EU Open Banking Regulations: What Changes in 2026

The most boring three words in your inbox, “new EU regulation,” happen to be deciding something concrete right now: whether a shopper can pay you straight from their banking app for a flat fee, or keep handing roughly 2.8% to a card network. Three reforms are moving at once. Here’s what each one actually does, and which ones deserve your attention this year.

The rule that already rewired the plumbing

The Instant Payments Regulation is the one that already bit. It came into force in April 2024 and arrived in phases. Since January 2025 every euro-area bank has had to be able to receive instant euro transfers. Since October 2025 they’ve had to send them too, around the clock, landing in about ten seconds, with the old €100,000 cap gone.

The part that matters if you take payments hides inside a dull phrase: equality of charges. A bank cannot charge more for an instant transfer than for a regular one. That single line is why account-to-account payments can undercut cards at all. The rails are now fast, always on, and priced at the floor.

Riding alongside it is a fraud check called Verification of Payee. Before the money moves, the payer’s bank matches the payee name against the IBAN and flags a mismatch, live across the euro area since October 2025. Fewer “I paid the wrong account” disasters, which is exactly the trust bank payments were missing. Non-euro countries run on a slower clock, receiving by January 2027 and sending by July 2027.

PSD3 and the PSR: open banking finally gets teeth

PSD2 invented European open banking back in 2015 and then let it limp. Bank APIs were patchy and slow, full of little frictions that conveniently steered people back to cards. PSD3 and its sibling, the Payment Services Regulation, go after that enforcement gap.

The split is the clever bit. PSD3 is a directive covering who gets licensed and supervised. The PSR is a regulation, so it applies directly in every member state with no local reinterpretation. No more twenty-seven dialects of one rule.

For open banking specifically, the package forces banks to offer dedicated interfaces that perform as well as their own apps, bans a named list of “obstacles,” and hands customers permission dashboards to see and switch off who’s touching their data. It also normalises reimbursement for authorised push payment fraud and pins liability when a name and IBAN mismatch goes unflagged.

On timing: Parliament and Council struck a political deal in November 2025, and the final texts were published in April 2026. Publication in the Official Journal is expected around mid-2026, with the rules generally applying about 21 months after that, so the real deadline lands across 2027 into 2028. In fintech that translates to: start now.

FIDA: from open banking to open finance

FIDA, the Framework for Financial Data Access, is the ambitious one. It stretches the open banking idea past payment accounts into savings, credit, investments, pensions and insurance.

It nearly died. A leaked draft of the Commission’s 2025 work programme had it queued for withdrawal. The industry made a lot of noise, it clung on as “pending,” and it was written back into the 2026 work programme. Trilogue talks have run since spring 2025, with adoption pencilled in for 2026 and a phased rollout to follow.

For a payments business, FIDA is a horizon, not a deadline. Watch it. Don’t lose sleep over it.

So what does this mean if you take payments?

Strip the acronyms away and it all points one direction: the bank rails are becoming a real checkout option, deliberately, by law. Instant settlement is mandated and can’t be surcharged. The data connections are about to be reliable instead of best-effort. Fraud checks come built in. That’s the entire foundation pay-by-bank was waiting for, and it showed up without anyone needing a card scheme’s blessing.

Put a number on it. Run €2m of volume on a €40 basket, and card fees near 2.8% cost you about €56,000 a year. The same sales on a flat 1% plus €0.25 work out around €32,500. That’s over €23,000 you keep, for doing nothing differently except changing how the money arrives. Rough illustration, your mix will vary, but the shape holds.

This is the ground Zahlo is built on, in Germany and the UK, today. Not a clever workaround. Just what the rails now allow.

If you’re still filing 2.8% under “fixed cost of doing business,” that label has an expiry date. The rules are written, the rails are live, and the maths is sitting there waiting. Worth running yours before your competitors run theirs.