-
№ 1 · 02 Nov
1 min readOut of band Out of band
Two EU sites, two clocks
Parliament’s Legislative Observatory still says the Council’s first-reading position on PSD3 and the PSR is awaited. The Council adopted both on 29 October, 27 votes to 0. Both pages are right: they keep different clocks.
-
№ 2 · 27 Oct
2 min readOut of band Out of band
The fraud report is a third ledger
A 3DS liability shift moves the fraud loss and blocks the fraud dispute. It does not stop the issuer’s fraud report, and Visa’s VAMP ratio counts fraud reports as well as disputes.
-
№ 3 · 20 Oct
5 min readRegulatory
The monitoring you have to prove
A passed 3DS challenge proves the customer answered it, and under the PSR compromise text that would not be enough. An issuer that cannot show the customer its monitoring ran would refund the payment, so what you assessed, and when, becomes the record that matters.
-
№ 4 · 13 Oct
2 min readAuthentication Out of band
The human in the loop is already in the spec
When an AI agent buys something, how does the cardholder's bank get the cardholder to say yes? The published EMV 3DS specification already has an answer: a 3RI request answered with a decoupled challenge. What is missing is support and settled law.
-
№ 5 · 06 Oct
5 min readRegulatory
Authorised to do what?
Visa's rules make a cardholder responsible for an agent's purchase as if they initiated it. PSD2 asks whether they consented. A 2024 CJEU case on human proxies suggests what an issuer will have to prove, and the answer runs through the record of what the agent was told.
-
№ 6 · 29 Sep
1 min readRegulatory Out of band
Agent indicator or intent record?
Six banks say any party holding a potential liability should be able to require authentication. In the EU that is the issuer, yet the published EMV 3DS specification has no field telling its ACS an agent is acting. Which signal should reach the ACS first?
-
№ 7 · 22 Sep
3 min readRegulatory
Reading a Compromise Text
Four PSR articles with small textual changes and a changed obligation in each. A method for checking the obligations in your implementation plan against the April compromise, using the comparison and following its references.
-
№ 8 · 15 Sep
2 min readRegulatory
Give your AI the source
Connect ChatGPT or Claude directly to paymentslaw.eu and check the sources behind an SCA answer. A free, read-only connection to 51 curated EU payments instruments, with provisions, source editions and citations you can open.
-
№ 9 · 08 Sep
9 min readRegulatory
SCA gets a promotion
Strong customer authentication is being moved into a directly applicable regulation, not just amended. Your transition plan needs to separate what the text specifies, what waits on the EBA, and what it assumes about the handover. The law leaves that last part implicit.
-
№ 10 · 01 Sep
3 min readRegulatory
Where the payments package actually is
A May forecast for summer publication has come and gone. The official record now points to December, and carries a status line that reads backwards until you know the procedure.
-
№ 11 · 25 Aug
5 min readRegulatory
Three numbers that no longer exist
The PSD3 and PSR timetable has moved, but many summaries have not. The April 2026 compromise texts change the planning assumptions and contain two easily missed provisions that apply from entry into force.
-
№ 12 · 16 May
3 min readAuthentication
When “something you are” becomes “something they can make”
One in five biometric fraud attempts now involves a deepfake. The figure is striking on its own, but the more interesting story sits underneath it: inherence has quietly become the awkward leg of the SCA stool, and the trilogue text of the PSR is the first regulatory instrument to acknowledge it.