PSD3 & open banking: how an orchestrator secures payments and boosts sales

Asking a shopper for an SMS code before they can complete their purchase is a recipe for abandoned carts. Conversely, a fraudulent transaction that slips through can result in a refund to the buyer, often at the merchant's expense. PSD3 tightens security controls exactly where shoppers are least patient: at the checkout. However, the same legislation also paves the way for faster payment journeys through open banking. Absorbing the friction to unlock the opportunity is precisely the role of a payment orchestrator.

PSD3 and PSR: What really changes for e-commerce merchants

PSD2 laid the groundwork: Strong Customer Authentication (SCA) and opening up banking data to authorized third parties (AISPs and PISPs). However, the lack of API standardization hindered interoperability.

Proposed by the European Commission in June 2023, PSD3 and its twin regulation, PSR (Payment Services Regulation) form a cohesive framework: the directive establishes the licensing and supervision of players, which member states then transpose into national law; the regulation, which is directly applicable, sets the daily operational rules (user rights, security, open banking, transparency). The package is structured around four objectives:

1. Strengthening the fight against fraud : sharing anti-fraud information between PSPs (governed by GDPR), verifying that the beneficiary's name matches their IBAN before execution, and, most importantly, extending liability across the entire technical chain : a gateway or technology provider that fails to properly support security requirements can no longer hide behind the customer's bank alone. These measures address the rise of fraud types such as spoofing, where the fraudster impersonates the customer's payment provider to trick them into authorizing the transaction themselves: since the transaction is technically authorized by the cardholder, strong authentication alone is not enough to detect it.
2. Clarifying and extending SCA (Strong Customer Authentication), without increasing its frequency. This is the most interesting point for e-commerce merchants: while strong authentication remains the foundation, its application is becoming smarter. No more unnecessary re-authentication. For Merchant-Initiated Transactions (MITs), strong authentication can be focused at the time the mandate is set up rather than on every occurrence. SCA is also being simplified for account data access and must be made accessible to everyone, including those without a smartphone.
3. Making open banking more reliable : elimination of dual interfaces, dedicated APIs with performance commitments, and user consent dashboards.
4. Preparing for open finance (via FiDA): standardized access to financial data beyond just payment accounts.

Where do we stand exactly? The Parliament and the Council reached a provisional political agreement on November 27, 2025, and the text resulting from these negotiations was approved by the ECON committee on May 5, 2026. The formal vote and publication remain: once the directive is adopted, member states will have a transposition period, followed by a compliance period for companies. The right approach is therefore not to wait for a firm date, but to verify now that your payment architecture can absorb these changes without requiring a complete overhaul.

PSD2 vs. PSD3: the comparison

The three concrete risks for merchants

• Increased friction at checkout. New authentication and control requirements may weigh down the user journey. The risk: a mechanical drop in conversion rates.
• A requirement for proof. As highlighted in the Deloitte Avocats analysis we detail here, you will need to demonstrate that documented and verifiable anti-fraud measures are in place and that you are working effectively with your PSPs.
• Increased technical dependency. Every regulatory change translates into development work. Multiplied by the number of connected PSPs, these projects can overwhelm your IT roadmap.

Open banking: the new building block for conversion (and not just compliance)

Open banking is too often viewed as a regulatory constraint. First and foremost, it is an opportunity for the customer journey.

This is not a gamble on the future. Instant payments are growing rapidly: + 84% in 2023, even though they accounted for only 6.4% of the total number of transfers at the time, notes the Banque de France. The European Instant Payments Regulation aims to make their use widespread. And PSD3 specifically removes the barriers that were limiting their adoption: an end to dual banking interfaces, a list of prohibited obstacles to data access, and a user-side consent dashboard. Banks will even be required to publish quarterly statistics on the availability and performance of their APIs—allowing you to choose partners based on measurable data rather than marketing promises.

In a market where user experience matters as much as price, this quality of integration becomes a key differentiator. The challenge, however, is being able to activate these methods without having to launch a new technical project every time.

