines.

DORA took over. Article 23 applies its incident reporting chapter to operational or security payment-related incidents, whether ICT-related or not, where they concern credit institutions, payment institutions, account information service providers and e-money institutions. The time limits are in Article 5(1) of Delegated Regulation (EU) 2025/301:

Two reporting duties stayed in PSD2. Article 96(6) still requires statistical data on fraud relating to different means of payment, which the Directive sets at least yearly and the EBA's fraud reporting guidelines, EBA/GL/2018/05, ask for every six months. And the Article 95(2) yearly risk assessment is untouched. How DORA classifies a major incident, and how the weekend relief works, is set out in our guides to DORA for payment institutions and DORA major incident classification; the clocks of every regime side by side are in incident reporting deadlines by regulation.

What is strong customer authentication under PSD2?

Article 97(1) requires a payment service provider to apply strong customer authentication when the payer accesses a payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. Article 4(30) defines it as authentication based on two or more independent elements from the categories of knowledge, possession and inherence, designed so that a breach of one does not compromise the reliability of the others. Payment initiation and account information providers rely on the account provider's authentication procedures (Article 97(5)).

Delegated Regulation (EU) 2018/389, applying since 14 September 2019, sets the technical rules:

The liability rule is what makes SCA a board issue. Under Article 74(2), where the payer's provider does not require strong customer authentication, the payer bears no financial loss unless the payer acted fraudulently, and where the payee or the payee's provider fails to accept strong customer authentication, it must refund the financial damage caused to the payer's provider.

Which SCA exemptions can you use, and what does each commit you to?

Articles 10 to 18 of the RTS let a payment service provider skip strong customer authentication in defined situations. All but one are optional, and every one comes with conditions that become obligations the moment you use it. Article 2's transaction monitoring still applies to every exempted payment.

Article 97(1) attaches SCA to what the payer does. A charge initiated by the payee alone, such as a merchant-initiated transaction under an existing mandate, therefore falls outside the SCA duty altogether. The RTS contains no merchant-initiated exemption, and the recurring transactions exemption in Article 14 covers a series the payer set up with SCA.

What are the reference fraud rates for transaction risk analysis?

Transaction risk analysis is the exemption with the most obligations attached. A remote transaction qualifies only if your fraud rate for that type of transaction is at or below the reference rate for its value band in the Annex, and if your real-time risk analysis finds no abnormal spending or behaviour, no unusual device or software information, no malware in the authentication session, no known fraud scenario, no abnormal payer location and no high-risk payee location (Article 18(2)).

The fraud rate is the value of unauthorised or fraudulent remote transactions, whether the funds were recovered or not, divided by the value of all remote transactions of the same type, both SCA-authenticated and exempted, on a rolling 90-day basis (Article 19(1)). Note that credit transfers carry reference rates two to nine times stricter than cards in the same band.

What happens when a fraud rate goes over the reference?

Article 20 sets a fixed sequence. When a monitored fraud rate exceeds the reference rate, you report it to your authority immediately, with the measures you will take to restore compliance. If the rate stays above the reference for two consecutive quarters in a band, you stop using transaction risk analysis in that band at once. You may resume only after one quarter at or below the reference, after notifying the authority and showing evidence. Article 21 requires you to record, at least quarterly and for each exemption, the value of fraudulent transactions, the total value, the fraud rate, the average transaction value and the number of transactions, and to make the results available to the authority and the EBA on request.

The audit comes with it. Under Article 3(2), a provider that uses transaction risk analysis has its methodology, model and reported fraud rates audited at least yearly by an auditor with IT security and payments expertise, and in the first year of use and at least every three years after by an independent, qualified external auditor, or more often if the authority asks. The methodology, any model and the rates themselves must be documented and fully available to the authority and the EBA (Article 19(3)).

What is the 180-day rule for account access?

Delegated Regulation (EU) 2022/2360, applying from 25 July 2023, rewrote the account information exemption in two parts. When users access their own account information directly, Article 10 lets the account provider skip strong customer authentication for the balance and the last 90 days of transactions, provided no sensitive payment data is shown, but SCA is needed at first access and once more than 180 days have passed since it was last applied. The exemption stays optional on that route.

