PSD3 and PSR: what payments teams need to change now

TL;DR: The EU is replacing PSD2 with PSR and PSD3, turning Strong Customer Authentication, payee verification and fraud prevention into a more prescriptive legal regime with liability attached for payment service providers, according to IDnow. The governance shift is from fragmented national interpretation to enforceable controls over identity, authentication and fraud handling.

Editorial analysis by NHI Mgmt Group, based on content published by IDnow: “PSD3 News for Financial Services: 5 Critical Changes Every PSP Must Act On Now.”.

Key questions

Q: How should payment providers adapt Strong Customer Authentication for biometric-only checks?

A: Providers should treat biometric-only SCA as a governance change, not a cosmetic rule update.

Q: Why does impersonation fraud create a stronger identity governance problem for PSPs?

A: Because the attack exploits trust in the provider’s identity, not just the payment flow.

Q: What breaks when verification of payee is not in place for credit transfers?

A: Without verification of payee, the payer’s PSP has no structured control to compare the stated beneficiary name with the IBAN before execution.

Practitioner guidance

• Build PSR readiness into your authentication roadmap Map current login and transaction flows against the new two-category SCA rules, then isolate where biometric-only options could be introduced without weakening assurance or recovery paths.
• Extend payee verification across all transfer types Review payment rails, exception logic and customer notices so Verification of Payee can operate consistently across euro, non-euro and non-SEPA credit transfers.
• Treat spoofed PSP channels as fraud infrastructure Add monitoring for lookalike domains, spoofed numbers and sender IDs to the fraud stack, and make ownership of those channels explicit across security, comms and operations.

Bottom line: PSD3 and PSR move payment authentication, payee verification and fraud prevention from fragmented guidance into a more uniform legal control set.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →