PSD2

What is PSD2?

PSD2 (Payment Services Directive 2) is the EU’s second payment services directive, applicable since January 2018. It imposes two main requirements: electronic payments in the EEA must be secured with strong customer authentication (SCA), and banks must give licensed third parties API access to account data and payment initiation (open banking) with the customer’s consent. SCA requires at least two independent factors from the categories knowledge, possession, and inherence.

Why does PSD2 matter?

For an online store, PSD2 hits conversion directly at checkout. Card payments where the bank requires SCA are routed through a 3-D Secure 2 flow, where the customer approves via, for example, a banking app or biometrics. Handled poorly, customers end up in declined or abandoned payments. The directive does define exemptions — including transactions under €30, recurring subscription payments, and merchant-initiated transactions (MITs) — so not every single payment triggers a challenge.

Common use cases

• Card payments at checkout. The issuing bank may require 3DS2 authentication before the payment completes.
• Subscriptions and recurring charges. The first payment is authenticated, while later charges can run as an MIT exemption.
• Open banking integrations. Account-to-account payment or accounting apps rely on PSD2’s API access.
• Debugging declined payments. Missing or failing SCA is a common cause of drop-off in the payment step.

Shopify perspective

Shopify Payments and most gateways handle 3DS2 dynamically, triggering a challenge only when the customer’s bank requires it. You rarely need to code SCA yourself, but you should test checkout with real European cards and verify that the 3DS2 window renders correctly on mobile. Monitor declined payments in your reports so you catch a gateway or app that breaks the authentication flow.