PSD3 and the Payment Services Regulation: The Fraud Provisions Will Bite, but Not the Ones Getting the Headlines

TrustSphere Network

5 hours ago

6 min read

The EU's payments package, a third Payment Services Directive alongside a directly applicable Payment Services Regulation, reached provisional political agreement between the Council and the European Parliament on 27 November 2025. The headlines have focused on the extension of IBAN and name checking to credit transfers generally. TrustSphere's view is that the headline is the wrong place to look.

The name-checking obligation matters, but euro-area institutions have already absorbed the hardest part of it: the Instant Payments Regulation, Regulation (EU) 2024/886, required euro-area payment service providers to offer verification of payee on credit transfers from 9 October 2025, a milestone the European Commission marked publicly. For most of the euro area, the package generalises an infrastructure that already exists. The provisions that will genuinely change institutional behaviour are the two that received less attention: the extension of liability for impersonation fraud, and the obligation on providers to share fraud-related information with one another.

Our house view, stated for the avoidance of doubt: the liability provisions convert fraud prevention from a conduct expectation into a balance-sheet exposure, and that is what moves budgets. Institutions that treat this package as a verification-of-payee compliance project, to be handed to the payments team, will discover in the first year of application that the real work was in scam detection, inbound payment monitoring and evidence of prevention, none of which a name-matching service provides.

What is settled, what is drafted, and what is still speculation

The discipline this topic needs most is a clear separation of legal fact from expectation, so here it is.

Settled: the substance of the political agreement, as described by the co-legislators themselves. The Council's announcement confirms a comprehensive anti-fraud framework targeting spoofing fraud, mandatory checking of IBAN numbers against the account name before transfers, fraud information sharing between providers, and liability for providers that fail to use required preventive tools. The Parliament's statement adds detail: where a provider fails to implement appropriate fraud prevention mechanisms it is liable for customers' losses; a transaction initiated or altered by a fraudster is treated as unauthorised, with the provider liable for the full amount; victims of impersonation fraud, where a scammer poses as a provider's employee, must be refunded in full provided they report to the police and inform their provider; receiving providers must freeze suspicious transactions; and online platforms face liability to providers who have reimbursed defrauded customers where the platform was notified of fraudulent content and failed to remove it. Also settled, and already in force, is the Instant Payments Regulation with its verification of payee obligation live across the euro area since October 2025.

Drafted but not yet law: the package itself. Both institutions are explicit that the agreed texts require formal adoption by Parliament and Council before entry into force, and application will follow the transition periods set in the final texts. Institutions should treat the detailed drafting, including definitions, carve-outs and the precise conditions attached to refunds, as near-final but not final until publication in the Official Journal.

Speculation, and flagged as such: how national supervisors and the EBA's eventual technical standards will interpret "appropriate fraud prevention mechanisms", which is the phrase the entire liability architecture hangs on; how the fraud data sharing gateways will interact with data protection law in practice; and how aggressively platform liability will be enforced. Anyone selling certainty on those three points today is selling ahead of the text.

Why the liability provisions are the centre of gravity

Under PSD2, the economics of an authorised push payment scam in most EU member states sat with the victim, because the customer authorised the payment. The agreed package changes that in two ways. Impersonation of the provider itself becomes refundable in full, subject to the customer reporting conditions. And more broadly, a provider that cannot evidence the required prevention mechanisms becomes liable for losses it previously attributed to customer gullibility.

That second mechanism deserves board attention, because it is conditional liability. The institution's exposure depends on whether it can demonstrate that the mandated tools were deployed and working: name checking, strong customer authentication, transaction risk assessment, spending limits and blocking options, and the freezing of suspicious inbound transactions. Fraud prevention evidence becomes a legal defence, which means it must be engineered to the standard of a legal defence. UK readers will recognise the direction of travel from the mandatory APP scams reimbursement requirement in force there since 7 October 2024 under the Payment Systems Regulator's rules; the EU has chosen a different legal mechanism, routed through prevention obligations rather than a blanket reimbursement scheme, but the budgetary effect on fraud teams will rhyme.

