Why is the shift from directive to regulation significant?

Why Is the Shift From a Directive (PSD2) to a Regulation (PSD3/PSR) Significant?#

The transition from PSD2 (Payment Services Directive 2) to PSD3 (Payment Services Regulation – PSR) marks a crucial evolution in European financial regulation. The key difference lies in how the law is applied across EU member states.

1. Regulations Apply Uniformly Across the EU#

• PSD2 was a directive, meaning each EU country interpreted and implemented it separately, leading to inconsistencies in enforcement.
• PSD3 will be a regulation (PSR), which means it applies directly to all EU member states without variations, ensuring standardized security, compliance, and consumer protections.

2. Stronger Consumer Protections & Security#

• PSD3 refines Strong Customer Authentication (SCA) rules, ensuring better fraud prevention and fewer exemptions.
• With consistent security standards, payment providers and financial institutions must adhere to phishing-resistant authentication methods, such as passkeys.

3. Better Market Competition & Innovation#

• PSD3 promotes fairer competition by improving access for non-bank financial service providers (PSPs).
• It encourages innovation in authentication and payment technologies, including biometrics and passkey-based login systems.

4. Clearer Guidelines for Payment Service Providers (PSPs)#

• Under PSD2, differences in national laws created uncertainty for financial institutions.
• PSD3 establishes universal rules for security, compliance, and fraud monitoring, reducing legal ambiguity.

5. Stronger Compliance for Digital Authentication#

• PSD3/PSR aims to align payment security with modern authentication trends by:
  • Expanding SCA requirements to ensure stronger fraud protection.
  • Encouraging the adoption of passwordless authentication, such as passkeys.
  • Reducing reliance on passwords and OTPs, which are prone to phishing attacks.

Conclusion#

The shift from PSD2 as a directive to PSD3/PSR as a regulation eliminates inconsistencies, enhances security, and promotes seamless digital payment innovation. For organizations implementing modern authentication solutions like passkeys, PSD3 ensures standardized security requirements across the EU, making compliance simpler and more predictable.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →