PSD3 and the PSR: How the EU's Next Payments Framework Reshapes DACH Market Entry

Every payment institution operating in Europe today is built on the architecture of PSD2. That architecture is being replaced. The European Commission's payments package — a third Payment Services Directive and, for the first time, a directly applicable Payment Services Regulation — will redraw the legal foundation under every payment and e-money business in the Union. For firms planning a DACH market entry, the sensible question is not whether to care, but how to sequence the transition.

The package, proposed in June 2023, splits today's PSD2 into two instruments: PSD3, a directive covering authorisation and prudential supervision, and the Payment Services Regulation (PSR), which moves the conduct rules — transparency, strong customer authentication, open banking, liability — into a regulation that applies identically across all member states, without national transposition. At the time of writing, the final texts are in the last phase of the legislative process; application follows a transition period after entry into force, putting the operative dates in the second half of the decade. The direction of travel, however, has been clear for two years — and it rewards early preparation.

The Quiet Revolution: E-Money Disappears as a Category

The most structural change is taxonomic: the separate e-money regime of the E-Money Directive is folded into the payments framework. E-money institutions become a subcategory of payment institutions, licensed and supervised under one rulebook. For the DACH market this is more than housekeeping — Germany's ZAG implements both regimes today, and countless product architectures were designed around the boundary between payment services and e-money issuance. That boundary is being erased; product classifications, safeguarding arrangements, and licence scopes should be reviewed against the merged regime.

For firms currently weighing an EMI licence for their DACH entry, the practical guidance is not to wait — under the transition provisions existing licences remain valid for a limited period and carry over into the new regime once the institution has given its supervisor, within that period, the information needed to verify that it meets the new requirements — but to design governance and safeguarding so that the migration is an update, not a rebuild.

What the PSR Hardens

• Fraud and liability. The framework extends liability toward impersonation fraud and mandates IBAN-name verification across credit transfers — continuing the line drawn by the Instant Payments Regulation.
• Strong customer authentication. SCA rules are consolidated and clarified, with accessibility and outsourcing dependencies addressed more explicitly than under PSD2.
• Open banking without screen scraping ambiguity. Dedicated interfaces become the norm, with performance requirements and user-facing permission dashboards that make data-sharing visible and revocable.
• Access to payment systems. The Instant Payments Regulation already opened direct participation in designated payment systems to payment and e-money institutions (to be transposed by member states by 9 April 2025). The new package builds on that: payment system operators must publish their access rules and give reasons for a refusal, banks may refuse or close a payment institution's account only on narrowly defined grounds, and client funds held in settlement accounts with designated payment systems count as safeguarded — reducing structural dependency on commercial bank sponsors.

“

PSD2 made open banking legal. The PSR is the attempt to make it work — uniformly, enforceably, and without the national footnotes that consumed compliance budgets for a decade.

Why a Regulation Matters for Multi-Market Strategies

Under PSD2, a firm passporting from Germany into Austria dealt with two national transpositions of the same directive — similar, never identical. The PSR ends that for conduct rules: one text, one interpretation hierarchy, one set of technical standards. For market-entry planning, this compresses the legal-analysis phase of multi-country rollouts and shifts the effort toward genuinely national topics — consumer-protection add-ons, language requirements, and the supervisory culture of each authority, which no regulation harmonises away.

Germany remains the reference market in this respect: BaFin's expectations regarding governance substance, outsourcing control, and IT security — shaped by ZAIT and now DORA — will continue to define the de-facto bar for serious applicants, whatever the rulebook is called.

Open Banking: From Cost Centre to Product

PSD2's account-access regime was famously asymmetric: banks bore the interface costs, third parties captured the product value, and the data perimeter stopped at payment accounts. The new framework rebalances parts of that equation — dedicated interfaces with enforceable performance expectations, permission dashboards that make consent tangible, and a cleaner enforcement path when access degrades. For account-servicing institutions, this is the moment to stop treating the API as a compliance artefact and start treating it as a product surface: the firms that expose reliable, well-documented interfaces will be the preferred partners when data-driven propositions scale.

The strategic horizon extends further: the parallel Financial Data Access proposal (FiDA) would carry the open-banking logic into savings, investments, and insurance data. Whatever its final timetable, the direction is one-way — firms building consent management, data-sharing infrastructure, and monetisation models for the PSR world are simultaneously building the muscles the open-finance decade will demand.

What Happens to the Old Battlegrounds

Veterans of PSD2 will recognise the new framework's quiet settling of old disputes. The exemptions that generated a decade of boundary litigation — commercial agents, limited networks, telecom billing — are being tightened and standardised, with notification duties that make exemption-based business models more transparent to supervisors and less comfortable for those stretching them. Firms whose DACH structures rely on an exemption should re-derive that analysis against the texts agreed between Parliament and Council now, because the cost of discovering a reclassification after launch is measured in restructuring, not in legal memos.

Enforcement architecture also matures: stronger roles for the European Banking Authority, a consolidated register of authorised firms, and harmonised sanction logic reduce the arbitrage between forgiving and strict host states. The practical meaning for multi-market operators is uniformity in both directions — the same rules everywhere, and the same consequences everywhere.

Sequencing the Transition

1. 01Classify your product portfolio against the merged payments/e-money taxonomy and flag every service whose categorisation shifts.
2. 02Audit safeguarding and prudential arrangements against the stricter of current and proposed requirements — building to the higher bar avoids double work.
3. 03Treat verification-of-payee and fraud-liability capabilities as convergent obligations across the Instant Payments Regulation and the PSR; one engineering roadmap should serve both.
4. 04If open banking interfaces are part of your model, budget for dashboard and performance requirements early.
5. 05Track the transition timelines for existing authorisations so licence migration is a scheduled project, not an emergency.

Conclusion

PSD3 and the PSR will not change what a good payments business does; they change how uniformly Europe demands it. The merger of the e-money regime, the hardening of fraud and SCA rules, and the shift of conduct law into a regulation collectively favour firms with clean product classification and substantive governance — the same qualities DACH supervisors have always rewarded. Aegiron Capital Group helps international payment and e-money firms align their market entry with the coming framework — from putting the product into context to the project plan for the licensing procedure, alongside the law firm you engage.