PSD3 and PSR Explained: Compliance and Fraud Prevention

The digital payments space is constantly evolving, with new regulations shaping how businesses operate and protect their customers. PSD3 (Payment Services Directive 3) and PSR (Payment Services Regulation) are the latest regulatory advancements aimed at enhancing security, reducing fraud, and improving customer experiences in the European Union and wider European Economic Area (EEA). Building on the foundations of PSD2, these new rules bring more stringent requirements and opportunities for businesses to innovate and secure their transactions. In this blog, we’ll explore the key aspects of PSD3 and PSR, their implications, and how Sift supports compliance in these areas.

Where things stand

PSD3 and the PSR were proposed by the European Commission in June 2023. The European Parliament and the Council reached a provisional political agreement on 27 November 2025, and the final compromise texts were published in April 2026. The Parliament’s ECON committee approved the agreed text in May 2026. As of October 2026, formal adoption and publication in the Official Journal of the EU are still pending, and the date is not yet known.

Once published, the PSR enters into force 20 days later and applies 21 months after that, so most obligations are expected to apply during 2028. PSD3 must be transposed into national law over a similar window. The content of the texts is now effectively settled, so this is the right time to prepare.

Understanding PSD3 and PSR

The third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) together update the framework of the European payments market. Building on PSD2, they focus on payments, data, and security, further strengthening the market and reducing national variations. PSD2, which began applying in 2018 (with some EEA countries following later), was itself an evolution of the original PSD from 2007. The PSR is a directly applicable regulation that carries over articles from PSD2 with additional clarifications and new rules, while PSD3 covers matters such as the licensing of payment and e-money institutions. Together they affect banks, fintechs, payment service providers, and customers, both legally and operationally.

Key objectives of PSD3 and PSR

• Enhanced Security Measures: Building on the Strong Customer Authentication (SCA) requirements of PSD2, the new rules strengthen protections for consumers and businesses against evolving fraud tactics.
• Increased Transparency: Greater transparency in payment processes, including clearer communication of fees and terms to consumers, fostering trust and informed decision-making.
• Innovation and Competition: Encouraging innovation by supporting the development of new payment services and promoting competition among PSPs, including a strengthened open banking framework.
• Consumer Protection: Strengthening consumer rights and ensuring that PSPs handle complaints and disputes more effectively.

The evolution from PSD2 to PSD3

While PSD2 laid the groundwork for stronger security through SCA and reduced fraud in electronic payments, it also highlighted areas that needed further improvement. PSD3 and the PSR address these gaps with a more comprehensive approach to fraud prevention and customer protection.

Key differences between PSD2 and PSD3/PSR

• Fraud Liability and Impersonation Fraud: Fraud liability shifts further toward payment service providers and platforms, with new measures aimed at authorized and impersonation-style fraud.
• Verification of Payee: IBAN and name verification becomes mandatory for SEPA credit transfers.
• Redefined SCA: The rules refine what counts as strong customer authentication, including requirements designed to address fraud in which customers are manipulated into authorizing payments.
• Fraud Monitoring and Governance: PSPs are expected to have effective transaction monitoring and fraud-detection systems capable of identifying suspicious activity at an early stage, with stronger expectations around fraud governance and organisational accountability.
• Open Banking and Scope: More prescriptive requirements for open banking API performance and uptime, and an expanded scope that covers certain crypto-asset service providers engaged in payment activities.

How Sift supports PSD3 and PSR compliance

Sift offers advanced fraud prevention solutions that can help businesses meet the requirements of PSD3 and PSR. By leveraging machine learning and real-time data analysis, Sift helps businesses support compliance while providing exceptional customer experiences. See below for how our features help support various aspects of regulatory compliance.

