PSD3 and the Acquirer Liability Shift: A Merchant’s Guide

The EU Council confirmed and published final texts for Third Payment Services Directive (PSD3) and Payment Services Regulation (PSR), a legislative package proposed to replace PSD2, with the framework expected to take full effect in late 2027 or early 2028. PSD3 and PSR aim to improve fraud prevention by setting more robust licensing and supervision requirements on PSPs and banks in the EU.

Changes include: 

• The PSD3 acquirer liability shift
• Strong Customer Authentication (SCA) alone no longer proves a transaction was authorized
• Transaction Risk Analysis (TRA) exemptions becoming more difficult to qualify for
• More clarity for merchant-initiated transactions (MIT) and subscription merchants

As PSPs are subject to increasing regulatory burden, they may become more risk-averse and authorize fewer transactions. A multi-PSP strategy can help merchants navigate the new legislation by protecting the customer experience.

Last updated: October 1st, 2026

What are PSD3 and PSR?

PSD3 is a directive that will primarily address the authorization, licensing, and supervision of PSPs and banks. PSR is a regulation that will cover security, SCA, and the obligations of PSPs. The evolution of PSD2 comprises both, often collectively referred to as “PSD3.”

PSD2 covered transparency, liability, and open banking. While PSD2 did reduce fraud rates across the EEA, it also led to under-reported revenue leakage for merchants. Faced with the friction of a 3DS challenge, many customers chose to abandon transactions. 

PSD3 is designed to further curb fraud, though it does come with its own risk of revenue loss. Changes to TRA exemptions may cause PSPs to add friction, while acquirers may adopt a more defensive, risk-averse posture as a result of the liability shift.

The timeline of PSD3/PSR

The EU Council’s texts are currently undergoing final linguistic and legal checks. They are expected to be published in the Official Journal of the European Union in September 2026, becoming law 20 days later.

European Economic Area member states will then have 18-21 months to transpose PSD3 into national law. PSR will be directly applicable to all member states. Enforcement for the new rules will likely begin in late 2027 or early 2028.

How does liability shift under PSD3?

Under PSD2, the card issuer carries strict liability for fraudulent transactions if they don’t enforce SCA. One major change is that PSD3 will increase liability for acquirers, who will share that responsibility with the issuers. Acquirers must prove they carried out transaction monitoring before approving a transaction. Without proof, they bear liability, whether or not SCA was carried out.

Acquirers may be less likely to authorize risky transactions, which makes pre-auth fraud checks more important than ever. PSPs are also likely to become more selective about granting TRA exemptions, which let lower-value, low-risk transactions skip the SCA challenge. If so, there will be a higher burden of proof on merchants to show transactions have been properly reviewed. Some PSPs may introduce a formal checklist or audit process before granting exemptions, similar to Japan’s JCA framework approach.

SCA no longer proves a transaction was authorized

SCA alone was never sufficient proof of authorization, though some merchants continue using it to determine which transactions are fraudulent. Without that option, the evidence standard for fraud disputes will likely rise. Merchants will have to support chargebacks and fraud claims with transaction-level signals, such as behavioral data, device intelligence, and network patterns.

This means that fraud checks should happen before, rather than instead of, SCA.

New standards for TRA exemptions

TRA exemption ability was previously based on a PSP’s overall fraud rate against a fixed threshold. While TRA exemptions still exist under PSD3, a low fraud rate is no longer enough. The qualifying criteria will become stricter, requiring PSPs to demonstrate the fraud prevention measures behind that number.

If PSPs are unable to demonstrate robust fraud measures, they may default to 100% SCA across the board, which will add friction and hurt conversion for merchants. When PSPs do allow exemptions, they may change unpredictably, rendering rule-based exemptions ineffective, unlike a more dynamic, responsive approach.

Exactly how these TRA exemptions will work remains to be seen. The European Banking Authority (EBA) has not yet published the Regulatory Technical Standards (RTS). Merchants will likely get full clarity by late 2026 or early 2027.

Changes impacting specific types of merchants and transactions

PSD3/PSR ushers in some changes that only apply to specific categories of merchants and transactions. 

MIT and MOTO transactions

MITs and Mail Order/Telephone Order (MOTO) transactions were previously addressed only in accompanying EBA guidance. Both are now formally defined in the PSR itself.

For MITs, SCA is required only at mandate set-up. Subsequent charges initiated by the merchant without the payer’s active involvement are explicitly exempt. Refunds initiated by the merchant back to the original payer are also explicitly exempt. MOTO transactions are exempt from SCA provided the PSP applies alternative authentication checks.

This gives merchants a clearer regulatory basis for MIT flows, reducing unnecessary friction and decline rates on subscription renewals. Merchants will also have stronger protection against first-party fraud. Customers will only be able to claim a refund on a recurring card payment if they can prove the amount differs from what they had initially agreed to pay — not because they no longer want to be charged. However, this only applies to card-based recurring payments. Direct debit retains a separate “unconditional refund right” under the regulation.

Multi-sided marketplaces: Tightening of the Commercial Agent Exemption

Under PSD2, platforms could avoid a payment license if they acted for only one side of a transaction, whether buyer or seller. Serving both, most marketplaces were unable to qualify. They routed payments through licensed PSPs instead. Some platforms created contracts that said they were acting for only buyers or sellers, even if it wasn’t accurate.

The PSR closes that loophole, requiring platforms to act for one side only — with the authority to negotiate the transaction. Multi-sided marketplaces that relied on that workaround will likely now need a payment institution license. The alternative is to restructure so that a licensed PSP handles all fund flows on their behalf. Simply relabelling their role in a contract won’t be enough. The EBA will also issue guidelines to ensure consistent enforcement across all EU member states, ending the patchwork of national interpretations that enabled the workaround.

Preparing for PSD3/PSR with a multi-PSP strategy

A multi-PSP strategy protects exemption rates and conversion. Working with a single processor may prove challenging for merchants as PSPs will likely become more defensive and risk-averse, offloading their increasing regulatory burden onto merchants. Depending on each PSP’s risk posture, merchants may see their auth rates shift with specific PSPs. Merchants may also face a higher burden of proof when challenging disputes.

The advantages of a multi-PSP strategy will only grow under PSD3. Maintaining relationships with multiple PSPs helps protect the customer experience by reducing the risk of being pushed to 100% SCA. It also gives merchants leverage to push back on overly conservative requirements, and gauge how well a PSP is preparing for changes.

Merchants should engage with their PSPs early to better understand their approach to PSD3 while there’s still time to act before enforcement begins.

Prepare for PSD3

When it comes to compliance, there’s a common misconception that friction is mostly out of your hands. Join us for Off the Rails on 10 November as Galit Michel, Forter VP of Payments, leads a data-driven discussion on how to get more out of your European authentication strategy, and prepare for PSD3.