Somewhere in Brussels right now, a lawyer is arguing about whether Apple counts as a “gatekeeper.” That sentence sounds boring until you realize it’s actually deciding who gets to build the next generation of banking apps in Europe. That’s PSD3 and FiDA in a nutshell. Dry names, huge consequences.
If you run a fintech, a crypto exchange with EU users, or you’re just trying to figure out why your bank suddenly wants you to approve data sharing from a new “permission dashboard,” this is the piece that actually explains it. No legalese. Just what changed, what’s coming, and what it means for your product roadmap.
Why PSD2 Wasn’t Built to Last
PSD2 gave Europe open banking back in 2018. It forced banks to open account data to licensed third parties through APIs instead of keeping it locked behind a teller’s window. That was genuinely revolutionary at the time. Budgeting apps, payment initiation services, and account aggregators all exist because PSD2 forced the door open.
But here’s the thing nobody tells you. PSD2 was written for a world before instant payments and before AI powered fraud. Some banks built excellent interfaces. Others built the bare legal minimum and called it a day. Screen scraping never fully died because plenty of “PSD2 compliant” APIs were unreliable enough that third parties kept the scraping fallback running quietly in the background.
Add rising APP fraud (authorized push payment scams, where someone tricks you into sending money willingly) and a fragmented directive that 27 member states interpreted 27 slightly different ways, and you get regulatory pressure for something stronger. That something is PSD3, paired with a new Payment Services Regulation, or PSR.
PSD2 vs PSD3 Differences: What Actually Changes
Here’s the part everyone searches for, so let’s get concrete. PSD3 doesn’t replace PSD2 with a bigger rulebook. It splits the old directive into two separate instruments, and that split is the single biggest structural change.
- One directive becomes two instruments. PSD3 (a Directive, needing national transposition) handles licensing, supervision, and authorization. The PSR (a Regulation, directly binding) handles the actual conduct rules: open banking access, fraud liability, and Verification of Payee.
- Screen scraping gets formally killed off. PSD2 banned it in theory but left loopholes when APIs underperformed. PSR closes those loopholes and pushes everyone toward dedicated, monitored APIs, with contingency measures if a bank’s interface goes down.
- Verification of Payee becomes mandatory EU wide. Before you send money, you’ll see whether the name matches the account, similar to what UK banks already do with Confirmation of Payee. This alone should cut a meaningful chunk of push payment fraud.
- Stronger fraud liability rules. Banks carry more responsibility when fraud happens through weak authentication or spoofed identities, not just when a customer was careless.
- Faster, harmonized licensing. PSD3 sets a three month clock on authorization decisions once an application is complete, addressing years of complaints about inconsistent, slow approvals across national regulators.
- E-money and payment institution rules merge. The old separate e-money directive gets folded into PSD3, simplifying licensing for firms that do both.
- API performance standards get real teeth. Regulators can now act on banks whose “open banking” APIs are technically compliant but practically unusable.
If you’re comparing PSD2 vs PSD3 differences for a compliance memo, that list above is the whole story. Everything else is implementation detail.
PSD3 and PSR Compliance Summary
For teams building fintech products in the EU, here’s the quick reference version:
- Full harmonization of conduct rules across all 27 member states through the PSR, removing the old patchwork of national interpretations
- No more screen scraping as a fallback data access method
- Mandatory Verification of Payee before payment confirmation
- Three month authorization timeline for new payment institution licenses
- Alignment with DORA (the Digital Operational Resilience Act) for operational resilience and ICT risk expectations
- Safeguarding rules updated, including the option to hold customer funds at central banks
- “Triangular passporting” clarified for firms operating through agents across borders
None of this is in force yet. That’s the part people keep getting wrong when they write about PSD3 like it’s already live.
The Real Timeline (Not the Rumor Mill Version)
PSD3 coverage online is a mess of outdated dates because the legislative process kept sliding. Here’s where things actually stand as of September 2026:
- June 2023 – European Commission proposes the PSD3 and PSR package.
- April 2024 – European Parliament adopts its negotiating position.
- June 2025 – Council of the EU adopts its own negotiating mandate.
- 27 November 2025 – Parliament and Council reach provisional political agreement after the final trilogue.
- 23 April 2026 – Final compromise texts of PSD3 and the PSR are published.
- 5 May 2026 – The Parliament’s ECON committee formally approves the agreed text.
- Expected H2 2026 – Formal plenary vote, Council adoption, signature, and publication in the Official Journal.
- ~20 days after publication – The PSR technically enters into force, but most of its operative provisions won’t actually apply for roughly 21 months after that.
- Realistic applicability window: Q2/Q3 2028 – PSD3 needs 18 months for national transposition, and the PSR’s main rules follow a similar delayed application schedule, so most obligations land around 2028, not 2026 or 2027.
The honest takeaway: PSD3 is agreed but not adopted, and “live” enforcement is still a couple of years out. Treat 2026 and 2027 as prep years, not deadline years.
FiDA: Financial Data Access Explained
If PSD3 upgrades open banking, FiDA is what turns it into open finance. And the distinction actually matters.
Open banking under PSD2 and PSD3 only covers payment accounts. FiDA, the Financial Data Access regulation, extends the same customer-controlled data sharing model to savings accounts, investments, mortgages, pensions, insurance products, and consumer credit. It’s a much bigger surface area, and it explicitly includes crypto asset service providers in scope as data holders and potential data users.
