If you take card payments, two main sets of rules shape how you do it. PCI DSS covers how card data is stored and handled, and PSD2 outlines how payments are authenticated.
This guide covers what PCI DSS, PSD2 and the upcoming PSD3 rules require, why travel draws more security scrutiny and what strong payment security looks like in a payments provider. Make sure to read part two, where we explore AML and KYC regulations and how to find a compliant merchant account provider.
Key Takeaways
- PCI DSS protects card data at every point it's stored, processed or moved, and applies to any business that takes card payments.
- PSD2 requires Strong Customer Authentication (SCA) on most online payments, usually applied through 3D Secure 2.
- PSD3 and the PSR have been agreed in the EU and are expected to apply from mid-to-late 2028.
- The most effective way to stay compliant is to work with a PCI DSS Level 1 certified travel merchant account provider that applies authentication by risk and keeps up to date with regulatory changes.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) protects cardholder data as it is stored, processed and moved between parties. The standard was developed to improve payment card account data security and encourage the adoption of consistent data security measures across the globe.
What are the PCI DSS Requirements?
PCI DSS is built around six goals, which are broken down into 12 individual requirements:
Build and Maintain a Secure Network
- Install and maintain network security controls.
- Apply secure configurations to all system components.
Protect Cardholder Data
- Protect stored account data.
- Protect cardholder data with strong cryptography during transmission over open, public networks.
Maintain a Vulnerability Management Program
- Protect all systems and networks from malicious software.
- Develop and maintain secure systems and applications.
Implement Strong Access Control Measures
- Restrict access to system components and cardholder data by business need to know.
- Identify users and authenticate access to system components.
- Restrict physical access to cardholder data.
Regularly Monitor and Test Networks
- Log and monitor all access to system components and cardholder data.
- Test security of systems and networks regularly.
Maintain an Information Security Policy
- Support information security with organisational policies and programmes.
What are the PCI DSS Compliance Levels?
Level 1
Merchant levels are set by the card schemes (such as Visa and Mastercard) and are based on how many card transactions you process each year. Level 1 merchants are those that process over 6 million card transactions annually. Merchants in this category must put together an annual Report on Compliance (ROC) through a Qualified Security Assessor (QSA), run quarterly network scans by an Approved Scanning Vendor (ASV) and fill in the Attestation of Compliance Form.
Level 2
Level 2 merchants are those that process 1 to 6 million card transactions annually. Merchants in this category must complete an Annual Self-Assessment Questionnaire (SAQ), run quarterly network scans by an ASV and fill in the Attestation of Compliance Form.
Level 3
Level 3 merchants are those that process 20,000 to 1 million card transactions annually only via eCommerce processing. Merchants in this category must fill in an Annual SAQ, run a network scan by an ASV quarterly and complete the Attestation of Compliance Form.
Level 4
Level 4 merchants are those that process fewer than 20,000 e-commerce transactions or up to 1 million total card transactions annually. Merchants in this category must fill in an Annual SAQ, run quarterly ASV network scans where their acquirer requires them and fill in the Attestation of Compliance Form.
What is PSD2?
The revised Payment Services Directive (PSD2) is a European Union regulatory framework that increases online payment security. In the UK, PSD2 was implemented through the Payment Services Regulations 2017, and its SCA rules still apply under the FCA. The directive, which was adopted in 2015 and applied from January 2018, is an updated version of the Payment Services Directive (PSD).
What are the objectives of PSD2?
The main goal of PSD2 is to shake up the payments market, making it both more secure and more competitive. Here's what the updated EU standard set out to do:
Strengthen Security
PSD2 lays out stricter requirements for online payments, including Strong Customer Authentication (SCA), which reduces instances of fraud and protects customers' sensitive financial data.
More Competition
PSD2 lets third parties such as fintechs access customer data (with the customer's consent), so they can build new services and compete with established banks.
Offer Better Consumer Protection
PSD2 gives customers more control over their financial data and sets clearer rules for handling complaints.
A Single European Payments Market
By standardizing payment rules across the EU, PSD2 makes it easier for businesses and customers to make and receive cross-border payments.
How Did PSD2 Change European Payments?
MPSD2 has fundamentally changed how payment services work in the EU. Here are the directive’s main components:
Strong Customer Authentication (SCA)
SCA requires most online payments to be verified with two of three factors:
- Something the customer knows (e.g., password or PIN)
- Something the customer has (e.g., phone)
- Something unique to the customer (e.g., fingerprint or face scan)
Because these three factors are independent of each other, a fraudster who gets hold of one of them can't complete the payment. The goal is to reduce fraud on card-not-present transactions, which accounted for £423.5 million in losses in 2025, a 3% rise on the year before.
