A Guide to PSD2 and Open Banking

PSD2 is a European regulation that mandates stronger security and allows third-party access to banking data, fostering innovation and competition in financial services

What You Will Discover:

---

Ever wondered why your online payments feel more secure and your banking options more varied lately? That’s no coincidence. The financial world has undergone a quiet revolution, thanks to the Payment Services Directive 2, or PSD2.

Introduced by the European Union, PSD2 didn’t just tweak the rules—it changed the game. Breaking down the walls of traditional banking opened the door for innovation, competition, and consumer empowerment. But what exactly is PSD2, and why should you care? Let’s dive into how this directive shapes the future of finance and what it means for you.

What is the PSD2 Directive?

PSD2, or the Second Payment Services Directive, is the primary European regulation for electronic payment services. It was introduced to harmonise payment operations across the European Economic Area (EEA). Building on the original Payment Services Directive (PSD) from 2007, PSD2 introduces significant changes aimed at enhancing consumer protection and fostering competition and innovation in the payments market.

Key Changes Introduced by PSD2:

Consumer Protection and Security:

• Stronger security requirements for online transactions.

• Introduction of multifactor authentication (MFA) to safeguard consumer data.

Boosting Competition and Innovation:

• Enables third-party providers (TPPs) to access consumer bank data (with consent) via application programming interfaces (APIs).

• Opens the market to new payment solutions, breaking banks’ monopoly on customer data.

These changes directly impact how businesses handle customer authentication and allow for a more streamlined and secure payment experience, particularly in e-commerce. By leveling the playing field, PSD2 encourages both banks and non-banks to innovate and provide better services to consumers.

PSD2 and Open Banking

Aspect	PSD2	Open Banking
Origin	European legislation (EU directive)	Concept that started in the UK but has now become global
Purpose	Mandates that banks must allow third-party access to customer data with consent	Standardises and facilitates secure data sharing between banks and third parties globally
Scope	Applies across the European Economic Area (EEA)	Implemented in various countries, with different standards and regulations
Data Sharing	Requires banks to share data but doesn’t dictate how	Provides frameworks and standards for secure data sharing globally
Use Cases	Focuses on increasing competition and security in payments	Enables services like account aggregation, faster loan approvals, and secure online payments
Examples	Regulatory requirement for banks to open data to third parties	Tools for managing multiple bank accounts, global payment solutions, and financial planning apps

Strong Customer Authentication (SCA)

With the introduction of PSD2, online payments across the European Economic Area (EEA) are now subject to stricter customer authentication measures, especially for high-value and recurring transactions. This requirement is known as Strong Customer Authentication (SCA), a key element designed to significantly boost consumer protection.

Since its enforcement in September 2019, SCA has become a critical requirement for any merchant accepting online payments within the EEA. The goal of SCA is to ensure customers’ protection in an era of increasingly transparent and widespread digital transactions.

In the past, online payment authentication often relied solely on a username and password. However, this method proved to be cumbersome, with users frequently forgetting their login details. To address this, SCA mandates that payment providers verify a customer’s identity using at least two out of three independent factors:

Previously, only one of these factors, typically a password, was required. Now, for a transaction to be successfully processed, it must meet at least two of these criteria, providing an additional layer of security.

Impact of PSD2

On Consumers

• Safer Transactions: PSD2 makes online payments more secure and easier to complete, reducing the risk of fraud.
• Better Money Management: Consumers now have access to tools that help with budgeting, spending, and investing.
• Simplified Services: Tasks like applying for a loan have become quicker and less complicated, thanks to instant data sharing.

On Companies

• Balancing Act: While Strong Customer Authentication (SCA) improves security, businesses need to ensure it doesn’t disrupt the customer experience. A smooth checkout process is crucial.
• Chargeback Relief: If businesses use 3DS2 for SCA, the responsibility for chargebacks shifts to the card issuers, reducing the business’s liability.
• Implementation Costs: Adapting to SCA may require businesses to invest time and resources to get it right.

On Banks

• Data Access: PSD2 requires banks to open their payment systems to third-party providers, sharing data that was previously kept in-house. While this disrupts the traditional model, it also encourages innovation.
• Revenue Potential: This shift allows banks to explore new revenue streams by developing and offering new products and services.
• Adapting to Change: Banks that embrace these changes can stay competitive by becoming trusted advisors to customers, guiding them through the open banking landscape.

PSD2 requires banks to open up their customers’ financial data to third-party providers, with the customer’s consent. This has led to the creation of two important services: Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs).

What are Account Information Service Providers (AISPs)?

AISPs are essential under PSD2, allowing businesses and consumers to share financial data with third-party providers. These providers offer services that aggregate and analyse data from multiple accounts—such as transactions, balances, and standing orders—into a single view. This consolidated data helps users budget, track expenses, and gain actionable financial insights.

What are Payment Initiation Service Providers (PISPs)?

PISPs facilitate online payments by initiating transactions directly from a consumer’s bank account at their request. Under PSD2, banks must allow third-party providers access to this data, enabling more competition and innovation in the payment market. PISPs act as intermediaries between banks and merchants, securely authorising direct transfers when consumers approve.

GDPR & PSD2

Both the Payment Services Directive 2 (PSD2) and the General Data Protection Regulation (GDPR) came into effect around the same time in 2018, and they work together to shape how financial data is managed and protected in the EU and EEA.

• PSD2 aims to open up financial data, allowing third-party providers to access it with the customer’s consent. This promotes innovation and competition in the financial sector.

• GDPR, on the other hand, focuses on protecting personal data and ensuring that consumers have control over how their information is used.

The key link between these two regulations is the emphasis on individual consent. For example, under PSD2, third-party providers can access your financial data, but only if you’ve given explicit consent. At the same time, GDPR ensures that you can request the deletion of your personal data if you no longer want it to be shared.

Non-compliance with either regulation can result in significant fines, making it crucial for financial institutions to navigate both PSD2 and GDPR carefully. By doing so, they can protect consumer data while also fostering innovation in the financial sector.

How Open Banking Providers Protect your Data?

Open Banking providers go above and beyond to ensure the safety of your data. They invest heavily in advanced security technologies and processes to protect your information from unauthorised access and cyber threats. Adhering to PSD2 and GDPR creates a secure environment where you can confidently manage your finances, knowing that your data is accessible and protected from others.

In a world where data breaches and online fraud are constant threats, the compliance of Open Banking providers with these regulations is your assurance that your financial information is in safe hands. When you choose an Open Banking provider, you’re not just choosing convenience—you’re choosing security, transparency, and peace of mind.

Finexer: An Open Banking Provider’s Commitment

Our compliance with these regulations is not just about meeting legal requirements—it’s about providing peace of mind. At Finexer, we’re committed to offering innovative financial solutions and ensuring that these solutions are delivered within a framework of trust, security, and compliance. This way, you can focus on managing your finances confidently, knowing that your data is in safe hands.