PSD3 and PSR: what changes for payment fraud prevention

In short: on 21 October 2026, the Council of the EU adopted its first-reading position on the third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR). Together they replace PSD2 and the E-Money Directive. On fraud, four major changes stand out: full refunds for bank impersonation scams, name/IBAN checks extended to all credit transfers, strong customer authentication written into law, and mandatory fraud data sharing, including with large online platforms. The PSR will apply 21 months after entry into force.

‍

The text is not final yet, but its content is now known and stable. The reform tightens licensing, opens up access to bank accounts and modernises open banking. Its real centre of gravity, though, is fraud: for the first time, the law makes payment providers bear part of the cost of scams their customers authorised themselves.

‍

At Meelo, we work every day with banks, payment institutions and fintechs on fraud detection at onboarding. Here is what changes, who is affected, and how to prepare.

‍

PSD3 and PSR at a glance

‍

The reform splits the old framework into two texts. The PSD3 directive covers licensing and supervision. The PSR regulation sets the conduct rules, including everything on fraud, and applies directly in all 27 Member States with no national transposition.

‍

That is a change of method. Under PSD2, each country transposed the rules its own way, which created gaps. With the PSR, a French bank and a Dutch payment institution will apply exactly the same anti-fraud rules. E-money also disappears as a separate regime: e-money institutions (EMIs) move into the payment institution (PI) framework.

‍

The timeline, counted from entry into force

‍

• Day 0: entry into force 20 days after publication in the Official Journal of the EU.
• +21 months: the PSR applies, along with national laws transposing PSD3. Existing licences keep working.
• +27 months: the transition ends. PIs, EMIs and exempt firms must be re-authorised or have their activity suspended. The extended name/IBAN check and its liability rules apply.

‍

The European Parliament still has to complete the procedure, and every deadline runs from publication. If the text is published in 2027, the first fraud obligations would apply in late 2028 or 2029.

‍

Bank impersonation scams: the PSP refunds

‍

This is the most awaited measure. Today, a customer who approves a transfer under pressure from a fake bank adviser bears the loss alone: the payment is “authorised”, so it falls outside PSD2 refund rules.

‍

Under the PSR, the consumer gets a full refund when three conditions are met:

‍

• the fraudster posed as the customer's own payment provider (bank, PI or EMI);
• they used spoofed channels: phone number, text message or email address imitating the PSP's;
• the victim reported the fraud to their PSP and filed a police report.

‍

To refuse, the PSP must prove gross negligence by the customer. The Council limited the scheme to impersonation of the PSP itself, whereas the Parliament wanted it to cover any public or private entity. Scams by fake police officers or other organisations therefore remain out of scope.

‍

PSPs must also secure their own channels against spoofing. For classic unauthorised payments, the rule stays the same: refund by the end of the next business day, with a €50 customer liability cap. What is new: if the PSP suspects fraud or gross negligence, it must give written grounds and decide within 15 business days.

‍

Meelo's view. An impersonation scam always needs an account to receive the money, often one opened with a stolen identity or forged documents. That is where we step in. The earlier that account is blocked, the fewer victims there are to refund, for you and for every other PSP.

‍

Name/IBAN check: every credit transfer

‍

Since October 2025, the Instant Payments Regulation has required Verification of Payee for SEPA euro transfers. The PSR extends it to all credit transfers, including non-euro ones.

‍

Before sending, the payer's PSP checks that the name entered matches the IBAN holder and flags any mismatch. If a PSP fails to apply the check or applies it badly, it refunds the payer, and the PSP at fault compensates the other.

‍

This rule applies at month 27. For firms handling foreign-currency transfers, it is a technical project to start early. For businesses paying suppliers and partners, it is a direct defence against invoice redirection fraud.

‍

Meelo's view. Our IBAN ownership check already works for individuals and businesses, and it is compatible with Verification of Payee. Our clients use it mostly at onboarding: confirming from day one that the declared IBAN belongs to the person or company in front of you keeps fraudulent accounts out of the payment chain.

‍

Strong customer authentication: now in the law

‍

Under PSD2, strong customer authentication (SCA) relied on the directive and EBA technical standards. The PSR writes it directly into the regulation and widens its scope:

‍

• New cases covered: card tokenisation, limit increases, password or contact detail changes.
• Truly distinct factors: authentication elements must come from different categories.
• Accessibility: methods suited to people with disabilities, older people or those without a smartphone.
• Wider liability: technical service providers and payment scheme operators become liable if they prevent SCA.

‍

Sensitive moments in the customer journey, such as a phone number change, are exactly the ones fraudsters exploit to take over an account. They will now have to be protected.

