New EU package on payment services and financial data access

In 2022, the European Commission evaluated the application and impact of the second payment services directive¹ (“PSD II”), the conclusions of which resulted in the publication on 28 June 2023 of a new legislative package, including proposals for a new directive on payment services and electronic money services in the internal market² (“PSD III”), a regulation on payment services in the internal market³ (“PSR”), and a regulation on a framework for financial data access⁴ (“FiDA”).

I. Background

The evaluation of PSD II showed that a number of initial objectives had been achieved. However, it also showed the necessity for a new set of rules to take account of the developments in the payment services space, without changing the fundamentals as the industry needs stability.

Against that backdrop, the Commission proposes to replace PSD II by PSD III, which would be designed to outline the rules regarding the access to the activity of providing payment and electronic money services within the EU and the supervision thereof, and to adopt PSR, which would regulate the provision of payment and electronic money services themselves. Since it would be a regulation, it would be directly enforceable in the entire EU, thereby reducing the risk of misinterpretation or variations in interpretation among the Member States.

In addition, the Commission proposes to establish FiDA, which would regulate the access, sharing and use of certain categories of customer financial data and would set out rules concerning the authorisation and operation of financial information service providers (“FISP”).

II. Proposed key changes of PSD III and PSR

Amongst the contemplated changes to, and improvements from, PSD II, the following can be highlighted:

1. A. Merging the legal and regulatory frameworks applicable to payment services and electronic money services

Currently, the regulatory regime applicable to payment services providers (“PSPs”) is set out in PSD II, while the activity of electronic money institutions is subject to the electronic money directive⁵ (the “E-Money Directive”). Both regimes have been transposed in Luxembourg into the Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems, as amended.

Given that both legal frameworks are reasonably consistent and compoundable, it is proposed to merge them into a single piece of legislation⁶ . Under the new regime, there would be only PSPs which would be allowed to provide e-money services, in addition to the payment services they provide. This would guarantee a greater level of harmonisation and would allow uniformity in the enforcement and supervision by national competent authorities of the legal requirements for payment institutions and former electronic money institutions within the European Union.

1. B. Improving the operation of open banking services

Open banking services were introduced with PSD II, but some obstacles to the provision of such services remained. Therefore, the purpose of PSR is to focus on the improvement of the functioning of open banking services, while avoiding radical changes, which might destabilise the market or could generate significant implementation costs. PSR would notably introduce the imposition of a dedicated interface for data access for account servicing payment services providers (subject to an exemption depending on their business model), open banking access management capabilities for users through permissions dashboards and a new liability regime for PSPs (for unauthorised transactions or failure to verify the matching of transactions), for technical service providers (for failure to support the application of SCA) and for payers (for unauthorised payment transactions).

1. C. Strengthening the protection of payment services users against fraud

In light of the ongoing issue of fraud and bearing in mind that PSD II is not appropriate to tackle certain specific types of fraud, the Commission suggests additional measures to combat fraud, encompassing both prevention and redress.

The newly proposed measures would consist in:

• Strengthening the customers’ authentication rules;
• Expanding the IBAN/name matching verification services to cover all credit transfers;
• Establishing a legal framework that would enable PSPs to share fraud-related information among themselves, while fully adhering to the GDPR⁷ ;
• Strengthening the transaction monitoring;
• Mandating PSPs to conduct educational campaigns aimed at raising awareness of payment fraud among their customers and staff; and
• Extending consumer refund rights in specific situations.

1. D. Reducing the imbalance between banks and non-bank PSPs 

• Enabling effective access of non-bank PSPs to bank accounts

Non-bank PSPs typically encountered difficulties in opening and maintaining accounts with banks because certain banks simply refused to open accounts for these institutions or closed existing bank accounts for concerns over matters such as anti-money laundering controls.

PSR would reinforce the existing requirements for banks in order to grant non-bank PSPs non-discriminatory access to bank accounts. Banks would thus be obliged to explain access refusal, the justification of which should stem from the unique circumstances of the non-bank PSP, encompassing serious grounds to suspect illegal activities being pursued by or via the non-bank PSP, or a business model or risk profile, which would cause serious risks for the bank. Moreover, non-bank PSPs would have the possibility to appeal to a national competent authority against a decision of a bank not to open or to close an account.

Apart from commercial banks, central banks would also have the possibility to offer account services to non-bank PSPs, at their discretion.

• Enabling effective access of non-bank PSPs to payment systems

The Commission observed that non-bank PSPs also struggled to access payment systems, directly or indirectly. In this regard, PSR would guarantee the direct participation of non-bank PSPs in all payment systems, including those designated by the Member States in accordance with the settlement finality directive⁸ , to which the requirement to have proportionate, objective and non-discriminatory access rules in place would be extended. The only grounds for refusal would be if the PSP was unable to comply with the payment system rules or if the PSP poses a high level of risk deemed unacceptable for the payment system operator.

Payment system operators would carry out a risk assessment of a PSP, which would apply for direct participation; the PSP would in return have to provide evidence that its internal arrangements are robust enough against relevant risks, including settlement, operational, credit, liquidity or business risks.

III. Key features of the new framework for financial data access

To complete the proposed regulatory framework applicable to payment services, the Commission intends to create a legal framework regarding the access and sharing of the financial data of customers of the financial sector, including on a cross-border basis, meant to boost financial innovation in terms of products and services available to customers.

Essentially, this new framework would provide, among other things, for the possibility for customers of the financial sector to share their financial data with certain data users, amongst which PSPs and FISPs – a new category of professionals subject to authorisation by national competent authorities, and to decide who can access such data and for what purpose. In addition, FiDA would put in place a detailed liability framework in the case of data breach on part of the financial data users as well as dispute resolution mechanisms meant to encourage customers to share their financial data by securing their trust in this respect.

IV. Timing

The payment services and financial data access package is expected to be adopted in the course of 2025 and