How Open Banking and PSD2 Are Changing the Roles of Acquirers and Issuers

By changing who can access banking information and who can authorize payments, Europe's PSD2 (Second Payment Services Directive) and Open Banking initiatives are disrupting payment processing. Acquirers have to provide value beyond transaction processing, while issuers face new competition.

As PSD2 and Open Banking mature, market adaptation will compensate for current investments in secure APIs, fintech partnerships, and collaborative efforts.

Open Banking and PSD2: What It Means for Acquirers and Issuers

Payment processing is becoming more regulated rapidly. PSD2 along with Open Banking is arguably the biggest advancement in payment processing since digital payments were created.

In practice, this means PSD2 and Open Banking are not gradual regulatory adjustments; they are transforming who acquirers and issuers are in the payment ecosystem.

Key PSD2 and Open Banking Changes for Payment Providers

Here are the key changes driven by Open Banking under PSD2 that are reshaping the payment processing landscape:

Introduction of Third-Party Providers (TPPs)

PSD2 makes Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) regulated players in the space, with third-party access to customer banking data to process payments, as long as customers explicitly consent.

An AISP reads account data, such as balances and transaction history, to power budgeting, lending, or verification services. A PISP instructs a payment directly from the customer's bank account on the customer's behalf. The bank holding the account acts as the account servicing payment service provider (ASPSP) and must give both types of TPP access.

As a result, fintechs can develop third-party applications, and payment applications may come through software and directly from merchants.

Disintermediation

Disintermediation means banks are no longer required to act as intermediaries. Third-party providers (TPPs) can go directly to customers for payment initiation through banking information aggregation with permission, and merchants can process payments without traditional payment processors or card network involvement.

This disrupts revenue opportunities for established players who previously could rely on income from merchant connections.

Lower Costs

When direct bank-to-bank payments are enabled via A2A (account-to-account) payments through TPPs, there are lower processing fees. Merchants only incur transaction fees through their A2A payment systems via TPP's real-time payment processing.

An influx in Europe is already turning to this payment system due to ease of payment and cost-effectiveness compared to direct bank-to-bank payments.

Instant rails strengthen this shift. Under the Instant Payments Regulation, euro-area payment service providers had to receive SEPA instant credit transfers by 9 January 2025 and send them by 9 October 2025, at no higher price than a standard transfer. For acquirers, this makes A2A payments a more direct alternative to card acceptance for merchants.

Impact on Payment Acquirers

The impact on payment acquirers centers on adapting to competition from third-party providers, shifting business models, and expanding value-added services. Modern payment acquirers leverage API integration and new technologies to remain competitive and deliver greater value to merchants.

Competition from TPPs

Payment acquirers now compete with TPPs (Third-Party Providers), which allow payment initiation without going through card networks. Compared to card payments, these alternatives offer merchants speed, cost savings, and transparency, forcing payment acquirers to create new value beyond simple transaction processing.

New Business Models

Payment acquirers must evolve from card processors to payment orchestrators. They're blending payment rails (cards and bank transfers, cards with digital wallets) and offering Banking-as-a-Service (BaaS) for non-financial companies looking for white-label solutions. This diversifies how they can leverage their regulatory licenses and technical infrastructure.

Payment orchestration refers to routing each transaction to the best-suited acquirer, method, or rail through a single integration. For acquirers, it is the practical way to offer cards and A2A payments side by side instead of losing bank-transfer volume to TPPs.

Value-Added Services (VAS)

With new competitive threats from TPPs, acquirers need to offer more than basic acquirer processing. Payment acquirers now provide:

Should acquirers deliver these services from one platform and generate merchant stickiness, the conversation can shift from discount rates to incremental value.

API Integration

With partnership opportunities paramount, payment acquirers need robust API infrastructure to support integrations with banks and platform providers similar to TPPs. Integration promotes real-time payment processing, instant settlement, and bank account connectivity.

Impact on Payment Issuers

The impact on payment issuers is shaped by the rise of open banking, new compliance requirements, and intensified competition from fintechs. Payment issuers must prioritize secure API access, strong authentication, and technology partnerships to remain relevant and compliant.

Opening Access

Issuers must offer secure APIs to allow TPP access to customer accounts when authorized. This democratization effort required them to upgrade technology platforms to allow what was previously internally controlled access to become external platform connectivity.

The technical rules for this access sit in the Regulatory Technical Standards on strong customer authentication and common and secure communication, which applied from 14 September 2019. They define how issuers, acting as ASPSPs, expose dedicated interfaces to TPPs and how they authenticate customers.

Focus on Security and Compliance

Strong Customer Authentication (SCA) mandates that for electronic transaction approval, multi-factor authentication must be executed by the issuer. SCA means the customer confirms a payment with at least two of three factors: something they know, something they have, or something they are.

While the goal remains transparency with minimal customer friction, failure to comply, which requires additional inputs like 3DS2 (3-D Secure 2), may compromise the experience and compliance frameworks.

Increased Competition

Neobanks and fintechs can provide banking-level services without traditional banking licenses. Technology platforms with robust data collection can accumulate expenditure histories and provide users credit without involving the issuer, increasing competitive tensions.

Embedded finance simplifies this process.

Collaboration with Fintechs

Issuers at the forefront are empowering fintechs through strategic partnerships since many lack banking licenses. These collaborative efforts allow issuers to penetrate new markets with minimal effort while fintechs obtain credibility and foundational growth.

In card programs, this collaboration usually takes the form of BIN sponsorship and white label card issuing: the licensed issuer lends its BIN and scheme membership, and the fintech runs the customer-facing card product under its own brand.

Innovation Pressure

Open Banking has created ongoing innovation pressure. Issuers need to continue upgrading their technology platforms for compliant applications that allow secure, real-time issuer processing and customer-centric digital experiences.

Those issuers who innovate will benefit from data monetization opportunities versus being reliant on traditional revenue streams.

What Comes Next: PSD3 and the Payment Services Regulation

The impact of PSD2 on acquirers and issuers is not the end point. The EU is replacing PSD2 with a new Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation (PSR). Council and Parliament reached a provisional agreement on the package in November 2025.

For payment providers, the package targets stronger fraud protection, better-performing Open Banking interfaces, and clearer rules for TPP access, so the API and authentication investments described above carry forward into the next framework.