Yes, PSD3 and the Payment Services Regulation add measures beyond PSD2, and most requirements are expected to apply 21 months after entry into force. For PSD3 and its impact on UK fintechs in 2026, the key distinction is jurisdiction: the package won’t automatically apply to UK-only operations, but firms operating in or serving EU markets need to assess its effect on their services.
If you’re concerned about overlapping rules, changing open banking access or the cost of getting compliance timing wrong, those are practical questions, not distant policy debates. The challenge is to understand which requirements affect your EU activity and how they change the obligations you already manage under PSD2.
This article explains the expected compliance timeline, key changes to fraud controls and payment services, and the rules shaping open banking interfaces and customer consent. It also clarifies what the reforms mean for UK firms with EU operations, helping you distinguish EU obligations from UK requirements and plan accordingly.
Key Takeaways
Build your compliance roadmap around the staged EU timeline, including the expected 21-month application period and later transition requirements.- Assess how the directly applicable Payment Services Regulation and stronger fraud and payee-verification measures change your current PSD2 controls.
- Review how open-banking interface performance, consent renewal and withdrawn-access processes may affect your customer journeys.
- Separate UK-only activity from services operating in or serving EU markets, then focus your impact assessment on the latter.
Table of Contents
- When do businesses need to comply with PSD3 and PSR?
- How PSD3 and the Payment Services Regulation differ from PSD2
- Open banking interfaces, fallback access and consent
- PSD3 and PSR applicability to UK businesses with EU operations
- Gemba: Fast time to market embedded banking
When do businesses need to comply with PSD3 and PSR?
PSD3 is the EU directive reforming payment institution rules; the Payment Services Regulation (PSR) establishes directly applicable rules across Member States. Both are expected to enter into force 20 days after publication in the Official Journal of the European Union, with most requirements applying 21 months after publication.
Implementation timelines
The timeline separates legislative approval, entry into force and the later application of requirements. The European Parliament’s ECON committee approved the texts on 5 May 2026, and formal adoption and publication were expected in late 2026.
For firms assessing PSD3 and its impact on UK fintechs 2026, those stages mark different planning points. The 20-day period begins after publication, while most rules apply 21 months later. Depending on publication, the main application period falls around late 2027 or 2028.
Existing market participants also face transition milestones: a 21-month cut-off for qualifying firms and a 27-month deadline to submit information and demonstrate compliance. If a supervisor cannot process a timely submission, it may have up to 30 months from entry into force.
The European Banking Authority is expected to develop Level 2 and Level 3 measures from 2027 to 2028. Firms should track these technical measures alongside the main regime because they shape detailed conduct requirements.
Compliance planning and costs
Compliance planning turns applicable requirements into assigned work, system changes and evidence of control. A practical assessment of PSD3 and its impact on UK fintechs 2026 starts by identifying EU-facing services, then reviewing authorisation, safeguarding, fraud controls, disclosures and open-banking processes.
There is no single compliance cost for every firm. The work depends on existing control gaps, affected services, technology changes and governance needs. A firm with established EU controls may need a different programme from one seeking payment institution authorisation.
Build a plan that maps each requirement to an owner, supporting evidence and a transition milestone. This helps separate early design decisions from later operational changes and keeps the programme aligned with the firm’s EU service scope and applicable deadlines.
How PSD3 and the Payment Services Regulation differ from PSD2
PSD3 and the PSR reshape EU payment services through revised institutional rules and a directly applicable regulation. For UK firms, the key distinction is whether they serve EU markets or operate only in the UK.
Changes from PSD2
PSD2, Directive (EU) 2015/2366, has regulated EU payment services since 2018. PSD3 revises the directive framework, while the PSR introduces directly applicable rules across EU Member States, aiming to reduce fragmentation between states.
The package strengthens fraud measures, including IBAN and name matching and information-sharing. Under Article 50, verification of payee applies to all credit transfers. The PSR also sets reimbursement requirements for certain authorised payments involving impersonation fraud. These changes matter because providers must assess payment journeys, fraud controls and customer communications together, rather than treating each rule as an isolated system update.
Payment institution licensing and authorisation
PSD3 changes how payment institutions and e-money institutions are classified and authorised. E-money institutions become a sub-category of payment institutions and need re-authorisation, making regulatory status a central preparation issue for affected firms.
Existing firms face transition requirements, while new applicants must meet the applicable authorisation framework. Map each EU service to its institution type, then identify whether current permissions and control evidence remain suitable. A timely submission that a supervisor cannot process may take up to 30 months from PSD3 entry into force. That makes complete documentation and clear governance important parts of preparation.
PSD3 and the PSR don’t replace the UK’s Payment Services Regulations 2017 or current FCA rules. The EU package governs applicable EU activity; UK requirements remain separate for UK operations, including FCA-supervised conduct.
UK payment providers have been required to reimburse most victims of authorised push payment fraud since October 2024 for payments made through the Faster Payment System or CHAPS. Compare those UK protections with the EU package’s fraud rules, then document which controls apply to each payment route.
