Europe is rewriting its payment rules. When a scam call empties someone's account, the bank will often be the one paying it back. And the data banks sit on is about to get a price. Here is what changes, who feels it first and what you can build on top.
The rulebook for how money moves. Every EU country now reads the exact same text.
Conduct rules move from a directive into a regulation, so Germany, France and Lithuania read the same text. Fraud liability, payee checks, open banking APIs and fee transparency live here. [3]
The licence side. Payment and e money institutions end up under one roof.
PSD3 repeals PSD2 and the E Money Directive. Authorisation and supervision stay national. Existing firms get a transition window to show they meet the new rules. [3]
PSD2 forced banks to open a door. This package makes them responsible for what walks through it, and FiDA lets them charge for the hallway. The winners will treat compliance work as product work.
PSD3 and PSR are agreed. The Council finalised its first reading position on 21 October 2026 and Parliament's final vote is pencilled in for the December plenary. Publication follows in early 2027, so most rules apply in late 2028. FiDA has no deal yet. [12] [14]
The Instant Payments Regulation pulled some of the hardest builds forward. Banks have shipped them. PSR mostly adds the liability on top. [25]
Share of check results, EPC data presented in August 2026. About 2.2 billion checks in the second quarter alone. [24]
forsa survey for the Federation of German Consumer Organisations, 1,030 online banking users, August 2026. [22]
like the payee check in principle
rate the way banks run it today as bad
of those warned see a warning on about every fourth transfer or more
False alarms are now the real risk. If customers learn to click every warning away, the PSR refund rule will hit the banks with the weakest name matching hardest. Better matching is a product advantage today, two years before the liability lands.
The fourteen changes we think matter most. Flip between the old and the new rules and see what it looks like in real life.
The bank checks payee name against IBAN for all credit transfers. If it fails to flag a mismatch, it refunds the payer. [3][10]
In practice You pay an invoice from Müller GmbH. The app shows no match before you confirm, because the IBAN belongs to someone else.
If a fraudster poses as your bank and you report it to the police and the bank, the bank must refund in full within 15 business days, or refuse with reasons if it suspects fraud or gross negligence by you. [2][13]
In practice A caller shows your bank's real number and talks you into a safe account transfer. The bank pays you back.
If a fraudster initiates or changes a transaction, the payment provider covers the full amount. [2]
In practice Malware swaps the IBAN in a payment you prepared. Your bank refunds the full amount.
Real time monitoring, spending limits and blocking options for users, plus a legal basis to share fraud data between providers. [2][3]
In practice A customer sets a €500 daily limit for new payees in the app before travelling.
Large platforms and search engines must check that financial advertisers are authorised. If they are told about fraudulent content and leave it up, they are liable to the bank that refunded the victim. [2][15]
In practice A fake bank ad stays online for days after a report. The bank refunds the victim and claims the money from the platform.
Electronic communication providers must cooperate and share information with payment providers to fight fraud. [2][4]
In practice A telco flags calls that spoof a bank's number and passes the signal to the bank.
The API becomes the only access route and must be as fast as the bank's own app. Banks publish performance figures every quarter, cannot demand a contract and face a list of banned obstacles. The fallback goes. [5][13][16]
In practice A payment initiation provider no longer has to push users through three extra screens in the bank's flow.
Banks give users a dashboard to see and withdraw data permissions for free. A withdrawn permission can be restored within 48 hours, and records stay for two years. [17][13]
In practice A user sees four apps reading her account and switches off two of them in one screen.
The 180 day logic moves into law. The bank authenticates at first access, then the provider renews the customer's consent itself. [4][5]
In practice A budgeting app keeps working for six months without sending the user back to the bank.
One payment institution regime with an electronic money subcategory. Existing firms reapply or prove compliance within the transition. [3][4]
In practice A Berlin EMI updates its licence file and keeps passporting across the EU.
Banks can refuse or close accounts only on specific grounds such as anti money laundering rules. A vague financial crime risk is no longer enough, and refusals can be challenged with the supervisor. [18]
In practice A payment institution gets a refusal without a real reason and takes it to the supervisor.
Strong authentication must be free, must not depend on a smartphone alone and must fit people with disabilities or low digital skills. [3][4]
In practice An 80 year old customer confirms payments with a card reader instead of an app.
All ATM and conversion fees shown up front. Shops can give cash without a purchase, up to €150. A country may set a lower cap, but not below €100. [2][16]
In practice A drugstore till pays out €100 to a customer who buys nothing.
Phone makers and service providers must give payment providers access on fair, reasonable and non discriminatory terms. [2]
In practice A bank launches its own tap to pay wallet on every major phone.
Based on the phased plan in the April 2026 compromise paper. Months count from entry into force. Nothing here is final law yet. [7]
Phase 1 opens. Savings, consumer credit and motor insurance data. This is where switching and refinancing products start.
