PSD3/PSR tracker
Current as of: 26 October 2026
This tracker follows the status of the level 2 and level 3 measures to be adopted pursuant to the Payment Services Directive regulatory package, comprising PSD3 and PSR, published on 28 June 2023 by the European Commission. It also includes the PSD3/PSR relationship to existing guidance under the Payment Service Directive 2 (PSD2).
This tracker will be updated from time to time. It was prepared by Juliet de Graaf and Floor van de Swaluw, from Osborne Clarke, The Netherlands. If you have any questions, kindly get in touch with them or reach out to your local expert at Osborne Clarke.
Please note: The tracker is provided for general information purposes only. It has been produced with care, but may contain errors. This tracker is not intended and should not be used as a substitute for legal advice. Specific legal advice should be taken before acting on any of the topics covered.
About the measures
Level 2 measures specify certain aspects of PSD3/PSR, expressed as:
- A Commission-delegated Act
- RTS: Regulatory Technical Standards
- ITS: Implementing Technical Standards.
Level 3 measures are guidelines provided by EBA to ensure consistent interpretation throughout EU member states.
Level 2 measures
Commission delegated acts - Level 2 measures
| Legal reference PSD3/PSR | Description | Status | Existing guidance under PSD2 |
|---|---|---|---|
| 31(4) PSR | The information to be disclosed to payment service providers providing acquiring services. | Not yet available | N/A |
Regulatory Technical Standards - Level 2 measures
Ordered by first PSD3/PSR reference
| Legal reference PSD3/PSR | Description | Status | Existing guidance under PSD2 |
|---|---|---|---|
| 3(5) PSD3 | The information to be provided to competent authorities for the authorisation of payment institutions and the registration of account information service providers and ATM deployers, establish a common assessment methodology for such authorisations and registrations, define what qualifies as a guarantee comparable to professional indemnity insurance, and lay down criteria for determining the minimum monetary amount of that insurance or comparable guarantee. | Not yet published | Final Report published 7 July 2017 Final Report published 11 July 2017 |
| 7(6) PSD3 | The criteria to determine when the payment institution’s business model is such that they only execute a small number of transactions, but of a high individual value. | Not yet published | N/A |
| 9(7) PSD3 | Safeguarding requirements, laying down in particular safeguarding risk management frameworks for payment institutions to ensure protection of users’ funds, and including requirements on segregation, designation, reconciliation and calculation of safeguarded funds. They shall in particular specify the circumstances in which it is appropriate to avoid concentration risks. | Not yet published | N/A |
| 18(5) PSD3 | Operation and maintenance of the electronic central register and on access to the information contained therein. | Not yet published | Final Report published 13 December 2017 |
| 30(5) PSD3 | Framework for cooperation and information exchange between home and host Member State competent authorities, specifying the methods, means and practical details for notifying cross‑border payment institution activities, including the scope and treatment of information to be submitted, as well as common terminology and standard notification templates to ensure a consistent and efficient notification process. | Not yet published | Final Report published 31 July 2018 |
| 2(8) PSR | When services based on limited‑use payment instruments qualify for exclusion from PSR. | Not yet published | N/A |
| 32(5) PSR | The harmonised format and information to be contained in the notification and motivation regarding the decision to refuse to open a payment account or close a payment account. | Not yet published | N/A |
| 38(5) PSR |
| Not yet published | Commission Delegated Regulation published 20 November 2017 |
| 39(2) PSR | The criteria on the basis of which it is justified for an account servicing payment service provider not to offer any interface at all for secure data exchange. | Not yet published | N/A |
| 48(8) PSR | The data to be provided to competent authorities on access by account information service providers and payment initiation service providers to payment accounts which they service as well as the methodology and periodicity to be applied for such data provision. | Not yet published | Commission Delegated Regulation published 20 November 2017 |
| 82(2) PSR | Statistical data to be provided on the fraud reporting requirements. | Not yet published | Guidelines published 22 January 2020 |
| 89(1) PSR | Authentication, communication and transaction monitoring mechanisms. | Not yet published | Final Report published 5 April 2022 |
Implementing Technical Standards - Level 2 measures
Ordered by first PSD3/PSR reference
| Legal reference PSD3/PSR | Description | Status | Existing guidance under PSD2 |
|---|---|---|---|
| 18(6) PSD3 | The details and structure of the information to be notified for the purpose of the EBA register, including the data standards and formats for the information. | Not yet published | Final Report published 13 December 2017 |
| 82(3) PSR | The details and structure of the information to be notified for the purpose of the EBA register, including the data standards and formats for the information. | Not yet published | Final Report published 18 July 2018 |
Level 3 measures
Guidelines - Level 3 measures
| Legal reference PSD3/PSR | Description | Status | Existing guidance under PSD2 |
|---|---|---|---|
| 85(12) PSR | How to assess whether, in cases where strong customer authentication is based on two inherence elements, the independence of those elements is fully preserved and a high level of security is ensured. | Not yet published | N/A |
| 91(6) PSR | On complaints procedures, including the channels for submission of complaints, the information requested from complainants, and the disclosure of the aggregate analysis of complaints. | Not yet published | Final Report published 13 October 2017 |
