Brussels: The new PSD3 payment rules moved closer to the finish line when the Council of the EU published its position at first reading, dated 21 October 2026, with a view to adoption. The text replaces the second Payment Services Directive and the Electronic Money Directive, and it amends the Settlement Finality Directive and the Markets in Crypto-Assets Regulation.
The directive works alongside a Payment Services Regulation that applies directly in every member state. The Commission proposed the package on 28 June 2023, and the Council’s permanent representatives endorsed the compromise texts on 22 April 2026. The rules generally apply 21 months after publication in the Official Journal.
Fraud is the centre of the package. If a criminal impersonates a customer’s own bank through the bank’s channels and tricks the customer into authorising a payment, the bank must refund the customer in full, provided the customer reports promptly to the bank and the police. The bank can avoid liability only by proving fraud or gross negligence by the customer.
Payee name verification becomes mandatory for every credit transfer. Before a payment leaves the account, the provider must check that the name matches the account identifier, and a failed check that leads to a misdirected payment triggers a direct refund duty. These PSD3 payment rules therefore turn a service that some banks offer voluntarily into a legal standard.
Strong customer authentication gets wider triggers, including the creation of tokenised payment instruments, changes to spending limits and changes to contact details. Under the PSD3 payment rules, providers must offer several authentication methods free of charge, suitable for people with disabilities, limited digital skills or no smartphone. No method may depend on a single device unless the user agrees.
Negotiators dropped broad liability for online platforms and telecom firms, but kept a narrower route. A hosting provider must compensate a payment provider when illegal content it stored leads to fraudulent payments, and very large online platforms and search engines face conduct duties that the Commission will supervise. Retailers may also give cash without a purchase, and ATM deployers get their own registration category.
Consumers should see the effects first. Customers who lose money to bank impersonation scams gain a clearer path to a refund, and name checks before each transfer should cut misdirected payments. Banks will carry the cost of building those checks, so the PSD3 payment rules matter well beyond the compliance department.
Banks and payment institutions now face a long list of technical standards and guidelines from the European Banking Authority. The next milestones are formal adoption and publication, and firms that start their compliance work now will meet the PSD3 payment rules in better shape than those that wait.
