Brussels: New EU payment fraud rules moved within one vote of becoming law after the Council of the EU adopted its first-reading position on the payment services package on 29 October 2026. Member states signed off both the third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR), and the European Parliament must now approve the texts in plenary.

The step closes a negotiation that began when the European Commission tabled the package in June 2023. Parliament set its position in April 2024, the Council agreed its mandate in June 2025, and negotiators struck a provisional deal on 27 November 2025. Since then, lawyer-linguists have turned that political agreement into final legal text.

The Council recorded its decision in a statement on the Payment Services Regulation and a matching statement on PSD3. Because the Council acted first, Parliament can close the file on the payment fraud rules with a single plenary approval, without reopening the substance agreed last year.

At the heart of the payment fraud rules sits a new shield against impersonation scams. When a criminal poses as a bank employee and tricks a customer into sending money, the bank will have to refund the full amount, provided the victim reports the fraud to the police and informs the provider. Banks that lack adequate fraud-prevention systems will also carry the loss.

The payment fraud rules also extend to every euro transfer a check that matches the payee’s name with the account number. If the name and the IBAN do not match, the provider must alert the customer before the money leaves. Customers will also get tools to set spending limits and block payments on their accounts.

Online platforms enter the frame for the first time. Under the payment fraud rules, a platform that learns of fraudulent financial content and fails to remove it will have to compensate banks that have already reimbursed scam victims. Platforms will also be allowed to carry advertising for financial services only when the provider holds an authorisation in the relevant member state.

Consumers should notice changes beyond fraud protection. Providers must display all charges, including currency conversion costs and fixed ATM withdrawal fees, before a customer pays. Shops will be able to hand out between €100 and €150 in cash without a purchase, a measure aimed at towns where bank branches and cash machines are disappearing.

Open banking firms win new rights as well. The regulation lists barriers that banks may no longer place on data access, requires a dashboard where customers can see and withdraw the permissions they have granted, and guarantees payment institutions fair access to bank accounts. Crypto-asset service providers licensed under MiCA get a lighter route to a payment licence.

Rapporteurs René Repasi and Morten Løkkegaard steered the files through Parliament, where the platform liability clause drew the hardest fights over the payment fraud rules. Big Tech lobbied against any duty to repay victims, while consumer groups argued that the deal still leaves too much of the burden on customers who authorise transfers themselves.

Once Parliament votes and the texts appear in the Official Journal, banks face a transition period that advisers expect to last around 21 months for most PSR obligations. That timetable means the payment fraud rules will reach customers in 2028 at the earliest, so supervisors and banks will spend 2027 rebuilding verification systems and refund procedures.