What Is PSD2 Compliance? Requirements, Benefits, and Checklist

Complying with PSD2 regulations can be difficult when businesses need to protect online payments without creating extra friction for customers. Insufficient authentication and vulnerable banking APIs can lead to fraud and payment failures. Payment service providers, FinTech firms and banks should meet legal requirements and keep payment systems safe, dependable and convenient to achieve PSD2 Compliance.

In January 2026, the European Central Bank updated its payment statistics with provisional data for the first half of 2025. The data recorded €161,000 in fraudulent remote card payments involving payment-order changes, even though Strong Customer Authentication (SCA) was used. This shows that authentication alone cannot prevent every type of payment fraud.

In this blog, we will discuss PSD2 compliance rules, SCA, payment API security, exemptions, benefits, mistakes, and a checklist. We will also cover how penetration testing can reveal weak spots in payment systems.

Key takeaways

• PSD2 compliance is crucial in protecting digital payments, personal data, and account access with Open Banking security.
• Strong Customer Authentication (SCA) means the use of at least two unique factors for relevant transactions.
• There is a need to secure the open banking APIs by creating reliable interfaces, using appropriate certificates, and managing third-party access.
• Eligible transactions can be exempted from SCA under various conditions such as low-value payments, TPA, and trusted payees.
• Documentation required consists of risk policy and procedures, SCA, fraudulent activity reports, and security assessment.
• Non-compliance risks fines, loss of money, and liabilities in case of fraud.
• The process of penetration testing, fixing vulnerabilities, and repeated testing can expose security gaps.

Understanding PSD2 Compliance

PSD2 compliance refers to following the EU regulations securing electronic payments, customer authentication, and ensuring secure access to bank accounts. Compliance with PSD2 regulations ensures that consumers are protected from any form of payment fraud and also allows for digital banking and open banking.

The EU enacted the Second Payment Services Directive (PSD2), known as Directive (EU) 2015/2366 on 25 November 2015. It entered into force on 12 January 2016, and EU member states had to transpose it into national law by 13 January 2018. The purpose of this directive was to enhance payment security, customer protection, and competition within the financial sector. 

PSD2 compliance affects several participants in the payment ecosystem:

• Banks and payment service providers (PSPs): Ensure secure payment processing and give regulated third parties access to customer accounts.
• Payment Initiation Service Providers (PISPs): Allow payments to be initiated directly from customers’ bank accounts by customers.
• Account Information Service Providers (AISPs): Gather and aggregate information on customer accounts from several banks, upon the consent of the customers.
• Online merchants: Support Strong Customer Authentication (SCA) when required for electronic payments.

Understanding PSD2 compliance requirements helps businesses secure electronic payments, protect customer data, and meet authentication and Open Banking obligations. 

What Has Changed From PSD1 to PSD2?

PSD1 set uniform regulations for European payment standards to protect transactions and customer data. Due to the development of online and mobile banking, customers began using third-party apps to manage their finances. PSD2 updated the system to accommodate such services and secure payments.

The EU adopted PSD2 in 2015, introducing Strong Customer Authentication (SCA) requirements and rules for authorized third-party access to bank accounts.

Key Differences Between PSD1 and PSD2

The European Central Bank released the latest payment statistics on 29 January 2026, for the first half of 2025. There were 77.7 billion non-cash payment transactions made in Europe, according to the statistics.

These statistics demonstrate the volume of electronic payment transactions that need to be performed securely by payment service providers. Authentication, account access, and fraud prevention become increasingly relevant for PSD2 compliance.

What Does PSD2 Compliance Cover?

PSD2 compliance involves customer authentication, securing payment information, linking banks to third-party providers, and protection of consumer rights. This helps prevent any unauthorized access, mitigating the risk of fraud, and ensuring that electronic payments are carried out safely.

I. Strong Customer Authentication for Electronic Payments

 PSD2 requires Strong Customer Authentication (SCA) when accessing payment accounts through online channels and making electronic payments. SCA involves using at least two factors out of three types of authentication factors:

• Knowledge factor: It includes something that the customer knows, like a password or PIN.
• Possession factor: It includes something that the customer possesses, like their registered mobile phone or hardware token.
• Inherence factor: It includes something that the customer is, for example, a fingerprint or facial recognition.

For remote electronic payments, the authentication should be related to the exact amount of payment and the payee. If either one of these things changes, the authentication code should expire.

