A Merchant’s guide to PSD3: Key changes, timelines and three quick wins

The third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR) are the EU’s latest effort to keep payment rules up to speed with how people and businesses actually pay today. These updates build on the foundations of PSD2 - recognizing the changing reality of digital payments, instant settlements, rising fraud, and more widespread use of open banking. 

Although the final rollout dates haven’t been confirmed, based on previous timelines, we expect an 18-month transition period. This means the new rules could start applying by 2026. 

So, what’s changing - and more importantly, what does it mean for your business? 

Let’s explore the two biggest areas of impact: Strong Customer Authentication (SCA) and Open Banking. 

Strong Customer Authentication (SCA): Sharpened rules in a real-time world 

Strong Customer Authentication (SCA) is a set of rules that helps verify a customer’s identity when they make a payment. You may already be familiar with it from PSD2, which introduced two-factor authentication.  

PSD3 strengthens these SCA rules by: 

• Making multi-factor authentication mandatory in more situations 

• Requiring authentication when a customer adds a mobile wallet 

• Preventing PSPs from relying on one method of authentication 

This means customers will be asked more often to confirm their identity through something they know (a password), something they have (a phone), or something they are (like a fingerprint). 

The goal of these measures is to reduce fraud and build trust – while still making checkout as smooth as possible.  

PSD3 is also closely connected to the Instant Payments Regulation (IPR), introduced in 2024, which pushes for real-time payments to become the new standard across Europe. As a merchant, this means you could receive payments within seconds, not days.  

That’s a big win for cash flow – but can also make it harder to reconcile or match incoming payments with orders if the timing is off or settlements happen outside the normal hours.  

That’s where we come in. We support smarter SCA flows, help you apply exemptions where possible (through Transaction Risk Analysis or Low-value Payments) and ensure your authentication processes are efficient and compliant, without adding unnecessary friction at checkout.   

Want to learn more? Read how PSD2 SCA impacted success rates 

Open Banking: Greater access, tighter controls 

Open banking allows customers to give third parties permission to access their bank account data or initiate payments on their behalf – safely and securely.  

PSD2 introduced this idea, but many providers ran into challenges – slow APIs, inconsistent access and features, and unclear rules.  

PSD3 and PSR aim to fix open banking rules by:  

• Requiring banks to offer high-quality APIs with better reliability 

• Making sure those APIs are priced fairly 

• Creating stricter guidelines for how consent is collected and managed 

As a merchant, this could unlock faster, simpler payment options (like account-to-account payments), smarter analytics, and more personalized checkout experiences.    

Behind the scenes, we handle the complexity for you – integrating open banking tools that comply with PSD3, managing data permission properly, adding new ways to initiate payments, and helping you turn payment data into actionable insights.  

What this means for your business 

These changes may feel technical, but they translate into practical improvements, and a few areas where you might need to adapt. Here’s how it could affect your day to day:  

1. Stronger fraud protection (and fewer chargeback headaches) 

With PSD3’s new fraud checks, such as Confirmation of Payee (matching IBAN-name with account-holder's name), there’s more protection against errors and unauthorized payments. This can reduce chargebacks and boost customer trust.  

For merchants, it adds a layer of security and trust to bank transfers but may also introduce friction or payment failures if customer-entered details don’t exactly match the account records. Payment providers will need to ensure seamless integration of CoP checks into their payment flows.  

2. Smoother cross-border payments 

Today, PSD2 rules are applied slightly differently across EU countries. PSR will change that by applying one consistent set of rules across all member states. That means less admin when expanding into new markets.  

PSD3 also narrows the “one-leg” exemption. Previously, certain consumer protections didn’t apply if only one party in a transaction was based in the EU. Now, fraud checks and refund rights will extend to cross-border payments involving non-EEA countries. 

For merchants trading with partners or customers in the UK, the US, or Asia, this means stricter verification steps, clearer refund obligations, and greater liability for fraud. While protection improves for EU-based customers, it could also add complexity for businesses trading internationally. Making it even more important to partner with a PSP that understands these evolving compliance standards.  

A key example is how this change affects Strong Customer Authentication (SCA), particularly 3D Secure (3DS) checks. PSD3 aims to reduce this exemption, increasing the need for merchants to apply authentication on transactions that were previously considered optional. This will require adaptive 3DS strategies and coordination with a PSP to balance security, compliance, and conversion.   

3. Faster and more flexible service from your PSP 

PSD3 gives PSPs like MultiSafepay better access to key payment infrastructure. Allowing us to process and settle payments faster, deliver advanced features, gain data insights and reduce reliance on traditional banks.