PSD2 is an important piece of legislation aimed at transforming the way digital payments work in Europe. It is a revised version of an existing payment service regulation, containing directives that are meant to guide online payments, bank integrations, and fintech development across Europe.

It goes without saying that a directive like this will have far-reaching impacts on both businesses and their customers. This shift in regulation has also opened the door for new opportunities to emerge in the fintech industry. This article is a comprehensive guide to the PSD2 regulation, explaining what it entails and the emerging opportunities for fintech businesses as a result of this new law.

Payment Services Directive (PSD2) is an EU regulation published in 2016.
The directive aims to increase security, support competition, and give consumers more control in the digital payment and financial services industry.
PSD2’s Regulatory Technical Standards mandate Strong Customer Authentication (SCA).
The directive also fosters an open finance system by ensuring the standardization of communication between banks and third parties through APIs.

An Introduction to PSD2 and Fintech

PSD2 was adopted in November 2015, and EU Member States were required to transpose it by 13 January 2018. The technical SCA obligations under the RTS became applicable on 14 September 2019.

It is a set of regulations aimed at making online payments more secure, protecting consumers, and supporting competition within the industry. Below is an overview of what the PSD2 entails.

What Is PSD2?

PSD2 stands for Payment Services Directive 2. This directive was issued by the European Union and the European Council as an update to the original Payment Services Directive. This legislation regulates payment services while streamlining the existing payment processing structures, encouraging innovation in the financial industry, and making the online experience smoother for customers.

As part of the initiative, PSD2 aims to create more innovative ways of making online and mobile payments, improve payment security measures, and also give consumers control over who and how they use their personal data.

PSD2 was introduced as an upgrade to the PSD in response to growing changes in the world of commerce. It introduced some adjustments to existing rules and regulations aimed at making room for the growing popularity of online transactions. PSD2 also took new mobile payment systems into consideration.

Key Objectives of PSD2

The main goal of PSD2 is to improve the retail payments market by introducing stronger security measures while opening up the market to more competition. Some of the key objectives of this regulation are highlighted below:

Security

PSD2 requires Strong Customer Authentication (SCA) for many, but not all, electronic transactions. The RTS defines several exemptions, such as low-value transactions, certain recurring payments, and trusted beneficiaries.

In line with this, PSD2 has established a set of standardized regulations for payment transactions, such as the Strong Customer Authentication (SCA) regulations and Common and Secure Communication (CSC). To conduct payments within the EU, all payment institutions must comply with this new legislation.

Market Competition

Before PSD2, some third-party access existed through screen-scraping, but PSD2 formalized and regulated third-party access via licensed AISPs and PISPs with explicit customer consent, standardizing secure data sharing.

Opening up access to customer data this way will encourage new players (particularly fintech companies) to enter the market and offer innovative services to their consumers. This will promote competition within the financial services industry, leading to improved products and services.

Consumer Protection

The consumer is the ultimate beneficiary of PSD2. In addition to giving consumers more control over their financial data, the regulation also mandates collaboration between banks and third parties, leading to better services for users. The implementation of higher security standards, such as identity verification and authentication, will also ensure the integrity of every transaction.

PSD2 Benefits

The introduction of new regulations and security procedures makes things a bit more complicated for service providers. Many financial institutions had to change how their whole infrastructure worked to add the necessary security measures. They also needed to invest in advanced fraud prevention measures and tackle other technical issues, while dealing with consumer reactions to the introduction of new authentication rules. Despite all of these challenges, PSD2 brought about several benefits for customers, banking institutions, and fintech companies. These benefits are highlighted below:

Benefits for Businesses

While many traditional institutions see the entry of new companies and fintech businesses as a threat, the overall change in policy can benefit them as well. Some of these benefits include:

Access to vast amounts of data might give traditional banks an advantage.
It opens the door to new partnerships with third-party companies, which may also be profitable for the banks. For instance, they could ask fintech companies to create innovative products for them that will improve the customer experience while also allowing them to maintain their position as trusted advisors.
PSD2 opens up new opportunities for fintech companies to expand their offerings into new markets and collaborate with banks to develop new products.
Using new technologies such as voice biometrics or payments, financial institutions can make their payment transactions more convenient and safer for their users.

