The European Commission issued a proposal to update the EU’s payment-services rules (often referred to as “PSD2” during negotiations). A central goal was to modernize online payments and create clearer rules for new third-party payment providers, laying groundwork for later “open banking” access models.
The European Parliament and Council adopted PSD2, formally setting new EU-wide rules for payment services. PSD2 recognized and regulated new services such as payment initiation and account information services, which are key building blocks for open banking.
PSD2 was published in the EU’s Official Journal, making the final legal text widely available and starting the formal countdown to implementation steps. Publication helped industry and regulators begin detailed preparation for national rule changes and new technical standards.
PSD2 entered into force, meaning it became EU law and began binding Member States as a directive to be implemented nationally. From this point, the shift toward regulated third-party access and stronger online payment security became a firm EU policy direction.
Separately from PSD2, the UK Competition and Markets Authority (CMA) issued the Retail Banking Market Investigation Order 2017, requiring major banks to develop and use open and common API standards. This created a practical, standards-driven implementation path that reinforced open-banking concepts alongside PSD2.
Under PSD2, the European Banking Authority (EBA) developed detailed technical standards for “Strong Customer Authentication” (SCA) and secure communication. These standards mattered because open banking depends on secure ways for banks (account-servicing providers) and regulated third parties to communicate via interfaces such as APIs.
The European Commission adopted the regulatory technical standards (RTS) as a delegated regulation, translating PSD2’s security and interface goals into detailed requirements. This step was important because it set consistent expectations for authentication and for “common and secure” communications supporting third-party access.
Member States reached the deadline to transpose PSD2 into national law, meaning local legal frameworks should now support regulated third-party payment providers. This shift enabled open banking services to move from policy and planning into real-world authorization, supervision, and market entry.
The UK’s Open Banking program began on the CMA’s timeline with a managed rollout starting on 13 January 2018. This was a major practical milestone: it moved the concept of permissioned data sharing and payment initiation from “screen scraping” toward standardized APIs and governance.
The RTS for SCA and secure communication was published in the Official Journal, confirming the final text for industry implementation. Publication also started the countdown to the RTS becoming applicable after a transition period, giving banks and third parties time to build compliant authentication flows and interfaces.
As rollout challenges emerged, the EBA published materials (including opinions and consultations) to clarify how parts of the RTS should be implemented. This mattered for open banking because it addressed practical questions about API access models, exemptions, and contingency (fallback) measures when dedicated interfaces fail.
The RTS became applicable, meaning SCA and secure-communication requirements were expected to be used in practice across the EU. This was a key endpoint for 2015–2019 open-banking implementation: it marked the shift from “rules on paper” to enforced security and interface expectations supporting regulated third-party access.
EU PSD2 implementation and the rise of open banking (2015–2019)