A payments CTO in Amsterdam told me something that stuck with me. Three weeks before her startup’s biggest product launch, her legal team handed her a stack of PSD3 compliance requirements and said the API she had spent a year building needed to be rebuilt around new authentication standards. Not tweaked. Rebuilt. That is the reality a lot of fintech founders are living through right now, and it is why understanding the open banking PSD3 regulations impact fintech companies are facing has stopped being optional homework and become a survival skill.
PSD3 is not a minor update sitting quietly in some Brussels filing cabinet. It is the next phase of Europe’s open banking experiment, and it touches everything from how payment apps verify your identity to how much it costs a small fintech to even exist in this space. This piece breaks down what PSD3 actually changes, who gets hurt, who gets an advantage, and what fintech teams should be doing right now instead of waiting for the final text to land.
What PSD3 Actually Is, in Plain Terms
PSD3, short for the third Payment Services Directive, is the European Union’s update to the open banking rulebook that PSD2 introduced back in 2018. PSD2 forced banks to open their data through APIs so third party apps like budgeting tools and payment initiators could plug in. It worked, but it also exposed cracks. Banks dragged their feet on API quality. Screen scraping stuck around longer than regulators wanted. Fraud liability rules were messy. PSD3, paired with a companion regulation called FIDA, the Financial Data Access framework, is the EU’s attempt to patch those cracks and extend open banking into open finance more broadly, covering insurance, investments, and pensions alongside payments.
Here is the part that matters most for fintech teams: PSD3 is expected to be enforced as a regulation in large part, not just a directive, which means less room for individual EU countries to interpret it their own way. That consistency sounds boring. It is actually one of the biggest shifts in the whole package.
The Core Changes Fintechs Need to Track
Reading the draft text line by line is not realistic for most teams, so here is the condensed version of what is actually moving the needle.
- Mandatory dedicated APIs. Banks will no longer be allowed to offer a fallback screen scraping option as a backup interface. Every bank has to maintain a proper, dedicated API, and it has to perform at least as well as the bank’s own online banking channel.
- Stronger authentication requirements. Strong customer authentication gets tightened again, closing loopholes that fraudsters had been exploiting around session timeouts and re authentication windows.
- Expanded fraud liability on banks. Banks will carry more responsibility for authorized push payment fraud in certain scenarios, which changes the economics for payment initiation service providers that sit in the middle of a transaction.
- A dedicated open finance scope under FIDA. Data sharing extends past payment accounts into savings, mortgages, pensions, and insurance products, opening a much bigger surface area for new fintech products.
- Real time API monitoring obligations. Banks have to report on API performance and downtime, giving regulators and third parties actual visibility instead of relying on complaints after the fact.
None of these changes exist in isolation. A fintech building a budgeting app today has to think about authentication flow, API reliability, data scope, and liability all at once, because PSD3 ties them together deliberately.
Why This Is a Bigger Deal Than PSD2 Was
PSD2 asked banks to open a door. PSD3 asks them to keep that door open, clean it regularly, and post a sign explaining exactly how it works. The shift from directive to regulation status removes the patchwork compliance landscape that fintechs have been navigating since 2018, where a license in one member state did not guarantee smooth operations in another. That patchwork was expensive. Passporting disputes, inconsistent API standards, and country by country interpretation differences ate up legal budgets that smaller fintechs simply did not have.
With PSD3 pushing toward harmonization, a fintech that gets its compliance right once has a real shot at scaling across the EU without rebuilding its stack for every new market. That is the upside. The downside is that getting it right the first time now carries more weight, because the margin for “we will fix it market by market later” shrinks considerably.
The Compliance Cost Problem
Let’s talk money, because that is where the open banking PSD3 regulations impact fintech balance sheets most directly. Compliance is not free, and PSD3 raises the baseline investment required to operate legally in the EU payments space.
Costs tend to show up in a few predictable places:
- API redevelopment. Fintechs relying on existing bank API integrations may need to rebuild connectors to match new dedicated API standards.
- Authentication infrastructure. Tighter SCA requirements mean updated identity verification flows, often requiring new vendor contracts or in house engineering work.
- Licensing and authorization reviews. Payment institutions and e-money institutions will likely face updated authorization criteria, including stricter capital and governance requirements for some license categories.
- Legal and compliance staffing. Mid sized fintechs that previously outsourced compliance reviews are increasingly bringing specialists in house because the regulatory surface area has grown too large to handle reactively.
For a well funded fintech, these are manageable line items. For a bootstrapped startup two years into its journey, they can be existential. This is the uncomfortable truth underneath most PSD3 commentary: the regulation is designed to raise trust and reliability across the ecosystem, and raising trust almost always raises the cost of entry at the same time.
Where Fintechs Actually Stand to Win
It would be lazy to frame PSD3 as purely a burden, because it genuinely opens doors that did not exist before.
