Payments Sector Regulation Map: PCI, PSD2, Swift, ACH

A payment firm answers to card network standards, interbank messaging rules, scheme operating rules and national payments law at the same time, and each one sets its own security controls, authentication rules and fraud duties. PCI DSS governs card data, the Swift Customer Security Programme governs the local Swift footprint, PSD2 and its successors govern authentication and liability in the EU, and instant payment rails bring their own verification and fraud monitoring requirements. This map lays those instruments side by side for the EU, the UK, the US and India, with status as of November 2026, and links to the NHI Mgmt Group guides that cover each one in depth. It is written for security, fraud, payments operations and compliance teams at banks, payment institutions, e-money firms, processors and the technology suppliers that serve them. For general financial services cyber rules such as DORA, NYDFS Part 500 and APRA CPS 234, see the Financial Services Cyber Regulation Map.

Sources: dates and obligations come from the official texts and regulators where we could read them: the PCI Security Standards Council, Swift, the European Parliament legislative observatory, EUR-Lex, the UK Payment Systems Regulator and FCA, the eCFR, Nacha, the Federal Reserve Financial Services and the Reserve Bank of India. Statuses can change quickly, particularly for the EU payments package. Confirm against the official text before relying on it.

Key takeaways

Four layers apply at once. Industry standards (PCI DSS, Swift CSCF), scheme rules (Nacha, card networks, instant payment schemes), payments law (PSD2, UK Payment Services Regulations, Regulation E) and general cyber rules each reach the same systems.
The EU package is not law yet. The Payment Services Regulation and PSD3 were agreed politically in November 2025; as of November 2026 the Parliament's procedure file shows the Regulation awaiting the plenary vote and Council adoption, with no Official Journal publication.
Fraud liability is moving to firms. The UK APP scams reimbursement requirement since 7 October 2024 and the proposed EU impersonation refund rules make payment firms pay for scam losses they could have prevented.
Instant rails add verification duties. EU verification of payee applies in the euro area from 9 October 2025, and Nacha's risk-based fraud monitoring rules applied in two phases in 2026.
Machine credentials are in scope everywhere. PCI DSS 8.6, Swift's token and privileged account controls and PSD2 third-party access all regulate API keys, service accounts and certificates, not only people.

Regulations and frameworks at a glance

Instrument	Region	Who it covers	Status as of November 2026	Detailed guide
PCI DSS v4.0.1	Global (industry, enforced through card brands and acquirers)	Entities that store, process or transmit cardholder data, and service providers that can affect its security	v4.0.1 published 11 June 2024; v4.0 retired 31 December 2024; future-dated requirements effective since 31 March 2025	PCI DSS 4.0 Guide
Swift Customer Security Programme (CSCF)	Global (industry)	Swift users, for their local Swift infrastructure	Mandatory programme; annual attestation against the current CSCF version, supported by independent assessment	SWIFT Customer Security Programme (CSP) Guide
PSD2, Directive (EU) 2015/2366, and RTS on SCA, Delegated Regulation (EU) 2018/389	EU	Payment service providers, including account servicing and third-party providers	In force; remains the governing law until the new package applies	PSD2/PSD3 Strong Customer Authentication Guide
Payment Services Regulation and PSD3 (procedures 2023/0210(COD) and 2023/0209(COD))	EU	Payment service providers; some duties for online platforms and electronic communications providers	Proposal, not law. Provisional agreement November 2025; committee approved the agreed Regulation text on 5 May 2026; plenary indicated for 14 December 2026	This page
Instant Payments Regulation, Regulation (EU) 2024/886	EU	PSPs offering credit transfers in euro	In force since 8 April 2024; verification of payee from 9 October 2025 in the euro area and 9 July 2027 for non-euro Member States	Real-Time Payments Fraud Guide
PSR APP scams reimbursement requirement	UK	PSPs sending and receiving Faster Payments; CHAPS through the Bank of England	In force since 7 October 2024; maximum claim GBP 85,000	Authorised Push Payment (APP) Fraud Guide
Payment Services (Amendment) Regulations 2024 and FCA FG24/6	UK	Payment service providers executing outbound payments	In force since 30 October 2024	This page
Regulation E, 12 CFR Part 1005 (Electronic Fund Transfer Act)	US	Financial institutions holding consumer accounts	In force	This page
Nacha Operating Rules, fraud monitoring	US	ODFIs, RDFIs, non-consumer originators, third-party service providers and senders on the ACH network	Phase 1 from 20 March 2026; phase 2 from 19 June 2026	This page
FedNow Service operating rules and limits	US	Participating depository institutions	Network transaction limit raised to USD 10 million in November 2025	Real-Time Payments Fraud Guide
RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025	India	Payment system providers and participants, including card issuers	Issued 25 September 2025; compliance from 1 April 2026	This page

