PSD2 Compliance
Meeting the EU's Second Payment Services Directive requirements for open banking, strong customer authentication, and secure handling of payment account data — obligations that extend directly to any AI tool a bank, fintech, or payment provider uses to process that data.
What Is PSD2 Compliance?
PSD2 Compliance refers to meeting the requirements of the EU's Second Payment Services Directive (Directive (EU) 2015/2366), the current core legal framework governing retail payments, open banking, and payment account data across the European Union. Adopted in 2015 and applicable since 2018, PSD2's central goals were improving payment security and fostering competition and innovation through open banking — requiring banks to give authorized third-party providers access to customer account data and payment initiation, subject to strict security requirements like Strong Customer Authentication (SCA).
For an organization handling payment account data, PSD2 compliance means meeting requirements across authentication, data access, fraud prevention, and liability — and, critically for AI use, whatever safeguards apply to how account and transaction data is handled once accessed. If an AI tool is used to process, summarize, or analyze payment account data obtained under PSD2's open banking provisions, the same underlying data protection expectations extend to that AI tool's handling of the data, not just to the bank or fintech's own systems.
Practical Industrial Use
A fintech using an AI tool to analyze customer transaction data obtained through PSD2's open banking access is a clear example of where PSD2 compliance intersects directly with AI use. If the AI tool is used to categorize spending, detect anomalies, or generate financial insights from account data the fintech accessed under PSD2, the fintech remains responsible for ensuring that data is protected appropriately throughout that process — including when it's sent to an external AI vendor for analysis.
The same considerations apply broadly across payment-adjacent AI use: a bank using AI to review Strong Customer Authentication logs for fraud patterns without exposing full account and transaction details to the model performing the review, a payment initiation service using AI to summarize transaction disputes drawn from open banking data, or a budgeting app using AI to generate personalized financial advice from account data accessed under a PSD2-authorized connection. In each case, PSD2 compliance shapes not just how the data was accessed in the first place, but what obligations follow it into any AI tool used downstream.
What Happens Without It
Organizations that send PSD2-regulated payment account data to an AI vendor without addressing the security and data protection expectations that come with it are extending PSD2 compliance risk into a part of their pipeline that may not have been built with those obligations in mind. Since PSD2 compliance is enforced by national authorities across member states, gaps can result in regulatory penalties, licence-related consequences, and mandatory consumer compensation, separate from any broader data protection law that might also apply to the same data.
⚠ Risk Without PSD2 Compliance This becomes a particularly relevant risk given that the regulatory landscape itself is currently in transition: the EU's PSD3 and Payment Services Regulation (PSR) package — intended to replace PSD2 and the Second Electronic Money Directive with a more harmonized, directly applicable rulebook — reached political agreement in late 2025, with final compromise texts published in April 2026 and formal adoption expected to follow shortly after. Organizations building AI-integrated payment data pipelines around PSD2's current requirements need to track this transition, since obligations that apply today may shift as PSD3 and the PSR come into force.
With PSD2 Compliance Addressed in AI Use
- Payment account and transaction data accessed under PSD2's open banking provisions is protected consistently, including when processed by an external AI tool
- Sensitive account identifiers can be masked before reaching an AI vendor, reducing exposure while still allowing useful analysis of transaction patterns
- Organizations reduce regulatory risk tied to how payment data is handled throughout its full processing pipeline, not just at the point of initial access
- Compliance practices can be adapted as the regulatory framework shifts from PSD2 toward the incoming PSD3 and PSR regime
Without It
- Payment account data reaches an AI vendor without the same protections that applied to how it was originally accessed under PSD2
- Regulatory penalties, licence consequences, and mandatory compensation obligations can follow gaps in how payment data is protected downstream
- Organizations risk being caught unprepared as PSD3 and the PSR introduce new, directly applicable requirements replacing PSD2
- Sensitive account and transaction details can be exposed to an AI vendor in a form dependent entirely on the vendor's own data handling
How This Relates to Questa AI
Questa AI applies its entity-detection engine to payment account and transaction data, masking account numbers, routing details, and other identifiers before that data reaches an external AI vendor for analysis, summarization, or review. This helps banks, fintechs, and payment service providers extend the same data protection expectations that apply to PSD2-regulated data access into whatever AI tools they use downstream, rather than treating AI processing as separate from their broader PSD2 compliance obligations.
This approach is closely related to Questa's support for local and self-hosted deployment, since payment institutions can keep both the anonymization process and the underlying account data within infrastructure they directly control. Questa's Blackbox recording and governance dashboard also give organizations documented evidence of what payment data was protected and when — evidence that becomes especially valuable as the regulatory landscape shifts from PSD2 toward the incoming PSD3 and PSR framework, since organizations will need to demonstrate consistent data protection practices across that transition.
Frequently asked questions
PSD2 (Directive (EU) 2015/2366), applicable since 2018, is the EU's current core framework for retail payments, requiring banks to provide authorized third parties access to account data and payment initiation, subject to security requirements including Strong Customer Authentication.
PSD2 remains the current legal framework, but it is being replaced: the EU's PSD3 and Payment Services Regulation (PSR) package reached political agreement in late 2025, with final compromise texts published in April 2026 and formal adoption expected to follow.
Because PSD2 governs how payment account and transaction data is accessed and protected, and those obligations extend to any downstream processing of that data — including analysis or summarization performed by an external AI tool.
The PSR is expected to introduce a directly applicable rulebook replacing much of what PSD2 currently covers, while PSD3 as a directive will continue to govern licensing and supervision — organizations should expect their specific compliance obligations to shift as this transition takes effect.
No. Masking reduces exposure for the specific data protected, but PSD2 compliance also involves broader obligations around authentication, licensing, fraud liability, and consumer protection that extend beyond data handling alone.
Largely similar in substance, since PSD2 sets common requirements, but as a directive it required transposition into each member state's national law, which has historically produced some variation in specific implementation — one of the issues the incoming PSR is specifically designed to address by using a directly applicable regulation instead.
Related terms
Payment Records
Transaction data — card numbers, bank account details, billing information, and purchase history — that is both commercially sensitive and subject to specific industry security standards, making it a distinct category of data to protect before it reaches an external AI model.
Local Redaction
Removing or masking sensitive data on the device or within the organization's own environment before anything is ever transmitted to an external AI model — protection that happens before the data leaves, rather than trusting a third party to handle it responsibly once it arrives.
Masking
Replacing a sensitive value with a stand-in — a placeholder, a token, or a structurally similar substitute — so the surrounding content stays usable while the original identifier itself is withheld from whatever system or model receives it.
Third-Party Data Exposure
The risk that sensitive or regulated data is disclosed to, or accessed by, an external vendor, partner, or AI provider beyond what the originating organization intended or authorized — often as a byproduct of routine data sharing rather than a security breach.
Cyber-Sensitive Data
The category of information that isn't sensitive because it identifies a person or a business secret, but because it maps out how to break in — credentials, network architecture, vulnerability details, and security configurations that turn an AI tool's normal output into an attacker's shortcut if handled carelessly.
See PSD2 Compliance in practice
Questa AI anonymizes sensitive data before it reaches any AI model — across documents and live prompts, with governance and data-residency control.