The EU's Biggest Payment Reform Since PSD2 Arrives in Poland
In June 2026, the European Union published PSD3 (Payment Services Directive 3) and PSR (Payment Services Regulation) in the EU Official Journal — the most significant overhaul of European payment rules since PSD2 came into force in 2018. For customers of Polish banks, the reform delivers three concrete new rights: a warning before a transfer goes to the wrong account, a refund right when a fraudster impersonates their bank adviser, and full transparency on fees before every transaction.
The reform comes in two parts. PSD3 is a directive — Poland must transpose it into national law within 21 months. PSR is a regulation — it applies directly in all 27 EU member states without any additional national legislation. Both will take effect from early 2028.
Three Key Changes for Bank Customers
1. Payee Verification — Warning Before a Transfer Goes Wrong
The most impactful consumer-facing change in PSR is mandatory Verification of Payee (VoP). When you enter a recipient's name and IBAN, your bank must check whether they match. If they do not, you receive a warning within seconds — before you authorise the payment.
This tackles two significant problems. The first is simple human error — a wrong digit in an IBAN. The second is Business Email Compromise (BEC) fraud, where criminals intercept supplier invoices and replace the payee's account number with their own. In Poland alone, hundreds of millions of zloty were lost to fraudulent and erroneous transfers in 2025. Mandatory payee verification is expected to significantly reduce these losses.
One important note: if the bank warns you of a mismatch and you proceed with the transfer anyway, responsibility shifts to you. Always call the recipient on a separately confirmed number before approving a payment that triggers a warning.
2. Banks Will Refund Victims of Impersonation Fraud
This is the change that fraud victims have been waiting for. The typical scenario: a criminal calls from a number that looks exactly like your bank's helpline, poses as a security officer, and tells you your account is at risk. They instruct you to transfer your savings to a safe account immediately. You do — and lose everything. Until now, banks typically refused refunds, citing the fact that the customer authorised the transaction.
PSR changes this entirely. If a criminal impersonates a payment service provider (a bank or payment institution) and you transfer money as a result of that manipulation, your bank must refund you — provided that:
- you notify your bank promptly (ideally the same day or the next day),
- you report the fraud to the police,
- you did not act with gross negligence — for example, by ignoring explicit system warnings during authorisation.
This is a fundamental shift in liability. For years, banks argued that customers bore full responsibility for authorised transactions. PSR draws a clear line: if authorisation happened because a fraudster impersonated the bank, the bank — not the customer — is liable for the loss.
The golden rule remains: no legitimate bank will ever ask you to transfer funds to protect your account. If you hear this, hang up and call the official helpline printed on the back of your card.
3. Full Fee Transparency — Know the Cost Before You Confirm
PSR requires banks and payment institutions to disclose all charges before a transaction is confirmed. This means:
- Exchange rates must be shown before a cross-currency payment is initiated — not after.
- ATM fees for withdrawals outside your bank's network must be displayed on screen before you confirm, with the option to cancel at no cost.
- Dynamic Currency Conversion (DCC) — if an ATM offers to convert the currency at its own rate rather than your bank's rate, you must be clearly informed and given the option to decline. Currently many ATMs apply DCC automatically at unfavourable rates without the customer's knowledge.
For travellers, this is a concrete financial benefit. Undisclosed DCC rates and ATM fees have routinely cost customers 3–5% of the withdrawn amount without their awareness.
Open Banking: One Place to Manage All Your Consents
PSD2 opened the market for fintech apps to access customer bank data with their consent. The problem was that managing those consents was scattered and opaque — each app had its own settings, and it was difficult to track who had access to your account data. PSR requires banks to provide a centralised consent dashboard — a single screen in your banking app showing every third-party service that has access to your financial data, with the ability to revoke permissions in a few taps. Banks will also be required to provide fintech providers with API quality equivalent to their own mobile apps, ending the practice of deliberately degrading third-party access.
When Will the Rules Apply in Poland?
- June 2026 — PSD3 and PSR published in the EU Official Journal.
- Early 2028 — PSR applies directly in all 27 EU member states (21 months after publication).
- Early 2028 — deadline for Poland to transpose PSD3 into national law.
- 2028–2029 — full roll-out of new open banking standards by Polish banks.
Banks have roughly eighteen months to prepare their systems. The Polish Bank Association has indicated that major banks plan to implement payee verification ahead of the regulatory deadline — some as early as 2026 as a voluntary measure.
What You Can Do Right Now
PSD2 remains the law until 2028, but you do not have to wait for new rules to protect yourself:
- Use BLIK where possible — BLIK payments require a one-time code valid for only two minutes and are significantly harder to spoof than a standard bank transfer.
- Verify every IBAN manually from the original document — never from an email or text message, which may have been tampered with.
- Never transfer money during a phone call — regardless of what number appears on screen. Hang up and call the official helpline.
- Review your fintech app permissions regularly — check which services have access to your bank data and revoke any that you no longer use.
Looking for a bank with strong security features and modern authentication tools? Compare personal accounts and savings accounts on BankSorter.com — we include security ratings alongside fees and interest rates.
Summary
PSD3 and PSR represent the most significant reform of European payment law in eight years. For customers of Polish banks they bring three concrete improvements: a payee verification warning before transfers go wrong, bank liability when fraudsters impersonate advisers, and full fee transparency before every transaction. The rules come into effect in early 2028 — but the best time to choose a bank that takes your security seriously is now. Compare personal accounts on BankSorter.com and find a bank that puts customer protection first.