When the same information is accessed through an account information service provider, new Article 10a makes the exemption mandatory: the account provider must not apply strong customer authentication except at the first access through that provider and once more than 180 days have passed. It may apply SCA earlier only for objectively justified and duly evidenced reasons relating to unauthorised or fraudulent access, which it must document and justify to its authority on request (Article 10a(3)). Before July 2023 the period was 90 days on both routes. Account providers had to make the interface changes for Article 10a available to third-party providers at least two months before implementing them (Article 30(4a)).

What must account providers offer third-party providers?

If you offer a payment account that is accessible online, you are an account servicing payment service provider, and Chapter V of the RTS applies to you. That includes an e-money institution whose e-money accounts can be used for payments online. Article 30 requires at least one interface through which account information providers, payment initiation providers and card-based instrument issuers can identify themselves, communicate securely and rely on your authentication procedures. Article 31 lets you offer a dedicated interface or adapt the interface your own users log into.

The duties also run the other way. A third-party provider must keep sessions secure and as short as possible, keep credentials unreadable to its staff, and, absent an active request from the user, retrieve account information no more than four times in 24 hours unless a higher frequency is agreed with the account provider with the user's consent (Articles 35 and 36). Under PSD2 Articles 66(4) and 67(3), the account provider must treat payment orders and data requests from those providers without discrimination, except for objective reasons.

What do the conduct rules in Titles III and IV require?

Title III is about information: what you tell users before a contract, before and after each transaction, and when terms change. Title IV is about rights and obligations: consent, refunds, liability and execution times. Most of the deadlines a complaints handler meets every day come from these two titles. Article 61 lets you agree out of some of them, such as the liability and refund rules, only with users who are not consumers.

Two more rules shape product design. Article 64 makes a transaction authorised only where the payer has given consent in the agreed form, and lets consent be withdrawn. Article 68 lets you agree spending limits and block an instrument for objectively justified security reasons, telling the payer before the block where possible and at the latest immediately after.

How fast must you answer a PSD2 complaint?

Article 101(1) requires adequate and effective complaint resolution procedures for complaints about the rights and obligations in Titles III and IV, applied in every Member State where you offer payment services, available in an official language of that Member State, and monitored for performance. Article 101(2) sets the clock: a reply on paper or another agreed durable medium that addresses all points raised, within 15 business days of receipt. In exceptional situations beyond your control you may send a holding reply that gives the reasons and the deadline, but the final reply must arrive within 35 business days. Member States may set rules more favourable to the user, and where they do, those rules apply.

Ireland shows how that works alongside national conduct rules. Regulation 105(5) of the Consumer Protection Code 2025 switches off the Code's own 20 and 40 working day complaint steps for a firm providing payment services, so payment service complaints run on the Article 101 clock, while the rest of the Irish procedure still applies: a 5 working day acknowledgement, a named point of contact and a six-monthly analysis reported to the board. Our guide to the Consumer Protection Code 2025 sets out which other parts of the Code bind payment and e-money institutions.

Article 101(3) and (4) require you to name at least one alternative dispute resolution entity, on your website, at your branches and in your terms and conditions, with how to reach it. For e-money holders, Article 13 of EMD2 applies the same procedures. The working evidence is a complaints log with received and replied dates, holding replies with reasons, root cause analysis, and the performance monitoring that Article 101(1) asks for.

What do you have to report to your regulator, and how often?

Reporting duties are spread across four instruments, and most of them recur. This is the calendar a compliance team should be able to show on request; national authorities often add their own returns on top.

Which other EU payment rules sit alongside PSD2?

No payment firm runs PSD2 alone. Five other regimes change what your programme has to cover.

Data protection runs through all of them: PSD2 Article 94(2) lets you access, process and retain only the personal data necessary for your payment services, with the user's explicit consent, on top of the GDPR. What the Instant Payments Regulation already asks of a payment or e-money institution, and what changes in April 2027, is in our guide to the Instant Payments Regulation for payment and e-money institutions.

What happens if you breach PSD2?

PSD2 sets no EU-wide fine. Article 103 requires each Member State to lay down effective, proportionate and dissuasive penalties for breaches of its transposing law, and to let its authority publish administrative penalties unless that would seriously jeopardise the financial markets or cause disproportionate damage. The size of a fine therefore depends on where you are licensed. The supervisory tools are the same everywhere: an authority can withdraw an authorisation whose conditions are no longer met or that is unused for 12 months (Article 13), refuse to register an agent or branch, and use the powers its national law gives it. DORA works the same way for the ICT side of the same firm, as our guide to DORA fines and penalties explains.

The day-to-day cost of non-compliance usually arrives as liability. Unauthorised transactions are refunded by the end of the next business day (Article 73), and where a user disputes a transaction, the burden of proving it was authenticated and accurately recorded sits with you (Article 72). Skipping SCA moves the loss to you unless the payer acted fraudulently (Article 74(2)). A payer's provider that fails to run verification of payee refunds the payer for a misdirected transfer (Regulation (EU) No 260/2012 Article 5c(8)). And for the user screening duty in the Instant Payments Regulation, Member States must provide maximum fines of at least 10% of total annual net turnover for a legal person (Article 11(1b) of that Regulation).

What changes with PSD3 and the Payment Services Regulation?

The Council and the European Parliament reached a provisional political agreement on a third Payment Services Directive and a new Payment Services Regulation on 27 November 2025. Formal adoption and publication still complete the process, and application is expected around 2028. Until then PSD2, its national transposition and the RTS remain the law you are supervised against.

Under the agreed texts, licensing and supervision stay in a directive that also repeals the second E-Money Directive, so e-money institutions move into the payment institution regime, and existing institutions get a transition period in which they must show their authority that they meet the new authorisation requirements. The information duties, the rights and obligations of users and providers, and strong customer authentication move into a directly applicable regulation, with new rules on fraud aimed at impersonation scams. The practical advice is to build the programme on PSD2 now and map it to the final texts when they are published: safeguarding, authentication, complaints and reporting carry over, and the evidence you keep today is the evidence you will need then.

What the other results get wrong

Page one for this query is written by identity verification vendors, payment gateways and data security firms, and most of it is a merchant's guide to strong customer authentication. We checked each claim below against the text of the Directive and the RTS.

The first error is the fine. Two of the ranking pages say PSD2 breaches can cost up to 4% of annual revenue or returns. PSD2 sets no fine at all, let alone a percentage of turnover: Article 103 leaves penalties to each Member State. The 4% figure is the top tier of the GDPR.

The second is the transaction risk analysis table. One merchant guide on page one gives the reference fraud rate for card payments up to EUR 500 as 0.06%; the Annex to the RTS says 0.01%, and 0.005% for credit transfers, which that guide omits entirely. The same page garbles the low-value rule as no SCA "if any one purchase is less than 100 Euros", when Article 16 caps each payment at EUR 30 and resets after EUR 100 or five payments, and it calls recurring payments merchant-initiated and therefore exempt, which runs two separate concepts together.

The third is the EUR 30 threshold. Another guide states that two-factor authentication "has become mandatory for online card payments over €30". Article 97 applies SCA to every electronic payment the payer initiates, whatever the amount. EUR 30 is the ceiling of an optional exemption that the payer's provider may apply, subject to the cumulative limits.

The fourth is the history. One page calls PSD2 "an attempt by the European Union's (EU) European Banking Authority"; another says Article 98 required the "Euro Bank Association" to draft the technical standards "by July 2017"; a third says the Commission "added an amendment to the legislation in 2013, creating PSD2". PSD2 is a directive of the European Parliament and the Council, adopted on 25 November 2015, and it repealed the first directive, 2007/64/EC, outright. Article 98(4) gave the European Banking Authority until 13 January 2017 to submit the draft standards.

The fifth is what is missing. None of the ranking pages we checked mentions safeguarding, the DORA takeover of incident reporting under Article 96(7), the 15 and 35 business day complaint deadlines, the 180-day rule, or the reference fraud rates for credit transfers. For a payment or e-money institution those are the requirements that fill the compliance calendar.

How do you turn PSD2 into a working compliance programme?