Benefits for Consumers

PSD2 makes accessing banking services far easier and generally safer for consumers. Some of the direct benefits of this new standard for consumers include:

PSD2 makes it easier to access banking services, especially in international markets.
Since it introduces strong security requirements for electronic payments and financial data protection, PSD2 can help to lower the number of fraud or security breach cases.
All third-party payment providers are allowed to initiate payments for their customers or give them an overview of their accounts and balances.
The new directive increases consumers’ rights in multiple areas, from allowing them to choose who has access to their financial data to reducing consumers’ liability for unauthorized payments.
Surcharges (additional charges for payments and money transfers) are now forbidden.
All member states of the European Union are obliged to designate competent authorities to handle complaints from payment service users and other interested parties who feel that their rights are being violated.

The Regulatory Framework Behind PSD2: Key Entities and Compliance Requirements

PSD2 is a regulation introduced by the European Union. The European Commission proposed the PSD2 Directive and is responsible for its adoption, enforcement, and review.

The European Banking Authority (EBA) plays a more technical role in the creation of this directive. This independent EU authority drafted the detailed technical rules necessary to implement the directive, specifically the Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS).

Compliance Standards

In order to comply with the revised Payment Services Directive, banks, fintechs, and other key players must meet several standards. These new regulations are summarized under the Regulatory Technical Standards (RTS) as well as the pre-existing GDPR regulations.

RTS

The Regulatory Technical Standards are the document that ensures the standardization of communication between banks and third parties while also defining the stringent standards for consumer authentication.

SCA

SCA requires authentication based on at least two independent elements drawn from knowledge (e.g., PIN/password), possession (e.g., OTP, authenticator app, hardware token) and inherence (biometrics). In practice, static secrets or weak ‘secret questions’ are not sufficient alone; the elements must be independent and implemented to a quality standard described in the RTS.

Banks and other Payment Service Providers (PSPs) must implement these multi-factor authentication systems. The authentication elements should also be independent so that in case of a security breach, the other verification method will still be reliable.

However, the RTS allows for specific exemptions for low-value payments, recurring transactions, and payments made to trusted beneficiaries.

Secure Communication

The second component of the RTS is the secure communication framework. This regulation specifies the strict security standards for all communication between different parties.

A crucial aspect of this is the open banking practice, which allows third-party payment providers and other financial institutions to get secure access to customers’ banking transactions and other payment data from banks and financial institutions.

Banks must provide open and secure interfaces (APIs) to allow licensed fintechs (Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs)) to access customer account data, but only with the customer’s explicit consent.

GDPR

Under GDPR, consumers may request deletion, but financial institutions may retain data where required by law, such as for fraud monitoring or regulatory record-keeping.

PSD2 interacts closely with the GDPR, which is a separate set of regulations that defines how banks and other stakeholders share customer data. In line with the GDPR’s requirement for lawful processing of personal data, PSD2 mandates that third-party providers can only access a customer’s payment account data with their explicit consent. Consumers also have the right to request that their data be deleted.

TPPs and banks must adhere to the GDPR’s data minimization principle, meaning they should only process the personal data that is strictly necessary for the provision of the requested payment service.

Understanding the PSD2 Ecosystem: Banks, Third-Party Providers, and Consumers

PSD2 applies to a wide range of entities within the broader payment ecosystem. This includes banks, third-party providers, fintech companies, and even consumers. Essentially, every company that handles financial transactions or customer account data is included in the PSD2 ecosystem. They include:

Banks and Credit Institutions

Traditional financial services providers such as banks and credit institutions are known as Account Servicing Payment Service Providers. These are the primary targets of PSD2, mandated to adopt open banking through secure APIs.

Third-Party Providers (TPPs)

As the name suggests, third-party payment service providers are companies that offer various services to consumers based on the access they have to their payment accounts with traditional banks. Examples of third-party payment service providers include:

Payment Initiation Service Providers (PISPs): These companies facilitate the transfer of electronic payments straight from a user’s bank account, bypassing card networks.
Account Information Service Providers (AISPs): Companies that collect account data across multiple banks and aggregate it in one place. Examples of account information service providers include money tracking or budgeting apps.
Fintech startups: This refers to businesses offering various digital payment services, including digital wallets, prepaid cards, and other related tools.

All of these third-party providers must be registered with the relevant authority in their country and comply with all the stipulations of PSD2.

How APIs Enable Open Banking: The Technical Backbone of PSD2 Fintech

One of the primary objectives of PSD2 is to promote open banking in Europe. These practices, which allow third-party service providers to access customer data from banks, are made possible via application programming interfaces (APIs).

API integration is the backbone of an open banking infrastructure because it acts as a gatekeeper between the fintech company’s software and that of the bank. This technology allows both software systems to communicate with each other in a defined manner and share data in machine-readable formats.

