What is PSD2, and what did it change for you?

#What is PSD2 in simple words?

PSD2 stands for the second Payment Services Directive. A directive is an EU law that each member country must copy into its own national law. PSD2 updated the first Payment Services Directive from 2007⁠^[1] and has applied since 13 January 2018⁠^[2]. It sets rules for payment services in the EU, covering banks, card issuers, payment apps and the new kinds of providers it created.

For a beginner, PSD2 matters for three reasons. It is the law that made open banking possible in Europe. It is the reason your bank asks for a code or fingerprint when you shop online. And it gives you stronger rights when something goes wrong with a payment. The glossary entry for PSD2 gives a one-paragraph version if you are in a hurry.

#Which new services did PSD2 create?

PSD2 brought two kinds of providers under regulation, often called third-party providers or TPPs. Payment initiation services let you pay online by credit transfer straight from your bank account and tell the merchant immediately that the payment has been started, which the Commission described as an alternative to cards for online shopping. Account information services let you see the accounts you hold at one or more banks in one place, for example to categorise spending and plan a budget⁠^[1].

The UK, which wrote these rules into its own Payment Services Regulations 2017, uses the same definitions: a payment initiation service starts a payment order at your request from an account held at another provider, and an account information service gives consolidated information on your payment accounts⁠^[3]. The bank that holds your account is called the account servicing payment service provider, usually shortened to ASPSP⁠^[3].

#How does strong customer authentication work under PSD2?

Strong customer authentication, or SCA, means the payment provider checks your identity with at least two separate elements from three categories: something you know (a password or PIN), something you own (a card or mobile phone) and something you are (a fingerprint or face scan)⁠^[2]. The detailed rules sit in technical standards adopted as Regulation (EU) 2018/389⁠^[4], which the Commission expected to apply from around September 2019⁠^[2]. For the full picture, read strong customer authentication explained or the short SCA glossary entry.

#Why did PSD2 ban screen scraping?

Before PSD2, many apps reached your account by asking for your online banking login and then reading your screens automatically, a technique called screen scraping. Under the technical standards, the Commission said it would no longer be allowed to access customer data that way. Instead, each bank must set up a communication channel that gives authorised providers the data they need, and that interface had to pass a three-month prototype test and a three-month live test in market conditions⁠^[2].

Banks that build a good dedicated interface can be exempted from keeping a backup 'fallback' route, but a national authority can revoke that exemption if the interface fails the quality standards for more than two consecutive calendar weeks⁠^[2]. Our comparison of screen scraping vs APIs explains why regulators care so much about this.

#What problems appeared after PSD2 started?

Some banks' interfaces made life hard for third-party providers. In June 2020 the European Banking Authority (EBA) clarified that practices such as requiring multiple SCA steps, forcing manual entry of the account number (IBAN) in the bank's own pages, or imposing extra checks on the consent the customer had already given to the provider can be obstacles that the rules do not allow⁠^[7]. If you are unsure what an IBAN is, see our IBAN glossary entry.

Another friction point was re-authentication. Users of account information apps originally had to repeat SCA at their bank regularly. In April 2022 the EBA published an amendment that makes it mandatory for banks not to apply SCA when customers use an account information provider, under conditions, and extends the renewal period from 90 days to 180 days⁠^[8]. The EBA lists that amendment as in force⁠^[4].

#What replaces PSD2, and when?

In June 2023 the European Commission proposed a third directive (PSD3) and a directly applicable Payment Services Regulation (PSR), aiming among other things to remove remaining obstacles to open banking services and improve customers' control over their payment data⁠^[10]. On 27 November 2025 the Council and the European Parliament announced a provisional political agreement, including a requirement to check an IBAN against the account name before a transfer⁠^[11].

On 3 October 2026, the European Parliament's Legislative Observatory showed both files with the agreed text approved in committee on 5 May 2026, awaiting the Council's position, and an indicative plenary date of 14 December 2026⁠^[13]⁠^[14]. Formal adoption and publication in the Official Journal had therefore not yet happened. Until the new texts apply, PSD2 and the national laws that copy it remain the rules to follow.