Second Payment Services Directive
Sets rules for payment services in the EU: who may offer them, what customers must be told, strong customer authentication and who pays when a payment goes wrong.
- Supervision
- National competent authorities, for example Finansinspektionen in Sweden, Finanstilsynet in Norway and BaFin in Germany
- Official text on EUR-Lex
- eur-lex.europa.eu · 32015L2366
- Rows compiled
- 2026-10-06 · 2026-10-06
Note: A Payment Services Regulation and a third directive (PSD3) are agreed at EU level but do not yet apply. PSD2 remains the text in force until they do.
Obligations
| Who | Duty | Article | From |
|---|---|---|---|
| Payment institutions | Hold an authorisation from the home Member State before providing payment services. | Art. 5, 11 | 2018-01-13 |
| Payment service providers | Refund an unauthorised payment immediately, at the latest by the end of the following business day. | Art. 73 | 2018-01-13 |
| Payment service providers | Refund an authorised direct debit on request within eight weeks of the debit. | Art. 76–77 | 2018-01-13 |
| Payment service providers | Apply strong customer authentication when the payer accesses the account online or starts an electronic payment. | Art. 97 | 2019-09-14 |
| Account servicing providers | Give payment initiation and account information services secure access to payment accounts. | Art. 66–67 | 2019-09-14 |
| Payment service providers | Answer a complaint within 15 business days, or 35 in exceptional cases. | Art. 101 | 2018-01-13 |
Exemptions
| Who | Condition | Article |
|---|---|---|
| Payers | Liability for losses from a lost, stolen or misappropriated instrument is capped at EUR 50. The cap does not apply where the payer acted fraudulently or with gross negligence. | Art. 74(1) |
| Limited networks | Instruments usable only in a limited network of providers or for a limited range of goods are outside the directive. | Art. 3(k) |
| Electronic communications providers | Payments for digital content and certain charges billed by telecom providers, within value limits. | Art. 3(l) |
| Small payment institutions | Member States may waive parts of the authorisation regime where monthly payment volume averages no more than EUR 3 million. | Art. 32 |
| Strong customer authentication | Exemptions such as contactless payments and low-value remote payments, set in the regulatory technical standards. | Art. 98; Reg. (EU) 2018/389 |
Fines
| Breach | Highest amount | Article | Imposed by |
|---|---|---|---|
| Breach of national rules transposing the directive | Set by each Member State; must be effective, proportionate and dissuasive | Art. 103 | National competent authorities |
Dates
| Dates | Article | |
|---|---|---|
| 2016-01-12 | Entry into force | Art. 116 |
| 2018-01-13 | Transposition deadline; national rules apply | Art. 115 |
| 2019-09-14 | Strong customer authentication and secure communication apply, 18 months after the technical standards entered into force | Art. 115(4); Reg. (EU) 2018/389 |
Obligations, exemptions, fines and dates in EU digital rules
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
