PSD2

PSD2 is the reason your bank asks twice.

It is Directive (EU) 2015/2366, the second EU directive on payment services. It replaced the first one (Directive 2007/64/EC, repealed by Article 114 of PSD2) and has shaped how Europeans pay online ever since. National law in each member state implements it, so the detail varies by country.

What it does

Three things matter most to someone who accepts or sends payments.

• Security. It requires strong customer authentication for electronic payments, with the technical detail in Delegated Regulation (EU) 2018/389. The authentication requirement legally applied from 14 September 2019.
• Competition. It opens the market to new providers, including firms that initiate payments or aggregate account information with the customer's permission, which is the root of what people call open banking.
• Rules for providers. It sets who may provide payment services and what they owe users in transparency, rights and obligations.

What it does not do

It does not cap card interchange fees. That is a different law, Regulation (EU) 2015/751. Both date from 2015, so they get mixed up.

What comes next

The EBA's own materials already refer to the period "until PSD3/PSR apply". The successor package, a third directive plus a Payment Services Regulation, was provisionally agreed by the Council and Parliament on 27 November 2025. As of October 2026 it still needed formal adoption, and it does not apply yet. Until it does, PSD2 is the law in force. Check the current state before you rely on a date.

The short version for a merchant: PSD2 decides how a payer proves they are the payer. The interchange is somebody else's rule.