In recent years, the financial services industry has undergone a seismic shift, brought on in large part by regulatory reforms intended to promote innovation, competition, and heightened security. One of the most consequential of these reforms is the Second Payment Services Directive (PSD2), introduced by the European Union. Aimed at enhancing the existing PSD framework, this regulation redefines the dynamics of payment services in the EU and the European Economic Area (EEA).
The implications of PSD2 are wide-ranging, particularly for those involved in drafting, negotiating, and managing payment processing contracts. The directive introduces obligations that touch on virtually every actor in the payment services ecosystem—from traditional banks to fintech startups, merchants, and third-party service providers. Navigating this complex but essential regulation demands a deep understanding of both legal and commercial implications.
The directive’s emphasis lies on customer rights, data sharing, security, and enabling competition through open banking. As such, payment processing contracts must be adapted to align with these mandates. This presents challenges but also unparalleled opportunities for those able to stay ahead of the curve.
Key Objectives and Scope of the Regulation
At the heart of this directive are several key objectives. Firstly, it seeks to make electronic payments within the EU more secure. Secondly, it aims to increase competition among payment service providers (PSPs), especially by facilitating market entry for new non-bank fintech firms. Thirdly, it endeavours to increase transparency and strengthen consumer protection.
To achieve these goals, the regulation introduces stringent technical and operational stipulations, including strong customer authentication (SCA), access to account (XS2A) provisions, and new requirements around complaints handling and incident reporting.
Importantly, while the regulation is a legislative act of the European Union, many of its provisions also impact third-party companies operating outside the EU. Any organisation providing payment services within the EEA must comply if they process payments for EU consumers or merchants. This extraterritorial reach adds another layer of complexity to contractual arrangements.
Altered Contractual Relationships in the Post-PSD2 Environment
One of the most transformative effects of the regulation is its alteration of traditional contractual relationships in the payment processing value chain. Previously, payment service contracts were relatively linear: a merchant would engage a processor or an acquirer, and banks supported the transaction settlement. With the advent of PSD2, the ecosystem has expanded to include new regulated players, such as Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs).
This expansion results in more complex contractual frameworks. Merchants, payment processors, and financial institutions must rethink their roles and obligations. Where once a bilateral agreement sufficed, today’s contracts may need to encompass multi-party arrangements with shared responsibilities relating to data handling, authentication, liability, and compliance.
An essential point of attention is liability apportionment. Under PSD2, various actors may be jointly or severally liable for fraudulent transactions or breaches of data security. Contracts must clearly delineate responsibilities and outline recourse mechanisms in the event of disputes. This necessitates detailed clauses covering indemnity, insurance, and dispute resolution procedures.
Implications of Strong Customer Authentication
A central pillar of the regulation is the requirement for strong customer authentication. SCA mandates that electronic payments must be authenticated using at least two independent factors from the categories of knowledge (something the user knows), possession (something the user has), and inherence (something the user is).
For payment processors and merchants alike, this has necessitated significant adjustments not only in technological infrastructure but also in service contracts. These contracts must now detail how SCA will be implemented, what party is responsible for ensuring its compliance, and how exemptions are applied and managed.
Although some transactions are exempt from SCA—for example, low-value or recurring payments—these exemptions must be supported by analytics and risk-based decisioning. Contracts should clarify the criteria for exemptions, along with who bears the burden if exemptions are incorrectly applied and a fraudulent transaction results.
Third-party providers are particularly affected. Their access to customer account data is contingent upon the correct implementation of SCA protocols. Payment processing contracts must therefore elaborate on the interdependence of these services, secure communication protocols (such as APIs), and mutual obligations for safeguarding user credentials.
Data Access and Open Banking Mandates
Perhaps the most groundbreaking component of the regulation is the data access requirement—commonly referred to as open banking. Through XS2A provisions, appropriately authorised third-party providers are entitled to access bank account information and initiate payments directly from the user’s account, provided the end user gives explicit consent.
This has enormous repercussions for payment processing contracts. Contractual arrangements must now make allowances for data sharing with third parties, under highly regulated terms. These terms include obtaining, recording, and maintaining customer consent, ensuring secure data transfer through APIs, and defining who will be responsible in the event of inadvertent data disclosure.
Moreover, open banking has necessitated commercial partnerships between incumbent financial institutions and fintech providers. The terms of these agreements must reflect not only PSD2 compliance but also business interests in terms of data monetisation and customer experience. Provisions around service levels, branding, liability, and intellectual property will typically need to be revisited and refreshed.
Trust between the parties becomes indispensable. Enforcing data access without compromising on security or creating legal friction requires delicately framed provisions. These include audit rights, certification processes, and mandatory reporting mechanisms.
Third-Party Service Provider Integration
The role of third-party providers is now institutionalised in EU law, providing both a framework and a challenge for traditional PSPs and newcomers alike. AISPs aggregate information from multiple bank accounts to give customers a consolidated view of their finances, while PISPs initiate transfers on behalf of customers without them having to use their banks’ interfaces.
