PSD3 and the PSR — the new EU payment rules and what they mean for Bulgarian business

After nearly three years of negotiation, the European Parliament and Council reached political agreement in November 2025, and on 23 April 2026 the final compromise texts of the Third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR) were published. Together they entirely replace the existing PSD2 and the e-money directive. Official publication in the EU Official Journal is expected during 2026.

Why two instruments — a directive and a regulation

Unlike PSD2, which each Member State transposed separately, a large part of the new conduct-of-business rules moves into the PSR — a directly applicable regulation, which applies identically across the EU without national legislation. PSD3 remains a directive only for licensing and supervision, which must be transposed into Bulgarian law — most likely by amending the payment services and payment systems act.

The key changes

• Consolidation of licences: e-money institutions become a sub-category of payment institutions and will be re-authorised under the single regime.
• IBAN-name verification: payment service providers must check that the IBAN matches the payee’s name and warn of any mismatch — on all credit transfers.
• Liability for authorised push payment fraud: where a transfer is made under deception but with the payer’s apparent consent, the victim has a wider right to reimbursement.
• Tighter open banking: banks’ API interfaces must meet specific standards for availability and speed, with a dashboard for managing permissions.
• Greater transparency on fees, exchange rates and expected transfer times for cross-border payments.

When it takes effect

The PSR enters into force 20 days after publication, but becomes applicable after a transitional period of about 18–21 months. PSD3 must be transposed nationally within a similar period. Real-world application is expected in 2027 Existing payment and e-money institutions will file for confirmation of their licence under the new regime during the transitional period.

What to watch as a business

• If you use an e-money institution rather than a bank for your business account, watch whether it files for re-authorisation on time.
• If you integrate with a payments API (for an online shop, for instance), expect updates from your payment infrastructure provider over the next year or two.
• Use the IBAN-name check as additional protection against fraud on outgoing payments to new counterparties.

Conclusion

PSD3 and the PSR are not yet in force, but the direction is clear — tighter supervision, more liability for fraud, and more uniform rules across the EU. Watch the central bank’s announcements for the Bulgarian transposition timetable.

PSD3 and crypto payments

PSD3 and the PSR also address the intersection with crypto-assets. Services involving e-money tokens under MiCA may, in certain circumstances, also count as payment services — which raises questions of dual licensing. The European Banking Authority has issued guidance narrowing the range of activities that require both. For a business accepting crypto payments through a provider, the practical conclusion is to check that the provider holds the necessary licences under both MiCA and the payments framework.

Frequently asked questions