The expansion into open finance under FIDA is the biggest one. Once data sharing extends to pensions, savings products, and insurance, fintechs get access to a dataset that has historically been locked inside legacy institutions. A fintech that builds a genuinely useful retirement planning tool, or a lending product that can see a fuller financial picture of an applicant, suddenly has raw material it never had before.
Stronger fraud liability rules also work in favor of fintechs that have invested seriously in security. When banks carry more liability for fraud losses, there is a natural push toward partnering with payment providers who can demonstrate strong fraud prevention, rather than the cheapest integration available. That rewards fintechs who built trust as a feature rather than an afterthought.
And the API reliability mandate removes one of the most consistent complaints fintechs have had about open banking since it launched. A dedicated API that has to match the bank’s own channel performance means fewer dropped connections, fewer failed payment initiations, and fewer support tickets blaming “the bank’s API was down again.” That operational stability is worth real money in reduced churn and support costs.
Who Gets Squeezed
Not every player in the fintech ecosystem benefits equally, and it is worth being honest about who faces the sharper end of this transition.
- Smaller account information service providers that built their entire business around being a thin layer on top of bank APIs, without differentiated product value, will struggle to absorb the new compliance overhead.
- Fintechs still relying on screen scraping as a quiet fallback lose that option entirely, forcing a technical migration on a fixed timeline.
- Companies operating across multiple EU jurisdictions with previously inconsistent compliance approaches now need a single, defensible standard, which can mean unwinding shortcuts taken during rapid expansion phases.
- Early stage startups without in house legal or compliance expertise face a widening gap between what regulators expect and what a five person team can realistically deliver without outside help.
This is the part of the PSD3 conversation that gets less airtime than it deserves. Regulation written to protect consumers and stabilize the ecosystem can, as a side effect, consolidate market share toward players who already had the resources to comply comfortably.
What Fintech Teams Should Be Doing Right Now
Waiting for the final PSD3 text before acting is a mistake most experienced compliance teams are already avoiding. The directional signals are clear enough to start preparing.
- Audit current API dependencies. Identify every integration still relying on screen scraping or indirect access methods, and build a migration timeline toward dedicated API connections.
- Stress test authentication flows. Review session handling, re authentication triggers, and fraud detection logic against the tighter SCA expectations likely to carry over from the draft text.
- Map FIDA’s data scope against your roadmap. If your product could benefit from pension, savings, or insurance data access, start scoping what a FIDA compliant data sharing permission request would look like.
- Revisit licensing structure early. Payment institutions should confirm whether their current authorization category still fits updated capital and governance thresholds, rather than discovering a gap during a routine supervisory review.
- Budget compliance as a product cost, not an afterthought. Teams that treat compliance engineering as part of the core roadmap, rather than a separate fire drill, consistently ship PSD3 ready features faster than teams scrambling after the fact.
The fintechs that come out ahead in this transition will not necessarily be the biggest ones. They will be the ones that treated the writing on the wall seriously back in 2025 and 2026, instead of waiting for enforcement deadlines to force their hand.
The Bigger Picture
Step back far enough and PSD3 looks less like a single regulation and more like Europe formalizing a bet it made back in 2018: that opening up financial data, under strict enough rules, produces a healthier market than keeping it locked inside incumbent banks. PSD2 proved the concept worked, even if the execution was uneven. PSD3 is the correction pass, tightening the loose screws while widening the scope dramatically through FIDA.
For fintech leaders, the honest takeaway is that the open banking PSD3 regulations impact fintech business models in ways that go well beyond a compliance checkbox. It reshapes who can compete, what data is available to build with, and how much trust a product needs to earn before a bank partner or a regulator will even consider it credible. The teams paying attention now are the ones who will be building on open finance data while their slower competitors are still arguing about API specifications.
Frequently Asked Questions
What is the main difference between PSD2 and PSD3? PSD2 opened payment account data through mandatory APIs. PSD3 strengthens those API requirements, removes the screen scraping fallback, tightens authentication rules, and works alongside FIDA to extend data sharing into open finance categories like pensions and insurance.
When does PSD3 take effect? PSD3 is still moving through the EU legislative process, with phased implementation expected across member states once finalized. Fintechs should treat the directional requirements as a near term planning baseline rather than waiting for a final enforcement date.
Does PSD3 apply outside the European Union? PSD3 is EU specific, but fintechs operating globally often see similar open banking standards echoed in markets like the UK, Australia, and parts of Asia, so the compliance patterns built for PSD3 frequently transfer well to other jurisdictions.
How does FIDA relate to PSD3? FIDA, the Financial Data Access framework, is a companion regulation that extends open banking principles beyond payment accounts into broader financial data, including savings, investments, mortgages, and insurance, giving fintechs a much larger dataset to build products around.
Will PSD3 increase costs for small fintech startups? Yes, in most cases. Smaller fintechs face real costs around API migration, authentication upgrades, and licensing reviews. Early preparation and treating compliance as part of the product roadmap, rather than a last minute scramble, significantly reduces that financial impact.