‍

Meelo's view. SCA proves it is the right device, not that the right person is behind it. We add complementary signals: device fingerprinting, automation indicators, VPN or proxy detection, phone carrier and number porting checks. These signals help spot an abnormal journey before it turns into fraud.

‍

Fraud data sharing and online platforms

‍

PSD2 said almost nothing about cooperation between players. The PSR makes it an obligation.

‍

Between PSPs. Providers must share fraud data with each other. Sharing is framed by a joint GDPR impact assessment before any exchange. PSPs must also publish their refund statistics.

‍

With platforms. Large online platforms and search engines may only run ads for financial services if the advertiser proves it is authorised in the target country. They must open reporting channels with PSPs. Under the provisional agreement, a platform that is notified of fraudulent content and fails to remove it becomes liable to the PSP that refunded the victim.

‍

The logic has changed: fraud is no longer each bank's isolated problem, but a chain of shared responsibilities.

‍

Who is affected, and how

‍

• Banks: they carry the refund burden for impersonation scams, check name and IBAN on all transfers and share fraud data. They must also offer a dedicated open banking interface and can only close a PI or EMI account on listed grounds, with 4 months' notice.
• Payment institutions (PIs): fraud liability, name/IBAN checks and SCA are now set by regulation. Re-authorisation at month 27 and higher initial capital (€40,000 for money remittance, €125,000 to €150,000 for other services).
• E-money institutions (EMIs): same fraud and SCA rules as PIs, end of the separate EMD2 regime, initial capital of €250,000 for issuance (€350,000 today).
• Consumers: refunds for impersonation scams with a police report, a warning before any transfer if the name does not match the IBAN, fees shown before payment and a dashboard to revoke open banking access. The €50 cap remains.

‍

How to prepare now

‍

The deadlines may seem distant, but refunds for scams change the economics of fraud. Every undetected scam will become a straight loss for the provider.

‍

• Map your exposure: estimate how many impersonation scams you would have had to refund over the last 12 months.
• Extend payee verification to all transfers, including foreign-currency ones.
• Harden sensitive journey steps: phone, email or limit changes and new payees.
• Detect upstream: an account opened with a fake identity is later used to receive victims' money. Onboarding controls (KYC, KYB) directly reduce what you will pay later.
• Prepare data sharing: GDPR impact assessment, choice of partners and exchange formats.
• Document refusals: claiming gross negligence will require written evidence and a decision within 15 business days.
• For PIs and EMIs: plan the re-authorisation file and the required capital level.

‍

How Meelo helps PSPs meet the PSR

‍

• Impersonation scam refunds: identity verification and fraud scoring with face matching and liveness detection, document authenticity checks and detection of AI-generated documents, to block accounts opened by fraudsters.
• Name/IBAN check: IBAN ownership verification for consumers and businesses, compatible with Verification of Payee.
• Extended SCA: device fingerprinting, VPN and proxy detection, phone and email verification.
• Open banking: account analysis, consistency with declared data, alerts on connected accounts.
• Business customers and invoice redirection fraud: KYB verification of companies, beneficial owners and directors, in France and abroad.
• AML obligations: sanctions, politically exposed persons and adverse media screening.

‍

Everything runs through one platform and one integration. The goal: stop the fraudster before they open the account that will receive victims' money, rather than refund after the fact.

‍

FAQ

‍

What is the difference between PSD3 and the PSR?

‍

PSD3 is a directive on the licensing and supervision of payment institutions, transposed by each country. The PSR is a directly applicable regulation that sets conduct rules, including fraud, SCA and open banking.

‍

When will PSD3 and the PSR apply?

‍

The PSR applies 21 months after entry into force. The transition period ends at month 27. The European Parliament still has to adopt the final text.

‍

Will banks have to refund impersonation scams?

‍

Yes, if the fraudster posed as the bank itself through spoofed channels, and the victim reported the fraud to the bank and the police. The bank can only refuse by proving gross negligence.

‍

Will payee verification become mandatory everywhere?

‍

Yes. Already mandatory for SEPA euro transfers, it will be extended to all credit transfers. A PSP that fails to apply it refunds the payer.

‍

Are online platforms affected?

‍

Yes. Large platforms will have to check that financial services advertisers are authorised, and cooperate with PSPs to remove fraudulent content.

‍

Does PSD3 replace PSD2?

‍

Yes. PSD2 and the E-Money Directive (EMD2) are repealed and replaced by PSD3 and the PSR.

‍

Sources: Council of the EU, documents ST 8535/26 (Payment Services Directive) and ST 8543/26 (Payment Services Regulation), first-reading position of 21 October 2026; provisional agreement between the Council and the European Parliament, November 2025; Regulation (EU) 2024/886 on instant credit transfers.