PSD2

What it means

PSD2 is the EU payment services directive. It introduced two things a company feels directly: third-party access to account data with the client’s consent, and strong authentication for payments.

Thanks to it accounting software or a finance app can read account movements through the bank’s API instead of someone downloading statements by hand.

Third parties under the directive play two distinct roles. An account information provider only reads balances and movements, while a payment initiation provider can, with the client’s consent, send a payment from the account. Some payment gateways are built on the second role, offering an online shop a transfer straight from the customer’s bank instead of a card.

How it works in practice

Automatic import of bank statements is the practical consequence: matching is faster, errors fall and the price per transfer drops, which shows in accounting price lists.

Strong authentication means confirming a payment with a second factor. On company accounts it is worth setting multi-level approval: one person enters, another confirms.

Consent to read an account has to be renewed with strong authentication after a while. If the director does not renew it, statement import quietly stops. For clients on automatic import we therefore watch the date of the last download, otherwise the sub-ledger shows long-paid invoices as open and the company chases customers for nothing.

What to watch out for

Grant third-party access only to licensed providers and review it regularly. An unused consent is a spare window into company finances that nobody is watching.

PSD2 offers no protection against a payment the authorised user confirms themselves. In a fake invoice scam or an e-mail announcing a supplier’s new IBAN, strong authentication passes without a hitch and the money is hard to recover. We therefore verify a partner’s change of bank details by phone on a known number, not by replying to the same e-mail.