How the Payment Accounts Directive Protects Your Bank Transfers
What the Payment Accounts Directive does
The Payment Accounts Directive (often called PSD2 in Europe) is a set of rules that govern how banks handle electronic payments and protect your money when you move it between accounts or send it to someone else. It does not change how much you pay for bills or when they are due — it changes how safely and transparently banks must handle the actual transfer of your money.
The directive applies mainly in the European Union and countries that have adopted it. If you live in the US, you are covered by different rules (the Electronic Funds Transfer Act and Regulation E). But if you bank with an international institution, send money across borders, or use a fintech app connected to your bank account, parts of this directive may affect you.
The core idea is simple: banks must show you what is happening to your money in real time, they must let you use third-party apps to check your balance or move money, and they must refund you quickly if something goes wrong.
Key Takeaways
- The Payment Accounts Directive requires banks to process payments faster, show you the status of transfers in real time, and refund unauthorized transactions within a set timeframe.
- You have the right to use third-party budgeting apps and payment services connected to your bank account without the bank blocking them.
- If someone makes an unauthorized payment from your account, the bank must refund you unless you were grossly negligent with your PIN or password.
- Banks must tell you the exact exchange rate and all fees before you send money internationally, so you know the final amount before you confirm.
- Payment timeframes are now standardized: domestic transfers within the EU must arrive within one business day, and banks must tell you when a payment failed.
How faster payment processing works under the directive
Before the directive, a bank transfer could take three to five business days to arrive, even within the same country. The directive set a standard: payments sent during business hours must arrive the next business day at the latest. If you send money on a Friday evening, it may not arrive until Monday or Tuesday, but the bank cannot hold it longer than that without a reason.
The directive also requires banks to tell you the exact moment a payment leaves your account and the exact moment it arrives in the recipient's account. You should see this status in your online banking or app — not a vague "processing" message, but real information about where your money is.
If a payment fails — the recipient's account number was wrong, the bank was closed, or something else went wrong — the bank must tell you why and refund your money within one business day. You should not have to call and ask; the bank must notify you automatically.
Your right to use third-party apps and payment services
Under the directive, you own the data in your bank account. That means you can give permission to a budgeting app, a payment service, or any other company to read your balance, see your transaction history, or even move money on your behalf — and your bank cannot refuse or charge you extra for it.
This is called open banking. In practice, it means you can connect your bank account to an app like YNAB, Emma, or a fintech payment service, and the bank must allow it. The bank can ask you to confirm your identity and can require you to use secure login (like two-factor authentication), but it cannot block the connection or penalize you for using it.
If a third-party app mishandles your money or leaks your data, you still have recourse. The bank is responsible for the security of the connection, and you can dispute unauthorized transactions that happened through a connected app the same way you would dispute a fraudulent card charge.
Protection against unauthorized payments and fraud
If someone makes a payment from your account without your permission, the directive requires your bank to refund you within 10 business days. The bank cannot refuse the refund unless it can prove you were grossly negligent — meaning you did something reckless, not just careless.
Gross negligence is a high bar. Forgetting to log out of your account on a shared computer is not gross negligence. Giving your PIN to someone else, or writing it on a sticky note and leaving it visible, might be. The bank has to prove you acted recklessly; you do not have to prove you were careful.
The refund covers the full amount of the unauthorized payment, plus any interest or fees you lost because the money left your account. If the bank takes longer than 10 business days to refund you, it must pay you interest on top of the refund.
How the directive handles international transfers and currency
When you send money across a border, the directive requires the bank to tell you three things before you confirm the transfer: the exact exchange rate it is using, all fees the bank will charge, and the exact amount that will arrive in the recipient's account. You must see all three numbers before you press send.
This stops the practice of hidden fees. A bank cannot charge you a fee and then charge the recipient a separate fee without telling you both upfront. If the bank is charging a fee, it must be clear. If the recipient's bank will charge a fee, the sending bank must tell you that too.
The recipient must receive the money in the currency they requested. If you send euros to someone in a country that uses a different currency, the bank must convert it at the rate it quoted you, not at a worse rate on the day the money arrives.
What happens if a bank does not follow the directive
If your bank violates the directive — for example, it refuses to refund an unauthorized payment, blocks a third-party app without reason, or does not tell you the exchange rate before a transfer — you can file a complaint with your national financial regulator. In the EU, each country has a banking authority that investigates these complaints.
You do not need a lawyer to file a complaint. You can do it online or by mail, and the regulator will contact the bank on your behalf. If the regulator finds the bank broke the rules, it can order the bank to refund you, pay you compensation, or both.
Some countries also have ombudsman services that handle banking complaints for free. These are separate from the regulator and often faster. You can usually file with the ombudsman if you have already complained to the bank and are not satisfied with the answer.
How the directive affects your bill payments and subscriptions
If you set up a recurring payment — a utility bill, a subscription, rent, or a loan payment — the directive requires the bank to show you the payment schedule and let you cancel it easily. You should be able to stop a recurring payment through your online banking without calling the bank or sending a letter.
If a company tries to take a payment that is not on your schedule, or takes more than the amount you authorized, you can dispute it the same way you would dispute any unauthorized payment. The bank must refund you within 10 business days.
For subscription services, the directive requires the company to ask for your permission again before charging you after a free trial or before raising the price. The bank must not process the payment if you have not actively confirmed it.
Frequently Asked Questions
Does the Payment Accounts Directive apply to me if I live in the US?
Not directly. The US has its own payment protection rules (the Electronic Funds Transfer Act and Regulation E), which are similar in many ways. If you use a US bank, those rules apply. If you use an international bank or a fintech service based in the EU, the directive may apply to some of your transactions.
What if my bank says it cannot connect to a third-party app?
Under the directive, the bank must allow the connection if you give permission and use secure login. If the bank refuses, you can file a complaint with your national financial regulator. The bank can require two-factor authentication or other security measures, but it cannot block the app outright.
How long does a refund for fraud actually take?
The bank must refund you within 10 business days. In practice, many banks refund faster — within 2 to 5 business days — but 10 days is the legal maximum. If the bank takes longer, it owes you interest on the refund.
Can a bank charge me a fee to use open banking or third-party apps?
No. The directive forbids banks from charging you extra for using third-party apps or for giving permission to access your account data. The bank can charge you for the account itself, but not for the act of connecting to an app.
What should I do if a recurring payment was taken without my permission?
Contact your bank immediately and tell them the payment was unauthorized. The bank must refund you within 10 business days. Also contact the company that took the payment and ask them to stop. If it is a subscription, you can usually cancel through their website.