From compliance to competitive advantage: what PSD3 and PSR change for fraud prevention

In a webinar hosted by The Paypers on 1 September 2026, Dirk Findeisen and Karl Illing from msg for banking set out what PSD3 and the Payment Services Regulation (PSR) will require of payment service providers, and where compliance stops short of effective fraud prevention. Joy Macknight moderated.

In brief

●       PSR makes real-time transaction monitoring obligatory for the payer PSP and the payee PSP alike.

●       Verification of Payee extends to all intra-EU credit transfers, beyond SEPA and instant payments.

●       The liability shift applies where the PSP itself is impersonated by the fraudster.

●       Ratification is expected in late 2026, with the rules applying 21 months later.

●       Payee-side monitoring and organisational readiness are the gaps most institutions still carry.

Why fraud has reached the board agenda

Dirk Findeisen, Managing Partner Anti-Financial Crime Compliance at msg Rethink Compliance, opened with the joint EBA/ECB payment fraud report. Fraudulent payment transactions across the EEA reached EUR 4.2 billion in value in 2024, up 17% year on year, with credit transfers accounting for EUR 2.5 billion and rising 24%. Payment service users bore around 85% of credit transfer fraud losses, largely through scams that induced them to initiate the payments themselves. Card fraud ran 17 times higher where the payee sat outside the EEA.

The attack surface has moved from third-party to first-party fraud and from human operators to AI-assisted ones, and Findeisen argued that the control architecture has to move with it.

What has changed in the payment environment

Karl Illing, Executive Partner Payments at msg for banking, set out four drivers. Real-time payments reached roughly 30% of EU credit transfer volume last year, shortening the window for detection and intervention. Strong customer authentication remains effective against what it was designed to prevent, with SCA-authenticated card transactions carrying around half the fraud rate of those without, but fraud has moved around authentication rather than through it. Authorised push payment fraud, in which a customer is deceived into authorising a transfer themselves, now accounts for around 70% of fraud volume in credit transfers. Digital customer journeys require session and device context, and AI has made attacks more scalable.

Asked what drives fraud prevention work today, the audience put customer trust and reputation ahead of regulatory and liability pressure, with increasing fraud losses at 17%.

What PSD3 and PSR change

PSD3 is the directive covering supervisory matters, particularly for payment institutions. PSR is the directly applicable regulation setting out the rights and obligations of PSPs. The trilogue concluded in November 2025 and a final draft followed in April 2026. Illing expects ratification in the November to December 2026 window, with application 21 months later and EBA technical standards within 12 months of publication. Assessment can begin now, with implementation starting next year.

PSR organises its fraud provisions around the transaction lifecycle. Verification of payee extends to all intra-EU credit transfers rather than SEPA or instant payments alone. Real-time transaction monitoring becomes obligatory for outbound and inbound flows, covering transaction, payer, account and payee data alongside session and device signals. The liability shift applies where the PSP itself is impersonated. Fraud data sharing moves to industry-led arrangements, with the EPC’s FRIDA scheme, the Fraud Information Distribution Arrangement, the reference initiative. Payee-side monitoring is the larger gap, since watching the payer account no longer suffices once mule accounts are in scope.

Compliance readiness and capability

Around 22% of the audience described themselves as largely ready. Illing’s caution was that an institution can satisfy the requirements in a legally sound way without addressing the fraud it actually faces, and that the optimisation target should be the fraud rate rather than the compliance checklist. Findeisen framed it through risk appetite: no institution catches 100% of fraudulent activity, so the working target is around 80%.

The capability underneath

Findeisen’s central argument concerned silos. Fraud, AML and onboarding sit in separate control environments, and his position was that the functions should stay distinct, because a fraud case follows a different decision logic from an AML case, while the data underneath them should be integrated well enough to identify modern typologies. He set out four layers: a data foundation; a detection and intelligence layer scoped to the risk assessment; a decision layer built around the analysts who use it; and governance over all of it, with attention to model drift where AI is applied. Detection has to address the customer’s intent as well as the transaction pattern, which brings behavioural analytics, device and session intelligence and transaction context into one picture.

Asked where the biggest capability gap sits, around a third of the audience chose organisation, governance and processes. Findeisen agreed, noting that a weak data foundation undermines whatever sits on top of it: 'It’s the old GIGO principle. Garbage in, garbage out.'

Where to start

Starting with a technology decision is the common mistake, in Findeisen’s view. The sequence he recommended runs from understanding current fraud exposure, to identifying gaps in controls, data and organisation, to prioritising them as any other risk would be, and only then deciding what to add. In around half the cases msg encounters, a home-grown solution is already in place, so delivery should be incremental rather than a big bang programme competing for scarce IT resource. Illing described the exercise as a holistic assessment rather than a checklist.

On fully 3DS-authenticated transactions, Findeisen said authentication alone will not prevent fraud where the customer has been socially engineered or the device compromised, so the risk layer has to sit around the authentication event.

Closing messages

Findeisen’s single message: 'Risk exposure becomes first, technology decision second.'

Illing placed the regulation as a starting point: 'PSR is important because, well, it’s a regulation. You need to do it and you better start now. But it doesn’t end there.'

The webinar recording is available on demand.

Questions from the session

When will PSD3 and PSR apply?

Ratification is expected in the November to December 2026 window, with the regulation becoming applicable 21 months later. EBA regulatory technical standards are due within 12 months of official publication.

Who has to monitor transactions under PSR?

Both the payer PSP and the payee PSP. Real-time monitoring covers outbound and inbound flows, which is a change from PSD2, where transaction risk analysis served mainly as an SCA exemption route.

Does strong customer authentication stop APP fraud?

No. A fully authenticated transaction can still be fraudulent where the customer has been socially engineered or the device compromised, which is why behavioural, device and session signals sit around the authentication event.