Payment Services Directive II (PSD2)

State-of-play: Published in the Official Journal (L 337/35). Security standards under PSD2 came into force 14 September 2019.

Level 1

Commission

• 24 July 2013, the proposal was published.

Parliament

• 12 March 2014, the ECON Committee adopted the report on the proposal.
• 16 June 2015, the ECON Committee approved the agreed text from the trilogue negotiations.
• 8 October 2015, the Parliament adopted the agreed text in plenary.

Council

• 9 December 2014, the Council agreed its general approach on the proposal.
• 16 November 2015, the Council formally adopted the text.

Level 2

• 27 November 2017, the Commission adopted a delegated regulation with regard to RTS for strong customer authentication and common and secure open standards of communication.
• 13 December 2017, the EBA published its final report on draft RTS setting technical requirements on development, operation and maintenance of the electronic central register on access to information
• 14 March 2019, the Commission published a delegated regulation on the criteria for the appointing central contact points within the field of payment services and on the functioning of those central contact points.

Level 3

• 29 June 2017, the EBA published its opinion in response to the Commission’s intention to amend the EBA’s draft RTS under PSD2.
• 4 December 2018, the EBA published the final guidelines on exemption from the fall back mechanism under the RTS on SCA and CSC.
• 11 December 2018, the EBA published an opinion on the use of eIDAS certificates under PSD2.
• 26 April 2019, the EBA published clarifications to a third set of issues raised by its Working Group on APIs under PSD2.
• 21 June 2019, EBA published an opinion on the element of strong customer authentication under PSD2.
• 14 August 2019, the EBA published clarifications to the fifth set of issues raised by its Working Group on APIs under PSD2.
• 28 November 2019, the EBA published its final guidelines on ICT and security risk management under PSD2.
• 22 January 2020, the EBA published an amendment to its 2018 guidelines on fraud reporting under the revised PSD2.
• 4 June 2020, the EBA published an opinion on obstacles to the provision of third-party provider services (TPPs) under the RTS on strong customer authentication (SCA) and common and secure communication (CSC).
• 14 October 2020, EBA published a public consultation on the revision of major incident reporting guidelines under PSD2.
• 22 February 2021, EBA published an opinion on supervisory actions NCAs should take to ensure the removal of obstacles to account access under the PSD2.

Next steps

• At the end of 2021, the Commission will launch a comprehensive review of the application and impact of PSD2, including a review of contactless payment amounts and unregulated services.
• By the end of 2023, the Commission will explore the feasibility of developing a ‘label’ accompanied by a visible logo for eligible pan-European payment solutions.