publication
2025-11-29 06:00
Expanding access to cash, protection against transfer errors and the effects of payment fraud – these are just some of the novelties of the emerging payment regulation package. The biggest change since the PSD2 directive is coming.
On 27 November 2025, the European Council and the European Parliament announced a preliminary political agreement on the EU payments package. This is another step towards modernizing the regulations that constitute the foundation for the operation of the payments market. Let us recall that PSD2, the second directive, entered into force 8 years ago and brought such novelties as the requirement to use strong user authentication (SCA) and the sanctioning of open banking services.
The regulatory package for payment services, presented for the first time in its preliminary form in 2023, consists of two parts. The directive (PSD3) focuses on more strategic issues (e.g. licensing), while more practical and detailed issues are included in the PSR (Payment Services Regulation). This will be an act directly applicable in EU countries, not requiring implementation into the national legal system.
Although the final texts of the Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) are not yet available, press releases indicate that recent negotiations have focused on three key areas: fraud prevention, transparency and open banking.
“To provide better access to cash, especially in remote and rural areas, retail stores will be able to enable cash withdrawal up to a maximum amount of 150 eurosbut a minimum of 100 euros, without the customer having to make any purchases” – indicated in the press release of the European Parliament.
In the previous version of the planned regulation, it was assumed that the provision of such a service would not require a permit provided:
- Limit the amount of a one-time payment to the equivalent of EUR 50.
- Informing the customer before providing the service about the amount of any fee for withdrawing funds.
The amount limits will therefore be increased, but will remain relatively low. They are intended to prevent cashback from becoming a threat to ATM operators. The proposed regulations also provide for facilitations (waiving the licensing requirement) for some ATM operators.
Payments with additional verification
In Bankier.pl we recently reminded you of the effects of the current regulations regarding liability for errors in payment orders. Today, only the recipient's account number is important, and additional data (e.g. name, address) are not checked during the transaction.
New regulations try to address this problem – it will become mandatory to compare the data of the transfer recipient provided by the payer with the data of the destination account holder. The so-called IBAN/name check will be a necessary condition for forwarding any credit transfer, not just an instant transfer (where in the case of the euro this requirement already applies in the common currency area).
Additional protection is intended to cover victims of fraud in which criminals impersonate a payment service provider (e.g. a bank). Payers manipulated in this way will get their money back. “Protection periods” will also be introduced for the execution of the most risky orders – e.g. changes in payment limits in electronic channels.
Against the plague of false advertising
The latest changes in regulatory projects include: expanding the liability of digital platforms for financial fraud. These types of steps have been proposed for a long time by representatives of banks and payment institutions.
Online platforms will be liable to payment service providers (PSPs) who refunded money to defrauded customers, if they are made aware of false content on their platform and do not remove it. This is a development and extension of the protection provided for in the Digital Services Act (DSA).
Before using the option to place ads on search engines and platforms (the dominant entities in the market, called VLSE and VLOP respectively in the DSA), advertisers of financial services will have to be legally permitted in the country in question (or officially exempt from this obligation) to offer these services or that they are advertising on behalf of an entity that is so permitted.
The package is on its final stretch
The final text of the laws may be finalized in 2025. Taking into account possible delays along the way, the PSR regulations will probably enter into force in the second half of 2026.