To ensure compliance with PSD2 directives, the API has rules written into its workflow that ensure users have full control over their data. The API only grants TPPs access to data or initiates payments if the customer grants explicit consent. Permissions are also granular, meaning they’re granted for a specific purpose within a limited duration. This control mechanism is enforced through the API layer in line with PSD2 regulations.

API integrations also make it possible to introduce standardization into various open banking protocols. By defining common technical specifications for various API endpoints, data formats, and communication protocols, fintechs can maintain consistency in their

To make integration scalable, multiple standards (like The Berlin Group’s NextGenPSD2 and Open Banking UK standards) define the common technical specifications for API endpoints, data formats, and communication protocols. This consistency allows fintechs to build one integration that works across multiple banks, significantly lowering development effort and accelerating innovation.

Strong Customer Authentication

Strong Customer Authentication (SCA) is one of the core security requirements of the revised Payment Services Directive. This component of the directive aims to make online accounts and electronic payments more secure.

The SCA directive mandates that all banks and third-party service providers implement a multi-factor authentication system to secure all user accounts and electronic transactions. This authentication must be based on at least two independent elements from the following categories:

Knowledge – something the user knows, such as passwords, PINs, or passphrases.
Possession – something only the user possesses, such as an OTP delivered to the user’s phone, a dedicated authenticator app, or a hardware token.
Inherence – something connected to the user’s identity, such as their biometric data (fingerprint or facial scan).

The SCA also stipulates specific rules that make the authentication method compliant with PSD2 requirements. Operators must ensure that the MFA elements chosen by the user are independent and dynamically linked.

Independence in this context means that the breach of one element should not compromise the reliability of the other. Dynamic linking means each transaction authentication must be linked to a specific amount and recipient. If any of these conditions change, the previous authentication becomes invalid, and a new one must be carried out before the transaction can be authorized.

The core legal implementation date set for PSD2’s SCA was September 14, 2019. However, the actual enforcement of e-commerce transactions in many countries in the European Economic Area was extended beyond this date, and the implementation was phased. The exact timeline varied from one country to another.

Fintech Innovations Powered by PSD2: Payments, Lending, and Personal Finance

One of the things PSD2 seeks to achieve is to open up access to user financial data for fintechs and other players apart from traditional banks. This trend has the potential to drive innovations related to payment processing, lending, and personal finance. The following are some of the most notable fintech use cases made possible by PSD2:

Instant Payment Initiation

The new directive introduced the concept of Payment Initiation Service Providers (PISPs). These companies allow customers to make payments directly from their bank accounts. PISPs bypass card networks, cutting down transaction processing time significantly.

Enhanced Lending Decisions Through Account Data

The open-banking trend created as a result of PSD2 gives credit providers easier access to customer data. This can improve the speed and efficiency of lending decisions, giving customers better credit access.

Account Aggregation Platforms & Budgeting Tools

An open-banking structure has given rise to fintech services that collect and aggregate data across multiple accounts or banks. Aggregating data this way is useful for budgeting apps and financial planning tools.

Market Disruption and New Business Models Driven by PSD2

As one of the most significant pieces of legislation in the European financial services market, PSD2 has reshaped the nature of competition and collaboration within the entire payment industry. This directive has fueled an entire market disruption, creating new ways for banks and fintech startups to generate revenue. Some of the disruptive business models that have emerged as a result of this directive include:

Banking-as-a-Service

PSD2 is helping businesses tap into new features and services that they would otherwise have no access to. One such emerging opportunity is Banking-as-a-Service, a model that allows licensed banks to offer their regulated infrastructure, features, and customer base to non-bank third parties such as fintechs, non-financial brands, or retailers. Thanks to open banking facilitated by APIs, these third parties can offer bank accounts, cards, payments, or lending to their own customers without obtaining a separate license or setting up their own back-end operations.

Embedded Finance

Embedded finance refers to the integration of financial services into non-finance-related product experiences. Thanks to the activities of PISP and AISP functionalities, non-financial companies can now incorporate payment options directly into their apps without friction, data access issues, or regulatory hurdles. This improves customer experiences while creating new revenues for operators.

Platform Banking

Increased competition due to PSD2 could pose a challenge to traditional banks. But it could also open up new opportunities for them through platform banking. This refers to scenarios where banks move beyond simply providing core banking services to acting as a marketplace for all kinds of financial services. To create a comprehensive customer experience, traditional banks may offer a wide range of products like loans, insurance, and even non-banking services to customers via a single digital interface.

