Most banks are still working to PSD2, a directive written for a payments world that’s already moved on. Open banking was still finding its feet when it was drafted. Instant payments were the exception, not the baseline. And as a directive, PSD2 always left room for member states to implement it their own way, which is exactly what happened over the years since.
That’s changing, though not quite the way most coverage describes it. PSD3 and a new Payment Services Regulation are working their way through Brussels together, splitting the old single-directive model in two. PSD3 stays a directive, handling authorisation, supervision and safeguarding at national level. The PSR is the new piece: a regulation that applies directly and the same way everywhere, carrying the conduct rules on fraud, refunds and open banking access.
For an industry that’s spent years quietly managing those national differences, that’s a real structural shift, not just a compliance update.
What PSD3 and the PSR actually change
The headline move is pulling those conduct rules out of national law entirely, so they apply the moment the PSR takes effect rather than waiting on each country’s own version to catch up. PSD3’s side of the split is narrower now, but it still gives national regulators a real role in authorisation and supervision.
Two changes underneath that will matter most to banks working across borders.
Payment institutions and electronic money institutions are being brought into one authorisation regime instead of two separate ones. And open banking APIs get real teeth behind them, with regulators required to step in quickly when an interface falls short, rather than leaving enforcement patchy.
The timeline is still moving, and that’s worth knowing
Nothing is adopted yet. Parliament and Council are still working through the process, and the compromise texts on the table point to most obligations applying 21 months after entry into force, with verification of payee running to 27 months. Until formal adoption happens, those are offsets rather than dates on a calendar, and anyone quoting a fixed year right now is guessing.
That’s still not much runway once the clock starts. A licensing shift, new fraud rules and an API uplift all landing in the same window will stretch most compliance teams. Better to start mapping the gap now than wait for a fixed date to make it feel urgent.
Why this feels familiar
There’s a version of this argument international banks have been having for years, just without a regulator sitting across the table. A corporate client working across several markets doesn’t get several coordinated banking relationships. It gets several different takes on broadly similar rules, from banks that were never obliged to line up with each other.
The PSR is Brussels closing that gap for itself. But it’s worth being precise about what that actually buys. A shared rulebook cuts down regulatory divergence. It doesn’t automatically make banks in different markets deliver a client the same experience, since regulators still supervise locally, service standards still vary and operational habits built over years don’t disappear because the law changed. Regulation aligns the rules everyone plays by. Getting separate institutions to actually work together under those rules is a different job, and it’s the one a governed network exists to do.
What this means for banks serving international clients
A few questions worth sitting with now.
Once the PSR applies the same way everywhere, does that actually reach the client, or does it stop at the regulatory layer while service standards keep varying market to market?
Is the current PI or EMI setup ready to move into a merged authorisation, and what does that transition actually involve?
Do the open banking APIs already meet a standard regulators will soon be checking properly, rather than the standard they’ve been able to get away with?
None of these get answered by looking at one market in isolation. A control that works well in one jurisdiction doesn’t automatically produce the same result somewhere else, especially once different supervisory habits and the processes sitting underneath it come into play.