PSD2 — Payment Services Directive

Quick Answer

PSD2 (Payment Services Directive 2) is a European Union directive regulating payment services that came into force in January 2018 and replaced the earlier PSD from 2007. It opens the payments market to fintechs via mandatory bank APIs, introducing AISP (account information) and PISP (payment initiation) providers, and requires Strong Customer Authentication (SCA) — two of three factors (something you know, have, or are). In Poland it is supervised by KNF under the PolishAPI standard.

---

What is PSD2?

PSD2 (Payment Services Directive 2) is a European Union directive regulating payment services that came into force in January 2018 (with full implementation of technical requirements by 2019–2020). It replaced the earlier PSD directive from 2007.

Main goals of PSD2:

• Opening the payments market to new players (fintechs)
• Increasing security of electronic payments
• Consumer protection
• Stimulating innovation in the financial sector

Key changes introduced by PSD2

Open banking

PSD2 requires banks to provide APIs (application programming interfaces) through which licensed third parties can — with customer consent — access account data and initiate payments.

New categories of entities

• AISP — account information service providers (can read account data)
• PISP — payment initiation service providers (can order transfers)

Strong Customer Authentication (SCA)

PSD2 requires two-factor authentication for electronic payments. You must confirm your identity with two of three elements:

• Something you know — password, PIN
• Something you have — phone, card
• Something you are — fingerprint, facial recognition

That's why for online payments you must confirm transactions in your banking app.

Consumer protection

• Lower liability for unauthorized transactions (max 50 EUR vs. previously 150 EUR)
• Ban on charging surcharges for consumer card payments
• Faster complaint resolution

PSD2 in Poland

In Poland, PSD2 was implemented through amendments to the Payment Services Act. KNF (Polish Financial Supervision Authority) supervises AISP and PISP entities. Polish banks provide APIs compliant with the PolishAPI standard.

PSD3 — what's next?

The European Commission is working on PSD3 and the accompanying PSR (Payment Services Regulation). Planned changes include better fraud protection, API standardization and extending regulation scope to new payment forms.

How Freenance can help

Freenance operates under PSD2 regulations — it safely connects to your bank accounts to automatically import transactions. Everything is legal, with your consent and under regulatory supervision.

👉 Safe bank connection — freenance.io

Related Articles

• Open banking — czym jest i jak działa
• Fintech — co to jest i jak zmienia finanse

FAQ

What does PSD2 stand for?

PSD2 stands for the second Payment Services Directive — an EU directive (2015/2366) that took effect in January 2018 and replaced the original PSD from 2007. It set common rules for payment services across the European Economic Area, opened the market to non-bank providers, and tightened consumer protection requirements.

What is the difference between AISP and PISP?

An AISP (Account Information Service Provider) is licensed to read, with explicit user consent, transaction and balance data across multiple banks — this is the basis of modern account aggregation. A PISP (Payment Initiation Service Provider) is authorised to initiate payments directly from the user's bank account, bypassing card networks. Both are supervised in Poland by KNF and operate via standardised banking APIs.

What is Strong Customer Authentication (SCA)?

SCA is a PSD2 requirement that most electronic payments and account access events be confirmed using two of three independent factors: something you know (password, PIN), something you have (phone, hardware token) and something you are (biometrics). The goal is to drastically reduce fraud on remote transactions. In practice this is why online card payments now usually trigger a confirmation in your banking app.

Is account aggregation under PSD2 safe?

PSD2 mandates that licensed AISPs use regulated APIs, never store credentials, and obtain explicit, time-limited consent — usually renewed at least every 180 days under SCA rules. Supervision in Poland is handled by KNF, with EBA setting technical standards at EU level. As with any data-sharing service, you should still review which providers you authorise and revoke access you no longer use.

Will PSD3 replace PSD2?

The European Commission has proposed PSD3 together with a Payment Services Regulation (PSR) to strengthen fraud protection, harmonise API quality, and broaden the scope to newer payment forms. The proposals are still going through the EU legislative process, so PSD2 remains the operative framework today. This article is educational and not legal advice.