On 28 June 2023 the European Commission published its proposed revisions to the EU Payment Services Legislation (PSD2) as well as a proposal on Open Finance/data access in the financial services sector beyond open banking/payment accounts in the form of a new Open Finance framework called “FIDA” (the “Payment Regulations”).
For further reading you will find the proposals here. The time frame for EU legislations from proposal to adoption tends to be quite extensive and the Payment Regulations are no exception: A reasonable guess is that they will be adapted in final form before Q2 2025. The legislation will enter into force 20 days later and the Member States will have 18 months to implement PSD3 into national legislation whereas market participants will have 18 months to comply with the PSR which in its capacity as regulation will be directly applicable.
The Payment Regulations contain many news and for all details we refer to the link above. The following is a summary of the amendments which are intended to improve the functioning of the payment markets in EU:

• Enhancing measures to combat payment fraud;

• Further enhancing consumer information and rights;

• Enhancing the operation of open banking, particularly in terms of data interface performance, eliminating barriers to open banking services, and enhancing consumer control over their data access permissions;

• Improving the accessibility of cash;

• Granting non-bank payment service providers (PSPs) access to all EU payment systems, under suitable safeguards, and affording them the privilege of holding a bank account;

• Strengthening the authority of national competent bodies to enforce regulations and simplifying the implementation of rules that clarify various aspects;

• Consolidating the legal frameworks governing electronic money and payment services.

With the introduction of PSD2, Payment Institutions and E-money Issuers had to apply for re-authorisation for these actors to provide payment services or issue e-money. The same requirement will apply under PSD3. The validity of existing licences will however be “grandfathered” until 30 months after entry into force on the condition that the application for a licence under PSD3 is made at least 24 months after PSD3 enters into force.
We also want to draw your attention to the fact that the definition of 'technical service provider’ is amended to mean a provider of services which, although not being payment services, is necessary to support (under PSD2: merely “support”) the provision of payment services, without the provider of technical services entering at any time into possession of the funds to be transferred. Our experience has shown that it may be difficult to determine whether an actor is a technical service provider (which is not subject to a license or registration) or in fact a payment services provider (which is required to hold a license or registration). The borderline will, with the introduction of PSD3, be somewhat sharper.

Written by Johan Ragnar


Data Protection

Third time is the charm? This July the EU Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework for transfers from the EU to the USA. For more information read our post here.

Synch’s data protection team joined Nordic Privacy Arena 2023 on the 25-26th of September!

Top topics that were discussed during those 2 days include:
• regulating A.I.
• priorities and challenges from the Nordic Data Protection Authorities
• the cooperation between cybersecurity and data protection silos
• updates on data protection and privacy legislative changes in the UK and the USA
• the future of international transfers of personal data

Both the Swedish and the Danish Data Protection Authorities agreed on something: The focus is back to the basics. Ensure that you have a record of processing activities in place, data processing agreements where required, as well as processes to handle data subject requests in a timely manner.

Feel free to reach out if you have questions about how we could support your organisation with your GDPR compliance.

Karolina Pekkari: karolina.pekkari@synch.law

Elisavet Dravalou: elisavet.dravalou@synch.law

Josefin Riklund: josefin.riklund@synch.law


The International Comparative Legal Guide

Our legal minds at Synch have recently lent their expertize to the International Comparative Legal Guide.

In the guides’ question-and-answer format, our lawyers share expert insights into the complex legal arena of Technology Sourcing Laws and Regulations, covering two chapters: Data Protection and Technology Sourcing.

Karolina Pekkari and Josefin Riklund explore a wide range of topics regarding Data Protection, including Restrictions on International Data Transfers, Data Security and Data Breach, Individual Rights, Whistle-blower Hotlines, and more. You can read this chapter here.

With a focus on Technology Sourcing, Karolina Pekkari, Josefin Riklund, Johan Ragnar, and Mathilda Nordmark, address issues such as Intellectual Property Rights, Cloud Computing Services, the emerging technologies of AI and Machine Learning, and Blockchain. You can read their chapter here.

Be sure you stay ahead of the curve – you have free access to read these chapters and learn more about the ever-evolving landscape of Data Protection and Technology Sourcing with Synch.