For practical preparation, create a requirements map for EU payment services, authorisation status, fraud handling and customer-facing processes. Assign owners to each gap and track evidence against the applicable rules. Firms reviewing how their payment flows are supported can explore payment services infrastructure as part of that operational assessment.
Open banking interfaces, fallback access and consent
PSD3 and the PSR set out more specific expectations for open-banking interfaces, consent management and account-data access. For providers, interface performance and understandable customer controls both shape the consumer experience.
Fallback access and consent
Fallback access concerns how an account information or payment initiation service can keep accessing an account when its usual connection fails. The PSR’s consent dashboard lets consumers manage permissions, making clear access controls important for continuity and trust.
An ASPSP must let users re-establish withdrawn data access through its consent dashboard within 48 hours. Providers must also retain records of withdrawn or expired data-access consents for 2 years. These records help distinguish current permissions from access that a consumer has ended.
Data access and re-authentication
Open-banking account-data access depends on an active customer consent and a connection between the provider and the account-servicing institution. Account information providers must re-authenticate customers every 180 days to keep consent current.
That interval makes consent renewal part of the service journey, not just an onboarding step. Providers should make renewal requests clear and accessible, so consumers understand what access will continue and how to manage it.
Interface quality also becomes more visible. Under the PSR rules described, banks must publish the performance of their dedicated connection every quarter. Providers can use this recurring measure to assess whether the interface supports reliable account-data access and to identify patterns of disruption.
For account-holding institutions, the rules specify that an ASPSP offering online-accessible payment accounts must put at least one dedicated interface in place within three months of authorisation. This links authorisation timing to technical readiness, making interface planning part of implementation.
Strong customer authentication remains part of the framework. The PSR permits authentication using two inherence elements instead of elements from two separate categories, if their independence is demonstrated to the competent authority. The European Banking Authority is due to develop guidelines on assessing that independence within 18 months of the PSR entering into force. Clear authentication and consent journeys help consumers understand each step without obscuring their choices.
PSD3 and PSR applicability to UK businesses with EU operations
The PSD3 directive and Payment Services Regulation apply to EU activity, not automatically to UK-only operations. UK fintechs serving EU markets should assess operational, data, fraud-risk and governance impacts, including cross-border transaction flows.
Applicability to businesses with EU operations
Applicability depends on whether a business operates in or serves EU markets, so service scope is central to compliance planning. A UK-only operation isn’t automatically covered by the package, while EU-facing payment services require an impact assessment.
For a U.S.-headquartered business, the same practical question applies: does it operate in or serve EU markets? Map customers, payment services and transaction routes by market, then identify which EU-facing activities need review under the European regime. National implementation and directly applicable rules may affect how firms organise compliance responsibilities.
Cross-border operational and commercial risks
Cross-border risks arise when payment flows, data handling and control responsibilities span UK and EU operations. Firms should assess whether fraud monitoring, payee verification and customer processes work consistently across each relevant transaction route.
DORA is a parallel EU regime concerning operational resilience. Consider ICT dependencies alongside PSD3 and PSR changes, then assign governance owners for service continuity, data risks and fraud controls. A gap between UK and EU processes can create operational complexity and affect how confidently a firm serves customers across markets.
For example, a UK fintech serving EU customers should map each payment route, identify the relevant controls and document accountable teams. This helps distinguish EU obligations from UK-only activity without treating the two frameworks as interchangeable.
If cross-border payment flows are part of your operating model, explore SEPA and SWIFT payment infrastructure as you assess how those flows fit your EU service design.
Gemba: Fast time to market embedded banking
Gemba provides fast time to market embedded banking for businesses building branded financial services. If your EU growth plans depend on launching financial features without building every banking capability in-house, Gemba’s White-Label Banking Interface can support a branded customer experience.
Gemba also offers ultra-fast bulk payments and global payroll for operational needs. These services can suit businesses coordinating payouts across their operations, while the right infrastructure depends on the payment flows and customer experience they need to support.
Use the regulatory assessment above to define your requirements, then consider how embedded banking fits your operating model. This article was written by Alexander Legoshin. Contact Gemba to discuss your business needs.
Turn regulatory change into a stronger operating model
The next step is to make regulatory readiness part of how your business designs and governs its services, rather than treating it as a separate compliance exercise. Bring product, operations, technology and risk teams into the same planning process, so decisions about customer journeys and payment flows reflect shared priorities.
That discipline can help your organisation respond thoughtfully as the European framework develops, while keeping its commercial direction clear. For leaders considering the impact of PSD3 on UK fintechs in 2026, the opportunity is to build an operating model that can adapt without losing sight of customer trust.
If your plans include embedded financial services, discuss how Gemba’s infrastructure could fit your business requirements. Contact Gemba to discuss your payments compliance, and take the next step with clarity and purpose.
