PSD3 for German CFOs: What to Decide in 2026 Before 2028 Forces Your Hand

Definition

PSD3 (Payment Services Directive 3) and the companion PSR (Payment Services Regulation) update EU payment services law. For German CFOs, the practical impact spans open banking API access, payment initiation (PIS), account information (AIS), fraud liability, and licensing requirements for fintech partners. Transposition into German law via BaFin is expected by 2027–2028.

Why CFOs Must Decide in 2026

PSD3 is not a future problem: it is a planning problem. The companies that wait for final BaFin circulars will scramble in 2028. The companies that decide architecture, vendor relationships, and internal controls in 2026 will treat PSD3 as an upgrade, not a migration.

Three decisions cannot be deferred:

1. Bank connectivity model: Direct bank APIs vs aggregator (finAPI, Tink, Klarna Kosma)
2. Payment initiation scope: Will you initiate supplier payments via API, or remain on EBICS/file upload?
3. Fraud and authorization framework: Who approves payments, with what verification, at what threshold?

What Changes from PSD2

PSD3 does not replace open banking: it matures it. Banks must improve API reliability. TPPs face stricter operational resilience requirements. Your integration architecture should assume higher uptime SLAs and standardized error codes.

Decision 1: Open Banking Provider Strategy

German CFOs typically choose between three models:

Direct Bank Integration

Connect individually to Deutsche Bank, Commerzbank, Sparkasse via EBICS or bank-specific APIs. Maximum control, maximum maintenance.

Choose if: You bank with 1–2 institutions, have internal engineering capacity, and payment volume exceeds €500M annually.

Aggregator (Recommended for Mittelstand)

Single API to finAPI, Tink, or Klarna Kosma covering 3,000+ EU banks.

Choose if: You have 3+ bank relationships, need consolidated cash visibility, and lack dedicated payment engineering team.

// Example: finAPI account aggregation
const response = await fetch('https://live.finapi.io/api/v2/accounts', {
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  }
});
const accounts = await response.json();
const totalCash = accounts.reduce((sum, a) => sum + a.balance, 0);

Hybrid

Aggregators for AIS (read access), direct EBICS for high-value PIS (write access).

Choose if: You need real-time treasury visibility but want direct bank rails for payments above €50,000.

Decision 2: Payment Initiation Scope

PSD3 will make PIS more reliable. Decide now what you will initiate via API:

Build approval workflows before connecting PIS:

def approve_payment(payment_request, approvers):
    if payment_request.amount > 50000:
        required = ['cfo', 'ceo']
    elif payment_request.amount > 10000:
        required = ['finance_manager']
    else:
        required = ['ap_clerk']

    for role in required:
        if role not in approvers:
            raise ApprovalError(f'Missing {role} approval for €{payment_request.amount}')
    return initiate_pis(payment_request)

Decision 3: Fraud and Verification Framework

PSD3 strengthens IBAN/name verification requirements. Implement before regulators mandate:

1. IBAN validation: Checksum + bank identification
2. Name matching: Compare payee name against account holder (VOP: Verification of Payee)
3. Beneficiary whitelist: New IBANs require dual approval
4. Anomaly detection: Flag payments deviating from historical patterns

async function verifyPayee(iban, name) {
  const result = await openBankingClient.verifyPayee({ iban, name });
  if (result.matchCode === 'NO_MATCH') {
    await queueManualReview({ iban, name, matchCode: result.matchCode });
    return false;
  }
  return true;
}

German banks are rolling out VOP throughout 2026. Your payment system must handle CLOSE_MATCH, NO_MATCH, and NOT_POSSIBLE responses without blocking legitimate payments or allowing fraud.

Vendor Evaluation Criteria

When selecting open banking partners, score against PSD3 readiness:

Request SOC 2 Type II reports and BaFin registration numbers. Verify the provider's PSD3 migration roadmap in writing.

Internal Controls Checklist

Before 2028, establish:

• Payment policy document with approval matrix
• Segregation of duties: initiator ≠ approver ≠ reconciler
• Daily bank reconciliation via AIS (automated)
• Monthly access review for open banking tokens
• Incident response plan for unauthorized payment initiation
• Vendor due diligence file for each TPP/fintech partner

Budget Planning

Typical investment for Mittelstand (€20M–€200M revenue):

Compare against cost of manual treasury operations (typically 1.5–2.5 FTE for multi-bank Mittelstand).

Timeline

Business Outcomes

CFOs who decide in 2026 gain real-time cash visibility across all bank accounts, reduce payment fraud exposure, cut manual EBICS file handling by 70%, and enter the PSD3 transition with working infrastructure instead of emergency RFPs.

Related: Open Banking in Germany 2026 · PSD3 Explained