PSR Strong Customer Authentication Rules Near Adoption

The EU’s payment services package is close to final. On 29 October 2026 the Council of the EU adopted its first-reading position on the third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR). The text now goes to the European Parliament for its second reading. (In this article, PSR means the EU Payment Services Regulation, not the UK’s Payment Services Regulations 2017 or the UK Payment Systems Regulator.) For anyone involved in card authentication, PSR strong customer authentication rules are the part to read closely, because the PSR is a regulation that will apply directly in every member state, and it adds requirements for the technical providers that support SCA as well as for payment service providers.

This article is written for acquirers, payment service providers and 3DS technology providers. Issuers will find their own checklist in PSD3 and the Payment Services Regulation: What Issuers Need to Do.

Where PSD3 and the PSR stand

Date	Step
28 June 2023	European Commission proposes PSD3 and the PSR
26 November 2025	Final political trilogue between the Council and the European Parliament
22 April 2026	Coreper approves the compromise text
5 May 2026	Parliament’s Economic and Monetary Affairs (ECON) Committee approves the agreed text
13 May 2026	The ECON Chair writes that she will recommend Parliament accepts the Council’s position at second reading, subject to legal-linguistic verification, if it matches the agreement
21 October 2026	Council position at first reading published (document 8543/26 for the PSR)
29 October 2026	Council adopts its first-reading position on both acts
Next	Parliament second reading, signature, then publication in the Official Journal

The final application date depends on when the acts enter into force. Legal commentary on the agreed text puts the PSR’s application at 21 months after entry into force. Confirm the date against the version published in the Official Journal before building it into a plan.

PSR strong customer authentication points to check in the final text

The recitals of the Council’s position show where the PSR touches card authentication. Article numbers will be fixed in the published version, so the list below is organised by subject.

Subject	What the Council text says	Who should check it
Technical service providers	Technical services, which include data and entity authentication, are not payment services. Their providers are still subject to certain requirements, including liability for failing to support the application of SCA, limited to direct financial damage and capped at the transaction amount.	3DS Server and ACS providers, gateways, processors
Outsourcing of SCA	Where technical service providers provide and verify the elements of SCA, they must enter into outsourcing agreements with payment service providers.	Issuers using a hosted ACS; their providers
Authentication as a step in execution	Once a payment order is placed, the payment service provider checks that the transaction has been authorised and authenticated, including by applying SCA where applicable, before validating it.	Issuers and acquirers mapping 3DS to authorisation
Evidential weight of SCA	Recorded authentication, including SCA, should not alone be sufficient evidence that the payer authorised a transaction or acted fraudulently or with gross negligence.	Issuers handling unauthorised-payment claims
Social engineering	Fraudsters can take control of the whole consent and authentication process, including completing SCA, and the conditions of consent should be considered when deciding whether a transaction was authorised.	Issuer fraud and disputes teams
Non-consumer payers	Subject to regulatory technical standards, agreements with payers who are not consumers could govern whether SCA is applied.	Commercial card programmes
Other SCA triggers	SCA is required for remote requests to increase spending limits and in the process of activating a mobile application on a device.	Issuers designing app and limit journeys

The first two rows matter most for 3DS providers. The PSR keeps technical services outside the definition of payment services but attaches specific obligations to them. Providers should map their role in each authentication flow against these provisions once the final articles are published.

What this means for acquirers and 3DS Server operators

For the acquiring side, the most practical effect is on evidence and contracts. If a transaction is challenged as unauthorised, the authentication record will be weighed alongside other information rather than settling the question alone. That makes the completeness of 3DS data more important, not less: what was sent in the authentication request, the result, and whether the result reached authorisation. Our article on why authenticated transactions lose their 3D Secure protection at authorisation covers the last point.

Acquirers and payment service providers that rely on a technical provider for 3DS should also review their contracts once the text is published. The PSR’s provisions on technical service providers’ liability and on outsourcing agreements may require changes to terms that were written for PSD2.

Regulatory technical standards still to come

Much of the operational detail will sit in regulatory technical standards rather than in the PSR itself, as the SCA-RTS do under PSD2. The Council text refers to such standards, for example on how SCA applies to non-consumer payers. Exemption conditions, which drive a large share of 3DS rule configuration, will need to be checked against those standards when they are published.

What to do before the final text is published

Read the Council’s first-reading text now. The substance is agreed, so it is a reliable planning document, even though article numbers and dates must be confirmed against the Official Journal.
Map each authentication flow you operate and record who provides and who verifies each SCA element.
Identify contracts with technical providers that will need review for liability and outsourcing terms.
Check that 3DS data is complete and reaches authorisation, because authentication records will be one piece of evidence among several.
Plan for EU and UK requirements to diverge. The UK is moving the other way, as we explain in How Strong Customer Authentication in the UK Is Changing.

Where GPayments fits

ActiveServer is GPayments’ 3DS Server for acquirers, payment service providers and merchants, and ActiveAccess is its Access Control Server for issuers. To discuss how the PSR affects your authentication set-up, speak with a 3DS specialist.

Frequently asked questions

Is the PSR now law?

Not yet. The Council adopted its first-reading position on 29 October 2026. The European Parliament still has to approve it at second reading, and the act must be signed and published in the Official Journal before it enters into force.

Does the PSR replace PSD2?

The package does. The PSR takes over the conduct rules, including SCA, as a directly applicable regulation, and PSD3 covers licensing and supervision as a directive that member states transpose. The Council’s PSD3 position repeals Directive (EU) 2015/2366.

Will the PSR change which SCA exemptions are available?

Exemption detail is expected to be set in regulatory technical standards. Check those standards when they are published rather than assuming the current SCA-RTS conditions carry over unchanged.

Are 3DS providers regulated as payment service providers under the PSR?

The Council text treats technical services as outside the definition of payment services, provided the provider never holds the funds. It still attaches requirements to those providers, including liability for failing to support SCA and outsourcing agreements where they provide and verify SCA elements.

Does the EU Payment Services Regulation apply in the UK?

No. The EU Payment Services Regulation is EU law and does not form part of UK law. Payment services in the UK are governed by the Payment Services Regulations 2017 (often shortened to ‘the PSRs’), with the Financial Conduct Authority as the lead regulator. HM Treasury is consulting separately on reforming those regulations. UK firms that provide payment services in the EU should take advice on how the EU Regulation applies to that part of their business.

Note that ‘PSR’ is also the abbreviation for the UK’s Payment Systems Regulator, a different body, which the government is consolidating into the FCA.