Payment Service Directive is a European regulation that sets rules for how digital payments work

Payment Service Directive (PSD) is a set of European Union laws that govern how banks, payment providers, and fintech companies handle your money transfers and payments. The original directive came into force in 2007; a second version, PSD2, took effect in 2018 and added stronger security and consumer protection rules. If you send money across Europe, use a payment app, or bank online, PSD rules shape how your transaction is processed and what happens if something goes wrong.

The directive applies to any payment service provider operating in the EU or UK — which includes most major banks, digital wallets, money transfer services, and newer payment apps. It does not directly apply to payments within the United States, but many international payment providers follow PSD principles because they operate in Europe. Understanding PSD matters if you make cross-border payments, use fintech services, or want to know what legal protections cover your transactions.

Key Takeaways

  • PSD2 requires payment providers to authenticate your identity using two or more verification methods before processing certain transactions, a security measure called strong customer authentication.
  • The directive gives you the right to move your payment data between providers and to see your transaction history in a standardized format.
  • Payment providers must refund unauthorized transactions within specific timeframes — usually 10 business days if you report the fraud promptly.
  • PSD2 allows third-party apps to access your bank account with your permission, which increases convenience but requires you to grant explicit consent.

Strong customer authentication: the two-step verification requirement

PSD2 introduced strong customer authentication (SCA), which requires payment providers to verify your identity using at least two independent methods before processing a payment. These methods fall into three categories: something you know (a password or PIN), something you have (your phone or a security key), or something you are (a fingerprint or face scan). A text message code plus your password counts; a password alone does not.

SCA applies to online payments, transfers between accounts, and access to your payment account from a new device. Some transactions are exempt — recurring payments you have already authorized, payments under €30 in certain circumstances, and transfers to accounts in your own name. If you make a payment and your bank asks for a second verification step, that is SCA in action. The requirement exists to reduce fraud, though it can slow down transactions by a few seconds to a few minutes.

Your right to access and move your payment data

PSD2 gives you the legal right to see your transaction history and account information in a standardized, machine-readable format. You can request this data from your bank or payment provider at no cost, and they must provide it within 30 days. This right exists so you can move your data to a different provider without losing your history or having to re-enter information manually.

The directive also allows you to authorize third-party apps — budgeting tools, investment platforms, or payment aggregators — to access your account data and initiate payments on your behalf. These apps must ask for your explicit permission and show you exactly what access they are requesting. You can revoke that permission at any time. This openness has created a market for fintech services that were not possible before, but it also means you need to be careful about which apps you grant access to.

Fraud protection and refund timelines

If someone makes an unauthorized payment from your account, PSD2 requires your bank or payment provider to refund you within 10 business days of you reporting the fraud. The provider can investigate and ask you questions during that time, but the money must be returned unless they can prove you were negligent or acted fraudulently yourself. This protection applies to most payment types — card payments, bank transfers, and digital wallet transactions.

Your responsibility depends on when you report the fraud. If you report it before the transaction posts, the provider must stop it if possible. If you report it after the transaction clears, the 10-day refund clock starts. If you delayed reporting — for example, you did not check your account for months — the provider may argue you were negligent and refuse the refund. The key is to monitor your accounts regularly and report anything suspicious as soon as you notice it.

How PSD2 affects cross-border payments within Europe

One of PSD2's main goals was to make payments across EU borders as easy as domestic payments. The directive requires banks to process euro transfers between EU countries at the same speed and cost as domestic transfers. A payment from your account in Germany to an account in Spain should arrive within one business day and cost no more than a domestic transfer would.

This rule applies to SEPA (Single Euro Payments Area) transfers, which cover most EU countries plus a few others like Iceland and Norway. If you send money outside the SEPA zone — to the UK, US, or elsewhere — different rules apply and the provider can charge a fee. The speed and cost depend on the provider and the destination country. When you initiate a cross-border payment, your provider must tell you the exact fee and the expected delivery date before you confirm.

Third-party payment apps and open banking

PSD2 created the legal framework for open banking, which allows fintech companies and third-party apps to connect to your bank account with your permission. A budgeting app might read your transaction history; a payment app might initiate transfers on your behalf; an investment platform might check your balance. Each of these actions requires you to grant explicit consent, and the app must show you what it is accessing and why.

This openness has benefits — you can use one app to see all your accounts across multiple banks, or authorize a service to pay bills automatically without giving it your password. It also creates risk: if you grant access to an app you do not trust, or if an app is hacked, your account data could be exposed. PSD2 requires providers to use secure authentication and encryption, but the responsibility to grant access carefully falls on you. Before authorizing any third-party app, check what permissions it is asking for and whether you actually need that level of access.

What happens if a payment fails or is delayed

PSD2 requires payment providers to tell you the status of your payment — whether it is pending, completed, or failed — within one business day of you sending it. If a payment fails, the provider must explain why and tell you how to fix the problem. If a payment is delayed beyond the promised timeframe, you have the right to ask for compensation, though the amount varies by provider and the reason for the delay.

For domestic SEPA transfers, the standard is next-business-day delivery; for international transfers outside SEPA, it can take several days. If your provider promises faster delivery and misses that deadline, you can file a complaint. Most providers have a dispute process — you report the issue, they investigate, and they either confirm delivery or refund the money. Keep records of the payment confirmation and any communication with the provider in case you need to dispute it later.

Frequently Asked Questions

Does Payment Service Directive apply to payments in the United States?

PSD applies only to payments within the EU and UK. However, many US payment providers follow similar security and consumer protection standards because they operate internationally. If you use a US bank or payment app, check their terms to see what fraud protection and authentication rules they follow.

What should I do if I do not recognize a payment on my account?

Report it to your bank or payment provider immediately — do not wait. Under PSD2, you have the right to a refund within 10 business days if the transaction was unauthorized. Provide as much detail as you can about when you noticed it and whether you recognize the merchant or recipient.

Can I refuse to use two-factor authentication for payments?

No. Strong customer authentication is a legal requirement under PSD2 for most online payments and account access. Your provider must enforce it. However, some low-risk transactions and recurring payments you have already authorized may be exempt from the requirement.

Is it safe to give a third-party app access to my bank account?

It can be, if you trust the app and it is regulated. Check whether the app is licensed as a payment service provider in your country. Read what permissions it is asking for and grant only what you actually need. You can revoke access at any time through your bank's settings.

How long does a SEPA transfer take?

Under PSD2, a SEPA transfer within the EU should arrive within one business day and cost no more than a domestic transfer. Some banks offer faster delivery for an additional fee. Check your provider's terms for the exact timeline and any fees that apply.