II. Secure Open Banking and API Access

PSD2 requires banks and other account-servicing payment service providers (ASPSPs) to support secure communication with authorized third-party providers. PSD2 compliance requirements for banks include Strong Customer Authentication (SCA), secure Open Banking APIs, fraud monitoring, and customer data protection. Cybersecurity for the banking sector helps in protecting financial data, preventing unnecessary access, and securing digital payment services.

Key requirements include:

• Secure access: APIs must allow authorized providers to access account information or initiate payments within their permitted scope.
• Reliable service: Dedicated interfaces must meet regulatory requirements for availability, performance, and support.
• Certificate-based identification: Applicable eIDAS certificates, including Qualified Website Authentication Certificates (QWACs) and Qualified Electronic Seals (QSealCs), support secure identification and communication.
• Compliant account access: Third-party providers must follow applicable interface requirements rather than relying on methods such as screen scraping where compliant access interfaces are required.

Correct API configuration, access controls, and certificate implementation help protect banking data and establish trust between banks and third-party providers.

III. Account Information and Payment Initiation Services

PSD2 recognizes two main types of third-party payment services:

• Payment Initiation Service Providers (PISPs): Initiate payments directly from customers’ bank accounts with their consent.
• Account Information Service Providers (AISPs): Retrieve and combine account information from one or more banks with customer consent.

PISPs generally need authorization from the relevant national authority, while AISPs must meet the applicable registration requirements. Both must satisfy relevant professional indemnity insurance or equivalent guarantee requirements.

The European Banking Authority (EBA) maintains a central register of payment institutions, electronic money institutions, and account information service providers across the EU and EEA. The register uses information supplied by national authorities and is updated regularly.

IV. Transparent Fees and Customer Protection

PSD2 establishes rules to protect customers from certain charges and unauthorized payments. Businesses must understand these requirements and apply them to the payment services they provide.

• Surcharge restrictions: Merchants cannot impose surcharges on consumer debit and credit cards covered by the EU surcharge ban. The ban also covers SEPA credit transfers and direct debits in euro.
• Eight-week refund right: Customers can request a refund for qualifying SEPA direct debits within eight weeks of the debit date.
• Unauthorized payment claims: Customers generally have up to 13 months to report unauthorized or incorrectly executed transactions, subject to applicable conditions.
• Limited customer liability: For certain unauthorized transactions involving a lost or stolen payment instrument, customer liability is generally capped at €50. Exceptions can apply, including cases involving fraud or gross negligence.

These protections make transparent pricing, secure authentication, and clear procedures for handling disputed payments important parts of PSD2 compliance.

V. Payment Fraud Reporting and Regulatory Oversight

PSD2 for payment service providers requires them to collect and report statistical data on payment fraud to their national competent authorities. These authorities share aggregated information with the European Banking Authority (EBA) and the European Central Bank (ECB). The EBA and ECB use payment fraud data to monitor developments in electronic payments and understand how fraud affects payment services.

According to the EBA’s 2026 Work Programme, a joint EBA–ECB report on payment fraud is scheduled for the fourth quarter of 2026. The report is planned regulatory work, not a published set of findings. Its focus on payment fraud reflects the continuing need to monitor fraud patterns and assess the effectiveness of security measures.

What Documentation Is Required for PSD2 Compliance?

Payment service providers need to have documents showing their compliance with the relevant requirements of PSD2. The exact documents depend on whether the organization is a payment institution, an account information service provider, or another type of payment service provider. PSD2 risk management helps identify and reduce payment security risks, fraud, and vulnerabilities. 

The following documents will help prepare for PSD2 compliance:

1. Business Plan and Programme of Operations: Outline the payment services provided, the business model, the operations process, and the activities that will be carried out. This is especially important in the application for authorization.
2. Governance and Risk Management Policies: Set out management responsibilities, internal controls, operational risk assessments, and procedures to manage security risks.
3. Security Policies and Procedures: Maintain information security policies, access control procedures, data protection policies, and security risk assessments. The PSD2 security guidance requires proper risk management and regular security testing.
4. Strong Customer Authentication (SCA) Documentation: Record the methods of authentication, exemptions, and controls put in place to secure the payment transactions. Where appropriate, retain evidence of the exemption of using the exemption under the applicable regulatory technical standards.
5. Fraud Monitoring and Reporting Records: Ensure that relevant transaction monitoring records, fraud prevention policies, and information concerning any fraud reporting requirements are maintained.
6. Incident Management Records: Ensure that security incidents, findings, actions, and any reporting are documented.
7. Security Testing and Audit Reports: Ensure that relevant security testing and audit reports, along with vulnerabilities identified, are maintained. This will demonstrate how the entity identifies and mitigates security risks.