The real cost of the problem: cart abandonment

According to the Baymard Institute, the average cart abandonment rate is 70% (average across 49 studies), a figure we analyze in detail in Payment barriers: why 70% of carts vanish. And a significant portion of these abandonments is directly linked to the issues covered by PSD3:

• distrust regarding the security of banking information, one of the most frequently cited reasons for abandonment;
• the absence of the preferred payment methodwhich is enough to drive a buyer out of the funnel, a point that Purse addresses by connecting a wide catalog of PSPs and payment methods;
• other abandonments are explained by a checkout process that is too long, 3DS triggered indiscriminately, or an unrecovered technical failure.

In other words: too much security kills the sale, and so does too little. The challenge is not to choose between the two, but toadapt the level of authentication to the actual risk of each transaction.

How a payment orchestrator solves the equation

A payment orchestrator sits between your IT system and all your providers (PSPs, payment methods, fraud tools, ACS). It becomes the single control point for your flows, and therefore the best place to absorb regulation without penalizing conversion.

Agnostic 3DS: authenticating at the right time

Rather than systematically triggering 3D Secure, the orchestrator calibrates authentication according to the actual context : customer profile, amount, country, device, history, and risk level. This is exactly the risk-based authentication logic recommended by fraud experts like Cybersource : apply SCA only when necessary. The result is a frictionless journey for safe transactions, and reinforced authentication where it adds value.

PSD3 goes further by pushing merchants to transmit more contextual data to issuers (location, device, spending habits, history, session data). This is exactly what an orchestrator does systematically, and it is what helps improve approval rates. EMVCo, the organization that publishes the 3-D Secure specification, states it clearly: richer data improves issuer decision-making and results in more approved transactions and fewer unjustified declines. Better informed, the issuing bank can more accurately distinguish between a legitimate transaction and a suspicious one. Compliance then becomes a conversion gain, not a cost. This is what Kiabi achieved by dynamically orchestrating its flows: an acceptance rate boosted to 94%, an increase of 2 to 3 percentage points, by moving away from reliance on a single PSP.

Exemptions, managed with precision

For known and regular customers, banks can authorize the transaction without additional authentication (risk analysis, purchase history). The Safer by CB program, for example, aims to streamline authentication for a portion of transactions; its specific conditions should be confirmed with your acquirer.

The PSD3 proposals significantly expand this playing field: merchant-initiated transactions (subscriptions, recurring payments) are removed from the scope of SCA, with only the first transaction requiring it, and MOTO transactions are also exempt. This is a direct gain for the subscription, travel, and debt collection sectors, provided you know how to apply the right rule to the right transaction.

However, you still need to know the rules of the game. Several exemptions coexist (transaction risk analysis, low amount, whitelisted trusted beneficiary, recurring payment, MIT, MOTO, and Acquirer TRA), each with its own eligibility conditions. Some depend on the transaction amount, others on your provider's observed fraud rate. The exact thresholds are set by technical regulations and are subject to change with PSD3: they should be verified with your PSPs rather than assumed.

Four operational consequences that few merchants anticipate:

• Your fraud rate is an asset. It determines your eligibility for the broadest exemptions. Monitoring it by PSP, rather than just globally, allows you to route exempteable transactions to the best-positioned provider.
• The issuer has the final say. A requested exemption may be declined by a soft decline : the bank responds that it requires authentication. Without an automatic 3DS retry mechanism, this transaction is lost even though it was perfectly legitimate.
• Trusted beneficiaries are underutilized. This exemption is activated on the buyer's side: they are the ones who whitelist you with their bank. Encouraging your recurring customers to do this is a sustainable and free way to boost conversion.

This is the main advantage of a single control point: these trade-offs can be managed via rules, measured, and adjusted without redeployment.

Acquirer TRA (Transaction Risk Analysis): as a merchant, you can request an exemption for transactions you consider low-risk. Since the acquirer bears the responsibility, they analyze the overall transaction portfolio (transaction value, fraud rate) and decide whether or not to grant an exemption. You can contact your acquirer for more information.

⚠️ Systematically requesting exemptions can lower your score with issuing banks, thereby reducing your acceptance rate. It is a fine-tuning process, not an on/off switch.

Smart routing and fallback: never lose a sale for a technical reason again

A decline is not always final. The orchestrator allows you to intelligently route each transaction to the highest-performing PSP (BIN routing), to retry a failed payment, and to automatically switch to a backup provider in the event of downtime (fallback). These are all recovered carts that would otherwise never have been counted as sales.

