Regulation
PSD2
The EU's Payment Services Directive 2, which mandates SCA, opens banking APIs, and reshapes payment liability.
The Second Payment Services Directive (PSD2) is a piece of EU legislation that regulates payment services and payment service providers throughout the European Union and European Economic Area. It mandates Strong Customer Authentication (SCA), requiring multi-factor verification for most electronic payments to reduce fraud. The directive introduced a legal framework for Open Banking by requiring banks to provide regulated third-party providers, such as Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs), with access to customer accounts via secure APIs. For merchants, this shift impacted checkout flows through the implementation of 3D Secure 2.0 and shifted liability for fraudulent transactions to issuers when SCA is correctly applied. While the UK has transposed these rules into domestic law via the Payment Services Regulations 2017, the directive continues to set the standard for interchange fee transparency and the prohibition of surcharging on consumer cards.
Frequently asked
How does PSD2 affect transaction abandonment rates?
The requirement for Strong Customer Authentication often adds friction to the checkout process, which can lead to higher abandonment if not managed via 3D Secure 2.2 protocols. However, merchants can mitigate this by utilising technical exemptions, such as those for low-value payments or Transaction Risk Analysis (TRA), granted by the acquirer.
What is the difference between PSD2 and the upcoming PSD3?
While PSD2 established the foundations for Open Banking and SCA, PSD3 is expected to refine these rules by improving API performance and tightening fraud prevention measures. The new framework will likely increase the liability of payment providers for 'spoofing' fraud and merge the licensing regimes for payment institutions and e-money institutions.
Related terms
PSD2 requirement that customer-initiated electronic payments in the EEA and UK be authenticated with two of: knowledge, possession, inherence.
A card-network authentication protocol that shifts fraud liability from the merchant to the issuer when a cardholder is verified.
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.