Payment Services Directive 2
PSD2Also called second Payment Services Directive, directive (EU) 2015/2366
PSD2 is the EU's second Payment Services Directive, applied from January 2018. It sets licensing rules for payment institutions, opens bank accounts to regulated third parties for open banking, requires strong customer authentication and sets consumer rights on refunds, charges and complaints. The UK implemented it through the Payment Services Regulations 2017.
How it works
PSD2 brought two new regulated services into scope: payment initiation, where a third party starts a payment from a customer's account, and account information, where a third party gathers account data with the customer's consent. Banks must give these providers secure access without requiring a contract with them. Every provider must apply strong customer authentication, report major operational and security incidents and maintain a framework to manage those risks.
The directive also sets conduct rules. Providers must refund unauthorised payments promptly, give clear information before and after a payment, and answer payment complaints within 15 business days, or 35 in exceptional cases. Surcharges on consumer card payments are banned. National authorities license and supervise payment institutions. The EU has agreed PSD3 and a Payment Services Regulation to replace PSD2, and those texts were not yet in the Official Journal in October 2026.
The rules
Sets licensing, transparency, access to accounts, security and consumer protection rules for payment services.
Banks, payment institutions, e-money institutions and third-party providers in the EUSets the technical rules for strong customer authentication, its exemptions and secure access to accounts by third-party providers.
Payment service providers in the EUUK implementation of PSD2, kept in UK law after Brexit and supervised by the FCA.
UK payment service providersCommission proposals to replace PSD2 and the E-Money Directive; Parliament's lead committee approved the texts agreed with the Council on 5 May 2026, with Official Journal publication still pending.
Payment service providers, e-money institutions and banks in the EUCommon questions
Is PSD2 still in force?
Yes. PSD2 remains the EU's payments framework until PSD3 and the Payment Services Regulation are published and apply. The new texts include transition periods, so PSD2 rules continue to govern payment firms in the meantime.
Does PSD2 apply in the UK?
The UK implemented PSD2 through the Payment Services Regulations 2017, which stayed in UK law after Brexit. The FCA supervises them and has made its own changes, such as amending the UK strong customer authentication standards.
What is the link between PSD2 and open banking?
PSD2 created the legal right for regulated third parties to access payment accounts with the customer's consent. In the UK, the Competition and Markets Authority's 2017 order required the largest banks to build common open banking standards to deliver it.