These documents provide a starting point for organizing PSD2 compliance evidence. Organizations should verify the specific requirements applicable to their services and jurisdiction, including any national supervisory requirements.

Need a Real Penetration Testing Report Sample Today?

See exactly how security experts document vulnerabilities, risks, and remediation steps in a professional pentest report.

Download Sample Report
→

What is Strong Customer Authentication and How Does SCA Work Under PSD2?

Strong Customer Authentication under PSD2 is used to authenticate the customer’s identity during online banking transactions. The process for making payments online usually involves 3-D Secure 2.x technology, which links up the merchant, gateway provider, and issuing bank.

Transaction Initiation

On receiving customer payments online, the merchant uses the gateway to submit information such as the amount paid, merchant identification, and risk data on behalf of the merchant. Payment gateway security helps protect this transaction data through secure communication, encryption, and fraud detection measures.

Dynamic Linking

According to Article 5 of the SCA Regulatory Technical Standards (RTS), the authentication code must be tied to the payment amount and payee that have been previously agreed on. Any changes to these will make the code invalid. The payment amount and payee must also stay secure throughout the authentication process, with proper segregation of channels.

Factor Verification

SCA requires at least two independent factors:

• Knowledge: A password or PIN.
• Possession: A registered mobile device or hardware token.
• Inherence: A fingerprint or facial recognition.

Authentication and Payment Authorization

The issuer’s Access Control Server (ACS) assesses the transaction. It may complete frictionless authentication or request a challenge, such as a one-time password or banking-app approval. The authentication result returns through the payment system and informs the issuer’s authorization decision. Encryption helps protect data in transit, while tokenization can reduce exposure of card details. Tokenization is not itself an SCA factor or a mandatory SCA step under PSD2.

Note: A PSD2 SCA exemption means a payment can be processed without requiring Strong Customer Authentication (SCA), provided it meets specific regulatory conditions. Businesses can use these exemptions for eligible low-risk payments to reduce extra authentication steps while maintaining payment security. Security compliance can help organizations apply PSD2 SCA exemptions while following regulatory standards.

When Can Businesses Use PSD2 SCA Exemptions?

PSD2 allows payment service providers (PSPs) to skip Strong Customer Authentication (SCA) for eligible transactions. These exemptions help reduce checkout interruptions when payment risks are low or specific conditions apply. Understanding the limits helps you identify eligible payments without assuming every transaction qualifies.

I. Transaction Risk Analysis (TRA) Exemption

TRA allows eligible remote payments of up to €500 without SCA when the PSP applying the exemption meets the relevant fraud-rate threshold.

The PSP must assess fraud indicators and calculate its fraud rate using a rolling 90-day period. The issuer makes the final decision when an exemption is requested.

II. Low-Value Payment Exemption

Remote card payments below €30 might be eligible for an SCA exemption. SCA will be required in case the combined value of consecutive exempt payments from the last SCA is over €100, or the customer completes more than five consecutive exempt payments. Visa suggests using TRA first in case the payment is eligible.

III. Trusted Beneficiaries Exemption

Users have the ability to add trusted merchants to a list which is held by the card issuer. SCA needs to be done while adding or modifying the list, but future transactions made with these trusted merchants do not need to go through SCA, irrespective of the transaction amount.

IV. Secure Corporate Payments and Protocols Exemption

Business payments may be eligible if conducted using dedicated payment solutions that are inaccessible to consumer use. These include business procurement systems, travel management solutions, virtual cards, and corporate travel accounts. A commercial card in itself is not sufficient for exclusion. Testing for banks and financial institutions checks the security of these payment systems and their compliance with proper requirements.

V. Contactless Payments at Point of Sale Exemption

Contactless payments of €50 or less may qualify for exemption. Since the last SCA, the issuer applies either a cumulative limit of €150 or a maximum of five consecutive contactless payments. SCA is required when the applicable limit is exceeded.

VI. Transport Fares and Parking Exemption

Payments at unattended terminals for transport fares or parking may qualify for exemption. Examples include automated parking machines and qualifying transport terminals. Eligibility depends on the payment purpose and terminal conditions.

VII. Recurring Payments Exemption

PSD2 includes an exemption for recurring payments when the amount and recipient remain the same. Recurring Visa card payments are typically merchant-initiated transactions (MITs), which are generally outside SCA’s scope rather than covered by this exemption.

What Are the Benefits of PSD2 Compliance?

PSD2 compliance allows financial institutions to enhance the security of their payments along with innovation within the sector. While implementing PSD2 can take time and effort, at the same time, it will provide opportunities to your organization.

The benefits of PSD2 compliance include:

• Fraud Prevention: SCA ensures that payments cannot be made without authorization and helps to avoid payment fraud.
• Transaction Cost Reduction: Direct account-to-account payments provided through open banking will enable merchants to avoid the use of card networks and their transaction fees.
• Financial Integration: With the use of secure APIs, it is possible to link payment and account information services for banks and third-party providers.
• Trust Building: Strong authentication and regulation of unauthorized payments will ensure consumer protection.

How Can PSD2 Affect the Financial Industry?

PSD2 has impacted the collaboration between banks, fintechs, and payment processors. It has created opportunities within the field of finance but increased the emphasis on payment security, open banking, and secure mobile banking.

• More Competition in Banking: AISPs can aggregate information from multiple accounts, whereas PISPs can initiate bank transfers based on customer authorization.
• Open Banking Growth: The account information is useful for financial management, affordability checking, and credit scoring. Inconsistent API and different implementations may cause issues in integration among banks.
• More Payment Options: Account-to-account payments enable customers to pay merchants directly from their bank accounts without using card networks only. This gives merchants an alternative payment method; however, cost reductions will vary by provider and market.
• The Shift Toward PSD3 and the PSR: In November 2025, EU institutions reached a provisional agreement on PSD3 and the Payment Services Regulation (PSR). These reforms aim to strengthen fraud prevention, improve consumer protection, and address issues with open banking access.

What is the Cost of Non-compliance with PSD2?

Not complying with the PSD2 rules could lead to losses for payment service providers and merchants in terms of fines, failed transactions, loss of authority, and responsibility for any fraud committed.

• Regulatory Fines and Administrative Sanctions: The European Union regulators have the power to impose fines, reprimands, and other sanctions for violations of national PSD2 requirements. The relevant penalties will vary depending on the jurisdiction and the type of violation committed.
• Minimum Fine under PSD2: In case of specific serious infringements, PSD2 requires Member States to establish a fine of at least €5 million or twice the profit gained, whichever is higher, subject to the Directive’s conditions.
• Higher Penalties under PSD3/PSR: The proposed higher penalties will concern severe infringements and may reach up to 10% of the annual turnover of a legal person.
• Failed Transactions and Lost Sales: If a remote payment requires SCA but the required authentication is missing, the issuer may decline it. These “soft declines” can interrupt checkout, increase abandonment, and reduce revenue.
• Loss of Authorization: Serious or repeated non-compliance can lead regulators to impose corrective measures or withdraw a payment institution’s authorization. This may prevent the organization from legally providing regulated payment services.
• Fraud Liability: When required SCA is not applied, liability for fraudulent payments may shift from the issuer to the merchant or acquirer, depending on the circumstances. This can result in fraud losses and chargeback costs.

Real-World Example: Why PSD2 Compliance Matters

In June 2026, a Spanish court found ING, a Dutch banking group, liable for €101,213.37 following a case relating to the status reporting of the bank’s payment system. The European Third Party Providers Association (ETPPA) claimed that 167 payment orders were labelled as accepted for processing. These were later rejected because the accounts had insufficient funds. The court also ordered ING to pay interest and legal costs.

This case shows why PSD2 compliance matters in practice. Banks must provide accurate payment information through their interfaces so that authorized third-party payment providers can process transactions reliably. Incorrect status updates can disrupt payments, create problems for businesses and customers, and lead to financial losses.

Quick Checklist for Organizations Preparing for PSD2 Compliance

Here is a PSD2 compliance checklist that will help you understand how prepared you are for PSD2 compliance. Go through the list to understand what you have done and what else you need to do.

