PSD2

PSD2 (Payment Services Directive 2) is the European directive that regulates payment services. For online stores, the most important part is strong customer authentication (SCA): since 14 September 2019, a customer must in principle confirm an online card payment in the EEA and the UK with two factors, for example in their banking app. To see what that means for your checkout, also read our guide to Shopify payments.

In short

PSD2 requires strong customer authentication for online payments, with a number of exemptions.

For card payments that check runs through 3D Secure; Shopify Payments handles it automatically.

Its successors PSD3 and PSR have political agreement, though realistically they will only apply from late 2027 to 2028.

What does PSD2 regulate?

PSD2 (Directive (EU) 2015/2366) was meant to make payments in Europe safer and open up the market. It has two major consequences:

Strong customer authentication for electronic payments, to reduce fraud.

Open banking: with your consent, authorised third parties can read your account data or initiate payments. That is the basis for accounting integrations and payment initiation.

For an online store the first point is the one you notice most, because it affects every card payment in your checkout.

Strong customer authentication (SCA): two of three factors

With SCA your customer confirms the payment with at least two of these three elements:

Knowledge: something the customer knows, such as a PIN or password.

Possession: something the customer has, such as their smartphone or card reader.

Inherence: something the customer is, such as a fingerprint or face recognition.

For card payments this check runs through 3D Secure. With Bancontact and iDEAL | Wero the customer already confirms in their banking app by default.

Exemptions from strong customer authentication

Not every payment needs an extra step. The main exemptions:

Your customer's bank always has the final say and can still require authentication.

What PSD2 means for your Shopify checkout

If you use Shopify Payments, Shopify automatically starts 3D Secure when your customer's bank requires it. That makes your checkout PSD2-compliant with no extra work. If you work with a different payment provider, check whether it supports 3D Secure; Shopify names Cardinal as the 3DS solution for third-party gateways.

SCA cuts both ways. An authenticated payment shifts liability for fraud to the bank, which protects you against a chargeback for fraud. On the other hand, every extra step can make customers drop off, for example when their banking app doesn't respond. So track your failed payments and abandoned checkouts, and if they drop, look at your payment methods first. Payment fees and revenue lost to failed payments both belong in your calculation of your total Shopify costs.

PSD3 and PSR: what's coming?

The European institutions reached political agreement on PSD3 and a new Payment Services Regulation (PSR) in November 2025. They build on PSD2, with stricter rules on fraud and open banking among other things. Application is realistically expected from late 2027 to 2028. For your Shopify checkout nothing changes for now.

Frequently asked questions

What is PSD2?

PSD2 is the second European directive for payment services. It requires strong customer authentication for online payments and gives authorised third parties access to bank data with the customer's consent.

What is the purpose of PSD2?

To make payments safer by reducing fraud, and to enable more competition by requiring banks to open their systems to other payment services.

When was PSD2 introduced?

The rules for strong customer authentication have applied since 14 September 2019, with a transition period for e-commerce.

Do I need to do anything for PSD2 as a Shopify store?

Not with Shopify Payments: 3D Secure starts automatically when the bank asks for it. With a different provider, check that 3D Secure is active.