Security Risks and Fraud in the PSD2 Era

The enhanced payment service directive creates stronger protection for customer information and secures online transactions. However, the expanded third-party access also introduces a number of new cybersecurity challenges. Some of these new risks include:

TPPs as Weak Links: PSD2 has given rise to many third-party service providers, many of which are small companies that often lack the level of security infrastructure offered by large traditional banks. Worse, the fact that these providers can plug into traditional banking systems via APIs introduces a weak link that can be exploited by malicious actors.
API Vulnerabilities: The API itself could also be a risk factor. As a mechanism for data sharing between different parties, a poorly secured API can be used as a point of entry by cybercriminals.
Data Misuse: While PSD2 mandates that customers must grant explicit consent for TPPs to access their data, the potential for data privacy breaches remains. Some TPPs may exceed the scope of consumer consent. It is also possible for malicious actors to trick customers into granting access to their data.

Best Practices to Mitigate Fraud Risks and Comply with Data Protection Laws

Implementing robust customer authentication and enhanced security measures.
Emphasizing securing the data sharing architecture (APIs and gateways) to limit vulnerabilities.
Data minimization and encryption.
Implementing a Zero-Trust model.
Banks and fintechs must thoroughly vet and continuously monitor the security and compliance posture of any TPP they connect with.

Global Trends and the Evolution Beyond PSD2: Open Finance and International Perspectives

The Revised Payment Services Directive (PSD2) is the cornerstone of financial services for many countries in the EU. However, this regulation is only one piece of a much bigger puzzle, which is global open finance. Other jurisdictions have introduced similar or closely related guidelines for their financial service or banking industries. Examples of these emerging initiatives include the United States’ proposed CFPB rule and Singapore’s MAS.

While there are notable differences in these frameworks to account for regional differences and market peculiarities, they are all aimed at managing risks, boosting security, and introducing rules to guide the conduct of business in a way that strengthens consumer protection within the payment landscape.

While PSD2 has established the framework for open banking, it’ll likely continue to evolve and spur new regulatory developments in the coming years. The European Commission has started working on a revised framework (PSD3) to improve the functioning of open banking. This revised directive will likely focus on improving API reliability and fixing liability issues. At the same time, new regulations like the Financial Data Access (FIDA) regulation are being introduced to provide a legal framework for the wider open finance initiative.

Analytics, API Performance, and Fintech Adoption

To measure the impact and success of the PSD2 framework, we can take a closer look at API usage and the general fintech adoption rate. Since the performance and quality of APIs are critical for the success of open banking, some of the key performance indicators to look out for include:

Availability/Uptime of APIs.
Response time.
Number of successful API calls.
Error rate.

Regulators can use metrics like these to set benchmarks, based on which compliance can be measured.

Beyond APIs, other metrics may also focus on evaluating adoption rates to determine the impact of this directive. A core part of PSD2’s mandate is to fuel the growth of the fintech sector and encourage the development of new services. Measuring adoption rates can provide a clearer picture of how well this is being used.

Impact of PSD2 on Venture Capital Investments and Market Growth in the Fintech Sector

PSD2 and the resulting open banking framework acted as a catalyst for investment and structural change in the fintech market. Some of the most notable impacts include:

Surge in the number of new financial services startups.
Increasing focus on measuring the performance of payment fintech companies (paytech).
Traditional institutions face a surge in competitive pressure. However, there’ll also be a shift towards a more collaborative ecosystem as more companies become connected with each other via their APIs.

Opportunities for Businesses and the Financial Industry

As mentioned above, the shift driven by PSD2 and open banking has created a wealth of opportunities for businesses and the payment market as a whole. As we wrap up this article, we summarize some of the major opportunities below:

Real-time access to transaction data via APIs will inspire a new wave of innovative payment services, such as smarter lending and ID verification services.
Emergence of new payment services for consumers and B2B solutions.
Embedded services within non-financial products.
Banks and other service providers can monetize their APIs via a license or usage fee model.

Conclusion: Navigating PSD2 for Future Fintech Growth

Businesses that take advantage of open banking and PSD2 can benefit consumers tremendously, but also gain a lot themselves. While this legislation has definitely made things tougher for traditional institutions by introducing competition, it also has the potential to drive innovation and open up new opportunities for them. A

s the ecosystem moves closer towards a truly open and integrated model, the key to future growth will be the ability of all players (banks, fintechs, and even non-financial) to collaborate effectively and leverage the PSD2 directive to enhance customer experiences.

For anyone planning on building a project for the EU or any other market, understanding the regulatory framework is crucial. As a software development company, we specialize in building great products that are compliant with industry standards like PSD2. Contact us to discuss the details of your project and explore how it fits into the broader ecosystem.

See all articles