A quick overview of the proposed PSD3 changes, the EU payment regulations already in force, and practical steps for PSPs and High-Risk merchants preparing for the new requirements.
Key takeaways
- PSD3 and PSR are not yet in force. Their final adoption and application dates remain unconfirmed as of October 2026.
- Other regulations already apply. DORA has been in force since January 2025, while the Instant Payments Regulation follows a phased timetable through 2027.
- Preparation starts with existing payment procedures. PSPs should review fraud controls and regulatory obligations. Forex and iGaming merchants should check how the changes may affect their payment partners.
EU payment providers could face stricter fraud liability rules and broader payee verification requirements under the proposed PSD3 and PSR framework. These measures are not yet in force. Meanwhile, DORA already applies, and the Instant Payments Regulation is being phased in.
This guide from SPAYZ.io lawyers explains the main PSD3 changes, how the proposed Payment Services Regulation (PSR) differs from existing PSD2 regulations, and which payment regulations have confirmed deadlines. It also covers what PSPs, Forex brokers and iGaming operators should review now to prepare for the upcoming requirements.
Check all the changes below.
PSD2 vs PSD3: What is changing?
The PSD2 regulations set rules for payment security and gave authorised third-party providers access to customers' payment accounts with their consent.
The proposed PSD3 regulations would update how payment and e-money institutions are authorised and supervised. The accompanying Payment Services Regulation (PSR) would introduce more consistent rules for handling payments across the EU.
Unlike PSD3, which would require transposition into national law, PSR would apply directly in EU Member States, subject to its final provisions and application timeline.
Key PSD3 and PSR changes for payment providers
The proposed PSD3 changes cover five main areas.
- Fraud prevention
Stronger payment fraud prevention rules would allow PSPs to share more fraud-related information. Providers could also face greater liability for failing to meet certain obligations. - Authentication
Updated strong customer authentication (SCA) rules would clarify when authentication is required and how exemptions apply. - Payee checks
Broader verification of payee requirements would help customers spot mismatches between a recipient's name and account identifier. - Open banking
Authorised third-party providers would face fewer obstacles when accessing payment accounts. Customers would also have more control over the permissions they grant. - Payment transparency
PSPs would need to disclose certain charges more clearly, including currency conversion fees.
These payment changes would primarily affect regulated PSPs. Merchants may also see changes to verification or reporting procedures, depending on their payment partners.
The European Parliament's overview covers the measures included in the November 2025 provisional agreement.
Beyond PSD3: Other payment regulations to watch
PSD3 has no confirmed application date yet. Other EU payment regulations already have deadlines in place.
Under the Instant Payments Regulation, euro-area PSPs generally had to support sending instant euro transfers and provide payee verification by October 2025. Some non-bank PSPs and providers outside the euro area have later deadlines.
DORA compliance is already mandatory for in-scope financial entities. They must manage ICT risks, monitor relevant third-party technology providers and report major incidents.
For High-Risk payment processing, the impact depends on which banks or PSPs handle transactions and where they're regulated. Forex and iGaming merchants working with European providers should check whether these rules affect their payment arrangements.
Further details are available from the European Central Bank, the European Banking Authority and the European Commission.
How to move from PSD2 to PSD3
The PSD2 to PSD3 transition has no confirmed implementation timetable yet. Payment teams can still review their current processes against the proposed requirements.
Use this PSD3 compliance checklist to identify where updates may be needed:
- Confirm which rules apply. Identify the entities and payment flows subject to EU requirements.
- Review fraud controls. Check how suspicious transactions are detected, investigated and recorded.
- Test payee verification. Check how your systems flag name mismatches and retain transaction records.
- Speak to payment partners. Clarify who handles customer complaints, fraud losses and reporting.
- Follow the final legislation. Update procedures once the requirements and deadlines are confirmed.
For Forex and iGaming businesses outside the EU, the immediate impact may come through European payment partners. Changes to their compliance procedures could mean additional checks or reporting requirements for merchants. Local regulations will still apply.
How SPAYZ.io is preparing for PSD3
SPAYZ.io follows PSD2-aligned procedures, maintains PCI DSS compliance, and conducts KYC/KYB checks during merchant onboarding, along with AML screening. End-user KYC remains the responsibility of individual merchants.
We're tracking the PSD3 and PSR legislative process and reviewing what the proposed requirements could mean for our payment operations and merchant support.
The SPAYZ.io P2P Agent Dashboard already helps merchants monitor P2P transactions in real time, manage agents and export payment records. It also calculates commissions automatically, reducing manual work for operations teams.
We support 55+ payment solutions across Africa, Asia, and the MENA through a single API, with 24/7 support from our team.
Read more about our approach to payment compliance.
FAQ about PSD3 and future payment changes
When will PSD3 come into force?
As of October 2026, the European Parliament's ECON committee had approved the proposed legislation, but it had not yet completed formal adoption. The application date remains unconfirmed.
Will PSD3 replace PSD2?
Yes. Once adopted and implemented, PSD3 is intended to replace PSD2. PSR would establish directly applicable rules for many payment services.
Does PSD3 apply to Forex and iGaming businesses outside the EU?
Not automatically. Businesses outside the EU may still be affected through their relationships with EU-regulated payment providers.
How should businesses prepare for PSD3?
Review fraud controls and transaction records, and confirm compliance responsibilities with payment partners. Update internal procedures when the final requirements and deadlines are published.
If you're reviewing payment operations across Africa, Asia, or the MENA, explore SPAYZ.io's payment solutions.