Key features of Sift’s fraud prevention solution

• Real-time Fraud Detection: Sift’s machine learning models analyze vast amounts of data in real time, identifying and preventing fraudulent activities before they impact the business. This proactive approach supports the transaction monitoring and fraud-detection expectations of PSD3 and the PSR.
• Comprehensive Risk Assessment: Sift provides a detailed risk assessment of each transaction, helping businesses apply the appropriate level of authentication and reduce unnecessary friction for legitimate customers.
• Seamless Integration: Sift integrates easily with existing payment systems, supporting a smooth transition to the new regulatory requirements without disrupting business operations.
• Adaptive Authentication: Sift supports various authentication methods, allowing businesses to choose the most suitable options for their customers while staying within regulatory standards.
• Continuous Monitoring and Adaptation: Fraudsters constantly evolve their tactics, and so does Sift. The Sift Platform continuously updates its models and strategies to stay ahead of emerging threats, supporting ongoing compliance and security.

Navigating the compliance landscape

As businesses prepare for PSD3 and PSR, understanding the regulatory landscape and taking proactive measures is essential. Here are some practical steps to protect your business:

• Assess Your Current Systems: Evaluate your existing payment systems and identify areas that need to be updated to meet the new requirements. A gap analysis against the PSR conduct rules and PSD3 licensing requirements is a good starting point.
• Implement Strong Customer Authentication: Ensure that your authentication processes are ready for the standards that will apply under PSD3 and the PSR, incorporating multiple verification factors to secure transactions.
• Leverage Advanced Fraud Prevention Tools: Utilize solutions like Sift to detect and prevent fraud in real time, reducing the risk of chargebacks and financial losses.
• Align with Related Regulations: Coordinate your readiness work with other regimes that overlap, such as DORA (operational resilience) and the GDPR.
• Educate Your Team: Train your staff on the new regulations and the importance of compliance, ensuring that everyone is aware of their role in maintaining security and protecting customers.
• Stay Informed: Formal adoption and publication are still pending, so keep up with regulatory updates to ensure that your business can adapt as new requirements and dates are confirmed.

The role of exemptions in reducing friction

One of the key strategies for balancing security and customer experience under SCA rules is the effective use of exemptions. Transactions that fall under specific categories, such as low-value payments or recurring charges, may be exempt from the stringent SCA requirements, reducing friction for customers. Businesses should confirm with their PSP how exemptions will apply under the final PSD3/PSR rules, and apply them judiciously to avoid creating vulnerabilities that fraudsters can exploit.

Strategies for managing exemptions

• Work with Your PSP: Collaborate closely with your payment service provider to develop a strategy for maximizing exemptions while maintaining security.
• Monitor Exempt Transactions: Keep a close eye on transactions that fall under exemptions, using advanced fraud detection tools to identify any suspicious activity.
• Educate Your Customers: Inform your customers about the security measures in place and how exemptions work, fostering trust and reducing concerns about authentication processes.

Implementing digital risk management

Digital trust and risk management are at the core of a successful compliance strategy. By adopting a holistic approach to fraud prevention and customer protection, businesses can create a secure and seamless experience for their customers, fostering loyalty and long-term growth.

Benefits of digital risk management:

• Improved Customer Experience: By accurately identifying and preventing fraud, businesses can provide a smoother and more secure experience for legitimate customers.
• Expanded Growth Opportunities: Strong security measures and compliance with regulatory standards open up opportunities to expand into new markets and attract more customers.
• Reduced Risk: Effective digital risk management reduces the risk of financial losses, chargebacks, and reputational damage, supporting business continuity and growth.

Conclusion

PSD3 and PSR represent the next step in the evolution of payment regulations, aiming to create a more secure and transparent digital payments ecosystem. Although formal adoption is still pending and most obligations are not expected to apply until 2028, the substance of the rules is settled. By understanding the new requirements and leveraging digital risk management solutions like Sift, businesses can prepare for compliance while enhancing customer trust and loyalty. As the regulatory landscape continues to evolve, staying informed and proactive is key to navigating these changes successfully and building a secure future for digital payments.

Fraud liability is shifting. Is your fraud strategy ready? See how Sift’s real-time fraud detection can support your PSD3 and PSR readiness. Request a demo today.

Frequently asked questions