Scope: who and what is covered

Card data: PCI DSS applies by contract wherever cardholder data or sensitive authentication data is stored, processed or transmitted, and to service providers that can affect it. Scope is set by data flows and connectivity, not by legal entity. See the PCI DSS Scoping and Network Segmentation Guide and, for providers, the PCI DSS for Service Providers and Responsibility Matrix Guide.
Interbank messaging: the Swift CSP covers each user's own Swift footprint, including messaging interfaces, connectors, jump servers and operator PCs, scoped by the user's architecture type. Swift secures the central network; the user secures what it runs.
Payment services law: PSD2 in the EU, the Payment Services Regulations 2017 in the UK and Regulation E in the US define who is a payment service provider or financial institution, when authentication is required, and who bears losses from unauthorised transactions.
Scheme rules: Nacha rules bind ACH participants by agreement; instant payment schemes and the FedNow operating rules bind their participants. Third-party service providers acting for originators are named directly in the Nacha fraud monitoring rules.
General cyber rules: payment and e-money institutions are also in scope of DORA in the EU and the UK operational resilience regime, covered in the Financial Services Cyber Regulation Map.

Key obligations

Theme	Instrument and obligation
Authentication of payers	PSD2 Article 97 and the RTS require strong customer authentication with two independent elements and dynamic linking for remote electronic payments, subject to exemptions. RBI's 2025 Directions set a minimum of two-factor authentication with optional risk-based checks, and require card issuers to validate additional authentication for non-recurring cross-border card-not-present transactions when the overseas merchant or acquirer asks.
Authentication of systems and staff	PCI DSS Requirement 8 covers user and system accounts, including 8.6 for system and application accounts. Swift's CSCF mandates controls on privileged operating system accounts, multi-factor authentication, logical access and token management.
Card data protection	PCI DSS Requirements 3 and 4 for stored and transmitted data; 6.4.3 and 11.6.1 for payment page scripts and tamper detection, mandatory since 31 March 2025.
Payee verification	Instant Payments Regulation Article 5c (inserted into Regulation (EU) No 260/2012): the payer's PSP must offer verification of the payee's name against the account identifier before the payer authorises a credit transfer, and tell the payer when the details do not match.
Fraud monitoring	Nacha rules require risk-based processes reasonably intended to identify ACH entries initiated due to fraud, reviewed at least annually; pre-posting monitoring of credit entries is not required. UK FG24/6 lets PSPs delay an outbound payment where there are reasonable grounds to suspect fraud, deciding by the end of the next business day and delaying no later than the end of the fourth business day after receipt.
Fraud reimbursement	UK APP reimbursement: sending and receiving PSPs share costs 50:50, claims up to GBP 85,000, made within 13 months. Regulation E 1005.6 caps consumer liability for unauthorised transfers at USD 50 with notice within two business days of learning of a lost or stolen access device, otherwise generally USD 500, and a consumer who does not report an unauthorised transfer within 60 days of the statement being sent can be liable for later transfers.
Annual validation	PCI DSS assessment or self-assessment questionnaire per brand and acquirer requirements; Swift attestation each year with independent assessment.

Timeline and current status

11 June 2024: PCI DSS v4.0.1 published; v4.0 retired 31 December 2024.
31 March 2025: PCI DSS future-dated requirements, including 6.4.3, 11.6.1 and 12.5.2, became mandatory.
7 October 2024: UK APP reimbursement requirement started.
30 October 2024: UK Payment Services (Amendment) Regulations 2024 in force, allowing delayed outbound payments.
9 October 2025: EU verification of payee applies to euro area PSPs; the EPC Verification of Payee scheme rulebook entered into force on 5 October 2025.
November 2025: FedNow network limit raised to USD 10 million; EU political agreement on the Payment Services Regulation and PSD3.
20 March and 19 June 2026: Nacha fraud monitoring phases 1 and 2.
1 April 2026: RBI authentication Directions compliance date.
5 May 2026: European Parliament committee approved the agreed Payment Services Regulation text.
Watch: plenary vote on the Regulation indicated for 14 December 2026, then Council adoption, publication and transition periods; verification of payee for non-euro Member States from 9 July 2027.

