PSD3 & PSR: What the New European Payment Frameworks Mean for High-Risk Merchants Globally

PSD3 & PSR

The European payments landscape is undergoing its most significant transformation in a decade. With the introduction of the Third Payment Services Directive (PSD3) and the accompanying Payment Services Regulation (PSR), the European Commission is refining the rules that govern digital transactions, data sharing, and consumer protection. While these frameworks are rooted in the European Economic Area (EEA), their “Brussels Effect” ensures that their impact will be felt by high-risk merchants across the globe — from online gaming operators in Curacao to nutraceutical e-commerce brands in the United States and crypto exchanges in Southeast Asia.

From PSD2 to the New Frontier: Why the Evolution Matters

For years, PSD2 was the gold standard, introducing Strong Customer Authentication (SCA) and Open Banking. However, as the digital economy evolved, so did the tactics of fraudsters and the complexities of cross-border commerce. High-risk merchants — businesses operating in sectors with higher chargeback rates, complex legal standings, or heavy regulation — often found themselves at the mercy of rigid enforcement and “de-risking” by traditional banks.

PSD3 and PSR aim to fix these fragmentation issues. The transition from a Directive (which countries interpret individually) to a Regulation (PSR) means that the rules for payment processing, fraud prevention, and technical standards will be harmonized across all EU member states. For a high-risk merchant based outside Europe but selling to European customers, this means a more predictable legal environment, even if the compliance bar has been raised.

Enhanced Security and the Combat Against “Social Engineering”

One of the core pillars of the new framework is the intensified focus on fraud prevention. High-risk merchants are often targets of sophisticated fraud, which leads to high chargeback ratios that can threaten their merchant accounts. PSD3 introduces stricter requirements for PSPs (Payment Service Providers) to monitor transactions and share fraud-related data.

A significant shift is the move toward liability for “spoofing” and social engineering. Under the new rules, if a consumer is manipulated into authorizing a transaction by someone pretending to be a bank employee, the PSP may be held liable. For high-risk merchants, this environment demands even more robust KYC (Know Your Customer) and KYB (Know Your Business) protocols. The PSR mandates a “Verification of Payee” system for all credit transfers, ensuring that the name of the recipient matches the IBAN. This reduces the risk of “misdirected” payments, which is a common pain point in high-volume, high-risk sectors like forex and remittance.

The “De-Risking” Dilemma: A Glimmer of Hope

Perhaps the most critical change for high-risk merchants is the new stance on bank account access for non-bank Payment Institutions (PIs) and Electronic Money Institutions (EMIs). Historically, many high-risk merchants have been “de-risked” — essentially banned from traditional banking — leaving them to rely on smaller, specialized PSPs. However, those PSPs themselves often struggled to maintain their own underlying bank accounts with major commercial banks.

PSD3 introduces stricter rules to prevent commercial banks from arbitrarily refusing services to PIs and EMIs. Banks must now provide “substantial reasons” for denying or withdrawing services. For high-risk merchants, this is a major win. It stabilizes the “plumbing” of the payment industry, ensuring that the specialized PSPs they rely on have more secure access to the central banking system, thereby reducing the risk of sudden service disruptions.

SCA and Transaction Monitoring: Friction vs. Conversion

The dreaded friction of Strong Customer Authentication (SCA) has long been a conversion killer for high-risk e-commerce. PSD3 seeks to strike a better balance between security and user experience. The frameworks encourage the use of “Transaction Monitoring” and behavioral biometrics to allow for more exemptions to SCA.

For high-risk merchants, the ability to utilize “Transaction Risk Analysis” (TRA) exemptions is vital. If a merchant can prove — through data — that their transaction environment is secure and their fraud rates are low, they can offer a “one-click” checkout experience even under the new, stricter regime. This places a premium on high-risk businesses partnering with tech-forward acquirers who can leverage AI-driven risk scoring to bypass friction without compromising the integrity of the payment.

Open Finance and the Rise of “Financial Data Access” (FIDA)

Beyond just payments, the new framework sits alongside the FIDA (Financial Data Access) proposal, moving the industry from Open Banking to Open Finance. This allows for the sharing of more diverse financial data, including insurance and investment information, provided the consumer consents.

For high-risk sectors like iGaming or high-ticket retail, this offers a revolutionary way to perform affordability checks and credit scoring. Instead of relying on static credit scores that might unfairly penalize certain demographics, merchants can use real-time financial data to verify a customer’s ability to pay. This not only fulfills regulatory requirements for responsible gambling and lending but also reduces the risk of friendly fraud and non-payment.

The Global Reach: Why Non-EU Merchants Should Care

If you are a high-risk merchant in the US, Asia, or Latin America, you might think PSD3 is a local European issue. That is a dangerous misconception. The EU is the world’s largest single market, and the standards set here inevitably become the blueprint for global payment gateways.

Furthermore, the PSR applies to “one-leg-out” transactions. This means if a customer in France buys a product from a merchant in Singapore, the European part of that transaction must comply with the new transparency and security standards. Merchants who fail to adapt their technical stacks to handle the new messaging standards (such as ISO 20022) or the new SCA requirements will see their authorization rates plummet as European banks reflexively decline “non-compliant” traffic.

Preparing for the Transition: A Roadmap for High-Risk Businesses

The transition to PSD3 and PSR won’t happen overnight — the full implementation is expected around 2025–2026. However, high-risk merchants should begin auditing their payment infrastructure now.

1. Evaluate Your PSP: Ensure your payment provider is proactively preparing for PSR compliance. Are they capable of handling the new “Verification of Payee” requirements?
2. Optimize Data Strategy: Start collecting more granular transaction data now. The more data you have, the easier it will be to qualify for SCA exemptions under the new Transaction Risk Analysis (TRA) rules.
3. Review Chargeback Management: With PSPs facing more pressure to share fraud data, merchants with high chargeback rates will be more visible than ever. Implementing automated chargeback mitigation tools is no longer optional.
4. Explore Open Finance: Look into how Open Banking (and eventually Open Finance) can be used as a payment method. “Pay-by-Bank” options often carry lower fees and lower fraud risks than traditional card payments for high-risk merchants.

Conclusion

PSD3 and PSR represent a double-edged sword for the high-risk merchant community. On one hand, the compliance burden is increasing, with stricter rules on fraud liability and data protection. On the other hand, the frameworks offer a more level playing field by curbing the practice of indiscriminate “de-risking” and providing the tools needed to create a smoother, more secure checkout experience.

In the world of high-risk processing, the winners are always those who stay ahead of the regulatory curve. By embracing the transparency and security mandates of the new European framework, global merchants can turn a regulatory hurdle into a competitive advantage, building deeper trust with consumers and ensuring long-term access to the world’s most lucrative markets.

PSD3 #PSR #HighRiskMerchant #PaymentsIndustry #FintechRegulation #Ecommerce #FraudPrevention #OpenBanking #DigitalPayments #CrossBorderTrade