The short answer
PSD3 is the successor to PSD2 — the EU rulebook that once gave us strong customer authentication (the extra approval step at online checkout) and opened up bank data to third parties. PSD3 is an adjustment, not a revolution: tighter supervision of payment companies, better fraud protection and more seamless security requirements online. For a Danish shop or webshop, the most important news is that your provider has to do the work — not you.
What PSD3 and PSR actually are
In 2023 the European Commission put forward a package with two parts:
- PSD3 — a directive on who may provide payment services, and how they are licensed and supervised. Must be transposed into Danish law before it applies here.
- PSR — a regulation with the rules for the payments themselves (security, fraud, data access). It applies directly in all EU countries without a Danish intermediary step — so the rules become the same across the EU.
The package is still making its way through the EU's legislative machinery, and the dates have shifted several times along the way. What matters isn't when, but what: when the rules take effect, there follows a transition period of about a year and a half before they apply in practice. Nothing happens from one day to the next.
Our promise
When the final texts and dates are settled, we'll update this guide — and if there's anything our customers actually need to do, they'll be told directly. Regulation is our job, not yours.
At the till: pretty much nothing
Physical card payment is the part PSD3 touches the least:
- Your terminal keeps working. There is no requirement for new hardware because of PSD3.
- Contactless payment continues as it does today — the rules for when the customer has to enter a PIN are adjusted at provider level, not in your till.
- Any changes land as software updates at your acquirer and terminal provider. That's their compliance task, not yours.
In the webshop: more seamless security
Online, there are three things worth knowing:
- 1. Smarter strong customer authentication.
PSD2's approval step becomes more flexible: more low-risk purchases can be approved without extra friction, and accessibility must be better for customers without a smartphone. Fewer abandoned purchases in your checkout — without you changing anything. - 2. A harder line on fraud.
Better sharing of fraud data between payment companies and expanded liability for, for example, spoofing fraud, where fraudsters pose as the bank. This primarily protects your customers — and fewer defrauded customers means fewer chargebacks for you. - 3. Account-to-account payment matures.
The rules for payments directly from the customer's bank account (open banking) are being tightened, including checking that the account name and account number match. In time, this could give webshops a real alternative to the card — something we're keeping an eye on for our customers.
What doesn't change
- The fee caps remain. The EU's interchange caps on consumer cards (0,2 % debit / 0,3 % credit) sit in an entirely different regulation and aren't affected by PSD3.
- Your acquiring agreement continues. There is nothing in the package that requires you to renegotiate or switch agreement.
- Your customers' cards work. Visa, Mastercard, MobilePay, Apple Pay and Google Pay continue as before.
- The requirements on you as a business are, in practice, unchanged. The compliance burden lands with the payment companies — banks, acquirers and providers like us.
What to do now (nothing — almost)
- ✓ Nothing at the till. No new hardware, no new routines.
- ✓ Nothing in the webshop — but expect your payment provider to roll out updates when the rules are final.
- ✓ One healthy check: Do you know who is responsible for compliance in your payment chain? If the answer is "I don't know", ask your provider. The answer should be "it's us".
Want a provider that takes regulation off your plate?
Our job is to keep your payment compliant, so you can keep the shop open. Tell us about your business, and we'll show you what it looks like in practice.