Also Read: how new crypto rules can affect token prices
A few things worth knowing about FiDA:
- Customer permission dashboards become mandatory. Every financial institution has to give customers a real time view of who’s accessing their data and let them revoke access instantly.
- A new regulated category appears: Financial Information Service Providers (FISPs). Any company wanting to pull or process financial data under FiDA needs this authorization, similar to how AISPs work under PSD2.
- Financial Data Sharing Schemes (FDSS) become the operating model. Instead of the EU dictating one technical standard, industry groups build sector specific schemes covering data formats, liability, and compensation for data holders.
- Big Tech exclusion is the sticking point. Trilogue negotiations have stalled repeatedly over whether Amazon, Apple, Google, and Meta should be locked out of the FiDA ecosystem as data users. This single political fight is the main reason FiDA’s timeline keeps slipping behind PSD3’s.
- Expected rollout is phased from 2027 onward, starting with accounts, savings, and areas like car insurance, assuming trilogue talks resume and adoption lands in 2026.
FiDA is the piece most fintech founders underestimate. PSD3 tightens a market you’re probably already in. FiDA opens an entirely new one, assuming the political fight over gatekeepers gets resolved.
Open Banking API Standards in Europe: What’s Actually Changing on the Ground
Regulation is one layer. The technical standards underneath it are another, and this is where day to day API work actually happens.
Europe never had one single mandated API spec. Instead, market initiatives filled the gap:
- Berlin Group NextGenPSD2 is the most widely adopted standard across continental Europe, used by a large share of German, French, and other EU banks.
- UK Open Banking Standard, now sitting at version 4.0.1 as of March 2026, remains the most mature implementation globally, predating PSD2 by design since the UK’s Competition and Markets Authority mandated it separately back in 2016. Oversight is now shifting from Open Banking Limited toward the FCA.
- Proprietary bank APIs still exist too, since PSD2 never forced a single technical format. This is exactly the fragmentation PSR is trying to clean up by mandating minimum performance standards rather than a single spec.
Under PSR, banks lose the “premium API” excuse many used to offer a better paid tier alongside a barely functional free one. Regulators are pushing toward one high quality, monitored, dedicated interface, with real contingency mechanisms if it goes down, instead of forcing third parties to fall back on scraping credentials directly.
What This Means for Fintech Startups
This is the section founders actually care about, so let’s be direct.
- Build for 2028, not 2026. The applicability window is further out than most headlines suggest. Don’t rush a compliance sprint for rules that aren’t binding yet, but do architect your data access layer so it’s easy to swap in new API standards later.
- API reliability becomes a competitive moat, not just a compliance box. Once premium tiers and scraping fallbacks disappear, the quality of a bank’s free API becomes the whole story. Startups that pick banking partners with genuinely good API uptime now will have an edge later.
- Open finance is a bigger opportunity than open banking ever was. If FiDA lands, the addressable data surface for personal finance apps, lending platforms, and even crypto onramps expands massively, from payment accounts alone to savings, investments, pensions, and insurance.
- New licensing category, new competition. FISP authorization under FiDA creates a fresh regulated lane. Expect a wave of new entrants and consolidation once that license type exists, similar to what happened with AISP registrations after PSD2.
- Fraud liability shifts change unit economics. If your product touches payment initiation, PSR’s stronger fraud liability rules mean you need to budget for authentication infrastructure now, not as an afterthought later.
- Crypto platforms should watch FiDA closely. Crypto asset service providers are explicitly named as potential data holders and users under FiDA’s scope. That’s a meaningful regulatory signal about how Brussels sees the line between traditional finance and crypto blurring.
Open Finance Regulations in Europe: The Bigger Picture
Europe isn’t moving alone here, and comparing notes helps set expectations. The UK’s Open Banking regime, built through the CMA order rather than an EU directive, remains ahead on maturity and API consistency, and it’s now evolving into open finance conversations of its own under FCA oversight.
Across the Atlantic, the US has its own version through Section 1033, tangled up in legal challenges for over a year, moving slower and messier than Europe’s coordinated track. Brazil has scaled its open finance framework to billions of monthly API calls, and India’s Account Aggregator system already covers close to three billion accounts.
The pattern is clear even with different timelines. Regulators worldwide are converging on the same idea: financial data belongs to the customer, not the institution holding it. Europe is just being the most methodical, and the slowest, about writing that idea into binding law.
FAQ
What is the difference between PSD2 and PSD3? PSD2 was a single directive covering open banking and payment rules. PSD3 splits that into two instruments: a narrower directive (PSD3) covering licensing and supervision, and a directly applicable regulation (PSR) covering conduct rules like open banking access, fraud liability, and Verification of Payee.
When does PSD3 come into force? PSD3 and the PSR were politically agreed in November 2025, with final texts published in April 2026. Formal adoption and Official Journal publication are expected in the second half of 2026, but most operative rules won’t actually apply until roughly Q2 or Q3 2028 due to transposition and application delays.
What is FiDA in simple terms? FiDA, the Financial Data Access regulation, extends the open banking model beyond payment accounts to cover savings, investments, pensions, insurance, and credit data, letting customers control and share this wider set of financial data with authorized companies called Financial Information Service Providers.
Does PSD3 end screen scraping? Yes. The PSR formally closes the loopholes that let third parties fall back on screen scraping when bank APIs underperformed, pushing the market fully toward dedicated, monitored open banking APIs.
How does this affect crypto companies operating in the EU? FiDA explicitly includes crypto asset service providers as potential data holders and data users, meaning crypto platforms could eventually sit inside the same regulated data sharing framework as banks and investment firms, not outside it.
