PSD3 and PSR testing requirements
PSD3 and the Payment Services Regulation (PSR) are the EU package that will replace PSD2 for banks, payment institutions, and e-money institutions. On 16 September 2026, both texts are agreed but not formally adopted. PSR testing verifies payee name checks, spending limits, fraud monitoring, strong customer authentication, and consent dashboards against the agreed article text.
- Jurisdiction
- EU (text with EEA relevance; PSR directly applicable, PSD3 transposed by member states)
- Primary source
- data.consilium.europa.eu
- Status verified on
Engineering interpretation of testing requirements, not compliance advice.
What PSD3 and the PSR require, and where the package stands
The European Commission proposed PSD3 (COM(2023) 366) and the Payment Services Regulation (COM(2023) 367) on 28 June 2023. Parliament adopted its first-reading position on 23 April 2024, and Coreper agreed the Council mandate in June 2025. The Council and Parliament announced a provisional agreement on 27 November 2025.
The Council sent the final compromise texts to Coreper on 17 April 2026 for agreement at second reading: document 8222/26 for PSD3 and the PSR final compromise text, document 8221/26 (checked on 2026-09-16). Parliament's ECON committee approved the agreed texts on 5 May 2026. On 16 September 2026, the Legislative Observatory file 2023/0210(COD) shows the status "Awaiting Council's 1st reading position" and an indicative plenary date of 14 December 2026. Neither act is published in the Official Journal. Requirements below follow the final compromise texts; article numbers can change during legal-linguistic revision.
Dates in the agreed texts. Each act enters into force 20 days after publication. The PSR applies 21 months after entry into force, and Articles 50 and 57 apply after 27 months (Article 112). Member states transpose PSD3 within 21 months (PSD3 Article 49), when PSD2 and Directive 2009/110/EC are repealed (PSD3 Article 48). Authorised payment and e-money institutions continue until 27 months after entry into force while authorities assess them (PSD3 Articles 44 and 45).
The PSR articles with the largest test scope:
- Article 50, payee name check. Articles 5c(1) to (7) and 5b(2) of Regulation (EU) No 260/2012 apply to all credit transfers, including non-euro transfers. Under Article 57, the payer's provider refunds a defectively executed transfer when a provider failed to apply the check.
- Article 51, spending limits and app activation. The user sets a limit per instrument, per transaction or per period. A remote limit increase takes effect after a four-hour delay that the user can adjust or opt out of, with immediate notification. An order above the limit is not executed, and the user receives the reason. Mobile app activation requires strong customer authentication through different communication channels, with the same four-hour delay when remote.
- Article 59, impersonation fraud. A consumer manipulated through channels attributed to the provider gets a full refund after reporting to the provider and the police. The provider refunds or justifies a refusal within 15 business days and carries the burden of proof.
- Article 83, transaction monitoring. The payer's provider monitors before execution; the payee's provider monitors before funds become available. A payer's provider without evidence of monitoring by both providers refunds the payer. Minimum risk factors include compromised authentication elements, the amount, known fraud scenarios, and signs of malware.
- Articles 85 and 88, strong customer authentication. SCA applies to online account access, payment orders, and risky remote actions, including token creation, limit increases, and online password or contact detail changes. Remote payment orders need dynamic linking to amount and payee (Article 85(8)). SCA does not depend on a smartphone unless the user agreed to app-only services (Article 88).
- Article 43, consent dashboard. The account servicing provider lists each open banking consent with provider, account, purpose, validity, data categories, and access dates. The user withdraws consent free of charge, can re-establish it within 48 hours, and sees withdrawn or expired consents for two years.
- Article 13(1)(f), currency conversion. Conversion charges for credit transfers and money remittance appear before initiation as an amount and as a percentage mark-up over a mid-market rate no more than 10 minutes old (Article 5).