Selin is 34 and works as a freelance designer in Berlin. Three moments over three years show how these rules land in a real life. Selin is made up, the rules are real. Moments two and three assume FiDA is agreed in 2027.
The call
First the payee check warns her that the name and IBAN do not fit. If the caller still talks her into it, she reports it to the police and her bank. Because the fraudster pretended to be her bank, the bank has 15 business days to pay her back in full or explain why not. [3] [13]
PSR payee check and the impersonation refund, applying from late 2028.
Fraud signals that work in real time, a refund process that runs in days and a way to claim the money back from telcos and platforms.
Take a guess before you read the answer. Based on the agreed PSR text. Real cases always depend on the details and on national courts.
Malware on your laptop quietly changes the IBAN in a transfer you set up. €3,200 is gone.
Where does your company sit? We placed each type of player by what the rules will cost it and how much new revenue they open up. The scores are our own estimates from 0 to 10.
They carry the new fraud refunds, payee checks, API performance KPIs and the permission dashboard. Under FiDA they are the biggest data holders and can also be data users.
Split API access into what the law makes free and a paid premium tier. Join a FiDA scheme early to shape compensation rules. Build recourse claims against platforms and telcos into fraud operations.
A large bank keeps PSR account access free, then sells a premium API with enriched transaction data and higher call limits to lenders and accounting software.
Every new rule creates a job someone will get paid for. Here are the twelve we find most interesting. Filter by who is best placed to build them. The use cases are examples.
Since 7 October 2024, UK banks and fintechs must refund most scam victims, even when the customer pressed send. The rule split the industry and it is live. Below are the rules, the numbers, the fights and what we learned building fraud flows for a UK digital bank launch at RUUT.
| EU, PSR | UK, mandatory reimbursement | |
|---|---|---|
| Status | Applies from late 2028 [12] | Live since 7 October 2024 [29] |
| Which scams | Impersonation of the customer's own bank, and failed payee checks [13] | Almost every authorised push payment scam over Faster Payments [30] |
| Who pays | The payer's bank, with recourse to platforms and technical providers [4] | Split 50/50 between the sending and the receiving firm [30] |
| How fast | 15 business days to refund or refuse with reasons [13] | 5 business days, up to 35 when more evidence is needed [29] |
| Limits | Full amount, unless fraud or gross negligence by the customer [13] | Cap of £85,000, optional excess up to £100, a consumer standard of caution [29] |
of money lost to in scope scams paid back, £316m in 18 months [29]
of claims closed within five business days [29]
less lost to scams a year, a fall of about 21% [31]
international scams outside the rule, 2023 to 2025 [30]
Independent evaluation by Frontier Economics for the PSR, July 2026, and the PSR reimbursement dashboard to March 2026.
Banks pay for fraud that mostly starts somewhere else.
54% of scams start on Meta's platforms, yet the refund bill lands only on payment firms. [36] Smaller fintechs said a few large cases could wipe out a year of margin. Refund rates range from 21% to 94% across firms, and one firm used the customer caution exception in over a quarter of cases by value while others never did. Fraud is also moving to crypto exchanges and overseas transfers, where the rule stops. [30]
The UK built the toolbox around the refund rule.
Confirmation of Payee has run since 2020 and now covers more than 320 firms and over 99% of Faster Payments senders. In October 2026 the regulator removed its expiry date. [32] Banks may hold a suspicious payment for up to four extra days. [33] Open banking recurring payments got their own industry scheme in June 2026. [34] The PSR itself is being folded into the FCA, the bill now sits in the Commons. [35] A consultation on fixing the refund rule follows in December 2026. [30]
Tap each step. These are defences UK banks and fintechs run today, many of which we designed or chose partners for at RUUT. EU teams can copy what worked.
Safe account and bank impersonation scams, where a caller coaches the victim live.
The UK proves refund rules change behaviour, losses fell within a year. It also proves fraud moves to wherever the rules stop. EU banks have two years to build calmly what UK firms had to build in a rush.
I built digital banks under PSD2. Compliance was the big topic back then too. What is new with PSD3 is that it opens the way to better, more flexible financial services and new products that actually mean something to people.
Fighting these rules is wasted energy. Building them into the product and turning them into something useful for customers is one of the smartest moves any bank, fintech or company can make right now.
FiDA goes even further. It brings new opportunities, new business models and some fresh air into competition. Fintech and banking have exciting years ahead.
Mehmet Burak · fspark9
fspark9 helps banks, fintechs and companies with customers turn regulation into product decisions.
Status checked on 26 October 2026. The Parliament vote, publication and application dates for PSD3 and PSR are indicative dates from the institutions' calendars and law firm trackers. FiDA is still under negotiation, so phases, scope and gatekeeper treatment can change. Impact scores, sector verdicts and use cases marked as our view are fspark9 analysis and do not constitute legal advice.