PSD2 in plain English: what the Payment Services Directive actually does
PSD2 is the regulation that let neo-banks exist in the form you know today. Here is why it was written and what it means in practice for your bank statements, logins, and 2FA.
PSD2 — the Second Payment Services Directive — came into effect across the European Economic Area in January 2018. It is the single most consequential piece of EU financial regulation of the last decade. Without it, every neo-bank you have heard of would either not exist or would look completely different.
What PSD2 forced banks to do
Before PSD2, your bank account was a walled garden. Only the bank itself could see your transactions, initiate payments from the account, or build apps on top of your financial data. PSD2 broke that wall. Banks are now required to expose two things via regulated APIs: account information (so authorised third parties can read your transaction history with your consent) and payment initiation (so third parties can trigger payments from your account, again with your consent).
What this enabled
Aggregator apps that pull your balances from five different banks into one dashboard. Buy-now-pay-later services that initiate the actual payment from your account. Accounting software that reads your transactions automatically for bookkeeping. And neo-banks themselves: a competitor can set up with a fraction of the historic infrastructure cost because the regulated API surface is already there.
Strong Customer Authentication (SCA)
The other PSD2 pillar is SCA. Every online payment above €30, every login to a new device, and every change to a payment limit must be authenticated with two of three factors: something you know (PIN or password), something you have (phone or hardware token), something you are (biometric). That annoying 3DS pop-up when buying something online is SCA at work.
Who it protects
SCA cut card-not-present fraud across Europe by roughly 40% in the two years after full enforcement. The friction is real but the fraud reduction is larger. For bank-to-bank transfers initiated via PSD2 APIs, SCA means a scammer who steals your login still cannot move money without approving the transaction on your phone.
Where PSD2 falls short
API quality across banks is wildly uneven. Some legacy banks still return error-prone data or require re-authentication every 90 days by default. The upcoming PSD3 / PSR, expected to be finalised in 2026, is set to raise the bar on API uptime, data completeness, and third-party fraud liability.