Insights

At a glance

PSD3 will have limited impact on merchants – it focuses on authorisation and governance of payment institutions.

The accompanying Payment Services Regulations (referred here as PSR1) are more relevant because they cover conduct of business rules, Strong Customer Authentication (SCA), fee transparency and Open Banking.

PSR1 is an evolution of PSD2, moving from a rules-based approach of where SCA takes place and how it takes place towards more of a risk-based approach.

PSR1 will only apply to transactions at UK merchants by EU based customers. Practical impacts are expected to be very limited, as SCA is already embedded at checkout in the UK and issuers already have the final say on when to apply SCA.

Directionally there is broad alignment between UK and EU payment regulations, with the UK also moving towards a risk-based approach and PSR1 introducing rules that already apply in the UK.

The EU is actively working to reduce its reliance on Visa and Mastercard. Along with the Digital Euro, Open Banking can help deliver this alternative to card payments, potentially via the rules covering variable recurring payments set out in PSR1.

The rollout of payment regulation is a marathon, not a sprint. PSR1 is around 2 years away from having to be adhered to, and draft Regulatory Technical Standards (RTS) are 12 months away. Similarly, changes to UK payment services law are not expected until 2027/28.

For PSD2 the devil tended to be found in the detail of the RTS. Whilst no substantive changes to SCA are expected, this will be kept under review.

Background

The Second Payment Services Directive (PSD2) had a significant impact on the UK payments landscape. As a 2015 European directive it first needed to be transposed into national law for each member state – for the UK, this was the 2017 Payment Services Regulations.

From a UK retailer perspective, the majority of PSD2 was of passing interest apart from one key aspect – mandatory Strong Customer Authentication (SCA) unless a defined exemption was available. It was the associated Regulatory Technical Standards (UK RTS) that really set out what this meant, and these came into force in 2021.

SCA did halt the rise in card fraud through remote channels, with cardholder not present fraud reducing from £470m in 2019 to £396m in 2022. The increase in friction from SCA was unavoidable, but the fact it was applied across the board helped with customer acceptance. In addition, it has probably supported the growth of payment methods with ‘low effort’ SCA - for example Apple Pay and Google Pay.

A number of years (and Brexit) have passed since PSD2 and UK RTS was embedded into UK consumer payments. The next evolution in European payment regulation was proposed by the European Commission in 2023 – the imaginatively titled Third Payment Services Directive (PSD3) as well as the Payment Services Regulation (PSR1).

Following extensive negotiations between stakeholders, April 2026 saw the final compromise texts of PSD3 and PSR1 published ahead of final approval. They are expected to come into force soon and will apply 21 months after that – so Q3 2028.

Like PSD2, PSD3 is also a directive, but again is of passing interest to retailers – it focuses on authorisation and governance of payment institutions.

PSR1 is of more interest as it focuses on conduct of business rules and so how consumers make payments, and covers strong customer authentication, liability, and Open Banking. As PSR is a regulation it will apply directly and uniformly across all EU member states.

Does PSR1 apply to UK Merchants?

In certain limited circumstances PSR1 will apply to transactions carried out at UK merchants. PSD2 had the concept of a ‘one leg out’ exemption from SCA, where, unless both the Card issuer and the Acquirer were in scope of PSD2, SCA did not apply. PSR1 changes this – where one PSP is in scope of PSR1 then most (but not all) of the rules apply to the part of the transaction carried out in the EU.

This means UK merchants who sell to EU based customers could theoretically be impacted. In practice the impact should be minimal. SCA is already in place in the UK, and the card issuer already has the final say on where SCA is applied.

As such, whilst when SCA is applied and what constitutes SCA may change slightly when selling to an EU based customer, PRS1 is not expected to require much if any changes UK merchant checkout journeys or usage of exemptions.

Could PSR1 influence UK regulation?

Yes, PSR1 could influence UK regulation and so UK merchants, although the expectation is that this will not mean the introduction of additional barriers.

Article 89 of PSR1 sets out the further development of the regulatory technical standards (RTS) on SCA requirements and exemptions, using a risk-based approach to balance fraud risk and customer experience. In addition, there are changes to SCA proposed in Article 85, where it is now permissible for both SCA ‘elements’ to be inherence (something the user is, such as a biometric) instead of each being from different elements.

There is already movement in this direction in the UK, where from March 2026 the FCA relaxed SCA requirements for contactless payments by removing the fixed £100 single transaction cap and cumulative limits and replacing with a risk-based framework. The expectation here is that card issuers will not increase the single transaction cap but may relax the cumulative limits. In addition, HM Treasury have committed to review UK payment services regulation.

Has UK regulation influenced PSR1?

Whilst it may be going too far to say that PSR1 has been influenced by UK regulation, there are obvious signs that the UK and the EU hold similar views.