The contracts governing the relationships between TPPs, PSPs, and merchants need to address this dynamic. Key legal issues surround the obligations and liabilities of TPPs in handling consumer data and initiating payments. For example, a PISP must ensure that the customer has given explicit consent, that the transaction complies with SCA, and that it reaches the intended recipient properly.
Importantly, contract frameworks must comply with licensing and passporting requirements defined in the regulation. Only authorised or registered providers are entitled to provide payment services. Contracts should therefore mandate proof of regulatory status and establish mechanisms for checking ongoing compliance with regulatory and supervisory expectations.
In situations where multiple PSPs interact in a single transaction, increase in systemic risks may emerge. Payment processing contracts must therefore contain clauses that provide contingency solutions, liability buffers, and data breach protocols. The operational and reputational interdependence between various parties necessitates a clear mutual understanding of responsibilities.
Enhanced Consumer Protection and Transparency
The regulation introduces updated provisions to protect end-users, including clearer pricing structures, faster complaint resolution mechanisms, and greater transparency regarding rights and obligations.
For businesses handling payment processing activities, these enhanced consumer rights translate into contractual requirements tying them to real-time reporting, complaint redress within specific timelines, and complete disclosures of transaction fees and currency conversion rates.
Contracts must now include specific language detailing the consumer complaint handling system, timelines for resolution, and escalation paths. Merchants and service providers need to ensure they are not unfairly held liable for customer-related service failures unless explicitly dictated by the agreement.
Furthermore, the regulation standardises the information disclosures that must be provided prior to a transaction. Contracts involving resellers, payment channels, or platforms must specify responsibilities for ensuring that end-users receive such information clearly and in a timely fashion.
Incident Reporting and Fraud Mitigation
Another significant requirement concerns the obligation of PSPs to report major incidents—including data breaches and service interruptions—to competent authorities. These reports are expected to follow specific templates and timelines and must include incident details, impact analysis, mitigation steps, and recovery plans.
Payment processing contracts must therefore establish coordinated incident response protocols. Legal provisions should define how partners communicate data breaches, which party takes the lead in regulatory submissions, and who manages customer notifications to avoid inconsistent or conflicting messages.
Given that under PSD2 the consumer liability in unauthorised transactions is capped (usually at €50 unless caused by gross negligence), companies must ensure that fraud detection and response measures are robust. Contracts should clarify when liability shifts from one PSP to another, how fraud data is shared, and what technologies are deployed to mitigate such risks.
Provisions surrounding insurance and indemnification are now, more than ever, central to payment processing agreements. To shield each party from liability exposures, especially in multi-provider arrangements, cyber insurance and mutual indemnities play a critical role.
Cross-Border Transactions and Local Regulatory Interpretation
While PSD2 sets out clear guiding principles, its implementation and enforcement are often subject to the discretion of national competent authorities. This creates potential divergence in regulatory expectations across jurisdictions.
Cross-border payment processing arrangements are particularly vulnerable to such discrepancies. Contracts in this context should acknowledge regulatory interpretation nuances and, where necessary, establish compliance review protocols that reflect local supervisory guidelines.
Choice of law and jurisdiction clauses gain greater importance. Inconsistencies between national implementing laws may create unforeseen liabilities or enforcement complications, especially where one party operates across multiple jurisdictions. Therefore, contracts must consider establishing neutral legal forums or dispute resolution mechanisms such as arbitration.
Future-Proofing Agreements Amidst Regulatory Flux
PSD2 is not the final chapter in the regulation of digital payments. Ongoing developments within the EU, such as proposals for a Digital Finance Strategy and the anticipated PSD3, suggest that further adjustments may soon become necessary. Additionally, other jurisdictions are also developing similar regulations with different emphases, such as the UK’s post-Brexit open banking roadmap or regulatory sandboxes available in financial hubs like Singapore and the UAE.
Smart contractual practice involves building in adaptability. This can take the form of review clauses tied to regulatory milestones, flexible pricing or service clauses contingent on compliance costs, and collaborative dispute resolution frameworks.
Contract drafters may also consider including an audit and remediation mechanism. These allow the parties to periodically review the contract’s compliance with current regulations and implement necessary amendments without the need for wholesale renegotiation.
Key Takeaways and Strategic Considerations
Navigating the directive as it relates to payment processing is fundamentally about aligning contract law with an evolving regulatory framework. It is not enough to technically comply with the regulation—contracts must be designed to operationalise that compliance effectively across a complex matrix of service providers and digital ecosystems.
A rigorous contract should reflect all touchpoints mandated under the regulation: data governance, customer consent, authentication protocols, liability chains, fraud contingencies, and redress mechanisms. It should anticipate future changes and allow for agile implementation of shifting regulatory standards.
Moreover, organisations should see the regulation not solely as a burden but as a catalyst for deeper innovation and customer engagement. By inserting well-considered performance and compliance metrics into their contracts, they can not only de-risk their operations but also drive better service levels, enhance customer trust, and carve out a competitive advantage in a crowded market.
The future of payment processing is undoubtedly shaped by rules that demand openness, security, and accountability. The contracts underpinning these services must reflect not just legal adequacy but strategic foresight, technical literacy, and commercial robustness. Only then can payment providers truly thrive in a post-PSD2 world.