Payment Services Directive 2 (PSD2)

What it is

PSD2 — Directive (EU) 2015/2366 — is the legal frame for payment services in the EU since 2018. It applies to banks, payment institutions and electronic-money institutions, and shapes both the customer experience of paying online and the supervisory expectations around payments fraud.

Three pillars relevant to financial defence

• Strong Customer Authentication (SCA). Two of three independent factors — knowledge, possession, inherence — required for most electronic payments. Exemptions exist for low-risk transactions and TRA (Transaction Risk Analysis), but the default is two-factor.
• Article 96 fraud reporting. Payment service providers must report fraud statistics to their competent authority and the EBA, in a harmonised format.
• Open banking. Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) can access account data with the customer's explicit consent, via standardised APIs.