What is PSD2?
Payment Services Directive 2 (PSD2, Directive (EU) 2015/2366) is the EU’s foundational payment services regulation that took effect on 13 January 2018. PSD2 expanded the regulatory perimeter to include third-party providers (TPPs) — Payment Initiation Service Providers (PISP) and Account Information Service Providers (AISP) — and mandated open banking access to payment accounts, enabling the European fintech ecosystem.
Key innovations
- Open banking access: banks must provide TPP access to payment accounts via secure APIs.
- Strong Customer Authentication (SCA): two-factor authentication for electronic payments above thresholds.
- New service categories: PISP (initiates payments on behalf of customers), AISP (aggregates account info).
- Liability shift: in unauthorised payments, customer liability capped at EUR 50 absent gross negligence.
- Surcharging ban: retailers cannot impose card fees on consumer payments within scope.
RTS on SCA and CSC
The Regulatory Technical Standards on Strong Customer Authentication and Common Secure Communication (Commission Delegated Regulation (EU) 2018/389) details SCA requirements, exemptions (low value, recurring, trusted beneficiaries, low-risk), and the technical interface obligations for banks to provide TPPs.
PSD2 in Türkiye
Türkiye is not an EU member but adopted parallel open banking architecture through BDDK regulations and the 6493 sayılı Ödeme Hizmetleri ve Elektronik Para Kanunu. The 2020 6493 amendment introduced “Ödeme Hizmeti Sağlayıcısı” categories, including AIS- and PIS-equivalent activities. BDDK’s Açık Bankacılık Tebliği (effective phased dates) operationalises Turkish open banking. Turkish fintechs serving EU customers must consider PSD2 licensing in an EU jurisdiction.
Do: classify your service against PSP/PISP/AISP categories; obtain BDDK and (where needed) EU NCA authorisation; implement SCA-compliant flows.
Don’t: assume reverse-solicitation lets you serve EU residents without PSD2 licensing — the EU narrow interpretation limits this defence.