What is PSD2?
The EU's Payment Services Directive 2, which mandates SCA, opens banking APIs, and reshapes payment liability.
The Second Payment Services Directive (PSD2) is a comprehensive piece of European Union legislation that regulates payment services and providers across the European Economic Area (EEA). Its primary goals were to increase competition, improve consumer protection, and enhance the security of electronic payments.
To achieve this, PSD2 introduced several transformative changes. The most well-known is the mandate for Strong Customer Authentication (SCA), which requires multi-factor authentication for the majority of online payments to combat fraud.
This directive is the 'why', while SCA is the 'what' and 3D Secure is the 'how'.
Beyond security, PSD2 was the driving force behind Open Banking. It legally requires banks (ASPSPs) to grant regulated third-party providers, known as Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs), access to customer payment accounts via secure application programming interfaces (APIs).
This has fostered innovation, enabling new services like account aggregation apps and 'Pay by Bank' Checkout options that compete directly with traditional card payments.
The directive also strengthened consumer rights by reducing a cardholder's liability for unauthorised payments from €150 to €50 and introduced strict rules on payment surcharging, effectively banning extra fees for using consumer card types like Visa and Mastercard across the EEA.
A key nuance is its extraterritorial effect; while an EU law, any global merchant processing payments through an EEA acquirer must comply with its rules, notably SCA.
Worked example
An online Marketplace based in the UK wants to improve its Checkout process and reduce costs. Under PSD2, they are no longer allowed to add a 1.5% surcharge for customers paying with personal credit cards, so they must build this cost into their pricing model.
To offer a cheaper alternative, they partner with a licensed Payment Initiation Service Provider (PISP). At Checkout, customers now see a 'Pay by Bank' option alongside cards.
A customer selecting this is redirected to their own bank's secure login portal (e. g. , HSBC or Barclays) where they authenticate themselves and authorise the payment directly from their current account. The funds are sent via the Faster Payments network.
For the Marketplace, the fee for this PISP transaction is a flat 30p, significantly less than the 1.5% + 20p they pay for a typical card transaction.
Scheme notes
PSD2 is not a card scheme rule, but a law that schemes and their members (issuers and acquirers) must obey.
The schemes have been instrumental in enabling compliance, primarily by developing and mandating the use of 3D Secure 2 as the technical standard for fulfilling SCA requirements on card transactions.
They also updated their network rules to support the data flags necessary to manage SCA exemptions and identify Merchant-Initiated Transactions.
The directive's rules on prohibiting surcharges for consumer cards (Visa/Mastercard) removed a tool some merchants used to steer volume, reinforcing the schemes' position as the default payment method for many online checkouts.
Why it matters for merchants
PSD2 directly impacts merchants in three main ways: cost, conversion, and compliance. The ban on surcharging on popular card types means merchants must absorb these costs, impacting margins.
The SCA mandate introduces a point of friction at Checkout that, if not managed via exemptions like TRA and low-value, can reduce conversion rates; non-compliance leads to declined payments.
On the other hand, the rise of Open Banking payments powered by PSD2 provides merchants with a new, often lower-cost, payment rail to offer customers.
Platforms like Cardflo help merchants navigate PSD2 by providing compliant 3DS2 integrations, optimising the use of SCA exemptions across multiple acquirers, and offering a range of APMs, including 'Pay by Bank' options.
Frequently asked
How does PSD2 affect transaction abandonment rates?
The requirement for Strong Customer Authentication often adds friction to the Checkout process, which can lead to higher abandonment if not managed via 3D Secure 2.2 protocols.
However, merchants can mitigate this by utilising technical exemptions, such as those for low-value payments or Transaction Risk Analysis (TRA), granted by the acquirer.
What is the difference between PSD2 and the upcoming PSD3?
While PSD2 established the foundations for Open Banking and SCA, PSD3 is expected to refine these rules by improving API performance and tightening fraud prevention measures.
The new framework will likely increase the liability of payment providers for 'spoofing' fraud and merge the licensing regimes for payment institutions and e-money institutions.
What is the difference between PSD2 and Open Banking?
PSD2 is the wide-ranging European directive that created the legal framework for a host of changes in the payments industry. Open Banking is one specific outcome of PSD2.
The directive mandated that banks must create secure APIs to allow licensed third-party providers to access customer account data (with consent) and initiate payments. So, PSD2 is the law, and Open Banking is the resulting ecosystem of API-driven financial services.
I'm a US merchant. Does PSD2 affect me?
Yes, potentially. If you sell to customers in the EEA or UK and use an acquirer in that region, your transactions will be subject to PSD2 rules, most notably Strong Customer Authentication (SCA).
Even if you use a US acquirer, if a European customer's bank declines a transaction for not meeting SCA standards, your sales will be impacted. Therefore, having the capability to support 3D Secure is important for any merchant with a significant European customer base.
Did Brexit change the rules for UK merchants?
No, the core principles of PSD2 were written into UK domestic law as the Payment Services Regulations 2017. The UK also adopted the technical standards for SCA.
Therefore, the rules regarding SCA, Open Banking, and surcharging remain substantively the same for UK businesses and consumers. Transactions between the UK and the EEA are now considered 'one-leg out' transactions, but the practical requirement for SCA remains.
Can I still surcharge corporate or commercial cards under PSD2?
Yes, the PSD2 ban on surcharging applies specifically to consumer debit and credit cards that are subject to capped interchange fees (which includes most Visa and Mastercard cards).
The directive does not prohibit surcharging for payments made with commercial or corporate cards, or for card schemes like American Express that are not subject to the same interchange fee caps. However, you must be able to identify the card type before applying the surcharge.
What are PISPs and AISPs?
These are two types of regulated third-party providers created under PSD2. An AISP (Account Information Service Provider) is a company licensed to access and consolidate financial information from a user's various bank accounts, with their consent.
A PISP (Payment Initiation Service Provider) is a company licensed to initiate a payment directly from a user's bank account on their behalf, also with their consent. 'Pay by Bank' services at Checkout are powered by PISPs.
See how PSD2 plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
PSD2 requirement that customer-initiated electronic payments in the EEA and UK be authenticated with two of: knowledge, possession, inherence.
A card-network authentication protocol that shifts fraud liability from the merchant to the issuer when a cardholder is verified.
UK/EU regulatory framework mandating banks expose account and payment APIs to licensed third parties, enabling Pay by Bank and account-based checkouts.
Any non-card payment method, wallets, bank transfers, BNPL, vouchers, accepted at checkout.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.