Where the legislation stands

The Council published final compromise texts of the Payment Services Directive 3 and the Payment Services Regulation on 23 April 2026, after COREPER endorsed the trilogue outcome the previous day, and the Parliament's economic affairs committee approved them in early May. Remaining steps reported by law firms are the final plenary vote, formal Council adoption, legal-linguistic review, and publication in the Official Journal. Sources expect that to complete in the second half of 2026 or by the end of the year.

So this is an agreed text, not yet in force. Details can change in finalization, and article numbers and conditions should be checked against the published versions.

The basic rule that a payer who authorizes a fraudulent payment bears the loss still applies in general. The impersonation rule is an important carve-out, not a reversal.

What the impersonation rule does

Under the agreed text, as summarized by law firms, a payment service provider must refund the full amount of an authorized payment where a consumer was manipulated by a fraudster impersonating the consumer's own provider. The refund is conditional, for example on the consumer reporting the fraud to the police. Summaries also describe provider liability for losses linked to inadequate scam warnings or monitoring and for failing to offer a verification service that would have caught a misdirected payment.

The effect is a stronger incentive to detect and interrupt scams before money moves.

Interrupt risky payments

Use signals such as new payees, unusual amounts, and active phone sessions to add friction at the right moments.

Make warnings specific

Replace generic banners with warnings tailored to the scam pattern the transaction resembles.

Design implications

Product teams should map their payment journeys for the moments where a scammer can steer a user, and design interventions that are proportionate. Invest in transaction monitoring that updates quickly against new scam tactics, and in clear verification of payee details before confirmation.

Keep records of warnings shown, signals evaluated, and decisions made, since liability may turn on what you did. Our earlier article covers how AI agents can assist compliance workflows around these controls without becoming the control.

Building or running payment flows in the EU? Talk to us about fraud-aware payment design.

Key takeaways

  • PSD3 and PSR compromise texts were published in April 2026; formal adoption and publication are still pending.
  • The agreed text reportedly requires refunds for impersonation of the consumer's own provider, conditional on steps like reporting to the police.
  • Provider liability may extend to inadequate warnings, monitoring, or verification.
  • Design specific warnings, risk-based friction, and verification, and keep evidence of what you did.
This is general information, not legal advice. It is based on law-firm and vendor summaries of agreed texts; check the final published PSD3 and PSR.