SCA gets a promotion

Strong Consumer Authentication is being moved into a directly applicable regulation, not just amended. Your transition plan needs to separate what the text specifies, what waits on the EBA, and what it assumes about the handover. The law leaves that last part implicit.

By Matt Berryman 8 September 2026 9 min read

Where the payments package actually is

A May forecast for summer publication has come and gone. The official record now points to December, and carries a status line that reads backwards until you know the procedure.

Regulatory

Three numbers that no longer exist

The PSD3 and PSR timetable has moved, but many summaries have not. The April 2026 compromise texts change the planning assumptions and contain two easily missed provisions that apply from entry into force.

AI & Automation

When “something you are” becomes “something they can make”

One in five biometric fraud attempts now involves a deepfake. The figure is striking on its own, but the more interesting story sits underneath it: inherence has quietly become the awkward leg of the SCA stool, and the trilogue text of the PSR is the first regulatory instrument to acknowledge it.

Regulatory

Meet Alexandre Lamfalussy

PSD3 and the PSR have cleared trilogue. Coreper has the final texts. None of that tells you when the rules will apply to your business. A primer on the four-level framework that determines when EU payments regulation lands.

The Trust Triangle Evolution: From 3-D Secure's Three Domains to AP2's Agent Architecture

Twenty-five years ago, the payments industry solved the trust problem of e-commerce with a three-domain architecture that became the backbone of online authentication. Now, as AI agents prepare to shop on our behalf, we're witnessing history rhyme. But this time, humans might not be in the loop.