PSD3 (the third Payment Services Directive) and the accompanying Payment Services Regulation (PSR) are the European Union's proposed successors to PSD2, intended to fix its uneven execution — tightening API performance and access requirements, curbing fraud, and moving core rules into a directly-applicable regulation to reduce national divergence. As proposed legislation they set the near-future direction of European open banking and open finance.
PSD3 & PSR
Directive European Union
PSD3 and the Payment Services Regulation (PSR) are the European Union’s attempt to fix what PSD2 got wrong. PSD2 opened the accounts but left execution to national implementations, and the result multiplied into flavors — inconsistent API quality, uneven access, and fraud gaps. PSD3/PSR, still moving through the legislative process, are the response.
- A regulation, not just a directive - Moving core rules into a directly-applicable regulation (the PSR) reduces the national-transposition divergence that fragmented PSD2.
- Better APIs by requirement - The package tightens dedicated-interface performance, availability, and access obligations — aiming at the usefulness gap, not just existence.
- Part of a wider open-finance push - It travels alongside the Financial Data Access (FiDA) framework that would extend data sharing beyond payment accounts.
PSD3/PSR is the regulation to watch if you want to know where European open banking is heading. Its whole premise is the lesson at the center of my banking research: a mandate that produces existence is not enough; the next iteration has to reach usefulness, and that means conformance, performance, and access written into law rather than left to each market.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
UK Open Banking Standard
The kind of conformance-tested standard PSD3/PSR aims to make the European norm rather than the exception.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
