What is PSD3 and how does it differ from PSD2?

What is PSD3?#

PSD3 (Payment Services Directive 3) is the upcoming revision of PSD2, designed to further enhance security, innovation, and consumer protection in digital payments. Unlike PSD2, PSD3 will be implemented as a Payment Services Regulation (PSR) rather than a directive, ensuring uniform enforcement across all EU member states.

Key Differences Between PSD2 and PSD3#

1. Directive (PSD2) vs. Regulation (PSD3)#

• PSD2 was a directive, meaning EU countries had flexibility in how they incorporated it into national laws.
• PSD3 (PSR) will be a regulation, which applies directly and uniformly across all EU countries without local variations.

2. Strong Customer Authentication (SCA) Updates#

• PSD2 introduced Strong Customer Authentication (SCA), requiring two-factor authentication (2FA) for most electronic payments.
• PSD3 aims to refine SCA by:
  • Clarifying exemptions and risk-based application of authentication.
  • Better integration with modern authentication methods, including passkeys and biometric authentication.
  • Reducing friction in user authentication without compromising security.

3. Enhanced Consumer Protection#

• PSD3 introduces stronger consumer rights for fraud prevention, refund policies, and data protection.
• Payment service providers (PSPs) will have clearer accountability rules in cases of fraud.

4. Leveling the Playing Field for Non-Bank Payment Providers#

• PSD3 improves access for FinTechs and non-bank payment service providers (PSPs) by allowing them greater access to banking infrastructure.
• This fosters more competition and innovation in digital payments.

5. Security and Fraud Prevention#

• PSD3 strengthens fraud detection mechanisms by mandating enhanced transaction monitoring and more rigorous identity verification.
• It also introduces clearer guidelines for outsourcing authentication, allowing third-party authentication providers like passkey services to integrate more effectively.

How Does PSD3 Impact Passkeys?#

While passkeys are not explicitly mentioned in current PSD3 drafts, the regulation's focus on modern authentication methods and phishing-resistant MFA aligns well with passkey technology. The transition to PSR ensures standardization, making passkeys a strong candidate for compliance with future authentication requirements.

Conclusion#

PSD3 builds upon PSD2’s foundation but increases security, eliminates national inconsistencies, and fosters digital payment innovation. Organizations preparing for PSD3 should focus on phishing-resistant authentication solutions like passkeys to stay ahead of regulatory changes.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →