Industry News
PSD3 and Payment Passkeys: What Actually Changes for Virtual Card Authentication in 2026
The EU's PSD3 regulation is arriving alongside Visa and Mastercard Payment Passkey services that replace SMS OTPs. Here is what virtual card users actually n…
Legislative-status update: September 2026
PSD3 and the PSR are not laws that took effect in 2025. Political agreement and compromise texts made public in 2026 do not equal publication and application in the Official Journal. For now, operations remain governed by PSD2, applicable local law and current issuer/acquirer policies.
What this means for virtual-card users
Passkeys, 3DS, tokenisation and payment authentication are technology and commercial deployments, not uniform PSD3 features already mandated everywhere. Support depends on the issuer, wallet, geography and merchant. Do not treat projected PSD3 dates as a current obligation or a payment-success guarantee.
Verdict
This remains policy commentary. Claims that PSD3/PSR passed or took effect in 2025, created uniform EU licensing, already tightened SCA exemptions, set fixed capital levels, or directly caused issuer declines through VAMP have been withdrawn. Confirm final dates and standards after Official Journal publication.