PSD3 and the next phase of open banking in Europe
The proposed PSD3 and Payment Services Regulation would tighten APIs, fraud liability and access rules. We outline what banks and TPPs should be preparing for next.
What PSD2 started
PSD2 was the directive that turned open banking from a concept into an operating requirement. It mandated strong customer authentication (SCA) across most electronic payments and forced banks to open account and payment-initiation access — via XS2A — to licensed third-party providers across the EU.
Nearly a decade on, that framework is still the backbone of open banking across Europe, but the European Commission has judged it incomplete, and a follow-on package is now working its way through Brussels.
From a single directive to a directive-plus-regulation model
The Commission's proposal splits the update in two: a new PSD3 directive alongside a directly applicable Payment Services Regulation (PSR), the latter intended to close the inconsistent, member-state-by-member-state implementation that dogged PSD2.
Between them, the two instruments aim to tighten fraud liability rules, push open banking APIs toward better performance and reliability, and extend supervisory reach further into the payments value chain.
As of writing, the package is still moving through the EU legislative process, and its final text, scope and timeline have not been settled. Anyone advising on it — Run Ventures included — is reading a moving target, not a finished rulebook.
Why the direction of travel matters now
Waiting for a final text before acting is not, in practice, an option for most banks, PSPs and e-money institutions. Three areas keep surfacing as likely to require product and technology change regardless of where the final drafting lands: open banking API performance and availability, IBAN/name-check requirements in the spirit of Verification of Payee, and materially stronger fraud-liability rules.
Firms that treat these as directional signals now, rather than waiting for a transposition deadline, tend to have an easier time when the rules do land.
Run Ventures tracks the PSD3/PSR process alongside the broader PSD2 compliance landscape and helps clients translate an unsettled legislative text into a sequenced, defensible programme of work rather than a last-minute scramble.