Under the upcoming Payment Services Regulation, a customer who authorizes a fraudulent transaction will no longer be left to carry the financial loss alone, nor will their bank be the sole party responsible for the refund. Specialist regulatory firm Compliance Consultant notes that the new European payments framework distributes this burden across the financial and digital ecosystem. Under Article 59 of the PSR, liability for impersonation and spoofing fraud shifts to both payment service providers and electronic communications service providers. This means telcos and online platforms will have to reimburse banks when their failure to block fraudulent content or spoofed numbers leads directly to financial scams.
Moving beyond the open banking paradigm: The real impact of PSD3 and PSR
Many heads of risk in financial services view the upcoming Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR) as structural expansions of Open Banking. That view misses the immediate balance sheet threat. The core of the new framework is a fundamental restructuring of fraud liability that moves financial exposure from the retail customer to the institutions facilitating the transaction chain.
Under the previous PSD2 rules, if a customer technically authorized a payment, they were rarely entitled to a refund. Deception-based scams, particularly social engineering and impersonation, fell into a grey area where the victim carried the ultimate loss. The PSR, which was advanced through a legislative agreement by the European Parliament and Council in late 2025, completely reverses this default position.
Our regulatory compliance firm, Compliance Consultant, has analysed these texts to help firms prepare for the transition. The direct applicability of the PSR means these rules will apply across EU member states roughly 21 months after the final text's mid-2026 publication in the Official Journal, targeting full application by late 2027 or early 2028. For firms regulated in both the UK and the EU, this timeline demands immediate review of internal fraud detection mechanisms to avoid a sudden surge in mandatory reimbursement payouts. You can review how these shifting timelines affect broader business strategies in our analysis of the FCA application process.
Decoding the mechanics of Article 59 of the PSR
The new rules target the financial mechanics of fraud through two primary avenues under Article 59 of the PSR. First, they mandate technical verification processes at the point of payment. Second, they set an exceptionally high bar for payment service providers to deny customer refunds. At Compliance Consultant, we see this dual approach as a direct attempt to force firms to treat fraud prevention as a direct operational cost rather than an external risk.
Mandatory verification of payee
The first defense mechanism is the expansion of Verification of Payee (VoP). This requires the payer's payment service provider to verify that the payee name matches the unique identifier, such as an IBAN, before any credit transfer is executed. If a mismatch is identified, the sending institution must notify the customer before they authorize the payment.
Importantly, this is not limited to euro transactions. The VoP mandate extends to credit transfers in non-euro currencies within the EU, including the Polish zloty (PLN) and the Hungarian forint (HUF). If a German bank sends a PLN transfer to a Polish account, both payment institutions must coordinate in real time to match the name and identifier. If the sending bank fails to detect a mismatch or fails to notify the payer of a mismatch, and the transaction is fraudulent, that bank is fully liable for the customer's loss according to data from ExpertLab.
The gross negligence barrier
Under the new PSR rules, if a customer falls victim to spoofing, the default position is that the payment service provider must refund the customer. The only way an institution can avoid this refund is by proving the customer acted with gross negligence or intent to defraud. This is a significant legal shift. Under previous frameworks, showing that the customer completed multi-factor authentication was often enough to deny a claim.
Under the new regime, the European Banking Authority (EBA) will define the exact criteria for gross negligence. It is expected that merely being tricked by a highly sophisticated spoofing campaign where a criminal impersonates a bank employee will not meet the threshold of gross negligence. If a criminal uses a spoofed phone number representing the bank's actual helpline, and the customer transfers funds, the bank must provide a full refund. The customer must report the scam to the police and notify the payment service provider without undue delay, but the burden of proof is entirely on the institution to show the customer behaved with extreme recklessness.
How the platform and telco liability trap redistributes fraud costs
Perhaps the most radical departure in the PSR is the introduction of shared liability for third parties outside the banking sector. Historically, banks carried the financial costs of refunds while telcos and social media networks operated with near-total immunity, despite hosting the ads and routing the calls that facilitated the fraud.
