PSD3 and Payment Services Regulation finalized in 2026 with phased rollout reshaping EU payments landscape

Executive Summary

• Reporting on PSD3 and the Payment Services Regulation (PSR) is inconsistent across sources on a basic fact: one source states the framework was finalised in 2026 ^S1, while others describe it as still "forthcoming" or "proposed" during the same period ^S3S6. This discrepancy is unresolved in the evidence and should be treated as a live open question, not a settled fact.
• PSD3/PSR is linked to consumer cash access initiatives, specifically enabling retailers to offer cash withdrawals without a purchase requirement ^S2.
• Vendors and PSPs are already citing PSD3/PSR in live commercial documentation (e.g., antifraud limits on SEPA transfers), indicating firms are operationalising compliance ahead of confirmed final rules ^S3.
• PSD3/PSR is being connected in vendor commentary to emerging use cases such as agentic commerce and automated payment initiation, though the substantive regulatory content of this link is not detailed in the evidence ^S5.
• UK commentary treats PSD3 as a EU-side development still "getting closer" for banks, distinct from the UK's own Open Banking/Pay by Bank trajectory ^S6.

What Happened

A Deloitte/The Paypers report states that PSD3 and the Payment Services Regulation were finalised in 2026, ahead of a phased rollout expected to affect licensing and consumer protection rules ^S1. Separately, a Central Banking article dated one month prior to that report describes PSD3 as linked to European Commission proposals on financial-sector preparedness, specifically enabling retailers to provide cash withdrawal services without requiring a purchase, as part of broader efforts to preserve cash access as bank branches and ATMs decline ^S2. This is being pursued alongside separate legal tender legislation for euro cash and digital euro legal-tender proposals ^S2.

Contradicting the "finalised" characterisation, a payments provider's general terms and conditions (dated shortly before the Deloitte report) refers to PSD3 and the PSR as "forthcoming" and "proposed," and applies antifraud limits to SEPA Credit Transfers and SEPA Instant Credit Transfers on the basis of anticipated PSD3/PSR requirements for customer-defined security parameters and dynamic transaction-risk monitoring ^S3. A UK-focused commentary from the same period also describes PSD3 as "getting closer" for EU banks, implying it had not concluded ^S6. A payments-industry blog with content dated 2023 discusses PSD3/PSR as draft EU legislation intended to advance open banking and strengthen consumer protection ^S4.

ANALYSIS: The conflicting characterisations (finalised vs. forthcoming vs. "getting closer") within the same four-week window suggest either a genuine legislative milestone occurred that trade press has not uniformly caught up to, or the Deloitte/Paypers report's "finalised" framing is imprecise relative to the formal legislative status. This should be verified against a primary EU source (Official Journal publication or European Parliament/Council record) before being relied upon.

Why It Matters

PSD3/PSR governs core payments infrastructure rules: licensing, consumer protection, fraud controls (SCA-adjacent), and open banking access ^S1S3S4. Its interaction with cash-access policy and digital euro legal tender proposals indicates EU policymakers are treating card/digital payment fees, cash access, and account-to-account rails as a single connected policy agenda rather than separate workstreams ^S2.

Strategic Implications

Merchants

• Potential new obligation or option to provide cash withdrawal services without requiring a purchase, which would change retail operating models and till/cash-handling processes ^S2.
• Merchants in cash-declining markets (Sweden cited) face rising card/digital payment fees as cash usage falls, which the evidence links to reduced merchant bargaining leverage once cash is no longer a viable fallback ^S2.

Banks/Issuers

• Banks are the direct subject of PSD3 licensing changes and are described as facing a countdown to compliance ("getting closer") ^S6.
• Digital euro legal tender proposals would constrain fees banks/PSPs can charge on mandatory digital euro payment services, since the draft rules state such fees "must be objectively" justified rather than eroding face value ^S2.

PSPs

• PSPs are already building compliance infrastructure (customer-defined security parameters, dynamic transaction-risk monitoring, antifraud limits on SEPA/SCT Inst) ahead of confirmed final rules, which carries execution risk if final requirements diverge from current drafts ^S3.

Fintechs

• Open banking-focused fintechs are positioning PSD3/PSR as an extension of PSD2's open banking mandate, with consumer protection as a stated objective ^S4.
• Vendors are linking PSD3/PSR to emerging automated/agentic payment initiation use cases, suggesting fintechs anticipate the framework will need to address non-human-initiated transactions, though the evidence does not specify how ^S5.

Card Networks / Acquirers

Insufficient evidence in the retrieved sources.

Competitive Impact

Firms that have already begun implementing PSD3/PSR-anticipated controls (e.g., the Malta-licensed provider in ^S3) may gain a compliance head start if the framework is confirmed as finalised, per ^S1. Conversely, if ^S1's "finalised" claim is premature relative to actual legislative status, early movers risk having built controls against draft requirements that could still change before formal adoption. Cash-declining markets are described as seeing merchants pay higher card/digital fees, which the evidence suggests advantages card/digital payment providers over merchants in the near term, though this dynamic is presented as a byproduct of cash decline rather than a direct PSD3 effect ^S2.

