What does PSD2 cover?
PSD2 sets who may provide payment services in the EU and on what terms. The European Commission says it became applicable in January 2018, aiming to make internet payments easier and safer and to protect consumers. Firms that are not banks need authorisation as a payment institution or e-money institution from a national authority; the European Banking Authority notes that account information service providers need only registration. The EBA’s central register lists these institutions, including those authorised for payment initiation and account information services.
Which rules matter most for merchants?
Strong customer authentication, which the Commission dates to 13 September 2019, requires most online card payments in Europe to be authenticated, usually through 3-D Secure. Access to accounts lets licensed third parties initiate payments or read account data with the customer’s consent, the basis of open banking. And together with the EU’s interchange fee rules, PSD2 bans surcharges on consumer debit and credit cards. As an illustrative example: a store that added a 2% card fee would charge 1 euro extra on a 50 euro order; for an EU consumer card that fee is not allowed, so the cost goes into the price instead.
For one-leg transactions, an EBA Q&A answered by the Commission says the provider in the EU must apply strong customer authentication, while one outside the EU is not subject to PSD2.
What comes next?
On 28 June 2023 the Commission proposed PSD3 and a Payment Services Regulation. The Parliament and the Council reached a political agreement on 27 November 2025, and the Commission’s page lists the revision as ongoing. Until new rules are adopted and apply, PSD2 remains the framework.
Where does Omno use it?
Omno does not acquire; it connects to PSPs, which carry the authorisation and authentication duties under PSD2. Omno’s hosted checkout carries the 3-D Secure step inside the payment flow, and the routing-decision log records the response code for each attempt, including soft declines that ask for authentication.