In plain words
Imagine your bank account as a house where only the bank had a key. To let a budgeting app see your spending, you had to hand over your online banking password, and the app logged in as you. PSD2 changed that. It gave licensed apps their own front door, with your permission, and made the bank open it.
PSD2 is the Second Payment Services Directive, the EU law that sets the rules for payment services. 1 It applied from January 2018 and did three big things. It created licences for new kinds of third-party providers that read account data or start payments. It required banks to give those providers secure access. And it made strong customer authentication (SCA) mandatory for online log-ins and payments.
It also updated older rules on fees, refunds and liability, and brought more types of firms and payments under supervision. In the UK, PSD2 was put into law through the Payment Services Regulations 2017, which still apply. 2
How it works
How PSD2 access works
What happens when you connect your bank to a licensed app.
-
1
The app is licensed
A third-party provider is authorised or registered to offer account information, payment initiation, or both.
-
2
You give consent
The app explains what it wants to see or do, and you agree in the app.
-
3
Your bank authenticates you
You confirm with your own bank using SCA. You never give the app your banking password.
-
4
The bank shares or pays
Through a secure interface, usually an API, the bank shares the data or makes the payment you approved.
What PSD2 changed
New licensed players
Account information service providers (AIS) and payment initiation service providers (PIS) became regulated services.
Access to accounts
Banks and other account providers must let these licensed providers access online payment accounts securely, with the customer’s consent.
Strong authentication
Two independent factors for online log-ins and most electronic payments, with detailed technical standards. 3
Customer protection
Prompt refunds for unauthorised payments, a small cap on what customers lose if their details are misused, and limits on card surcharges.
Wider scope
Transparency rules extended to payments where only one side is in the EU, and to all currencies.
Complaints and security
Deadlines for answering complaints, incident reporting and security risk management for every payment provider.
PSD2 sits alongside the E-Money Directive. A payment institution is licensed under PSD2, while an EMI is licensed under e-money rules but follows PSD2 for the payment services it provides.
Which permission does what
PSD2 sets minimum capital and other conditions for each kind of payment firm. The figures below are the EU minimums for initial capital in the directive; the UK uses the same structure. 1
| Type of firm | What it can do | Minimum capital |
|---|---|---|
| Account information service provider | Read account data with consent. Never holds or moves money | No initial capital, but professional indemnity insurance is required |
| Payment initiation service provider | Start a payment from the customer’s bank account. Never holds the money | €50,000 |
| Payment institution, money remittance only | Send money for customers, without holding accounts | €20,000 |
| Payment institution, other services | Payment accounts, transfers, card acquiring and more | €125,000 |
Capital is only one condition. Every applicant also needs fit and proper management, safeguarding where it handles customer money, anti-money laundering controls, a security policy and a credible business plan. A firm that needs to hold balances as e-money needs an EMI licence instead, with €350,000 of capital.
Most startups do not start with their own permission. They work as an agent of a licensed firm, or reach customers’ accounts through a licensed open banking provider, and apply for their own licence once the product and volumes justify the cost of running it.
What comes next: PSD3 and the PSR
In 2023 the European Commission proposed to replace PSD2 with a third directive, PSD3, and a directly applicable Payment Services Regulation (PSR). The proposals aim to fight payment fraud, make open banking work better and fold e-money rules into payment rules. They go through the EU legislative process before they apply, so check their current status before planning around them.
PSD2 in the UK, EU and Gulf
| Market | Status | What to know |
|---|---|---|
| European Union | PSD2 in force, through each member state’s law 1 | Licences can be passported. Successor rules proposed |
| United Kingdom | Payment Services Regulations 2017, supervised by the FCA 2 | Kept after Brexit and now changed separately. UK open banking also follows its own standards |
| UAE and Saudi Arabia | PSD2 does not apply | Local payment laws and open finance frameworks cover similar ground with their own licences and rules |
Teams moving from the UK to the Gulf often expect the same model. We explain the differences in open finance in the UAE for UK founders.
Example: Maya’s budgeting app
Maya builds a budgeting app for freelancers in Ireland and wants to show all their bank accounts in one place.
- Licence route. Rather than get her own AIS licence at the start, she connects through a licensed open banking provider and works under its permissions.
- Consent. A user chooses their bank in the app, reads what data will be shared and for how long, and agrees.
- Authentication. The user is sent to their bank’s app, approves with a fingerprint, and comes back. Maya’s app never sees the banking password.
- Data. The bank shares balances and transactions through its API. The user can withdraw consent at any time, and the access must then stop.
For the consent and audit trail details that trip teams up, read PSD2 consent flows that survive scrutiny.
Common misconceptions
“PSD2 only matters to banks.”
It applies to every payment service provider, including EMIs, payment institutions and open banking apps.
“PSD2 stopped applying in the UK after Brexit.”
The UK’s Payment Services Regulations 2017 still carry its rules. What changed is that the UK can now amend them on its own.
“PSD3 already replaced PSD2.”
The successor rules were proposed in 2023. Until they apply, PSD2 is the law to build against.
FAQ
What is PSD2 in simple terms?
PSD2 is the EU law that sets the rules for payment services. It let licensed third-party apps access bank accounts with the customer's consent, made strong customer authentication mandatory for online payments and log-ins, and strengthened customers' rights when payments go wrong.
Does PSD2 still apply in the UK after Brexit?
The UK implemented PSD2 through the Payment Services Regulations 2017, and those rules still apply. Since Brexit the UK can change them on its own, so UK and EU rules are gradually drifting apart.
What is the difference between PSD2 and open banking?
PSD2 is the law that gave licensed third parties the right to access payment accounts. Open banking is the wider practice of sharing bank data and starting payments through those third parties. In the UK it also refers to the specific standards that the largest banks were ordered to build.
Who does PSD2 apply to?
To payment service providers: banks, e-money institutions, payment institutions and the new account information and payment initiation providers. It covers most electronic payments made by people and businesses in the EU.
What is replacing PSD2?
In 2023 the European Commission proposed a third Payment Services Directive (PSD3) and a new Payment Services Regulation (PSR) to replace PSD2. They focus on fraud, open banking performance and merging e-money rules into payment rules. Check their current status before relying on any dates.
Do I need a PSD2 licence for my fintech?
If you provide payment services yourself, you need to be authorised or registered, for example as a payment institution, an e-money institution, or an account information service provider. Many startups instead work as an agent of a licensed firm or through a partner's API.
Related terms
Sources
-
1
EL
EUR-Lex Directive (EU) 2015/2366 on payment services in the internal market (PSD2)
https://eur-lex.europa.eu/eli/dir/2015/2366/oj -
2
LG
legislation.gov.uk The Payment Services Regulations 2017
https://www.legislation.gov.uk/uksi/2017/752/contents -
3
EL
EUR-Lex Commission Delegated Regulation (EU) 2018/389 on strong customer authentication and secure communication
https://eur-lex.europa.eu/eli/reg_del/2018/389/oj