Technology Impact

• Customer-defined security parameters and dynamic transaction-risk monitoring for SEPA Credit Transfers and SEPA Instant Credit Transfers are cited as PSD3/PSR-anticipated technical requirements ^S3.
• Open banking APIs and infrastructure are described as the continuation focus of PSD3/PSR from PSD2 ^S4.
• Tokenization is discussed in the context of agentic commerce and automated payment initiation alongside PSD3, though the evidence does not detail specific technical mandates linking the two ^S5.

Regulatory Impact

• PSD3/PSR: Central topic; status is contested in the evidence between "finalised" ^S1 and "forthcoming/proposed" ^S3S6.
• Digital euro legislation: Draft EC and Council proposals would grant legal tender status with mandatory acceptance and fee constraints, discussed alongside PSD3 in the context of cash/payment access policy ^S2.
• Legal tender for euro cash legislation: Proposed European Parliament amendments encourage retailer-based cash access, run in parallel with PSD3 discussions ^S2.
• SCA / fraud controls: PSD3/PSR reportedly includes customer-defined security parameters and dynamic transaction-risk monitoring requirements, per one PSP's terms ^S3.

Opportunities

• Retailers positioned to offer cash-withdrawal-without-purchase services could capture new foot traffic or fee income if the EC's cash-access proposals proceed ^S2.
• PSPs and banks that build compliant fraud-monitoring and customer-control infrastructure early may reduce compliance risk if PSD3/PSR is confirmed finalised as ^S1 states.
• Fintechs building on open banking rails have a stated regulatory tailwind toward continued consumer-protection-focused expansion ^S4.

Risks

• Regulatory status risk: Materially conflicting reports on whether PSD3/PSR is finalised or still draft ^S1 vs. ^S3S6 create planning risk for firms setting compliance timelines.
• Execution risk: PSPs implementing controls against "forthcoming" requirements ^S3 may need to re-engineer systems if final text differs.
• Merchant cost risk: Declining cash usage is linked to rising card/digital fees for merchants, a dynamic that could intensify if cash-access policy interventions fail to gain traction ^S2.
• Fee-regulation risk for PSPs/banks: Digital euro proposals would restrict fee-setting on mandatory digital euro services, a constraint that could extend in spirit to broader PSD3/PSR fee discussions, though this is not stated directly ^S2.

Outlook — What to Monitor Next

• Confirm actual legislative status of PSD3/PSR via a primary EU source (Official Journal, European Parliament, or Council publication) to resolve the finalised-vs-draft discrepancy ^S1 vs. ^S3S6.
• Track EC follow-through on the 2026 financial-sector preparedness report's retailer cash-withdrawal proposals ^S2.
• Monitor progress of the legal tender for euro cash legislation and digital euro legal-tender proposal through the European Parliament and Council ^S2.
• Watch for updated PSP/bank terms-and-conditions changes (as in ^S3) once final PSD3/PSR text is confirmed, to assess compliance gaps.
• Follow UK Pay by Bank and Open Banking developments referenced alongside PSD3 commentary, to compare EU vs. UK regulatory divergence ^S6.

Confidence Assessment

Source count: 6. None are primary/regulator sources (no European Commission, European Parliament, Council, or EBA documents); all are trade press, vendor blogs, or a PSP's own terms and conditions, at quality tiers 3–4. Overall confidence: Low. The core factual question — whether PSD3/PSR is finalised or still in draft — is contradicted across the retrieved sources, and no primary legislative source is available to adjudicate.

Sources

^S1 PA EU, Deloitte report on EU payments landscape — thepaypers.com — https://thepaypers.com/payments/news/pa-eu-deloitte-and-the-paypers-launch-eu-payments-report

^S2 Merchants in the cash system - Central Banking — centralbanking.com — https://www.centralbanking.com/central-banks/currency/banknotes/7976651/merchants-in-the-cash-system

^S3 General Terms and Conditions | Account, Card Use, Agreement, Definitions | Blackcat — blackcat.app — https://blackcat.app/terms-conditions

^S4 Open banking | Read the latest articles | Tink blog — tink.com — https://tink.com/blog/open-banking

^S5 Securing agentic commerce through advanced tokenization — nuvei.com — https://www.nuvei.com/posts/the-role-of-tokenization-in-securing-agentic-payments-and-autonomous-commerce

^S6 Why 2026 is a make or break year for Pay by Bank in the UK — redcompasslabs.com — https://www.redcompasslabs.com/insights/make-or-break-year-for-pay-by-bank-uk-amazon-ebay

*Generated automatically. All factual claims carry [S#] markers referring to the numbered sources above. Analytical judgements are the model's interpretation and are not sourced.*