What is the Payment Services Directive?

The Payment Services Directive is European Union law governing how payment services are authorised, supervised and secured. The current version, commonly called PSD2, is Directive (EU) 2015/2366. It replaced the original 2007 directive, and most of its rules have applied since January 2018, with the requirements on strong customer authentication following in September 2019.

It reaches this reference for one reason: people arrive asking whether it applies to them. Usually it does not. PSD2 binds payment service providers operating within the EU, and an Australian business is brought into scope by where it operates rather than by where its customers live. If you provide designated services in Australia, your obligations come from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and AUSTRAC, not from Brussels.

What PSD2 actually regulates

PSD2 is a conduct, prudential and security regime. It sets out who needs authorisation to provide payment services, what capital and safeguarding requirements they carry, what must be disclosed to customers about charges and execution times, how liability for unauthorised transactions is allocated, and how payments must be authenticated. It is not an anti-money laundering instrument, and conflating the two is the most common misreading of it.

Its best-known effect is open banking. PSD2 requires account-servicing providers, in practice banks, to let licensed third parties initiate payments and access account information when the customer instructs it. That created two provider categories that had not previously existed in EU law: payment initiation service providers, which move money on the customer's instruction without holding it, and account information service providers, which read account data to deliver services such as aggregation or affordability assessment.

Where the AML obligations really come from

Firms authorised under PSD2 do carry substantial AML duties, but those duties are imposed elsewhere. Payment institutions and electronic money institutions are obliged entities under the EU's anti-money laundering framework, which is being consolidated: the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, was adopted in 2024 and applies directly across member states from 10 July 2027, supervised alongside the new EU Anti-Money Laundering Authority. Customer due diligence, beneficial ownership and reporting expectations for an EU payment institution are set there, not in PSD2.

The distinction has a practical consequence. Strong Customer Authentication is often presented as an AML control. It is a fraud and payment-security requirement. It produces evidence that is genuinely useful when investigating suspicious activity, and it does nothing to discharge a customer due diligence obligation.

PSD2 is being replaced

The framework is mid-transition, which is worth knowing before relying on any summary of it, including this one. The European Commission proposed a replacement package in June 2023: a third Payment Services Directive covering authorisation, prudential supervision and safeguarding, and a directly applicable Payment Services Regulation covering conduct of business. Together they repeal and replace PSD2 and the second Electronic Money Directive, merging the payment services and e-money regimes into a single framework.

Parliament and Council reached provisional agreement in November 2025, the Council published final compromise texts in April 2026, and the Parliament's economic affairs committee approved the agreed text in May 2026. As at September 2026 formal adoption and publication were still outstanding. On the agreed texts both instruments apply 21 months after entry into force, with mandatory verification of payee arriving at 27 months and a transitional period for existing e-money institutions. Anyone with EU payments exposure should be planning against PSD3 and the PSR rather than against PSD2 alone.

The Australian equivalents

Australia has no single PSD2 analogue. The same territory is covered by two separate reform tracks.

Open banking sits outside payments law entirely, in the Consumer Data Right under Part IVD of the Competition and Consumer Act 2010. It is a consumer data access regime that happens to have been rolled out through banking first, rather than a payments directive that happens to mandate data access.

Payment provider regulation is being rebuilt through Treasury's payments system modernisation programme. The direction of travel is an activity-based framework in which providers performing defined payment functions require an Australian Financial Services Licence, with ASIC responsible for conduct, APRA for prudential regulation of major stored-value facilities and designated providers, and the Reserve Bank able to authorise industry standard-setting. The payment functions proposed include stored-value facilities, payment stablecoins, payment instruments, payment initiation services, payment facilitation services, payment technology and enablement services, and cross-border transfer services. Treasury released tranche 1 draft legislation for consultation in March 2026 and has signalled further tranches, so the detail is still moving.

What this means if you are a reporting entity

For most Australian reporting entities, PSD2 is context rather than obligation. The point at which it stops being academic is cross-border payments, and groups operating on both sides. International funds transfers and remittance are designated services under the AML/CTF Act, so they are captured here irrespective of what the receiving jurisdiction requires. A group operating in both Australia and the EU faces two regimes with similar intent and different drafting, and cannot assume one control set satisfies both.

If you are working out which regime actually binds you, that is a scoping question worth answering before you build controls around it. Australian AML/CTF scope is something we can help with directly. EU authorisation questions need EU-qualified advice.