# Payments regulation: PSD2, the EMI license and open bankingopen bankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. rules
In 2019, a UK fintech card issuer got hit with an enforcement notice after its checkout flow let customers skip two-factor authentication on transactions above the legal threshold. The regulator's finding was blunt: the firm had misapplied an exemption meant for low-risk payments, and thousands of transactions had been processed without the legally required customer verification. This is the everyday reality of payments regulation in Europe. The rules are specific, the exemptions are narrow, and getting the mechanics wrong counts as a compliance failure, not a technicality.
This lesson covers the three pillars every fintech professional operating in European payments needs to know: PSD2, the EMI license, and open bankingopen bankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. APIs.
PSD2 (the second Payment Services Directive) is the EU's foundational payments law, in force since January 2018. It replaced the original PSD (2007) and was designed to do two things: make electronic payments more secure, and open up bank account data to licensed third parties.
PSD2 is a directive, not a regulation, meaning each EU member state transposes it into national law (in the UK, pre-Brexit, this became the Payment Services Regulations 2017, which the UK retained post-Brexit with its own amendments). The national regulator enforces it: the FCA (Financial Conduct Authority) in the UK, BaFin in Germany, the ACPR in France, and so on. At the EU level, the EBA (European Banking Authority) writes the detailed technical standards that make PSD2 operational.
PSD2 introduced two concepts that define modern fintech compliance work: Strong Customer Authentication and open bankingopen bankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. access.
SCA requires two-factor authentication for most electronic payments: the customer must verify using at least two of three independent categories: something they know (a PIN or password), something they have (a phone or card), and something they are (a fingerprint or face scan).
For a card-issuing fintech, SCA shows up concretely in:
The regulatory text setting out exactly how this works is the EBA's Regulatory Technical Standards on SCA (full text via EBA), which took full effect across the EU in stages between 2019 and 2021, with the UK finishing its own phased rollout in March 2022.
SCA has legal exemptions, and this is where fintechs most often get into trouble. Common ones:
The catch: exemptions are optional and conditional, not automatic. A card issuer or acquirer has to apply fraud-rate thresholds correctly, document its risk model, and still allow the customer's bank to override the exemption and demand SCA anyway (issuers have final say). Fintechs that misconfigure this, applying an exemption too broadly, miscalculating cumulative thresholds, or failing to fall back to full SCA when a risk score is uncertain, create exactly the kind of authentication gap that triggered UK and EU enforcement actions in recent years, including fines and mandated remediation programs when firms processed transactions that should have required a second factor.
Before a fintech can issue cards or hold customer funds, it typically needs an EMI license (Electronic Money Institution license), authorized under the EU's Electronic Money Directive (EMD2) and, for payment-only firms without e-money issuance, a Payment Institution (PI) license under PSD2 itself.
Key practical distinctions:
Many fintechs you've used are EMIs, not banks: Revolut initially operated under an EMI license before obtaining full banking licenses in various jurisdictions, and Wise operates as an EMI/PI across multiple markets. The distinction matters. An EMI license is materially easier and faster to obtain than a full banking license, but it doesn't carry deposit insurance (like the EU's Deposit Guarantee Scheme) the way a bank license does. Safeguarding is a substitute protection, not the same thing.
Passporting matters here: an EMI licensed in one EU/EEA member state can, in principle, passport its license to operate across the whole EEA without re-authorizing in each country, which is why so many fintechs choose to headquarter and license in Lithuania, Ireland, or Luxembourg. The UK lost this passporting right after Brexit, meaning UK-licensed EMIs need a separate EU entity to serve EU customers, and vice versa.
PSD2's second major pillar forces banks to open account data and payment initiation to licensed third parties via APIs, provided the customer consents. Two new regulated roles emerged:
Banks must expose these APIs under standards coordinated in the UK by the Open Banking Implementation Entity and across the EU under frameworks like the Berlin Group's NextGenPSD2. This is why apps like Plaid, TrueLayer, or Yolt can pull your bank data or trigger a payment, they're licensed AISPs/PISPs plugging into bank-mandated APIs, not scraping your online banking with your password (the old, insecure method PSD2 was designed to eliminate).
For a deeper technical walkthrough of how this actually works end to end:
🎬 [VIDEO: "PSD2 and Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. Explained" - youtube.com/results?search_query=psd2+open+banking+explained - search for recent explainer videos covering the SCA flow and AISP/PISP APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → mechanics, useful for visualizing the consent and redirect flow]
Vérification des acquis
1. Why does PSD2 get implemented differently in each EU member state, with separate enforcement by regulators like the FCA, BaFin, and ACPR?
2. A fintech applies a PSD2 exemption to skip two-factor authentication on a large transaction, reasoning it will speed up checkout. Based on the enforcement case described, what is the underlying compliance principle this violates?
3. What are the two core objectives PSD2 was designed to achieve?
4. Select ALL correct answers about how Strong Customer Authentication (SCA) works under PSD2.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about the regulatory structure surrounding PSD2 in Europe.
Sélectionnez toutes les réponses correctes.
Regulators don't only fine firms for fraud. Most PSD2 enforcement centers on process failures: inadequate SCA fallback logic, poor incident reporting (PSD2 requires major operational and security incidents to be reported to the national regulator within tight deadlines), or failing to expose compliant APIs to third parties (banks have been scrutinized by regulators for building deliberately clunky "dummy" APIs to protect their own market sharemarket shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.Voir la définition complète →, contrary to the spirit of open bankingopen bankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif.).
A card-issuing fintech's compliance function typically has to:
1. Maintain documented, auditable SCA exemption logic, with the ability to prove fraud rates to the regulator on demand.
2. Ensure safeguarding accounts are reconciled daily against customer balances (a persistent focus area for the FCA in EMI supervision).
3. Report major incidents (an APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → outage blocking PISPs, a data breach) within the regulatory timeframe, often 24 to 72 hours depending on severity and jurisdiction.
4. Monitor evolving standards: the EU is finalizing PSD3 and a parallel Payment Services Regulation (PSR), expected to tighten fraud liability rules and open bankingopen bankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. access further, with implementation likely mid-to-late in the 2020s.