What’s Next for PSD3

The European Commission’s proposed update to the Payment Services Directive—PSD3—signals a new chapter in the regulation of digital payments and open banking. While PSD2 reshaped how financial data is shared and protected, PSD3 aims to build on its foundation with tighter security, broader scope, and enhanced consumer protections. But as with any regulatory overhaul, there are questions: When will it come into force? What should financial institutions do to prepare? What technical challenges lie ahead? 

At OceanoBe, we help banks and fintech companies integrate secure, scalable payment solutions. Here’s what developers and technology stakeholders need to know about PSD3’s roadmap and how to architect systems that will stay ahead of compliance. 

PSD3 vs. PSD2: Why the Shift? 

PSD3 (along with the accompanying Payment Services Regulation, or PSR) is the EU’s answer to several shortcomings identified in PSD2. While PSD2 introduced grounbreaking requirements for APIs and Strong Customer Authentication (SCA), implementation gaps, fraud loopholes, and inconsistent national supervision prompted the need for a more unified and enforceable approach. 

PSD3 proposes: 

Replacing certain directive elements with directly applicable regulations (PSR) 

Extending the scope of SCA to more types of transactions 

Enhancing user protection mechanisms 

Clarifying the liability in payment chain disputes 

Increasing access for third-party providers (TPPs) through standardized APIs 

Timeline: When Will PSD3 Be Implemented? 

The official legislative process began in 2023, and as of 2025, the proposal is under review by the European Parliament and Council. By next year the final text and regulatory technical standards (RTS) are expected to be adopted. In 2027 the latest member states begin implementing PSD3 (for directive parts). PSR will likely be enforceable sooner, as it’s a regulation and doesn’t require transposition. 

By 2028 most financial institutions are expected to comply fully with the new framework. 

For tech teams, the clock is already ticking. Systems, data flows, and customer authentication models need to be evaluated now—not after the deadlines hit. 

Preparing Technically: What Financial Institutions Should Do 

Audit Your API Infrastructure 

PSD3 is expected to mandate greater API standardization and uptime requirements. Institutions relying on fragmented, hard-to-maintain API gateways will need to migrate toward scalable, monitored solutions. Consider investing in Kong, Apigee, or AWS API Gateway combined with OAuth 2.0 and OpenID Connect protocols. 

Update Authentication Mechanisms 

Strong Customer Authentication under PSD3 will apply to even more use cases. Financial institutions will need to support advanced MFA solutions, including biometric authentication, device fingerprinting, and risk-based adaptive authentication. 

Data Governance & Consent Management 

Transparency and consent are central to PSD3. Implementing data access controls, consent tracking tools, and GDPR-aligned audit trails—possibly using PostgreSQL with Row-Level Security (RLS) or integrating a dedicated consent management platform—will be crucial. 

Modernize Core Systems for Compliance Readiness 

Legacy systems that can't adapt to new compliance frameworks will struggle. Cloud-native architectures with microservices, containerization (using Docker and Kubernetes), and CI/CD pipelines help reduce deployment time for regulatory updates. 

Key Technical Challenges Ahead 

One of the key technical hurdles revealed by PSD2 was interoperability—the inconsistent implementation of APIs across institutions led to fragmentation and inefficiencies. PSD3 aims to correct this with a stronger push for standardization, which will demand more agile development cycles and ongoing integration testing to ensure seamless functionality across providers. At the same time, real-time compliance monitoring becomes critical, as banks must capture and log every user consent, transaction, and access event with minimal latency. Technologies such as Kafka, Prometheus, and the Elastic Stack offer the scalability and observability needed to meet these demands. As PSD3 expands the role of third-party providers (TPPs), the threat landscape grows more complex, requiring developers to implement rigorous identity verification mechanisms and secure sandbox environments to test and validate integrations before going live. 

Industry Perspectives: What Does PSD3 Mean for the Future? 

From a business perspective, PSD3 levels the playing field. It opens doors for innovation while enforcing greater accountability. But for CTOs, product owners, and developers, it’s a compliance challenge that demands foresight, flexibility, and technical fluency. 

At OceanoBe, we view PSD3 as an opportunity. It's a chance to build secure, future-ready platforms that not only meet regulatory demands but also drive customer trust and product scalability. Whether you need help with payment gateway architecture, customer onboarding flows, or real-time fraud prevention—our team of engineers has you covered. 

Just an update? Or technical evolution? 

PSD3 isn’t just a regulatory update—it’s a technical evolution. Financial institutions that act now will be the ones who thrive later. Aligning your tech stack with PSD3’s core principles—openness, security, and transparency—should begin today. 

Let’s talk about how OceanoBe can support your compliance roadmap and turn it into a competitive advantage.