EU Parliament and Council Reach Provisional Agreement on PSD3 and Payment Services Regulation

The European Parliament and the Council of the EU announced a provisional political agreement on 27 November 2025 on both the Third Payment Services Directive (PSD3) and the accompanying Payment Services Regulation (PSR) — the successor regulatory framework to PSD2, which has governed European payments since 2018.

What PSD3/PSR Changes

Fraud Protection

Mandatory Verification of Payee (VoP) extended from SEPA instant payments (already required since October 2025) to all credit transfers — closing a major gap that fraudsters exploited via standard transfers where names were not checked
PSP fraud data sharing — payment service providers including neobanks will be required to share fraud signals with each other through a common EU database, enabling real-time detection of known fraud patterns across institutions
Enhanced liability framework — clearer rules on when banks must reimburse customers for authorised push payment (APP) fraud

Open Banking Improvements

Stronger requirements on banks to provide reliable, well-documented open banking APIs
New rights for third-party providers (TPPs) to access payment accounts under improved technical standards
“Financial data access” framework (FIDA) to be developed alongside PSD3 for broader data sharing beyond payments

Consumer Protections

Clearer fee disclosure requirements for currency conversion
Strengthened rules on account access for fintech companies (addressing concerns about incumbents using “technical obstacles” to block TPP access)

Timeline

The provisional agreement requires formal adoption by both the Parliament and Council. PSD3 — as a directive — will then require transposition into national law within 18 months. The PSR, as a regulation, will apply directly without national transposition.

Estimated application date: 2027–2028 for most provisions.

Impact on EU Neobanks

For Revolut, N26, bunq, Qonto, Wise, and other EU-licensed neobanks, the primary near-term impact is:

Implementing VoP checks for all outgoing credit transfers (already partially in place for instant payments)
Connecting to the EU fraud data sharing infrastructure
Updating open banking API documentation and reliability SLAs

The stronger open banking provisions are broadly positive for neobanks that have built business models around API connectivity and third-party integrations.