Enforcement and penalties

Industry standards: PCI DSS and the Swift CSCF are enforced by contract. Card brands act through acquirers, and Swift users' attestations are visible to counterparties and supervisors, so non-compliance shows up in commercial terms and supervisory questions rather than statutory fines.
Payments law: national competent authorities enforce PSD2 as transposed in each Member State; the FCA and the PSR enforce the UK rules; the CFPB and prudential regulators enforce Regulation E.
Scheme rules: Nacha rules are enforced through the network's rules enforcement process against participating institutions.
Financial exposure through liability: for most payment firms the larger cost is reimbursement, not fines: APP reimbursement in the UK and unauthorised transaction refunds under PSD2 and Regulation E.

What it means for AI agents and non-human identities

API keys and gateway credentials: merchant and platform keys at payment gateways can move money and read card or account data. See the Payment API keys beyond Stripe guide and the Payment Service Provider NHI and Key Security Guide.
Service accounts in the cardholder data environment: PCI DSS 8.6 governs interactive use, hard-coded passwords and periodic change for system and application accounts. See the PCI DSS Requirements for Service Accounts and NHIs Guide (8.6).
Swift connectors: middleware, API clients and file transfer tools that reach the Swift interface hold credentials and certificates that fall under CSCF identity and token controls.
Third-party providers: PSD2 account access by third-party providers relies on qualified eIDAS certificates and tokens on the dedicated interface, which are machine identities to inventory and monitor.
Agent-initiated payments: AI agents that initiate payments for users raise open questions about authentication, consent and liability under SCA and the reimbursement rules. See the Agent Payments Protocols Guide and the AI Agents and PCI DSS guide.

Compliance steps

Build an obligation register per legal entity and payment rail: which standards, scheme rules and laws apply, the annual validation date and the owner.
Map each payment system to the instruments above. One gateway may sit in PCI DSS scope, behind a PSD2 SCA flow and on an instant rail with payee verification.
Reuse evidence across regimes: one access review of system accounts can serve PCI DSS 8.6, CSCF identity controls and DORA ICT risk evidence if it is designed for all three.
Instrument fraud controls for the reimbursement rules: payment delay decisions, verification of payee outcomes and scam indicators should be logged and reportable.
Track the EU package: assign an owner to follow the Payment Services Regulation and PSD3 through adoption and plan for the transition periods once published.
Bring third parties into scope: processors, gateways and TPSPs carry obligations under PCI DSS and Nacha that you must monitor contractually.

Common failure patterns

Treating the EU proposals as in force: planning against the provisional agreement text without checking the adopted text and application dates.
Siloed programmes: separate teams for PCI DSS, Swift and PSD2 collecting overlapping evidence on the same systems and accounts.
Human-only access reviews: service accounts, API keys and connector certificates left out of reviews that both PCI DSS and the CSCF expect to cover them.
Fraud controls without evidence: payment delays and payee checks that are applied but not logged, leaving no basis for reimbursement disputes or regulator questions.
Ignoring scheme rule dates: third-party senders and processors assuming Nacha fraud monitoring only applies to banks.

Practitioner checklist

Keep a dated register of payment standards, scheme rules and laws per entity and rail.
Confirm all PCI DSS v4.0.1 future-dated requirements are implemented and evidenced.
Confirm the Swift attestation for the current CSCF version, including connectors in scope.
Check verification of payee is offered on every euro credit transfer channel.
Document Nacha risk-based fraud monitoring and its annual review if you originate, receive or send ACH entries.
Log UK payment delay decisions and APP reimbursement outcomes.
Inventory API keys, service accounts and certificates that can initiate payments or read payment data.
Assign an owner to track the EU Payment Services Regulation and PSD3 to adoption.

Standards and references

This guide summarises payments sector regulation for security practitioners and is not legal advice; confirm obligations with your legal and compliance teams and the primary texts. Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · Online Fraud Regulation Map · PCI DSS 4.0 Guide · Payment Fraud Guide

Payments Sector Regulation Map: Card, Account-to-Account and Instant Payment Rules in One View