PSD2

The EU's rulebook for electronic payments, best known for requiring extra identity checks on most online purchases.

It is the reason a European shopper is often asked to approve an online payment in their banking app, instead of only typing in card details.

The EU's revised Payment Services Directive, mandating Strong Customer Authentication for electronic payments and open banking access via regulated APIs. An API, or application programming interface, is a controlled way for one system to request data or actions from another.

PSD2 is formally Directive (EU) 2015/2366, and it has two main parts:

• Strong Customer Authentication (SCA), which requires at least two independent proofs of identity for most electronic payments, with exemptions for low-risk and low-value cases.
• Open banking, which requires banks to give licensed third-party providers access to customer account data and payment initiation, with the customer's consent, through secure APIs.

Open banking involves two kinds of regulated third parties:

1. Payment initiation service providers, which start a payment from a customer's bank account on their behalf.
2. Account information service providers, which gather a customer's account data from several banks in one place.

The EU has also proposed successor rules, often called PSD3 and the Payment Services Regulation, so the framework continues to evolve.

PSD2 sits next to terms that are easy to mix up:

• Strong Customer Authentication (SCA) is the authentication requirement that PSD2 created.
• 3-D Secure is a card protocol that merchants commonly use to meet SCA online.
• GDPR governs personal data, while PSD2 governs payment services, and both can apply to the same payment.