The key to a safer and more efficient payment system
Are you familiar with the PSD2 payment directive? Whether you realise it or not, it has affected you for over 5 years. PSD2 has enabled open banking in Europe. Thanks to this EU legislation, many use cases have emerged, such as rapid credit checks, personal finance management, customised payment options in e-commerce or at the point of sale (POS), and even preventive measures against identity fraud in high-risk professions. With the customer’s consent, licensed third-party providers can access account and transaction data held by a bank. This helps make the payment system in the EU safer and more efficient for consumers, merchants and financial institutions.
What Does PSD2 Entail and What Are Its Implications?
PSD2 (Payment Services Directive 2) is an EU directive that aims to increase competition and innovation in the payments sector and to improve the security of online payments. It requires banks to grant licensed third-party providers (TPPs) access to customer account information and payment initiation services, subject to the customer’s consent and strict security requirements. This enables TPPs to offer new services. In addition, PSD2 introduces strong customer authentication requirements for online payments, which are intended to reduce the risk of fraud.
The Evolution of the Payment Services Directive
In 2007, the European Commission introduced the first Payment Services Directive. The main objective of PSD1 was to create a single EU market for payment services by harmonising the legal requirements for payment service providers.
PSD2 goes beyond legal harmonisation. Its aim is to improve competition in the payments sector by enabling new players, such as fintechs, to access existing payment infrastructures. It also introduces strong customer authentication (SCA) to enhance the security of online payments. One of the most important changes is the introduction of the “Payment API” (Application Programming Interface), also known as the PSD2 interface. Through it, third-party providers can access customers’ account and transaction data held by a bank, with the customer’s consent.
The first phase of implementation took place in 2018. Key areas of focus included strengthening customer rights and establishing stricter data protection requirements.
The second phase followed on 14 September 2019. Since then, banks have had to meet the Regulatory Technical Standards (RTS) on strong customer authentication and secure communication, which also govern how customer data is made available to third parties via interfaces.
The Impact of PSD2 on Businesses
Companies that offer payment and/or account information services in the EU must comply with the PSD2 requirements. These include, for example, security procedures for customer identification and APIs through which authorised third-party providers can access customer accounts. This can mean additional costs, but also new business opportunities.
PSD2 enables companies such as fintechs to offer a wide range of use cases that make their customers’ lives easier and enable new business models:
With their customers’ consent, companies can use banking data to provide personalised offers. Loan approvals are faster and more efficient, since key information, such as the debt-to-income ratio, can be determined in a single step. The same now applies to renting apartments: before, during or after a viewing, it is possible to determine whether prospective tenants can afford the monthly rent.
Customer-friendly, personalised advice is also possible when leasing a car. Another use case is fraud prevention: with banking data, fintechs and banks can detect potential fraud cases early and respond more effectively.
The Impact of PSD2 on End Customers
For end customers, strong customer authentication means additional security steps for online transactions, such as entering a TAN or confirming a payment with a fingerprint. The introduction of SCA has significantly reduced the risk of fraud and cyberattacks.
Another important step is access to payment account data. With their consent, customers can share this data with third-party providers, manage their finances more effectively and benefit from more competitive offers.
PSD2 also requires banks to transparently disclose the costs incurred during payment processing, making it easier for customers to keep track of their finances.
PSD3: Why PSD2 Isn’t Enough
The European Commission has been working on the third Payment Services Directive (PSD3), although no official implementation date has yet been confirmed.
PSD3 is expected to address the evolving needs of a rapidly changing financial sector, particularly in relation to open banking and the payment services offered by third-party providers.
Key areas of focus for PSD3 include:
- Stronger consumer protection
- Increased competition in the payments market
- Enhanced security and data protection requirements for online payments
- Adapting the regulatory framework to emerging technologies and changing market requirements
Conclusion
PSD2 and PSD3 are EU directives aimed at creating a single market for payment services and increasing competition and security in the payments market. PSD2 was adopted in 2015 and has applied since 2018. It has enabled new players, such as fintechs, to access the existing payment infrastructure and introduced strong customer authentication to make online payments more secure. However, rapid technological change and new business models have also created new challenges, and this is where PSD3 comes in: it is intended to update the rules to reflect the latest technological developments and business practices.
Both directives play a crucial role in keeping the market for payment services competitive and secure, for the benefit of consumers and businesses.
Discover the opportunities created by PSD2 and open banking in our article on digital creditworthiness assessments.
If you have any questions or would like to schedule a personal appointment with us, please don’t hesitate to contact us via our contact form.
To stay up to date, follow us on our social media channels – LinkedIn or YouTube!