The Vault: data sovereignty and compliance

By centralizing payment data in a single vault, you become PSP-agnostic. You can change, add, or remove them without starting from scratch—a major advantage when regulations require you to evolve your stack.

This centralization has a valuable side effect: reconciliation. At Kiabi, it made it possible to close out 2025 with zero reconciliation discrepancies, compared to €2.8M previously, precisely the type of traceability that PSD3 will make mandatory.

A single integration to handle regulation

This is perhaps the most underestimated benefit: with a single integration, compliance updates are handled by the orchestrator, not your technical team. Your product roadmap remains focused on what truly creates value.

For details on the specific requirements, we have published a dedicated guide: PSD3: Understanding the directive and ensuring your compliance.

Enable bank transfer payments without a technical project

Everything mentioned above remains theoretical if adding a payment method requires six months of development. This is where the link between regulation and orchestration becomes concrete.

Payment initiation, created by PSD2, allows the buyer to pay via bank transfer directly from their bank account, without entering card details and therefore without 3D Secure. Until now, this channel remained fragile in production: each bank implemented APIs in its own way, and the mandatory fallback interface caused frequent drop-offs. This is precisely what PSD3 corrects, with a single dedicated interface, a list of prohibited obstacles, and performance statistics published by the banks.

Purse is connected to Fintecture, a French account-to-account payment solution available in production on the platform. For a merchant, activation is a matter of configuration, not development: this is how Kiabi added Fintecture to its payment flow, alongside Bizum.

Real-world proof

iQera: payment performance in a debt collection context

As a specialist in third-party debt management, iQera needed to secure its e-commerce and MOTO payments while keeping pace with regulatory changes (PSD2, PSD3) and managing the performance of its PSPs. With Purse:

• +2 percentage point increase in net acceptance rate
• 4 new payment methods deployed (PayPal, SlimPay, Scellius, and XPAY, the latter currently being rolled out), whereas only CB, Visa, and Mastercard were accepted initially
• Centralization of routing rules and unified performance management

👉 Discover the iQera case study

Vertbaudet: local payment methods driving cross-border growth

Present in 9 European countries, Vertbaudet has unified 8 PSPs and 13 payment methods behind a single API, without the need for a redesign or market-specific development. In 12 months: +4 percentage point increase in credit card acceptance rate, and massive adoption of local methods. 60% of Belgian transactions now go through Bancontact, compared to 10% previously, 50% of Swiss transactions via Twint, and 54% of Portuguese customers via MB Way.

Orchestration also makes it possible to dynamically adapt 3D Secure triggers based on the market and user behavior, reducing unnecessary friction. We detail this approach in our guide, Optimizing Your E-commerce Payments. It’s proof that a payment method catalog driven by orchestration deploys at the speed of business, not the speed of the IT roadmap. (Source: Vertbaudet, May 2025.)

Your 5-step action plan

1. Map your abandonment rates. Distinguish between abandonment before payment, abandonment during checkout, technical declines, and declines due to suspected fraud. Without this segmentation, you cannot prioritize any actions.
2. Audit your authentication rules. What percentage of your transactions triggers 3DS? What portion could legitimately qualify for an exemption?
3. Measure your acceptance rate by PSP, BIN, and country. The discrepancies are often greater than you might imagine.
4. Test an A2A / open banking flow on a specific segment (high-value carts, repeat customers, or a pilot country).
5. Evaluate your technical dependency. How many man-days would it cost to add a PSP or achieve PSD3 compliance with your current architecture?

Key takeaways

• PSD3 and the PSR are not just compliance issues. They redefine the rules exactly where your sales happen: at checkout.
• Poorly calibrated security costs more than fraud. With nearly 7 out of 10 carts abandoned, every unnecessary authentication step comes at the cost of revenue.
• Open banking is a conversion driver, not just an obligation: shorter flows, a card alternative, and immediate settlement.
• An orchestrator is the right control point : real-risk authentication, managed exemptions, smart routing, and fallback to recover from technical failures.
• A single integration, and compliance is handled for youYour IT roadmap remains available for what creates value.

‍