A directive with three key dates
When did PSD2 start to bite? The answer depends on which part you mean. Directive (EU) 2015/2366 is dated November 25, 2015, and Article 115 of the adopted text told member states to apply their national versions from January 13, 2018. Article 114 repealed Directive 2007/64/EC, the first payment services directive, on that same day.
Security came later. The same article delayed the authentication rules of Article 97 until 18 months after the technical standards took effect, and Delegated Regulation 2018/389 applies from September 14, 2019. What people search for as PSD2 SCA lives there, the two-factor strong customer authentication test with its exemptions for small and low-risk payments.
Britain wrote the directive into the Payment Services Regulations 2017. Regulation 1 of that instrument puts most of it into force on January 13, 2018, the EU date.
Eight services and the firms that may offer them
Annex I lists what the directive regulates. It names eight services, among them cash deposits and withdrawals, transfers and card payments, issuing payment instruments such as cards, acquiring payment transactions for merchants, and money remittance.
The last two entered EU law with PSD2, and Article 115 let firms already offering them before January 12, 2016 carry on during the transition. A payment initiation service starts a payment from an account held at another provider, and an account information service gathers data from accounts at one or more providers, as Article 4(15) and 4(16) define them. Together they are what Europe calls open banking.
Article 1 says who may provide those services. The list covers banks, payment institutions and post office giro institutions, central banks acting outside their monetary role, and member states or local authorities when they are not acting as public authorities, along with e-money institutions.
Where crypto firms meet PSD2
E-money tokens are where the directive reaches crypto firms. In a no-action letter of June 10, 2025, the European Banking Authority advised national supervisors to treat a transfer of e-money tokens made for clients as a payment service. In the letter’s reading, a custodial wallet held in a client’s name that can send and receive such tokens to and from third parties is a payment account.
Its advice was to require PSD2 authorization for those services only from March 2, 2026, through a streamlined process. The EBA advised supervisors not to treat exchanging crypto for money, or for other crypto, as a payment service at all. It still wants strong customer authentication for access to such a wallet and for starting a token transfer.
PSD3 is not in force yet
A common slip is to write as if PSD3 had already replaced PSD2. The Commission proposed both PSD3 and a Payment Services Regulation on June 28, 2023, and negotiators from Parliament and Council reached a deal that a Parliament press release announced on November 27, 2025. Under it, crypto-asset service providers already authorized under MiCA would get a streamlined route to a payments license.
The deal still needed formal adoption. On November 12, 2026, the Legislative Observatory showed both files awaiting Parliament’s second reading, with the Council’s positions published on November 5, 2026 and an indicative plenary date of December 14, 2026. PSD3 would repeal Directive 2015/2366, but until the new texts are adopted and start to apply, PSD2 and the national laws built on it are the ones to check.