PSD3 and PSR: What the EU's New Payment Rules Mean for Fans Agencies

The EU is replacing PSD2 with two new instruments that reshape how payment providers operate — and what protections their customers get.

Your payment provider is about to go through the most significant regulatory upgrade since 2018. PSD3 — a new directive — and PSR — a directly applicable regulation — will tighten fund safeguarding, make IBAN-name matching mandatory on every SEPA transfer, merge the EMI and PI license categories, and shift fraud liability from you to your provider. If you use an EU-licensed payment provider, these changes strengthen the floor beneath your money. If you don't, nothing changes — and that gap is the point. Here's what PSD3 and PSR actually mean for your agency's payment setup, in plain language.

What Are PSD3 and PSR — The 30-Second Version

PSD2 has governed EU payments since January 2018. It introduced strong customer authentication, opened the door to open banking, and set baseline rules for how payment service providers handle your money. It also left gaps — in fraud prevention, in e-money oversight, and in how consistently rules were applied across 27 member states.

PSD3 and PSR close those gaps. They work as a pair:

• PSD3 is a directive. It sets licensing, governance, and supervision rules. Each EU member state transposes it into national law — same objectives, some local variation in implementation.
• PSR is a regulation. It applies directly and uniformly across all EU member states. No interpretation gaps, no transposition delays. PSR covers the operational rules: payment execution, fraud liability, transparency, Verification of Payee.

The distinction matters. Under PSD2, member states sometimes interpreted rules differently — what counted as adequate safeguarding in Malta wasn't identical to the Netherlands. PSR eliminates that ambiguity for the rules that matter most to your day-to-day payment operations.

Five Concrete Changes That Affect Your Agency's Payment Setup

PSD3 and PSR run to hundreds of pages. Most of it concerns payment service providers, not their customers. These five changes are the ones that directly affect how your agency sends, receives, and protects money.

Stronger Safeguarding — Your Deposits Get More Protection

Under PSD2, your payment provider was required to safeguard customer funds — but "safeguard" left room for interpretation. Some providers held funds in a single credit institution. If that institution failed, your money was at risk.

PSD3 raises the bar. Providers holding customer funds above a defined threshold must now diversify across two or more credit institutions. They also gain the option to deposit funds directly with a central bank. Daily reconciliation becomes mandatory — providers must verify every day that the funds they hold match what they owe customers.

In an insolvency scenario, customer claims now get explicit priority. Your funds aren't mixed into the general creditor pool.

For agencies running six-figure monthly volumes through a single provider, this isn't academic. It's the difference between "your money is somewhere safe" and "your money is structurally protected by law."

Verification of Payee — Fewer Misdirected Splits

PSR makes IBAN-name matching mandatory for all SEPA credit transfers — not just instant payments, as under the current framework. Before your provider executes a transfer, the system checks whether the recipient's name matches the IBAN on file.

For fans agencies running auto-split payments, this matters. When your provider splits incoming revenue across 20, 50, or 100+ model accounts, each split is a SEPA transfer. Verification of Payee catches mismatches before the money moves — a wrong digit in an IBAN, an outdated name on an account.

Under PSR, if your provider sends funds to the wrong recipient because they failed to perform this check, liability sits with the provider — not with your agency.

EMI and PI Merge Into One License Category

PSD3 repeals the E-Money Directive (EMD2). The two current license categories — Electronic Money Institution (EMI) and Payment Institution (PI) — merge into a single "payment institution authorised to issue e-money."

What this means in practice: every EU-licensed EMI must re-apply for authorisation under the new framework. This is a re-licensing process, not a revocation. Providers with strong governance, adequate capital, and clean compliance records will transition smoothly. Providers that were borderline under the old rules may not survive the re-assessment.

What this means for you: your EU-licensed provider will go through a re-authorisation process over the transition period. Ask them about their timeline. If they can't give you a clear answer, that tells you something.

For agencies, the practical impact is indirect but real: the re-licensing filter raises the minimum quality bar for EU-licensed providers. Weaker players exit. The ones that remain are better capitalised and better governed.

Fraud Liability Shifts to Your Provider

PSR introduces a liability framework that puts payment service providers on the hook when fraud controls fail. If your provider doesn't implement adequate fraud risk management — and a fraudulent transaction slips through — the provider bears the financial loss.

Under PSD2, the burden often fell on the customer. You had to prove the provider was negligent. PSR flips this: the provider must demonstrate they had adequate controls in place.

