NPV and PSD3: what next?

It’s always interesting to see how regulators are working to ensure consumer protection in payments and fintech and as Sidley, an elite global law firm, point out: “2026 is set to be a pivotal year for payments and fintech regulation in both the UK and the EU as policymakers move from strategy-setting to the delivery and refinement of major regulatory reforms.”

Their analysis is really good and studies the changes in payments and fintech regulation in both the UK and Europe.

In the UK they note that, from 7 May 2026, the strengthened ‘supplementary’ safeguarding regime comes into force, introducing more demanding expectations around books and records (including more robust reconciliation), enhanced monitoring and reporting, and a suite of new operational and governance obligations aimed squarely at addressing historic weaknesses in customer money protection.

More broadly, 2026 is the year the National Payments Vision begins to take shape in more concrete terms, with the Payments Vision Delivery Committee expected to publish its ‘Payments Forward Plan,’ which will detail a sequenced set of initiatives expected across the payments ecosystem (retail and wholesale).

On cryptoassets, the UK continues its march towards a full Financial Services and Markets Act regulatory regime due to go live in October 2027; 2026 will be pivotal as the regime’s contours are more fully developed through the expected finalisation of regulations, alongside policy statements and further consultations.

Meanwhile, in Europe, they recognise that the region will be defined by the transition to the Third Payment Services Directive (PSD3) and the accompanying Payment Services Regulation, together replacing PSD2 and overhauling the EU payments framework. A political agreement has been reached, with formal adoption expected in the first half of 2026, triggering an anticipated 21-month transition period. These reforms will reset the regulatory baseline for payments across the Single Market, strengthening consumer protection, tightening fraud prevention and reshaping the competitive and operational landscape for payment service providers.

The main aims of PSD3 are to:

• Combat Fraud through mandatory IBAN-to-name checks for transfers, better data sharing among providers, clearer refund rules for victims, and enhanced Strong Customer Authentication (SCA).
• Boost Consumer Rights through greater control over data sharing, clearer transaction info, better protection for funds, and transparent ATM fee info.
• Level the Playing Field by granting non-bank payment providers access to all EU payment systems and secures their right to bank accounts, fostering competition.
• Improve Open Banking by removing obstacles, streamline data flow, and introducing minimum standards for APIs, making services smoother and more innovative.
• Uniformity (PSR) by using a regulation to ensure direct and consistent application across the EU, avoiding fragmentation from national transpositions.
• Cash Availability making clear rules to allow more cash services in shops and for independent ATM operators.

What surprises me however, as I read all about these new regulations and mantras, is that you would think after centuries of paying for things, we would have got this right by now, wouldn’t you? So, why do we need a PSD, PSD2 and a PSD3? Why do we need a new national payments vision? Why are regulators always updating regulations?

Well, the answer is obvs. Technology and criminal activity are always working to improve and undermine the financial system respectively. Equally, as one eurocrat said to me years ago, the aim of EU regulations are to get all the sheep in the pen to start with and then, over time, make the pen smaller to get all the sheep pointing in the same direction.

Roll on PSD4 and NPV2.