The PSR brings electronic communications service providers (ECSPs) and very large online platforms under the liability umbrella. For instance, platforms like Meta will face direct financial exposure. If a payment service provider reimburses a customer for a scam that originated through a spoofed telephone number or an unvetted ad on a major social media platform, the bank can seek reimbursement from the telecom operator or the platform that failed to block the content, as detailed by A&O Shearman.
| Liability Vector | PSD2 Framework | PSR / PSD3 Framework |
|---|---|---|
| Unauthorized transactions | PSP liable unless customer acted fraudulently or with gross negligence. | PSP liable; stricter definition of authorization if fraudster manipulated the system. |
| Impersonation/Spoofing scams | Customer generally bears the loss if they authorized the payment. | PSP must refund the customer in full unless gross negligence is proven. |
| Platform & Telco involvement | No liability or reimbursement obligations for third-party platforms. | Telcos and platforms must reimburse the PSP if they failed to block fraud. |
To trigger this platform liability, the payment service provider must demonstrate that the telco or platform was informed of the fraudulent activity or content and failed to take swift action to remove it, or that a telecom provider allowed a spoofed number to bypass basic network validations. This shared model is designed to force cross-industry cooperation, ensuring that digital platforms actively verify the credentials of financial services advertisers. Specialist advisers at Compliance Consultant can assist in mapping these requirements to your current risk management matrices.
Rebuilding compliance frameworks for the new liability regime
For risk officers at mid-sized financial institutions, waiting for the late 2027 enforcement date is a dangerous option. Adapting system architectures to accommodate real-time name-IBAN matching across multiple currencies requires significant lead time. Our team at Compliance Consultant recommends starting with a systematic gap analysis of your current payment processes and third-party risk protocols.
Upgrading fraud prevention infrastructure
Firms must transition their transaction monitoring from retrospective analysis to real-time, context-aware risk evaluations. This means your systems must dynamically assess the risk of a transaction based on the user's historical behavior, device metadata, and the payee's account age before the payment is sent.
Importantly, the PSR resists full automation of customer service. The regulation explicitly requires payment service providers to maintain human customer support channels to handle fraud reporting and dispute resolution. You cannot rely solely on automated chatbots to manage a customer who has just suffered an impersonation attack.
In our previous work, we have seen how mid-sized firms can restructure their systems to meet intense regulatory demands without overstretching their hardware budgets. For example, during an AML and KYC system overhaul for a foreign bank UK branch, we successfully updated financial crime governance and onboarding processes using existing technology infrastructure, eliminating the need for expensive new software suites while achieving full compliance. You can read more about this transition in our published compliance case studies.
Managing platform liability claims
To successfully recover fraud losses from telecom providers and digital platforms, your firm must establish rigorous data-capture protocols. When a customer reports an impersonation scam, your front-line team must document the exact origin of the contact. This includes capturing the spoofed telephone number, the specific social media advertisement, or the messaging platform used by the fraudster.
Without this exact forensic trail, your institution will struggle to claim reimbursement from the responsible platform. This data-gathering process must be embedded directly into your ongoing Compliance Monitoring Programme. If you need to assess whether your current systems are capable of capturing these complex new data points, our team can help you build and refine these structures, as outlined in our overview of compliance support services.
Operationalizing these changes requires deep expertise. If your firm is preparing for these shifts, consider securing structured advisory support. Compliance Consultant offers three structured retainer tiers designed to give your risk team ongoing access to senior advisory expertise and a comprehensive library of digital templates.
Our Silver retainer provides 8 hours of advisory support per month, monthly regulatory briefings, and full access to our digital template library, including our Regulatory Horizon Scanning Tracker and our Compliance Monitoring Programme Builder. This tier is billed quarterly at £2,685 including VAT, or annually at £9,540 including VAT. You can book this tier directly via our annual Silver payment gateway or quarterly Silver payment link.
For larger institutions requiring strategic board-level reporting, our Gold retainer includes 16 hours of dedicated consultant support, a 4-hour response guarantee, and advanced tools such as our Third-Party Oversight Toolkit and our Conduct Rules Breach Investigation Toolkit. To discuss which tier matches your firm's operational structure, email our team at info@complianceconsultant.org with the subject "Retainer Discovery Call" or call our UK freephone number on 0800 689 0190 to schedule a complimentary 30-minute consultation.