• Check if your payments utilize at least two SCA factors from knowledge, possession, and/or inherence where necessary.
• Check if your authentication code is reliably connected to the payment amount and its destination.
• Apply low-value and Transaction Risk Analysis (TRA) exemptions only when your transactions meet the eligibility conditions.
• Check if your open banking APIs comply with all the necessary regulatory and technical standards.
• Ensure your required eIDAS certificates are valid and correctly configured.
• Monitor your APIs and prepare contingency plans to cover technical issues.
• Document the customer consent for account information and payment initiation services, including timestamps and logs.
• Perform regular penetration testing of your payment system to check its vulnerabilities.

A Case Study: How Qualysec Helped a Fintech Company Identify Critical Security Gaps

A fintech firm hired Qualysec to perform an assessment of their application security and find any vulnerabilities that could affect the safety of users’ data and their operations. With the help of penetration testing, we found vulnerabilities that needed to be addressed.

What We Identified:

• Authorization Inconsistencies: Possible flaws in authorization mechanisms that might make sensitive user data vulnerable.
• Security Loopholes in Application Layer: Vulnerabilities that may cause redirections or exposure of internal workings of the application.
• Session Management Issues: Weak session controls that could increase the risk of unauthorized account access.

How We Solved It

We conducted manual penetration testing to identify and validate security weaknesses. Provided technical findings and remediation guidance to help the development team address the issues. The final step was retesting to verify that the identified vulnerabilities had been resolved.

We help fintech businesses strengthen application security through specialized penetration testing, actionable reports, and remediation validation. These services can help organizations preparing for PSD2 compliance by helping them identify and address relevant security risks.

How Qualysec Helps Businesses Achieve PSD2 Compliance?

Qualysec is a CREST-accredited specialized penetration testing company that helps businesses identify security weaknesses in their systems. Our testing method helps banks, fintech companies, payment gateways, and third-party providers strengthen security and prepare for PSD2 compliance.

Our assessment of core areas of payment security will help you to find and remediate security vulnerabilities before any damage is done.

• Open Banking API Testing: We test APIs for vulnerabilities related to access control, data exposure, and others.
• Authentication Testing: We test Strong Customer Authentication (SCA) for vulnerabilities and weak points in transaction verification.
• Consent and Token Security: We test authentication processes, session tokens, and certificates for vulnerabilities related to unauthorized access.
• Web and Mobile Payment Security: We assess payment applications for vulnerabilities that may affect users’ accounts, transactions, and sensitive data.
• Business Logic Testing: Our specialists analyze payment processes to detect vulnerabilities that could be missed by automated scanners.
• Reporting and Retesting: We offer detailed reports, remediation recommendations, and retesting to make sure vulnerabilities have been fixed.

With human-led penetration testing and actionable reporting, Qualysec helps your team address technical security risks and strengthen its preparation for PSD2 compliance.

Speak Directly With Qualysec’s Certified Security Experts

Discover vulnerabilities before attackers exploit them

Schedule Free Consultation
→

Conclusion

PSD2 compliance is crucial for ensuring the security of customer data, payments, and trust in digital payments. You should apply Strong Customer Authentication, ensure the security of Open Banking APIs, and utilize risk-based exemptions appropriately. The process of compliance is an ongoing activity. It helps to detect any vulnerabilities that could result in monetary or information loss.

By continuously reviewing their security controls and addressing emerging threats, organizations can strengthen payment security and maintain their PSD2 compliance efforts.

FAQs

1. What is the meaning of PSD2 compliant?

PSD2 compliance means meeting payment security, authentication, and consumer protection requirements. It helps payment providers protect transactions and customer data. 

2. What is PSD2 regulation in the UK?

The UK implemented PSD2 through the Payment Services Regulations 2017. These rules govern payment services, authentication, Open Banking access, and consumer protection.

3. What are the key requirements of PSD2?

Key requirements include Strong Customer Authentication (SCA), secure Open Banking APIs, fraud reporting, operational risk management, and customer protection.

4. Is PSD2 mandatory?

Yes, PSD2-derived requirements apply to payment service providers within scope. In the UK, applicable firms must follow relevant regulations and obtain required authorization or registration. 

5. How is PSD2 different from GDPR?

PSD2 regulates payment services, transaction security, and Open Banking access. GDPR governs personal data processing and protects individuals’ privacy rights. 

6. What are the penalties for non-compliance with PSD2?

Penalties depend on the violation and applicable jurisdiction. Consequences may include regulatory fines, enforcement action, authorization issues, and liability for certain payment losses.