Law · European Union

PSD2: Directive (EU) 2015/2366 on payment services in the internal market

Directive (EU) 2015/2366 (PSD2) is the EU directive governing payment services, electronic transactions and open banking in the internal market. It licenses fully authorised payment institutions, registered account information service providers (AISPs) and small payment institutions under national exemption regimes. It also sets core capital, customer safeguarding and Strong Customer Authentication requirements.

Last verified 2026-09-24Markdown · Data (CC BY 4.0)
Directive (EU) 2015/2366 on payment services in the internal market: lawPSD2§

At a glance

Official titleDirective (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC1
English titleDirective (EU) 2015/2366 on payment services in the internal market
CitationDirective (EU) 2015/2366
JurisdictionEuropean Union (applies in every EU/EEA state)
Typedirective
Adopted2015-11-25
In force from2016-01-12
Statusin force

Full text

Official full text: Directive (EU) 2015/2366 on payment services in the internal market (PDF, en)2 · 988 KB · file checked 2026-09-24 · consolidated version of 2025-01-17

Official page: eur-lex.europa.eu1

Summary

Directive (EU) 2015/2366 (PSD2) sets the EU's regulatory framework for payment services in the internal market. It covers payment institutions, credit institutions, electronic money institutions and post office giro institutions across the EEA. The directive creates three licensing statuses: fully authorised payment institutions, registered account information service providers (AISPs), and small payment institutions under optional national exemption regimes. A payment institution needs initial capital of between EUR 20,000 and EUR 125,000, depending on the services it offers, and must hold ongoing own funds calculated under one of three methods, A, B or C. Institutions holding client funds must keep them in a separate account or cover them with comparable insurance. PSD2 also requires account servicing providers to give payment initiation and account information providers non-discriminatory access, and it requires Strong Customer Authentication (SCA) and prior approval for anyone acquiring a qualifying holding.

Summary written by the Atlas from the official text; the law itself prevails.

Main articles

  • Art. 1: Sorts payment service providers into credit institutions, electronic money institutions, post office giro institutions, payment institutions, the ECB, national central banks and public authorities.
  • Art. 5: Lists what a payment institution must file for authorisation: a business plan, governance structure, risk controls, ICT resilience arrangements and anti-money laundering measures.
  • Art. 6: An acquirer must notify the competent authority in writing before buying or selling a qualifying holding that crosses the 20%, 30% or 50% threshold of capital or voting rights.
  • Art. 7: Sets initial capital at EUR 20,000 for money remittance, EUR 50,000 for payment initiation services and EUR 125,000 for other core payment services.
  • Art. 8: Payment institutions must hold own funds at least equal to their initial capital, or to the amount calculated under Article 9. Groups cannot count the same funds twice.
  • Art. 9: Sets three methods for calculating ongoing own funds: Method A on fixed overheads, Method B on transaction volume, Method C on gross revenue.
  • Art. 10: Institutions must protect user funds, either by keeping them in a separate account at a credit institution, investing them in secure low-risk assets, or backing them with comparable insurance.
  • Art. 11: Sets the statutory conditions for granting a payment institution authorisation: sound governance, sound management and effective supervisory oversight across all Member States.
  • Art. 13: Sets out when a competent authority may withdraw an authorisation: non-use within 12 months, obtaining it through irregular means, or a threat to payment system stability.
  • Art. 18: Payment institutions may provide ancillary services and credit linked to payments, funded from their own funds. They cannot take deposits or hold non-payment accounts.
  • Art. 28: Sets up the EU passporting regime. An authorised payment institution can provide cross-border services, or open a branch, in another Member State once its regulator has notified the host authority.
  • Art. 32: Member States may exempt small payment institutions, with monthly transactions under EUR 3 million, from full authorisation. They do not get EU passporting rights.
  • Art. 33: Account information service providers do not need to meet capital requirements. Instead they must hold professional indemnity insurance, and they keep full cross-border passporting rights.
  • Art. 35: Payment system operators must give payment service providers access on objective, non-discriminatory and proportionate rules, with no unjustified barriers.
  • Art. 36: Credit institutions must give payment institutions access to a payment account on an objective, non-discriminatory and proportionate basis, and must give reasons if they refuse.
  • Art. 66: Gives payers the right to use payment initiation services. An account servicing provider must let a payment be initiated this way without first requiring a contract between them.
  • Art. 67: Gives users the right to use account information services. With their explicit consent, the account servicing provider must share account data securely and without discrimination.
  • Art. 97: Requires strong customer authentication for online account access, electronic payment initiation and other remote actions that carry a fraud risk, with the authentication tied to the specific amount and payee.
  • Art. 103: Member States must set penalties for infringements that are effective, proportionate and dissuasive, and may publish administrative sanctions once imposed.
  • Art. 109: Lets payment institutions already licensed under Directive 2007/64/EC keep operating while they move across to PSD2.
  • Art. 114: Repeals Directive 2007/64/EC (PSD1) from 13 January 2018, and replaces references to it in EU law using the correlation table.
  • Art. 115: Sets 13 January 2018 as the deadline for national transposition and the date the directive applies, though some technical security standards apply later.

Licences it governs

Regulators that apply it

Upcoming changes

  • PSD3 (COM(2023) 366) and the Payment Services Regulation (COM(2023) 367) are to replace this directive. The European Parliament's committee approved the text agreed with the Council on 5 May 2026; as of September 2026 the procedure still awaits formal adoption.3
  • Conduct of business, open banking access, and Strong Customer Authentication rules currently in PSD2 will transfer to the directly applicable Payment Services Regulation (PSR, COM(2023) 367), introducing mandatory Confirmation of Payee verification across the EU.4
Last verified 2026-09-24Author Danil Marmysh, Founder & CEO, ProtegraReviewed by Anastasia Sidorenkova, Head of Licensing, ProtegraReport an errorReference information, not legal advice.

Sources

  1. EUR-Lex: CELEX 32015L2366 · retrieved 2026-09-24
  2. EUR-Lex: CELEX 02015L2366-20250117 · retrieved 2026-09-24
  3. oeil.europarl.europa.eu: procedure file · retrieved 2026-09-24
  4. EUR-Lex: CELEX 52023PC0367 · retrieved 2026-09-24

Does PSD2 apply to your business?

Send us a short description of what you do. We tell you which obligations and licences follow from it, and what it takes to comply.

A free preliminary assessment: we check your business model against the licence before you spend on an application. We handle this licence and any other fintech licence, including jurisdictions the Atlas does not cover yet.