Open Banking
Before PSD2, a customer's banking data stayed with their bank, and only the bank could initiate payments or see the data related to the account. PSD2 changed that by requiring banks to give regulated third parties access to elements of customers’ accounts, but only with customer consent.
This access is made possible through APIs, which are connections that let a bank's security system and a third party's system exchange information securely. Open banking lets customers use services other than their bank to manage their money, pay bills and move funds, all drawing on their own bank data.
When is SCA Not Required?
Some payments can be exempted from SCA, and some fall outside its scope entirely. Exemptions aren't guaranteed, because the customer's bank (the card issuer) always has the final say:
- Low-risk transactions identified through transaction risk analysis (TRA), up to a maximum of €500 depending on the provider's fraud rate
- Payments below €30 (until the customer reaches €100 or five payments in a row, when SCA is needed again)
- Recurring payments of a fixed amount to the same merchant (after the first payment, which needs SCA)
- Merchant-initiated transactions (out of scope rather than exempt)
- Mail and telephone orders, known as MOTO (out of scope rather than exempt)
- Payments to trusted beneficiaries the customer has whitelisted with their bank
- Corporate payments with equivalent security levels
How to Stay PSD2 Compliant
Authenticate Payments with 3D Secure 2
The main PSD2 obligation for merchants like you is applying Strong Customer Authentication to online card payments. In practice, this is handled by 3D Secure 2 (3DS2), the protocol that passes transaction data to the customer's bank so it can verify them. If your checkout runs card payments through a gateway that supports 3DS2, the authentication step is built in already.
Apply Exemptions Where Appropriate (Rather than Authenticating Everything)
PSD2 compliance doesn't mean forcing every customer through an additional authentication step. PSD2's exemptions are there so low risk payments can go through without one, and using these exemptions appropriately is what keeps your checkout process smooth and fraud low.
For a travel business like yours, where bookings are usually high-value, the low-value exemption rarely applies. Transaction risk analysis (TRA) can exempt some bookings, but only up to €500 and only for providers with very low fraud rates, so most holiday bookings will still need SCA. That makes a smooth 3DS2 flow just as important as exemptions. Working with a travel payments provider that applies TRA where it can and keeps authentication frictionless will help you keep checkout abandonment low.
Choose a Travel Payment Provider that Manages Compliance for You
Many of PSD2's technical requirements fall on the payment provider, so the most effective step is working with one that is built to meet them. A compliant provider (like Repayd) offers 3DS2, applies exemptions based on real transaction risk and keeps their finger on the pulse of regulatory changes.
On the Horizon: PSD3 and the PSR
In April 2026, the Council of the European Union published the final agreed texts of the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR). They still need to be formally adopted and published in the Official Journal, and most of the rules are expected to apply from around 2028.
For bank transfers (credit transfers), payment service providers (PSPs) will need to check that the payee's name matches their account identifier, such as an IBAN, and warn the payer about any mismatch. Customers will also get a right to a refund when a fraudster impersonates their PSP to trick them into making a payment, subject to certain conditions.
PSD3 and the PSR also introduce stricter rules for API performance and uptime, and national regulators will be expected to act quickly against interfaces which don't meet the required standards.
The core conduct rules are also moving into the PSR. This means they will apply the same way in every Member State rather than being interpreted and implemented differently from one country to the next. As EU legislation, PSD3 and the PSR won’t apply directly in the UK, which has its own Confirmation of Payee and APP fraud reimbursement rules.
What to Look for in a Compliant Travel Payments Provider
PCI DSS Level 1 Certification
For payment providers, Level 1 is the highest PCI DSS tier (for service providers handling more than 300,000 card transactions a year) and requires an annual independent assessment by a Qualified Security Assessor. Ask for proof of current certification rather than taking general claims of being "PCI-compliant" at face value.
Risk-Based Authentication, Not Blanket Rules
Every compliant provider will meet SCA, but the way they apply it affects your conversion rates. Look for support for 3DS2, along with appropriate exemptions using TRA that let low-risk payments through without an extra authentication step.
Fraud Tools Built for Travel Businesses
Generic fraud tools treat normal travel business activity, such as high-value, last-minute or cross-border bookings, as suspicious. A provider that specialises in travel uses fraud tools built around how travel payments actually work, letting more genuine bookings through while catching the fraudulent ones.
This guide covered payment security at the transaction level. In part two, we explore the other side of compliance: AML, KYC and how to choose a travel-specific merchant provider that’ll help you manage payment compliance.
With the right payment partner, compliance is one less thing to manage. Get in touch with the Repayd team to find out how we take the payment security burden off your plate.