Frequently Asked Questions
Are there any additional measures to PSD3 and PSR?
Yes. The package reaches beyond authorisation and fraud controls into cash access and payment transparency. Member States must allow retail cash withdrawals of up to €150, or the equivalent locally, and may set a lower limit that cannot fall below €100. The Payment Services Regulation also requires currency-conversion charges on credit transfers and remittances to be disclosed as a percentage markup over the European Central Bank’s official exchange rate before a transaction begins.
When will PSD3 and PSR take effect?
The rules are expected to enter into force 20 days after publication in the Official Journal of the European Union. Most requirements are expected to apply 21 months after publication. For planning purposes, separate the formal entry-into-force date from the later application period: each starts a different clock. The applicable transition provisions also matter, particularly for existing firms that must submit information and demonstrate compliance.
When will PSD3 be implemented?
Implementation is staged rather than tied to one date. Formal adoption and publication were expected in late 2026, followed by technical standards and further measures developed during 2027 to 2028. Certain verification-of-payee requirements have a distinct transition period, expected to apply 27 months after entry into force. Payment firms should therefore map milestones by obligation, rather than treating the broad application date as the deadline for every change.
Does PSD3 apply to UK-based fintechs after Brexit, and which UK firms are in scope?
PSD3 and the PSR don’t automatically apply to UK-only operations. UK firms operating in or servicing EU markets should assess the EU-facing payment services, entities and customer journeys in their scope. For example, a UK fintech serving customers through an EU payment institution should distinguish that activity from its domestic services. The relevant analysis follows the firm’s EU operations and service structure, not simply its UK headquarters.
How could PSD3 affect UK fintechs serving EU customers or operating through EU entities?
EU-facing firms may need to align entity permissions, payment processes and governance with the new regime. A UK parent with an EU entity should map which entity provides each service, handles customer funds and manages fraud-related decisions. This allocation helps expose gaps between group-wide policies and local operations. It also supports a clearer assessment of operational resilience, data handling and customer communications across borders.
What are the main PSD3 requirements for payment firms on fraud prevention, liability, and strong customer authentication?
The package strengthens fraud prevention through payee verification, information-sharing and transaction suspension where there are objectively justified reasons to suspect fraud. Under Article 69, a payee’s PSP with clear and incontrovertible grounds for suspicion must return funds to the payer’s PSP and not credit the payee. Article 59 covers certain impersonation scams, while two inherence authentication elements may be used if their independence is demonstrated to the competent authority.
Frequently Asked Questions
Are there any additional measures to PSD3 and PSR?
Yes. The package reaches beyond authorisation and fraud controls into cash access and payment transparency. Member States must allow retail cash withdrawals of up to €150, or the equivalent locally, and may set a lower limit that cannot fall below €100. The Payment Services Regulation also requires currency-conversion charges on credit transfers and remittances to be disclosed as a percentage markup over the European Central Bank’s official exchange rate before a transaction begins.
When will PSD3 and PSR take effect?
The rules are expected to enter into force 20 days after publication in the Official Journal of the European Union. Most requirements are expected to apply 21 months after publication. For planning purposes, separate the formal entry-into-force date from the later application period: each starts a different clock. The applicable transition provisions also matter, particularly for existing firms that must submit information and demonstrate compliance.
When will PSD3 be implemented?
Implementation is staged rather than tied to one date. Formal adoption and publication were expected in late 2026, followed by technical standards and further measures developed during 2027 to 2028. Certain verification-of-payee requirements have a distinct transition period, expected to apply 27 months after entry into force. Payment firms should therefore map milestones by obligation, rather than treating the broad application date as the deadline for every change.
Does PSD3 apply to UK-based fintechs after Brexit, and which UK firms are in scope?
PSD3 and the PSR don’t automatically apply to UK-only operations. UK firms operating in or servicing EU markets should assess the EU-facing payment services, entities and customer journeys in their scope. For example, a UK fintech serving customers through an EU payment institution should distinguish that activity from its domestic services. The relevant analysis follows the firm’s EU operations and service structure, not simply its UK headquarters.
How could PSD3 affect UK fintechs serving EU customers or operating through EU entities?
EU-facing firms may need to align entity permissions, payment processes and governance with the new regime. A UK parent with an EU entity should map which entity provides each service, handles customer funds and manages fraud-related decisions. This allocation helps expose gaps between group-wide policies and local operations. It also supports a clearer assessment of operational resilience, data handling and customer communications across borders.
What are the main PSD3 requirements for payment firms on fraud prevention, liability, and strong customer authentication?
The package strengthens fraud prevention through payee verification, information-sharing and transaction suspension where there are objectively justified reasons to suspect fraud. Under Article 69, a payee’s PSP with clear and incontrovertible grounds for suspicion must return funds to the payer’s PSP and not credit the payee. Article 59 covers certain impersonation scams, while two inherence authentication elements may be used if their independence is demonstrated to the competent authority.
