A landmark piece of European Union legislation designed to revolutionize the payments industry. Its primary goals are to increase pan-European competition, enhance consumer protection, and foster innovation within the financial sector.
PSD2 is the successor to the original Payment Services Directive, which was adopted in 2007. While the first directive laid the groundwork for a single payment market in the EU, PSD2 (implemented in 2018) addressed the rise of digital banking and FinTech by mandating more open and secure standards.
The Three Pillars of PSD2
To understand how PSD2 impacts businesses and consumers, it is helpful to look at its core components:
Strong Customer Authentication (SCA)
This is the security backbone of PSD2. To reduce fraud, banks must verify a user’s identity using at least two independent elements (MFA). These elements fall into three categories:
- Knowledge: Something only the user knows (e.g., a password or PIN).
- Possession: Something only the user has (e.g., a mobile phone or hardware token).
- Inherence: Something the user is (e.g., a fingerprint or facial recognition).
Open Banking (Access to Accounts)
PSD2 broke the banks’ monopoly over their customers’ data. Under the Access to Accounts (XS2A) rule, banks are required to provide third-party providers (TPPs) access to a customer’s account information—provided the customer gives explicit consent. This is done through secure Application Programming Interfaces (APIs).
New Regulated Entities
PSD2 introduced two new types of financial players:
- PISP (Payment Initiation Service Provider): Allows users to pay directly from their bank account instead of using a credit or debit card (e.g., paying for an item on an e-commerce site via a direct bank transfer).
- AISP (Account Information Service Provider): Aggregates information from multiple bank accounts into a single location (e.g., a budgeting app that shows all your balances across multiple banks).
Why is PSD2 Important?
| Feature | Impact under PSD2 |
| Security | Reduces the risk of “card-not-present” fraud through mandatory SCA. |
| Competition | Levels the playing field for FinTech startups to compete with traditional banks. |
| User Experience | Enables smoother checkout flows and more personalized financial management tools. |
| Cost | Potentially lowers transaction fees by bypassing traditional card schemes (Visa/Mastercard) via PISPs. |
Compliance Checklist for Businesses
If your business operates in the European Economic Area (EEA) or processes payments for EU customers, you likely need to be PSD2-compliant.
- Implement SCA: Ensure your checkout process supports 3D Secure 2.0 or other MFA methods.
- Consent Management: If you are an AISP or PISP, you must have transparent, revocable consent mechanisms for user data.
- Secure Communication: Use standardized, secure APIs to communicate with banking institutions.
- Incident Reporting: Maintain strict protocols for reporting security breaches to regulatory bodies.
