European Payments Package: PSD3 & PSR: What financial institutions need to prepare for

They will shape the way companies manage fraud risks, handle customer data, build partnerships, and interact with regulators. For those of us working in financial crime compliance, the message is clear: PSD3 and PSR will require deeper integration of fraud prevention into the broader financial crime framework.

What are PSD3 and PSR? 

PSD3 will replace PSD2 as the legislative backbone for payment services in the EU. Its role is to set out the overarching principles and requirements for national transposition. In contrast, PSR is a directly applicable regulation, designed to eliminate the patchwork of national interpretations that complicated PSD2's implementation.

The goals of the package are wide-ranging but can be grouped into four themes:

How will the reforms change the payments landscape? 

Customer data access and protection are another focus area. PSD3 and PSR reinforce the open banking framework by standardizing APIs and strengthening rules around consent management. This gives consumers greater clarity and control over who can access their data, while placing new responsibilities on institutions to ensure that sharing is both secure and transparent. 

Operational resilience and governance requirements are also set to rise. Institutions will face stricter obligations for risk management, incident reporting, and internal oversight. These changes align with the broader regulatory trend, exemplified by the Digital Operational Resilience Act (DORA), toward embedding resilience into the DNA of financial services. 

Finally, the scope of who needs a license to provide payment services will broaden, while licensing standards will be harmonized across the EU. The directly applicable nature of the PSR reduces national discretion and creates a more level regulatory environment, which will be particularly relevant for Fintechs and cross-border players. 

What does this mean for financial crime compliance? 

On one hand, it promises richer intelligence for tackling fraud. On the other, firms will need to manage the tension between mandatory sharing and data privacy rules under GDPR. Clear policies, robust governance, and transparent communication with customers will be essential. Reporting obligations are also becoming more demanding. Regulators will expect faster and more granular reporting of fraud incidents and operational disruptions. This will require tighter escalation processes, improved data capture, and a culture of accountability within institutions. The expansion of open banking will bring greater reliance on third-party providers. Financial institutions will need to strengthen their frameworks for managing compliance risks in these partnerships, ensuring that fraud and AML standards are applied consistently across the ecosystem. 

• 1

  Gap Assessment
  Preparation should begin with a comprehensive gap assessment, comparing current PSD2 compliance measures against the requirements of PSD3 and PSR. Fraud detection, authentication controls, and reporting processes are obvious starting points, but institutions should also look at governance structures and third-party risk management.

• 2

  Technology Updates
  Technology upgrades will be critical. Stronger authentication tools, advanced fraud analytics, and secure data-sharing platforms will all be needed to meet regulatory expectations. At the same time, policies and processes must be updated to reflect new rules, ensuring that operational resilience, reporting, and governance frameworks are aligned.

• 3

  Collaboration
  Institutions should also embrace collaboration. Fraud does not respect institutional boundaries, and the regulatory push toward intelligence sharing is a recognition of that fact. Active participation in industry-wide initiatives will not only meet compliance obligations but also strengthen collective defenses.

• 4

  Training and Awareness
  Staff training and awareness will round out the preparation process. Fraud patterns are evolving rapidly, and compliance teams, customer-facing staff, and senior management all need to understand their roles under the new regime.

Could compliance be an opportunity rather than a burden? 

While much of the focus will inevitably fall on compliance, forward-looking institutions will see opportunities as well. Stronger fraud protection can become a driver of customer trust at a time when confidence in digital payments is critical. Smarter authentication and monitoring solutions can improve user experience, reducing friction while safeguarding transactions. 

The enhanced monitoring and reporting infrastructure required by the new rules can also generate valuable insights. Data analytics, when applied beyond compliance, can inform product development, risk strategy, and customer engagement. Finally, institutions that demonstrate leadership in secure data sharing and open banking will be well-positioned as trusted partners in the evolving payments ecosystem. 

What comes next? 

The institutions that act now by assessing gaps, upgrading systems, embedding collaboration, and training their people will not only meet the new regulatory requirements but also seize the chance to build trust, resilience, and strategic advantage in a rapidly evolving market.