PSD3 and PSR: what the provisional deal means for engineering teams

On 27 November 2025, EU negotiators reached a provisional deal on the Payment Services Regulation (PSR) and the third Payment Services Directive (PSD3). It points to name and identifier checks, wider provider liability for fraud, and a permissions dashboard for customers. Final adoption and application dates should be checked before you plan around them.

What was agreed, as reported

A law firm summary of the deal lists these points:

• Providers must check that a payee's name and unique identifier match. On a mismatch, the provider must refuse the payment order and inform the payer.
• Providers must ensure strong customer authentication, run a risk assessment, and offer spending limits and blocking measures.
• A provider that fails to implement appropriate fraud prevention is liable for customers' losses.
• If a fraudster initiates or changes a transaction, it is treated as unauthorised and the provider is liable for the full amount.
• The receiving provider must freeze a transaction it finds suspicious.
• In impersonation fraud, where a scammer poses as a provider employee, the provider must refund the full amount if the customer reports it to the police and informs the provider.
• Online platforms are liable to providers that reimbursed customers if they were told of fraudulent content and failed to remove it.

Open banking changes

Customers will get a dashboard to monitor and manage the permissions they have given for data access. The deal lists prohibited obstacles to data access and requires banks to give payment institutions non-discriminatory access to payment accounts.

What is not settled

The agreement still needed formal adoption by the Parliament and the Council. The source expected publication in the Official Journal in the first half of 2026 and gives no application date. I could not confirm the final text or dates, so check the Official Journal before committing a plan.

Work worth starting now

None of this needs the final text to start.

1. Fraud telemetry: liability moves toward providers, so you need good records of authentication, device and behaviour signals per payment.
2. Name matching: if you do not yet run a payee check, design the data flow and the refusal path.
3. Consent inventory: a permissions dashboard needs a single source of truth for every access grant and its scope.
4. Freeze and recall: a receiving provider that must freeze suspicious transactions needs an operational path to do so quickly.
5. Incident evidence: a report to police plus a customer notice may trigger refunds, so case handling needs timestamps and audit trails.

Quick check

Sources

• William Fry: PSR and PSD3 legislation is agreed

Last reviewed: 19 October 2026.