What is PSD2?
Payment Services Directive 2 (PSD2, Directive (EU) 2015/2366) is the EU’s foundational payment services regulation that took effect on 13 January 2018. PSD2 expanded the regulatory perimeter to include third-party providers (TPPs): Payment Initiation Service Providers (PISP) and Account Information Service Providers (AISP), and mandated open banking access to payment accounts, enabling the European fintech ecosystem.
Key innovations
- Open banking access: banks must provide TPP access to payment accounts via secure APIs.
- Strong Customer Authentication (SCA): two-factor authentication for electronic payments above thresholds.
- New service categories: PISP (initiates payments on behalf of customers), AISP (aggregates account info).
- Liability shift: in unauthorised payments, customer liability capped at EUR 50 absent gross negligence.
- Surcharging ban: retailers cannot impose card fees on consumer payments within scope.
RTS on SCA and CSC
The Regulatory Technical Standards on Strong Customer Authentication and Common Secure Communication (Commission Delegated Regulation (EU) 2018/389) details SCA requirements, exemptions (low value, recurring, trusted beneficiaries, low-risk), and the technical interface obligations for banks to provide TPPs.
PSD2 in Türkiye
Türkiye is not an EU member but adopted a parallel open banking architecture through Law No. 6493 on payment services and e-money, as amended by Law No. 7192, and TCMB’s regulation and communiqué of 1 December 2021. The 2020 6493 amendment introduced “Ödeme Hizmeti Sağlayıcısı” categories, including AIS- and PIS-equivalent activities. TCMB, the licensing and supervisory authority for payment and e-money institutions since 1 January 2020, operationalises Turkish open banking; banks’ open banking services also fall under BDDK’s 2020 regulation on information systems and electronic banking. Turkish fintechs serving EU customers must consider PSD2 licensing in an EU jurisdiction.
Do: classify your service against PSP/PISP/AISP categories; obtain TCMB and (where needed) EU NCA authorisation; implement SCA-compliant flows.
Don’t: assume reverse-solicitation lets you serve EU residents without PSD2 licensing: the EU narrow interpretation limits this defence.