Preparing for a New Era of Fraud Accountability

How Is PSD3 Different From PSD2?

PSD3 is best viewed as an evolution rather than a revolution. While PSD2 focused on access, authentication and enabling Open Banking, PSD3 and PSR expand that vision toward Open Finance while introducing stronger requirements around fraud prevention, consumer reimbursement and operational accountability.

The most significant shift is the move from fragmented compliance and reactive controls toward standardised, real-time fraud prevention and clearer accountability across the payments ecosystem.

What Is the Timeline for PSD3 and PSR?

While the final legislative process is still underway, the direction is clear. PSD3 and PSR have progressed through several years of review, consultation and negotiation, with formal adoption expected to be followed by a phased implementation period across the EU.

The proposed timeline currently points to implementation beginning in 2028, with Verification of Payee (VoP) requirements likely following shortly after. Importantly, organisations are not expected to become compliant overnight. The framework includes transition periods that give institutions time to assess gaps, implement new controls and modernise fraud prevention strategies.

For many payment providers, the real question is no longer when PSD3 arrives, but whether they are using the time available to prepare effectively.

Who Will Be Impacted by PSD3?

PSD3 and PSR will affect a broad range of financial services organisations, including banks, payment service providers (PSPs), fintechs and Open Banking providers.

While requirements will vary by organisation type, virtually any institution involved in initiating, processing or facilitating payments will need to evaluate the potential impact of the reforms.

How Will PSD3 Change Fraud Prevention?

The most significant change introduced by PSD3 and PSR is the elevation of fraud prevention from an operational function to a strategic business priority.

Historically, many fraud programmes focused on detecting and investigating fraud after suspicious activity occurred. Under PSD3, the focus shifts toward identifying risk before funds leave an account.

A key driver behind these reforms is the rise of impersonation scams and other forms of Authorised Push Payment (APP) fraud. In these scams, fraudsters often pose as trusted organisations, such as banks, law enforcement agencies or government bodies, and persuade customers to authorise payments to fraudulent accounts. Because the customer initiates the payment themselves, traditional authentication controls alone are often insufficient to prevent the fraud.

Real-time monitoring, proactive intervention and reimbursement accountability therefore become central to the fraud operating model. Institutions are increasingly expected to identify, assess and intervene before fraudulent payments occur, rather than relying primarily on post-event investigation and remediation.


Organisations that can identify risk earlier and make better decisions in real time will be better positioned to reduce losses while maintaining a positive customer experience.

What Are the Five Key Changes Organisations Should Prepare For?

Why Layered Intelligence Matters

As expectations around fraud prevention, reimbursement and customer protection continue to grow, single-point solutions are unlikely to provide sufficient visibility. Organisations increasingly need a layered approach that combines transaction, identity, device and behavioural intelligence to create a more complete view of risk throughout the payment journey.

What Should Organisations Be Doing Now?

While implementation details continue to take shape, organisations do not need to wait to take meaningful steps toward readiness. Preparation can begin with:

• Assessing current fraud monitoring capabilities
• Evaluating Verification of Payee readiness
• Reviewing reimbursement and liability processes
• Identifying gaps in behavioural and transaction intelligence
• Establishing governance and oversight frameworks
• Understanding how increased fraud accountability may impact operating models and costs

A phased approach allows organisations to build momentum now while maintaining flexibility as the final regulatory framework is formalised.

What Does PSD3 Readiness Look Like?

While every organisation's journey will be different, several capabilities are emerging as foundational to PSD3 readiness:

• Making real-time fraud decisions before funds are sent
• Strengthening payee and transaction intelligence
• Monitoring risk across the full payment lifecycle
• Detecting behavioural indicators of scams and social engineering
• Leveraging network intelligence to identify emerging fraud threats

Together, these capabilities can help institutions move beyond compliance and toward a more proactive approach to fraud prevention.

Beyond Compliance: Turning Regulatory Pressure into a Competitive Advantage

The institutions that gain the most value from PSD3 will not simply focus on meeting regulatory requirements. They will use this moment to modernise fraud strategies, improve decisioning and strengthen trust across the customer journey.

Investments in real-time decisioning, risk intelligence, behavioural intelligence and fraud orchestration can help organisations prepare for regulatory change while simultaneously reducing losses, improving operational efficiency and creating better customer experiences.

The same investments that support regulatory readiness can also create competitive advantage.

Looking Ahead

PSD3 and PSR represent more than the next evolution of payments regulation. They signal a broader shift toward real-time fraud prevention, stronger consumer protections and increased accountability across the payments ecosystem.

The organisations that succeed will view PSD3 not simply as a compliance requirement, but as an opportunity to modernise fraud strategies, strengthen customer trust and build long-term resilience.