PSD2
Payment Services Directive 2
PSD2 is EU Directive 2015/2366, which regulates payment services in the European Economic Area, introduces Strong Customer Authentication (SCA), and opens access to bank data via APIs.
What is PSD2 (Payment Services Directive 2)?
PSD2 (Payment Services Directive 2) is the second European directive on payment services. It defines who may provide payment services in the EU, what security requirements they must meet, and how data exchange between banks and third-party services is organized. The directive has applied since January 2018 and is binding on all EEA member states, although its provisions are transposed into national legislation.
## What PSD2 introduces
First, Strong Customer Authentication (SCA): confirming a payment or logging into online banking requires at least two independent factors from three groups: knowledge (password, PIN), possession (phone, card, token), and inherence (biometrics). Second, open banking: issuing banks must give licensed third-party providers access to account data (Account Information Service, AIS) and to payment initiation (Payment Initiation Service, PIS) through standardized APIs.
## How it works in practice
For online card payments, SCA is usually implemented through the 3-D Secure 2.x protocol: the issuer receives the transaction data and decides whether an additional step is needed, such as confirmation in the bank's app or a one-time code. Exemptions (low-value, transaction risk analysis, trusted beneficiaries, recurring payments after the first confirmed one) are set by the European Banking Authority's Regulatory Technical Standards (RTS). Each exemption depends on the conditions and the decision of the issuing bank, so it cannot be relied on in advance.
## Where it matters in high-risk verticals
In fintech and payments, PSD2 affects checkout conversion, transaction approval rates, and subscriptions with recurring charges. A high share of declines due to unavailable authentication lowers the approval rate and directly hits the merchant's revenue. Open banking is used for pay-by-bank, income verification, and account verification during onboarding.
## Common mistakes
A typical mistake is assuming PSD2 works identically across all EU countries: national regulators and banks interpret exemptions and implementation deadlines differently. A second mistake is failing to pass in the payment request the data needed to apply exemptions (for example, indicators of a repeat payment using a stored card), which causes the bank to require full authentication. A third is confusing PSD2 with GDPR: the directive governs payments and account access, not general rules for processing personal data.
## What PSD3 changes
FAQ
What is SCA in PSD2?
Strong Customer Authentication is the requirement to confirm a payment with at least two independent factors: knowledge, possession, or inherence. It is implemented through 3-D Secure, the bank's app, or biometrics.
Does PSD2 apply to payments from Russia?
Not directly: the directive applies within the EEA. However, if the acquirer or issuer is located in the EEA, or the card was issued there, SCA requirements may apply to the transaction.
Why does PSD2 affect payment approval rates?
If the bank requires authentication and the customer does not complete it, the transaction is declined or fails due to a timeout. Therefore, the share of successful confirmations directly affects the approval rate.