The duties above are easy to understand and hard to keep track of, because they belong to different owners, recur on different cadences and leave evidence in different systems. Many compliance teams run them from a spreadsheet, a shared drive and long email chains, and that is where evidence goes missing. Five steps turn the list into a programme:

1. Map every duty to an owner and its evidence. Each row in this guide becomes a requirement with a named owner, a status and the document that proves it.
2. Put the recurring obligations on one calendar. The yearly Article 95(2) assessment, the six-monthly fraud statistics, the quarterly exemption monitoring and interface statistics, the yearly TRA audit and the 12-monthly instant payments report each get a date and an owner.
3. Run a gap assessment against the current text of the law. Score each area, and turn every gap into a task with a due date.
4. Keep the policies current. The SCA and exemptions policy, the safeguarding policy, the incident procedure, the complaints policy and the outsourcing and agents policy each need an owner and a review date.
5. Report to the board on one page. Status by area, overdue items, and the dates coming up in the next quarter.

That is what the EU Payments framework in Venvera is built for. It puts every requirement, owner, task, deadline and piece of evidence in one dashboard instead of Outlook, Excel and mail chains: 172 requirements drawn from PSD2, the SCA RTS, the surviving EBA ICT guideline section, EMD2, the Instant Payments Regulation and the Accessibility Act duties; an 81-question gap assessment; 25 recurring obligations on the compliance calendar; 20 policy templates; tasks and board reports. Venvera manages the programme and its evidence. It does not execute payments, perform strong customer authentication, run verification of payee or screen your customers; those stay with your payment systems and providers.

You can see where you stand in minutes with the free compliance check, book a demo to walk through the EU Payments framework, or start a 14-day Professional trial with no credit card. Plans are on the pricing page.

Where do you stand? A PSD2 self-check

Fill this in for one legal entity. A blank answer is your next piece of work.

Frequently asked questions

What are the main PSD2 compliance requirements?

For a payment or e-money institution: authorisation and governance (Articles 5, 11 and 16), initial capital and own funds (Articles 7 to 9), safeguarding of users' funds (Article 10), oversight of agents and outsourcing (Articles 19 and 20), operational and security risk management (Article 95), incident reporting, now under DORA (Article 96(7)), strong customer authentication and its exemptions (Article 97 and the RTS), access interfaces for third-party providers (RTS Chapter V), and the conduct, complaints and reporting duties in Titles III and IV and Article 101.

Does PSD2 apply to merchants?

Only indirectly. A merchant accepting payments is a payment service user, and its acquirer is the regulated provider. Merchants feel PSD2 through strong customer authentication at checkout, which the payer's provider applies, and through the liability rule in Article 74(2) where the payee or its provider fails to accept SCA.

Does PSD2 apply to e-money institutions?

Yes. E-money institutions are payment service providers under Article 1(1)(b), and EMD2 Article 3(1) applies PSD2 Articles 5, 11 to 17, 19(5) and (6) and 20 to 31 to them. Titles III and IV, strong customer authentication and the RTS apply to the payment services they provide, and EMD2 adds its own capital, safeguarding and redemption rules.

Is PSD2 still in force in 2026?

Yes. PSD3 and the Payment Services Regulation were politically agreed on 27 November 2025, but application is expected around 2028. Until then PSD2, as amended by Directive (EU) 2022/2556 and Regulation (EU) 2024/886, and the RTS as amended by Delegated Regulation (EU) 2022/2360, are the rules you are supervised against.

When will PSD3 and the PSR apply?

No date is fixed yet. The texts were politically agreed on 27 November 2025, formal adoption and publication in the Official Journal still complete the process, and application is expected around 2028, after a transition period that the final texts set.

How quickly must users' funds be safeguarded?

Funds still held at the end of the business day following the day they were received must be in a separate account at a credit institution or a central bank, invested in secure, liquid, low-risk assets, or covered by insurance or a comparable guarantee (Article 10(1)). For e-money paid by card, EMD2 allows up to five business days after issuance.

Can safeguarded funds be held at a central bank?

Yes, at the central bank's discretion. The Instant Payments Regulation amended Article 10(1) to allow a separate account at a central bank, for Member States to apply by 9 April 2025.

