The EU's Biggest Payment Reform Since PSD2 Arrives in Poland
The European Union is in the final stages of adopting PSD3 (Payment Services Directive 3) and PSR (Payment Services Regulation) - the most significant overhaul of European payment rules since PSD2 came into force in 2018. The European Parliament and the Council of the EU have agreed the final text of both instruments, but formal adoption and publication in the EU Official Journal have not yet happened: as of this update, the European Parliament's legislative tracker lists an indicative plenary vote for mid-December 2026 (see the update note at the end of this article). For customers of Polish banks, the reform will deliver three concrete new rights once it takes effect: a warning before a transfer goes to the wrong account, a refund right when a fraudster impersonates their bank adviser, and full transparency on fees before every transaction.
The reform comes in two parts. PSD3 is a directive - Poland will have to transpose it into national law within 21 months of entry into force. PSR is a regulation - it will apply directly in all 27 EU member states without any additional national legislation, generally from 21 months after entry into force (the mandatory Verification of Payee rule applies later still, 27 months after entry into force). Because the Official Journal publication date is not yet fixed, both are now estimated to take effect from around late 2028 to early 2029, not early 2028 as earlier reporting assumed.
Three Key Changes for Bank Customers
1. Payee Verification - Warning Before a Transfer Goes Wrong
The most impactful consumer-facing change in PSR is mandatory Verification of Payee (VoP). When you enter a recipient's name and IBAN, your bank must check whether they match. If they do not, you receive a warning within seconds - before you authorise the payment.
This tackles two significant problems. The first is simple human error - a wrong digit in an IBAN. The second is Business Email Compromise (BEC) fraud, where criminals intercept supplier invoices and replace the payee's account number with their own. Losses to this kind of fraud in Poland run into the millions of zloty every year, although no single official report publishes one combined total for 2025. Mandatory payee verification is expected to significantly reduce these losses.
One important note: if the bank warns you of a mismatch and you proceed with the transfer anyway, responsibility shifts to you. Always call the recipient on a separately confirmed number before approving a payment that triggers a warning.
2. Banks Will Refund Victims of Impersonation Fraud
This is the change that fraud victims have been waiting for. The typical scenario: a criminal calls from a number that looks exactly like your bank's helpline, poses as a security officer, and tells you your account is at risk. They instruct you to transfer your savings to a safe account immediately. You do - and lose everything. Until now, banks typically refused refunds, citing the fact that the customer authorised the transaction.
PSR changes this entirely. If a criminal impersonates a payment service provider (a bank or payment institution) and you transfer money as a result of that manipulation, your bank must refund you - provided that:
- you notify your bank promptly (ideally the same day or the next day),
- you report the fraud to the police,
- you did not act with gross negligence - for example, by ignoring explicit system warnings during authorisation.
This is a fundamental shift in liability. For years, banks argued that customers bore full responsibility for authorised transactions. PSR draws a clear line: if authorisation happened because a fraudster impersonated the bank, the bank - not the customer - is liable for the loss.
The golden rule remains: no legitimate bank will ever ask you to transfer funds to protect your account. If you hear this, hang up and call the official helpline printed on the back of your card.
3. Full Fee Transparency - Know the Cost Before You Confirm
PSR requires banks and payment institutions to disclose all charges before a transaction is confirmed. This means:
- Exchange rates must be shown before a cross-currency payment is initiated - not after.
- ATM fees for withdrawals outside your bank's network must be displayed on screen before you confirm, with the option to cancel at no cost.
- Dynamic Currency Conversion (DCC) - if an ATM offers to convert the currency at its own rate rather than your bank's rate, you must be clearly informed and given the option to decline. Currently many ATMs apply DCC automatically at unfavourable rates without the customer's knowledge.
For travellers, this is a concrete financial benefit. Undisclosed DCC rates and ATM fees have routinely cost customers 3–5% of the withdrawn amount without their awareness.
Open Banking: One Place to Manage All Your Consents
PSD2 opened the market for fintech apps to access customer bank data with their consent. The problem was that managing those consents was scattered and opaque - each app had its own settings, and it was difficult to track who had access to your account data. PSR requires banks to provide a centralised consent dashboard - a single screen in your banking app showing every third-party service that has access to your financial data, with the ability to revoke permissions in a few taps. Banks will also be required to provide fintech providers with API quality equivalent to their own mobile apps, ending the practice of deliberately degrading third-party access.
When Will the Rules Apply in Poland?
- Date not yet fixed (plenary vote indicatively mid-December 2026) - formal adoption, to be followed by publication of PSD3 and PSR in the EU Official Journal.
- Around 21 months after entry into force (estimated late 2028) - PSR applies directly in all 27 EU member states.
- Around 27 months after entry into force (estimated early 2029) - the mandatory Verification of Payee rule under PSR takes effect.
- Same 21-month deadline - Poland must transpose PSD3 into national law.
- 2029 onward - full roll-out of new open banking standards by Polish banks.
The exact deadlines depend on when the text is formally adopted and published; PSD2 remains in force until then. The Polish Bank Association has indicated that major banks plan to implement payee verification ahead of the PSR deadline. Some banks (e.g. PKO BP, for euro transfers) started as early as September 2026 - under a separate, already-adopted EU regulation on instant credit transfers that sets its own, earlier timeline independent of PSR.
What You Can Do Right Now
PSD2 remains the law until PSR takes effect, which current estimates put at no earlier than 2028. That does not mean you have to wait for new rules to protect yourself:
- Use BLIK where possible - BLIK payments require a one-time code valid for only two minutes and are significantly harder to spoof than a standard bank transfer.
- Verify every IBAN manually from the original document - never from an email or text message, which may have been tampered with.
- Never transfer money during a phone call - regardless of what number appears on screen. Hang up and call the official helpline.
- Review your fintech app permissions regularly - check which services have access to your bank data and revoke any that you no longer use.
Looking for a bank with strong security features and modern authentication tools? Compare personal accounts and savings accounts on BankSorter.com - we include security ratings alongside fees and interest rates.
Summary
PSD3 and PSR represent the most significant reform of European payment law in nearly a decade. For customers of Polish banks they will bring three concrete improvements: a payee verification warning before transfers go wrong, bank liability when fraudsters impersonate advisers, and full fee transparency before every transaction. The rules are expected to come into effect no earlier than 2028, once formally adopted and published by the EU institutions - but the best time to choose a bank that takes your security seriously is now.
Update (16 October 2026): When this article was first published (June 2026), we incorrectly stated that PSD3 and PSR had already been published in the EU Official Journal. In fact, according to the European Parliament's legislative tracker (OEIL, procedure 2023/0209(COD)), formal adoption and publication had not yet occurred: the ECON committee approved the negotiated text on 5 May 2026, and the indicative plenary vote is listed for 14 December 2026. Publication in the Official Journal is currently estimated for December 2026, which would push general PSR application to around late 2028 (21 months later) and the Verification of Payee obligation to around early 2029 (27 months later). All these dates remain estimates until the text is formally adopted by the European Parliament and the Council of the EU.
Compare personal accounts on BankSorter.com and find a bank that puts customer protection first.