PSD2 explained
What PSD2 is and why it matters to you
PSD2 sets the current legal standard for most digital payments in Europe. In full, it's the revised EU Payment Services Directive. You're covered by it whether you send a wire, pay by card at a store, or use a phone app that lets you pay or move money. The law spells out how financial firms are required to treat your payments, and what protections you can claim if something goes wrong with a transfer or transaction.
The directive is enforced throughout the EU and EEA. Since Brexit, the UK runs a comparable (though not always identical) regime. One of the biggest changes PSD2 brought was open banking, which lets you give certain licensed services access to your bank data to help you manage finances or initiate payments. These businesses must hold a licence, as you can check in our explanation of payment institution licences.
Your main rights under PSD2
- Clear information: before you confirm a payment, providers have to show the complete cost, including all fees.
- Transfer times: for euro payments inside the EEA, the law says the receiving bank must credit the funds by the end of the next business day.
- Limited liability: when someone makes an unauthorized payment with your lost card or login, your maximum liability is usually 50 euro, unless you have acted with gross negligence or committed fraud.
- Secure payments: nearly all online payments are subject to strong customer authentication.
Read about the refund process for unauthorized payments in our specific guide to getting a refund for an unauthorised payment.
Open banking and your consent
PSD2 lets you instruct your bank to give third-party providers access to your account information or start payments for you, so long as those firms have a regulator's authorisation. Apps that offer an overview of your finances or help you make payments use this legal right. They're limited to data use for the particular service that you approved.
You stay in control, and you can withdraw your consent from your bank's app or directly from the third party, often within its own account settings. Some countries plan future amendments to these rules, so consult up-to-date law for important decisions or edge cases.
Frequently asked questions
Does PSD2 cover authorised push payment scams?
No, not in the same category as unauthorised transactions. Refund rights under PSD2 only apply when you did not authorize a transaction. If you yourself instruct your bank or provider to send money (even if you were deceived by a scam), PSD2 treats that as an authorised payment. In these cases, the possibility of a refund comes from domestic laws or the provider’s own processes, not from PSD2’s regulation.
What is the most I can lose from an unauthorised card payment?
Where someone spends from your account using a stolen card or hacked login and you did not give permission, your exposure is capped at 50 euro before you report the loss. The moment you report the problem to your bank or provider, you aren’t usually liable for further losses, unless you acted fraudulently or with gross negligence, in which case the cap may not apply.