PSR articles that testing verifies
| Requirement | What we test | Evidence produced |
|---|---|---|
| Article 50: payee name check on every credit transfer | Match, close match, no match, and other results for euro, non-euro, single, and batch transfers | Result log per test account and payee name, with the screen the payer saw |
| Article 57: refund after a missed name check | A transfer executed without the check reaches the refund and account restoration path | Refund posting record with the restored account balance |
| Article 51(1a): four-hour delay on a remote limit increase | Limit increases by app and web, opt-out, and changes during an active delay | Timestamped limit change log with each notification sent |
| Article 51(1c): order above the spending limit | Orders that exceed a per-transaction limit or a per-period limit | Rejection response with the stated reason |
| Article 51(4a) to (4c): mobile app activation | Remote activation with SCA over a second channel, the four-hour delay, and the activation notice | Activation test cases with channel and notification captures |
| Article 83(1a): monitoring before execution | Payer-side screening before execution and payee-side screening before funds release | Monitoring decision log per test transaction |
| Article 85(1)(d): SCA on sensitive remote actions | Password change, contact detail change, limit increase, and token creation per channel | SCA trigger matrix per action and channel |
| Article 88: SCA without a smartphone | A free SCA path for a customer without a smartphone | SCA method coverage matrix per customer group |
| Article 43: consent dashboard | Consent fields, withdrawal per provider and for all providers, re-establishment within 48 hours, two-year history | Dashboard test report with the notifications sent to third-party providers |
| Article 13(1)(f): conversion mark-up disclosure | Mark-up as an amount and as a percentage, and the age of the reference rate | Disclosure capture per currency pair with the rate timestamp |
Artifacts a supervisor or partner bank requests
Once the PSR applies, a national competent authority or a sponsor bank in due diligence can ask for:
- a map from each PSR article in scope to the product flows it changes, with the 21-month or 27-month application date;
- payee name check test results for euro and non-euro credit transfers, and the Article 57 refund procedure;
- spending limit and delay configuration with change logs (Article 51);
- transaction monitoring rules mapped to the Article 83 risk factors, with per-transaction evidence that monitoring ran;
- impersonation fraud case records with the 15-business-day decision dates (Article 59);
- the SCA method inventory with the non-smartphone option (Article 88) and the actions that trigger SCA (Article 85(1));
- the consent dashboard test report and notification logs exchanged with third-party providers (Article 43);
- availability and performance statistics for the dedicated data access interface (Article 38).
Common findings against the agreed text
- Name check limited to euro transfers. The check built for Regulation (EU) No 260/2012 runs on SEPA transfers only, and non-euro or batch transfers skip it. The gap breaks Article 50, and under Article 57 the payer's provider refunds the misdirected amount.
- Limit increase effective at once. A limit raised in the app applies to the next payment with no delay and no notification. The defect breaks Article 51(1a) and lets an account takeover drain the account at once.
- Activation code sent to the device being activated. The SMS code for a new app installation goes to a phone number that a fraudster changed an hour earlier. The defect breaks the different-channel condition of Article 51(4a).
- Contact details changed without SCA. The phone number or email changes after a password login only. The defect breaks Article 85(1)(d).
- Fraud scoring after execution. An instant transfer settles before the asynchronous fraud score returns. The defect breaks Article 83(1a), and without monitoring evidence the payer's provider refunds the transaction.
- SCA only through the app. A customer without a smartphone cannot confirm a payment. The defect breaks Article 88(2).
- Dashboard without re-establishment. A withdrawn consent cannot be restored within 48 hours, or the withdrawal screen warns against third-party providers. The defect breaks Article 43(2)(c) or Article 43(3).
- Interface timeouts counted as uptime. Availability monitoring records a request with no response after 30 seconds as successful. Article 38(1) presumes unavailability after five consecutive such requests.
How we cover PSD3 and PSR
Our engineers test current PSD2 flows against the agreed PSR articles and retest against the Official Journal text after publication, so article numbers in the evidence match the published regulation.
The open banking API testing service delivers the consent and reauthorisation flow test suite for the Article 43 dashboard and API conformance test results for the dedicated interface rules of Articles 35 to 38. The consent and token refresh guide shows the requests behind those tests, and the open banking segment page covers connector coverage for aggregators.
Article 85 builds on the PSD2 SCA regime, with exemptions moving to new EBA standards under Article 89; the PSD2 SCA testing requirements page covers the current rules. For Article 83, the transaction monitoring rule test matrix from KYC, AML and fraud testing maps each rule to the minimum risk factors. The FX rate application guide covers the mark-up checks for Article 13(1)(f).
We test PSR flows for neobanks, remittance, Banking-as-a-Service, business banking, and spend management products. Test runs use synthetic payment account data under the rules for account data in our environment.
Related
Services
Segments
Questions
What is PSD3?
What does PSD3 mean?
When will PSD3 come into force?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing