An instant credit transfer leaves a customer’s account. Under the proposed EU Payment Services Regulation (PSR), as agreed by the co-legislators, if the payee’s payment service provider (PSP) withholds it as suspected fraud and returns it, it will have ten seconds, counted from the moment the payer’s PSP received the order, to notify the payer’s PSP of the return and its reasons, as far as anti-money laundering disclosure rules allow.

That clock is part of the main change in the agreed compromise texts, which are not yet adopted: once the PSR applies, both the payer’s and the payee’s PSP must check payments for fraud. The payer’s PSP must suspend a suspicious payment and refuse it if the suspicion remains. For payments in euro or another EU currency, the payee’s PSP may withhold and return suspected fraud, and must where the case is clear and incontrovertible. Liability follows these checks, and every PSP will have to join a fraud-data sharing arrangement. For institutions that hold accounts for merchants, sellers and platform users, that means fraud duties on the receiving side, on top of the anti-money laundering duties they already have.

This article, part of our series on the forthcoming EU payments framework, is the first of two on the Council’s first-reading positions on the PSR (ST 8543/26) and on the third Payment Services Directive, PSD3 (ST 8535/26), published on 21 October 2026. The Council has yet to adopt them formally; Parliament would then approve them at second reading, indicatively on 14 December 2026. On current estimates, both texts would enter into force in early 2027, and most of their rules would apply around the end of 2028, replacing the second Payment Services Directive (PSD2), with verification of payee extended to more credit transfers around mid-2029. Article numbers follow the Council’s positions. This article is general information, not legal advice.

Fraud checks by the payer's and the payee's PSP

Under the agreed text, before executing a payment, the payer’s PSP must monitor the transaction and apply strong customer authentication (SCA) where required, and for credit transfers it checks the payee’s name (verification of payee, or VoP), as it already does for many euro credit transfers under the Instant Payments Regulation. Where its monitoring or other information, not the payee name check alone, gives it objectively justified reasons to suspect fraud, it must suspend the payment and, except for instant credit transfers, ask the payer for the information it needs; if the suspicion remains, it must refuse the payment and, unless the law prohibits it, tell the payer and the payee’s PSP why, within ten seconds for instant credit transfers. Today, the payee’s PSP already monitors transactions under anti-money laundering rules and must refrain from carrying out those it suspects are linked to criminal proceeds until it has reported them, but PSD2 requires it to make incoming funds available immediately and contains no fraud-specific hold-and-return rule. Under the PSR, the payee’s PSP must also monitor the transaction for fraud before making the funds available.

For payments in euro or another EU currency, where its monitoring or other information gives it objectively justified reasons to suspect fraud, the payee’s PSP may withhold the funds and return them, provided it decides within the time it has to make them available. Where the reasons are clear and incontrovertible, it must. The result of the payee name check is not enough on its own, and neither is the fact that a payment is unusual. For instant credit transfers, the payer’s PSP must be notified within the ten seconds and any funds already received must be sent back immediately; the payer’s PSP then restores the account and informs the payer free of charge.

In practice, a decision that has to reach the payer’s PSP within ten seconds leaves little or no room for manual review, so it will need to be built into the payment flow. Institutions that receive instant payments through a correspondent bank should also check that their decision can reach the payer’s PSP in time.

Who pays when fraud gets through

Under the agreed text, where the payer’s PSP does not give the payer evidence that both PSPs monitored the transaction, it will have to refund the payer, and it will be able to recover that sum from the other PSP or an intermediary where the liability is attributable to them. Where only one of the PSPs is in the EU, the PSR’s right of recourse does not apply. A PSP that did not monitor will be liable to the payer for the financial damage the payer incurs. Where the payer’s PSP had objectively justified reasons to suspect fraud but did not suspend the payment, the payer bears no loss and the PSP must prove it complied.

Where the case for fraud was clear and incontrovertible and the payee’s PSP released the funds anyway, the payer bears no loss and the payee’s PSP must prove it complied. Article 73 does not say who compensates the payer in that case, although the right of recourse in Article 82 covers liability under this rule, so a PSP that pays can recover the sum where the liability is attributable to another PSP or an intermediary. Recital 126 links the payee’s PSP’s obligation “and the corresponding liability” to cases where it has strong, consistent and undisputed evidence or indications of fraud, with no plausible alternative explanation, but recitals guide interpretation without being binding, so the adopted text would leave this point unresolved until supervisors or courts clarify it. Under each of these rules, the payer loses this protection where the payer acted fraudulently.

To avoid refunding under this rule, the payer’s PSP must be able to show the payer that both PSPs monitored the transaction, so both sides will need to agree what evidence is produced, shared and kept.

Fraud data sharing and the EPC's FRIDA scheme

Once the PSR applies, every PSP will have to take part in an arrangement for sharing fraud information with other PSPs. Data will move only where a PSP has objectively justified reasons to suspect fraudulent behaviour by a user, and only within the categories the PSR lists, which exclude the environmental and behavioural characteristics typical of the payer’s normal use of their security credentials. The PSPs setting up an arrangement will carry out a joint data protection impact assessment before concluding it; according to the recitals, a PSP joining an existing arrangement for which one has been carried out need not repeat it.

No PSP will be allowed to draw conclusions or take decisions affecting a customer relationship, such as ending it or refusing future onboarding, solely on shared information it has not assessed. The recitals indicate that an anti-money laundering or Digital Operational Resilience Act (DORA) information-sharing partnership that allows the necessary exchange should be considered sufficient.

The PSR names no scheme. The European Payments Council (EPC) has put one to consultation: the draft rulebook for the Fraud Information Distribution Arrangement (FRIDA), EPC108-26 v0.1. Under the draft, a PSP that suspects fraud can share a fraud alert on the account, other participating PSPs use it in their own monitoring, and the PSP holding the reported account can add its own evaluation. The alert is not a stop list and may not be the sole basis for customer-facing decisions. The draft would make adherence mandatory for PSPs in the European Economic Area that take part in one or more Single Euro Payments Area (SEPA) payment schemes, with opt-outs in specific cases, and optional for the others; the EPC states that parts of the draft, including the participation model, are still under review. On that basis, an institution that reaches those schemes through a bank might not be bound by FRIDA directly, but once the PSR applies it would still have to join an arrangement.

Online platforms, telecoms and fraudulent ads

Where a payment fraud starts with fraudulent content online, such as a fake advertisement, the PSP will have to inform the hosting provider without undue delay, using the notice procedure of the Digital Services Act (DSA) or, where it is a trusted flagger, that route.

Under the DSA, a notice that lets a diligent host identify the illegality without a detailed legal examination gives the host actual knowledge, and a host that does not then act expeditiously loses its liability exemption. In that case, where the illegal content gave rise to unauthorised payments or to PSP impersonation fraud, the host will have to compensate the PSP, for payments where both PSPs are in the EU, for the losses incurred or sums paid under the PSR’s refund rules for unauthorised payments and PSP impersonation, covered in the second article. A record of what was reported, and when, should therefore be kept with the refund file.

Very large online platforms and search engines, and telephone and messaging providers, will also have duties of their own: cooperating with PSPs, warning users about new scams and, for telecoms providers, measures against spoofed caller IDs and email addresses. The platforms and search engines will also have to refuse advertisements for regulated financial services from advertisers that have not provided an authorisation or registration number, or other information attesting that they, or the provider they act for, are authorised or registered, and make best efforts to check that information.

How PSPs should prepare, and when

Joining a data-sharing arrangement is the visible part. Most of the work sits in internal processes: monitoring before execution and before release, hold-and-return rules that, for instant payments, fit within ten seconds, and the handling of fraud alerts sent and received; evidence of monitoring that can be given to the payer and the other PSP; claims against other PSPs and hosts; and a record of the notices sent to hosts.

Comments on the draft FRIDA rulebook close on 9 December 2026. That date carries no legal obligation, but it gives institutions a chance to test the draft rules against their own monitoring. Most PSR provisions would apply around the end of 2028.

Ten seconds leaves no time to design a decision when the payment arrives. In our view, institutions should start now with the hold-and-return decision and the evidence each side will keep. The second article in this pair covers scope, payment accounts, refunds, authentication and access to accounts.

We will soon publish a PSR readiness checklist: subscribe to our newsletter to receive it when it is ready or get in touch to discuss what the PSR means for your institution.

Discover our solution

Share article on social media