All regulations / EU Crypto and payments
PSD2 / PSD3
Know the rule before it knows you.
If you move, hold or initiate payments, you may need a licence or an exemption.
What it is
PSD2 regulates payment institutions, e-money, open banking (account information and payment initiation), strong customer authentication and liability for unauthorised transactions. PSD3 and a directly applicable Payment Services Regulation are being finalised to tighten fraud rules, merge e-money into the regime and strengthen open banking.
This applies to you if
- You offer wallets, payouts, marketplaces that hold funds, buy-now-pay-later, or embedded finance
- You access bank accounts via APIs or initiate payments for customers
- You are a platform collecting money on behalf of sellers
What it asks of you
- Licence or registration with DNB, or a documented exemption (for example commercial agent or limited network)
- Strong customer authentication, fraud monitoring and transaction reporting
- Safeguarding of client funds, capital requirements, outsourcing rules
- Transparent terms, refund rights and complaint handling
What it costs to ignore
Operating without a licence is a criminal offence; DNB and AFM fines and public enforcement.
Key dates
PSD2 since January 2018, SCA since 2019 to 2021. PSD3 and the PSR: political agreement reached; application expected from 2027 onwards.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.