The European Commission announced a review of PSD2 which ran from May 2022 to August of the same year. The review was to determine whether the Directive was still fit for purpose given the significant changes seen in the payments sector. The consultation on the effects of PSD2 showed that, while the Directive had in some part removed barriers to innovation and new players by paving the way for open banking, they had remained too high to ensure that it would take off completely. For many banking institutions the costs relating to the reforms were highlighted and largely outweighed the benefits. For example, developing new APIs is estimated to require more than €2 billion, and this is in addition to the €5 billion needed to roll out SCA according to a recent study on the impact of PSD2.
The acceleration of digitalisation requires a stronger framework. Since PSD2 we’ve seen an uptick in crypto, buy now pay later, and new players entering the market – some not in the scope of PSD2.
“The acceleration of digitalisation requires a stronger framework. Since PSD2 we’ve seen an uptick in crypto, buy now pay later, and new players entering the market – some not in the scope of PSD2,” notes Sara Berujon, Head of Payments Services at J.P. Morgan Europe. Three key conclusions came to the fore from the consultation according to Jonathan Prince, Co-founder and CTO of Finologee. “The first is that it is limited to payment accounts, which creates a barrier for open finance, the second is the SCA mechanism which while important doesn’t favour user experience. Finally, there is a clear lack of harmonisation between exposed APIs.”
A draft text of PSD3 stemming from the consultation was leaked early June 2023 before the final draft was released on June 28th 2023. The text covers a number of aspects that are introduced to ensure that PSD3 continues to foster innovation. The updated Directive brings regulatory consistency. “Consistency and interplay with other regulations is at the core of the new text, ensuring a co-existence with other texts such as MiCA, the GDPR and DORA,” Berujon explains. Ultimately, PSD3 brings about a merge between PSD2 and the current e-money Directive.
The original payments services Directive broke down barriers and helped to break down the monopoly of banks only providing payment institutions and now we have players such as Amazon Pay, Airbnb Payments, Rakuten and many others in Luxembourg for example.
What is most critical is that PSD3 takes a significant step in the right direction in terms of fostering innovation, which never truly materialised under PSD2. “The original payments services Directive broke down barriers and helped to break down the monopoly of banks only providing payment institutions and now we have players such as Amazon Pay, Airbnb Payments, Rakuten and many others in Luxembourg for example,” says Prince. “However, post the financial crisis the reassessment of the Directive saw the introduction of SCA which while fantastic for fraud prevention has somewhat killed user experience,” he continues.
“Banks had to heavily invest to become compliant and many almost missed the innovation train while that was happening,” explained Berujon. “What we saw with PSD2, is increasing friction along the payment chain in the search for protecting customers. This trend is going to continue with PSD3 imposing additional protection to vulnerable customers.” she adds.
While possible friction may not block innovation, it can dangerously slow it down.. It remains a balancing act as often, in times of economic crisis, consumers themselves are keen to have greater control over their finances and therefore their purchases, particularly when making online purchases using a credit card. The various steps involved when SCA is in play reinforce a sense of security.
The EU will therefore be sensitive to this in rolling out PSD3, even if this reinforcement runs counter to innovation in the payment industry. “’In the new Directive, the European Commission wants to clarify and strengthen the SCA with new rules to guarantee its application across the different payment channels,” assures Berujon. However, she also believes that control will involve more modern tools such as behavioural biometrics, which make use of facial recognition.
PSD2 largely focused on consumer protection and PSD3 further strengthens it, however the new Directive also deals with the complex issue of cross-border payments by proposing standards to solve the interoperability issue. PSD3 therefore places particular emphasis on new and alternative payments methods and introduces provisions to prevent the risks associated with instant payments, as responsibilities in the event of errors are being clarified.
Clearly, the payments sector has never evolved so fast, and regulations must adapt to new data such as crypto currencies, but also perhaps soon the digital euro, which would make it possible to relax the rules. In view of this, expectations for PSD3 are twofold: security must no longer be strengthened to the detriment of the relative fluidity of the customer experience, and all the measures that will be taken must remain bearable in terms of costs to enable payments providers to invest to innovation.