The data sharing obligation is the sleeper. Providers will have to exchange fraud-related information, which for the first time gives EU institutions a legal gateway resembling the consortium intelligence that fraud vendors have sold privately for years. Institutions that build the pipes early, and work out the governance of acting on another provider's fraud signal, will detect mule networks that single-institution monitoring structurally cannot see.

The operational bill: people, data, systems, governance

For people, the immediate pressure lands on fraud operations. Full refunds for impersonation fraud, conditional on police reporting, mean claims handling volumes rise and every rejected claim becomes a potential dispute. Receiving-side obligations create a new operational discipline most EU banks have never staffed: inbound payment investigation.

For data, name matching is only as good as account name data quality, and the euro area's experience since October 2025 has already shown that match thresholds, handling of close matches and corporate account naming are where the friction lives. The data sharing gateway adds a second problem: structuring fraud intelligence so it can be shared, consumed and actioned lawfully at scale.

For systems, the verification of payee rail built for euro instant payments becomes the template for credit transfers generally, and non-euro member state institutions have the steepest build. Real-time risk scoring of outbound and inbound payments stops being best practice and becomes the evidential basis of a liability defence.

For governance, someone must own the question "could we defend our prevention stack in a dispute tomorrow", and the honest answer in most institutions today is no. Mapping each mandated tool to an accountable owner, with evidence of operation, is the quiet project that should start now, during the transition, not after the first contested claim.

Stakeholder implications

Tier 1 banks face the broadest bill but hold the best starting position, since most already run name checking in the euro area and mature scam detection. Their exposure is evidential: proving the stack works, payment by payment, to liability standard.

Challengers, fintechs and smaller PSPs carry the heaviest proportional burden. Refund liability is a direct capital and pricing question for thin-margin providers, and the prevention tooling that larger banks amortise across millions of accounts must be bought or built on a smaller base. Expect consolidation pressure and renewed outsourcing to fraud utilities.

Technology vendors are handed a visible, dated market: name verification for non-euro rails, scam and impersonation detection, inbound mule monitoring and fraud data exchange infrastructure. The winners will be those who productise the evidence layer, not just the detection layer, because evidence is what the liability regime actually prices.

Regulators and supervisors, including the EBA and national authorities, inherit the hard interpretive work: standards for what adequate prevention looks like, and supervision of a data sharing regime that must coexist with GDPR. Their choices will determine whether the liability provisions bite uniformly or become a forum-shopping exercise.

Consumers and victims gain the most direct protection in EU payments law to date, with refunds for impersonation scams and discrepancy warnings before transfers. The residual risk is displacement: fraud migrates to the manipulation typologies the refund regime does not reach, as it has wherever reimbursement rules have tightened.

Conclusion

The package's fraud provisions are agreed in substance, pending in form, and underpriced in most institutions' planning. The name-checking headline describes infrastructure the euro area has already built; the liability and data sharing provisions describe obligations most institutions have not. The transition period is the cheapest time to close that gap, and the institutions that treat prevention evidence as seriously as prevention itself will be the ones for whom this regulation is a formality rather than a loss event.

Suggested Next Steps

Commission a gap assessment mapping each fraud obligation described in the agreed package, including name checking, impersonation refunds, inbound transaction freezing and data sharing, against current capability and an accountable owner.

For non-euro EU operations, scope the verification of payee build now, reusing the scheme and vendor arrangements proven in the euro area since October 2025 rather than procuring from scratch.

Quantify impersonation and spoofing scam exposure on your own book under a full-refund assumption, and put the resulting number in front of the board as the cost of inaction on scam detection.

Stand up a fraud data sharing working group covering legal, data protection and fraud operations, so the institution can consume and act on shared intelligence lawfully from the first day the gateway applies.

Sources: UK Payment Systems Regulator; Council of the European Union; European Parliament; Regulation (EU) 2024/886 (EUR-Lex); European Commission; TrustSphere Risk Index, April 2026.