Madrid: The payment services regulation that EU institutions have negotiated since 2023 is close to becoming law, and it will change who pays when fraudsters empty a bank account. The Council adopted its first-reading position at the end of October 2026, and on 3 November the Commission confirmed that the text fully reflects the political agreement reached in November 2025. Only a second reading in the European Parliament now stands between the package and publication in the Official Journal.
The Commission first proposed the payment services regulation and a third Payment Services Directive in June 2023. Parliament set out its first-reading position on 23 April 2024, and the Council settled its negotiating mandate in June 2025 before the two sides struck a deal. The directive repeals the second Payment Services Directive and folds electronic money institutions into the payment institution regime, which ends the separate e-money licence.
Fraud sits at the centre of the payment services regulation. Providers must offer customers tools such as spending limits and the option to delay a payment, and they must monitor transactions for fraud risk before execution and suspend any payment they suspect. A payee name check, already in place for euro instant transfers, will cover transfers more widely by comparing the IBAN with the account holder’s name before money leaves. Banks and other providers must also share data on suspected fraudulent transactions with one another.
Liability shifts as well. Under the payment services regulation, a provider that fails to deploy the required preventive tools can face liability to the customer, and consumers gain a new refund right when a fraudster impersonates their bank. Summaries of the text say this refund applies only under certain conditions, so the final wording will decide how often banks pay out. The rules also oblige communications providers to put anti-spoofing measures in place and limit very large online platforms to showing financial-services adverts from authorised or registered advertisers.
Other provisions touch daily payments. The payment services regulation requires ATM operators to display all fees and the exchange rate before a withdrawal, card solution providers to disclose their charges, and merchants to make their trading name match the name on a customer’s bank statement. Shops may hand out cash without a purchase, using chip and PIN, up to €150, three times the €50 the Commission first suggested. Mobile device manufacturers and electronic communications providers must give payment firms access to the technical features they need on fair, reasonable and non-discriminatory terms, which opens the door to more open-banking competition.
For banks and fintechs, the practical question is timing and cost. The sources reviewed give no application date, so firms should expect the usual transition period after publication, with the directive needing national transposition while the regulation applies directly. Danish ministries estimated recurring business costs for the original proposal above DKK 193 million a year, which shows the compliance bill that other capitals may face. The payment services regulation will therefore shape fraud budgets, customer service and product design across the single market well before the first refund is paid.