For example, Article 31 of PSR1 looks to improve merchant fee transparency by requiring card schemes (like Visa and Mastercard) to disclose scheme fees and rule changes directly to PSPs and acquirers in a clear, consistent format (although critics have pointed out that there is no obligation for this transparent fee data to be passed to merchants).

In the UK, the Payment Systems Regulator is implementing their Information, Transparency, and Complexity (ITC) remedy, which also requires card schemes to provide acquirers with clear, actionable pricing information. This follows on from their March 2025 Market review of card scheme and processing fees.

Other areas where PSR1 is driving alignment with UK regulation are proposed rules on confirmation of payee for credit transfers (e.g. faster payments) or protection for consumers who have been manipulated into authorising a payment by a fraudster.

What about Open Banking?

Whilst consumer use of Open Banking in the UK has grown it is not yet a significant payment method in retail. Work is underway to increase adoption.

One focus is an expansion of Variable Recurring Payments (VRPs), which are automated payments from a customer’s bank account where the amount and frequency can change within pre-approved limits. The UK Payments Initiative is currently looking to expand VRPs into a series of new use cases, including Retail. PSR1 similarly sets out VRP capability for credit transfers in Article 85.

Secondly, the UK Government has re-iterated its ambition for Open Banking to become a competitive alternative to card payments as part of their consultation on “Modernising Payment Services Regulation”, which was launched in July and closes on 6th October 2026.

As part of this consultation, they have committed to launching the regulatory framework to support this by the end of 2026 via a statutory instrument under the Data (Use and Access) Act 2025. It is worth noting that this consultation also covers agentic payments, with VRP’s being a potential way to support these agentic payments.

The ability to make a payment is one component of consumer payments – liability and redress is also critical, and key to consumer adoption.

Whilst Open Banking has defined legal liability, the mechanism for enforcement are the courts, a much higher barrier to entry than the dispute and chargeback mechanisms offered by card schemes. Addressing this gap will be important if consumer adoption is to increase.

Is Open Banking a strategic imperative for the EU?

The EU is actively working to reduce its reliance on Visa and Mastercard. This has long been driven by cost, but more recently the risk that a reliance on US payment systems could leave Europe exposed to political pressure or sudden disruption has been brought into focus.

Replicating a card-based payment system is unlikely to be the answer in a world that is now so deeply digitally connected. Instead, the card can be replaced with wallets that support direct account to account payments.

Along with the Digital Euro, Open Banking can help deliver this alternative to card payments, and so development of these standards is expected to continue. As highlighted, the hope is that this will move beyond technical integrations into replicating the broader frameworks that make card payments so attractive to consumers today.

Not now, but ‘soon’

One key thing to note is the timing of these changes.

PSR1 states that a draft RTS will be submitted 1 year after PSR1 comes into force, and guidelines on changes to SCA are due within 18 months of PSR1 coming into force.

HM Treasury is expected to consult on changes to UK payment services regulation during 2026 before presenting a related statutory instrument to Parliament during 2027/28 to supersede the 2017 Payment Service Regulations.

PSD2 had a 4-year gap between the rules being agreed and UK merchants being impacted. Whilst the rules are again close to being agreed, the details are still to be worked out and will not become real for a while yet – Regulatory change is a marathon, not a sprint.

The likely outcome is broad alignment between the UK and EU: more risk-based application of SCA, stronger consumer protection and improved support for Open Banking.

What should Retailers do next?

The impacts of PSR1 and the associated Regulatory Technical Standards on UK merchants are neither imminent nor material - at this point there are no compelling calls to action

Instead, focus should be on the UK governments moves to modernise payment services regulation. Either directly or through trade bodies, UK Retail’s voice needs to be heard in these discussions, especially around agentic payments.

In addition, there is a clear push from both UK and EU regulators to develop an alternative to card payments. From a merchant perspective, this will mainly be about ensuring payment architecture and strategy is flexible enough to take advantage of account-to-account payments when use cases become compelling.

Final thoughts

Firstly, there are a lot of PSRs – the EU Payment Services Regulation, the UK Payment Services Regulation, and the UK Payment Service Regulator. Hopefully, discrete shorthand for each will be developed over the coming years to avoid confusion!

And ‘coming years’ is the key point – UK merchants should not expect any impacts in the next 12-24 months. If there are any impacts, they will be driven by UK law as opposed to PSD3 and PSR1, although there is an expectation that UK and EU law will be broadly aligned.

That said, the ‘heavy lifting’ – implementing SCA and driving consumer understanding and acceptance of SCA – was delivered by PSD2. The next stage of payments regulation should focus on moving from a rules based towards a risk-based approach to what SCA is and where it needs to be applied.

Retail Perspectives #10 : PSD3 & SCA