This covers authorised push payment (APP) fraud, social engineering scams, and failures in strong customer authentication. For agencies handling high-value transactions across multiple jurisdictions, this is a material shift in who carries the risk.

Open Banking Access — More Competition, Potentially Lower Fees

PSD3 requires that non-bank payment service providers get fair access to EU payment systems — SEPA clearing, payment schemes, and related infrastructure. Under PSD2, non-bank PSPs often depended on commercial banks for indirect access, which added cost and friction.

Direct access means more providers can offer SEPA clearing without a banking intermediary. The long-term effect: more competition in payment infrastructure, potential downward pressure on fees, and faster settlement for providers that previously sat behind a correspondent arrangement.

For agencies, this won't change your account overnight. But over the 2027–2029 period, expect more providers to compete on execution speed and pricing as infrastructure access levels out.

EU-Licensed vs Offshore — Why PSD3 Widens the Gap

PSD3 and PSR apply exclusively to EU-regulated entities. If your payment provider is licensed outside the EU — or operates without a license — none of the protections described above apply to your account.

This is not a criticism of offshore providers. It's a structural fact. The protections PSD3 introduces are a function of regulatory jurisdiction:

Under an EU-licensed provider (post-PSD3): your funds are safeguarded across diversified institutions with daily reconciliation. Every SEPA transfer your provider sends is checked via Verification of Payee. If fraud controls fail, your provider is liable. Your provider has survived a re-licensing process that filtered out undercapitalised players. And you have regulatory recourse — you can escalate complaints to the MFSA, DNB, BaFin, or whichever national authority supervises your provider.

Under an offshore or unlicensed provider: none of the above. Fund protection depends entirely on the provider's internal policies. There's no mandatory VoP. No fraud liability shift. No regulatory body you can escalate to if something goes wrong.

The gap isn't new — EU licensing has always carried more protections than offshore arrangements. But PSD3 widens it. Each new requirement (safeguarding diversification, VoP, fraud liability, re-licensing) adds a layer that only applies within the EU regulatory perimeter. The cumulative effect is significant.

For agencies evaluating providers, this changes the cost calculus. The question isn't just "what are the fees?" — it's "what protections do I get for those fees?" Our guide to choosing a payment provider for your agency covers how to weigh these factors against pricing and features.

PSD3 Timeline — What Happens When

PSD3 and PSR follow a multi-stage path from political agreement to enforcement:

November 2025 — The European Parliament and Council reached provisional political agreement on both texts.

Q2 2026 (expected) — Official Journal publication. This starts the formal 18-month transposition clock for PSD3. PSR, as a regulation, becomes applicable directly from publication.

Late 2027 — Compliance deadline for payment service providers. PSPs must have updated their operations, contracts, and systems.

2028 and beyond — Full enforcement and supervisory convergence across EU member states.

For your agency, the practical window is 2026–2027. That's when your EU-licensed providers will be updating their terms, rolling out Verification of Payee, and completing their re-authorisation processes. You don't need to act now — but you should know these changes are coming and understand what to expect from your provider during this period.

What to Ask Your Payment Provider Now

You don't need to wait for PSD3 to come into force to make better decisions. The providers that will handle the transition best are the ones already building toward these standards. Here's a practical checklist:

On safeguarding:

• Where exactly are my funds held?
• Are they segregated from operational funds?
• Across how many institutions?

On Verification of Payee:

• Does your system currently check IBAN-name matches before executing SEPA transfers?
• What happens if there's a mismatch?

On re-licensing:

• What's your timeline for PSD3 re-authorisation?
• Which regulator supervises you, and what's your current compliance status?

On fraud liability:

• What fraud controls do you currently have in place?
• What's your process if a fraudulent transaction occurs?

A provider that can't answer these questions clearly — or that deflects — is a provider worth reconsidering before the regulatory upgrade forces the issue.

The Bottom Line

PSD3 and PSR don't change what your agency does. They change the floor beneath the payment providers you use. Stronger safeguarding, mandatory IBAN-name matching, fraud liability shifts, a tighter re-licensing process, and better infrastructure access — all of these raise the minimum standard for EU-regulated payment providers.

If you're already using an EU-licensed provider with strong governance, PSD3 is good news. The regulatory environment around your money is getting stronger.

If you're using an offshore or unlicensed provider, the gap between your situation and the EU-protected standard is about to get wider — not because your provider gets worse, but because the alternative gets better.

For agencies managing meaningful monthly volumes through payment infrastructure, that's a gap worth closing.