Your PSD2 setup wasn't built for what's next

PSD3 is a Directive on the authorisation and supervision of payment institutions and EMIs, applied through national law. The PSR is a Regulation that applies directly in every EU country and contains the open banking conduct rules: API performance, permission dashboards, fraud rules and strong customer authentication.

When people refer to "PSD3 API requirements", the obligations they mean sit in the PSR. Salt Edge delivers the PSR conduct layer for banks, EMIs and payment institutions.

Most PSR rules are expected to apply in the fourth quarter of 2028, 21 months after entry into force. PSD3 must be transposed into national law on the same timeline.

The European Parliament plenary vote is indicated for December 2026, publication in the Official Journal is expected in early 2027, and the texts enter into force 20 days after publication. Until then, PSD2 and the SCA technical standards remain in force. Salt Edge implements each standard release as part of the platform licence.

On 4 November 2026, the European Commission announced in its 2027 work programme that it will withdraw the proposal for the Financial Data Access Regulation (FiDA).

FiDA would have extended data sharing to savings, investments, mortgages, pensions and insurance. Without FiDA, sharing this data depends on commercial agreements. The PSR obligations are not affected, and the same Berlin Group openFinance Framework interface used for PSR compliance also supports Premium APIs.

The PSR makes the dedicated API the main access route and sets three duties. The API must perform at least as well as the interface the bank offers its own customers. Customers must get a permission dashboard to withdraw third-party access in real time. The standing fallback interface is replaced by a contingency mechanism supervised by the competent authority.

The EBA will set the performance indicators in technical standards. Salt Edge implements each standards release, including the contingency mechanism, as part of the platform licence.

The PSR applies to all account-servicing payment service providers that hold payment accounts: banks, electronic money institutions and payment institutions. Smaller institutions are not exempt from the API duties. Either the accounts are proven out of scope, or the institution complies in full.

Salt Edge delivers the compliance layer for smaller institutions in weeks.

FRIDA, the Fraud Information Distribution Arrangement, is a European Payments Council (EPC) scheme that sets common rules for how payment service providers share fraud information. It responds to the PSR obligation to share fraud data.

Each provider connects through a Fraud Information Platform (FIP) to a central Fraud Collection Point (FCP), owned by the EPC, which distributes alerts to the other FIPs. The scope is account-to-account payments: SEPA Credit Transfer, SEPA Instant Credit Transfer, SEPA Direct Debit Core and B2B, and One-Leg Out Instant Credit Transfer. Card payments are not in scope.

In the draft rulebook, a bank sends and receives fraud alerts through a Fraud Information Platform (FIP) of its choice, and confirms or rejects alerts on accounts it holds. Each alert carries mandatory fields, including the IBAN, the fraud type under the EBA fraud taxonomy, identifiers, timestamps and a status, delivered by push or by pull at least once a day.

An alert is a risk signal, not an instruction to block a payment. Whether a bank can also connect directly to the FCP is a consultation question that the final rulebook will decide.

FRIDA is expected to apply together with the PSR fraud data sharing obligation, in the fourth quarter of 2028.

The consultation on the draft rulebook (EPC108-26, version 0.1) closes on 10 December 2026. The EPC plans to publish version 1.0 and the technical specifications in mid-2027.

Salt Edge covers the PSR fraud data sharing obligation as part of the compliance layer, including the connection to FRIDA. Salt Edge is not a FIP. It provides the connection and the operations around it.

Salt Edge connects the bank to the FIP it chooses, or to the FCP directly if the final rulebook allows it, maps fraud data to the mandatory alert fields and the EBA fraud taxonomy, and runs the daily flow of alerts, including passing them to the bank's transaction monitoring.

Institutions have three options: build the interface in-house, join a national or sector consortium, or use a specialist compliance vendor. Salt Edge is a specialist vendor: an ASPSP compliance and open finance platform covering PSD2, the PSR conduct rules and Premium APIs on the Berlin Group openFinance Framework.

Salt Edge customers include Landsbankinn, Bank of Valletta and LHV in the EEA, and Guaranty Trust Bank and Jordan Ahli Bank outside it.

Both are valid. The cost depends on the starting point, the connection to core systems and the target scope: the PSR only, or the PSR plus Premium APIs. An in-house build must cover standards implementation, regulatory monitoring, third-party operations and interface performance continuously, so most of the cost is recurring.

In a workshop under NDA, the Salt Edge enterprise team produces a written recommendation and an implementation roadmap based on your architecture.

A consortium usually covers the regulated baseline, but Premium APIs are generally outside its scope and its roadmap moves at the scheme's pace. Ask the consortium whether it will offer Premium APIs. Many do not.

Salt Edge adds Premium APIs on top of what the consortium already delivers, and supports your connection to FRIDA.

Switching is an integration project, not a rebuild, because the migration reuses your existing integration layer. The effort depends on the core banking connection and the target scope.

For institutions already on Salt Edge for PSD2, PSR compliance is delivered as part of the platform. For a new institution, the timeline is measured in weeks, against the six to eighteen months an in-house build typically takes.

Premium APIs are services beyond the regulated baseline that a bank can offer commercially. The regulated baseline must be free of charge. Premium APIs can be priced and sold to commercial partners, corporates and embedded finance platforms, using the same interface the bank built for PSD3/PSR compliance.

Salt Edge offers all Premium APIs in the scope of the Berlin Group openFinance Framework as standard. Where a bank requests it, Salt Edge also builds custom APIs.