PSD3 and the merchant integration checklist
Payment Services Directive 3 and the Payment Services Regulation land in staggered dates through 2027. Here's what merchant integrators need to prepare for now.
The European Commission's PSD3 package — the directive and its companion regulation — is now moving from consultation into national transposition. Most operational obligations land in 2026 and 2027, but the integration work starts earlier.
Written September 2026 from ongoing implementation reviews.
What changes at the integration layer
Three things are worth putting on your near-term backlog:
- Stronger SCA exemption handling. The exemption rules under PSD2 were interpreted inconsistently across issuers. PSD3 tightens the language and pushes more decisions to the transaction context, not the merchant's discretion. Expect more challenges initiated by the issuer, not fewer.
- Explicit permission model for account-access services. Open banking APIs get a formal permission framework. If your integration reads accounts, that consent object needs a lifecycle — grant, refresh, revoke — that survives across your reconciliation pipeline.
- Liability for authorised push-payment fraud. The regulation shifts more liability onto payment service providers where the sender was manipulated. If you route push payments on behalf of a merchant, your fraud posture matters more than it did.
What merchants should ask their PSP
- Which SCA exemptions are honored by which acquirers on this account?
- What's your APP-fraud reimbursement policy going to look like once PSR is in force?
- Do you support the new account-information-service consent lifecycle, or are you relying on the old PSD2 approach?
What's actually urgent
Very little of the operational change is urgent this quarter. What is urgent is auditing your consent storage — the permission objects PSD3 mandates need durable, versioned, per-consumer storage, and retrofitting that after the fact is painful.