How much initial capital does a payment institution need?

EUR 20,000 for money remittance only, EUR 50,000 for payment initiation only, and EUR 125,000 for any of services 1 to 5 of Annex I (Article 7). An e-money institution needs EUR 350,000 (EMD2 Article 4). Own funds on top may never fall below that initial capital.

Do payment institutions still report incidents under PSD2?

No. Article 96(7) switched off the PSD2 major incident reporting paragraphs for payment and e-money institutions, account information service providers and credit institutions from 17 January 2025. Major operational or security payment-related incidents are reported under DORA Articles 19 and 23.

How often must fraud data be reported?

Article 96(6) requires statistical fraud data at least yearly. The EBA's fraud reporting guidelines, EBA/GL/2018/05, ask payment service providers to report every six months, with firms under the small institution exemptions reporting yearly with the data split into two half-year periods.

What is the EUR 30 rule in strong customer authentication?

It is the low-value exemption in RTS Article 16. A provider may skip SCA for a remote electronic payment of up to EUR 30, until the payments since the last SCA reach EUR 100 in total or five in number. It is optional, and SCA is otherwise required whatever the amount.

What are the transaction risk analysis thresholds?

For remote card payments, a fraud rate of at most 0.13% for payments up to EUR 100, 0.06% up to EUR 250 and 0.01% up to EUR 500. For remote credit transfers, 0.015%, 0.01% and 0.005% for the same bands. The rate is measured on a rolling 90 days (RTS Article 19 and Annex).

What is the 180-day rule?

Since 25 July 2023, strong customer authentication for access to the balance and the last 90 days of transactions is needed at first access and then once more than 180 days have passed. On direct access the exemption is optional (Article 10); through an account information service provider it is mandatory (Article 10a).

How long do you have to answer a PSD2 complaint?

15 business days from receipt. In exceptional situations beyond your control you may send a holding reply with reasons, but the final reply must arrive within 35 business days (Article 101(2)). National rules may be stricter.

How fast must an unauthorised transaction be refunded?

Immediately, and in any event by the end of the following business day after you note or are told of it, unless you have reasonable grounds to suspect fraud by the payer and report them in writing to the national authority (Article 73(1)).

What is the most a payer pays for a lost or stolen card?

EUR 50, unless the payer acted fraudulently or failed their obligations with intent or gross negligence (Article 74(1)). If the payer's provider did not require strong customer authentication, the payer bears no loss unless they acted fraudulently (Article 74(2)).

Is there a fixed PSD2 fine?

No. Article 103 leaves penalties to each Member State, so the amount depends on your national law. The Instant Payments Regulation is different for one duty: for user screening, Member States must provide maximum fines of at least 10% of total annual net turnover for a legal person.

Do the EBA guidelines on ICT and security risk management still apply?

Only section 3.8, on payment service user relationship management. EBA/GL/2025/02 deleted the rest from 20 May 2025, because DORA now governs ICT risk. Paragraphs 92 to 98 still cover user security guidance, the option to disable functions, adjustable spending limits, alerts and user assistance.

Does PSD2 apply to account information service providers?

Yes, in a lighter form. Providers of account information services only are registered instead of authorised and hold professional indemnity insurance (Articles 5(3) and 33). Titles III and IV apply to them only in part, while Articles 67, 69 and 95 to 98 apply in full.

Primary sources

Requirements, articles and dates are taken from the consolidated text of Directive (EU) 2015/2366 as amended by Article 7 of Directive (EU) 2022/2556 and by Regulation (EU) 2024/886; Delegated Regulation (EU) 2018/389 and its amendment, Delegated Regulation (EU) 2022/2360; Directive 2009/110/EC; Articles 19 and 23 of Regulation (EU) 2022/2554 and Article 5 of Delegated Regulation (EU) 2025/301; the consolidated EBA Guidelines on ICT and security risk management; the EBA Guidelines on fraud reporting; and the EBA's repeal of the PSD2 major incident reporting guidelines. The PSD3 and PSR status is from the Council's announcement of the provisional agreement. Your obligations apply through your Member State's transposing law; read it and the full texts before relying on a specific provision.