PSD2 applies to a Lithuanian business in one of two ways. If you provide payment services, you need authorization from the Bank of Lithuania and must meet security, safeguarding and customer-protection rules. If you only accept or send payments, you are not licensed, but you depend on strong customer authentication (SCA), transparent pricing and secure account access that your payment provider must deliver. This guide separates the two cases so you can see which duties are yours.

DemivoltSupport for Cross-Border PaymentsDemivolt provides business banking and payment solutions, including SEPA and SWIFT payments, for companies operating across borders.Visit Demivolt

TL;DR

PSD2 is Directive (EU) 2015/2366. It governs payment service providers, their licensing, security and the rights of payment users across the EU.
Most merchants and SMEs are payment service users, not regulated providers. Your main touchpoints are SCA on online card payments, fee transparency and open banking access.
If you provide payment services, even through agents or white-label models, the licensed institution stays responsible for compliance.
SCA needs two of three elements: knowledge, possession, inherence. Exemptions exist for low-value, contactless, recurring and low-risk payments.
PSD3 and a new Payment Services Regulation are on the way. Choose a provider that already works to EU-regulated standards.

What PSD2 is and what it changed
Who has to comply: providers versus users
Strong customer authentication in practice
Open banking duties
Duties of licensed institutions: agents, outsourcing and white labeling
A practical PSD2 checklist for an SME
What PSD3 and the Payment Services Regulation will change
How Demivolt supports PSD2-ready operations
FAQ
Sources

What PSD2 is and what it changed

PSD2 is the EU’s second Payment Services Directive, adopted in 2015. It sets rules for retail payments in the EU and aims to promote competition, improve consumer protection and security, and ease cross-border payment services. Its key features are licensing rules for payment institutions, rules for payment initiation and account information services, and security requirements for electronic payments.

The consolidated text of Directive 2015/2366 also covers transparency and information requirements, and the rights and obligations of both providers and users. The Central Bank of Ireland’s overview adds that the directive opened payment markets to new entrants and encouraged innovative mobile and internet payment services.

For a company, this produced three practical changes:

New provider types: payment initiation service providers (PISPs) and account information service providers (AISPs) can work with your bank account data and payments, with your consent.
Stronger authentication for electronic payments.
Clearer information on fees, execution and responsibilities.

Who has to comply: providers versus users

This is the question most Lithuanian businesses actually have. The answer depends on what you do with money that belongs to other people.

Businesses that provide payment services

If your business holds payment accounts for others, executes payments on their behalf, issues payment instruments, remits money, or runs payment initiation or account information services, PSD2 treats you as a payment service provider. In Lithuania this means an authorization from the Bank of Lithuania as a payment institution (PI) or electronic money institution (EMI), or operating as an agent of one.

The EU rules allow Member States to exempt certain small-scale providers from full licensing if monthly transaction volume stays within EUR 3 million and management meets strict integrity standards. Whether and how an exemption applies is decided nationally, so confirm it with the Bank of Lithuania before relying on it.

Fintechs, platforms and marketplaces should look hard at their payment flows. Collecting funds from buyers and passing them on to sellers is often where a business drifts into regulated territory. Take advice from a Lithuanian financial regulatory lawyer or ask the supervisor directly before launch.

Businesses that only use payment services

A webshop, a SaaS company or a consultancy that receives card and bank payments through a licensed provider is not itself licensed under PSD2. Your obligations are indirect but real:

Your checkout must support SCA on online card payments. The Bank of Lithuania told e-merchants and providers that SCA was to apply to online card payments from 1 January 2021, and that non-compliant transactions could be declined after the transition period.
You need to understand the fee and execution-time information your provider gives you, because PSD2 requires transparency about both.
If you connect to your accounts through accounting, treasury or payment apps, you should check that the third party is authorized as an AISP or PISP and that you control the consent.

Strong customer authentication in practice

Under the regulatory technical standards on SCA, authentication must use at least two independent elements from three categories:

Element	Meaning	Typical example
Knowledge	Something only the user knows	Password, PIN
Possession	Something only the user has	Phone, card, hardware token
Inherence	Something the user is	Fingerprint, face recognition

The elements must be independent, so a breach of one does not compromise the others. For an online merchant, the practical effect is that a card payment is usually confirmed in the cardholder’s banking app or with a one-time code. Checkouts that do not send the data needed to trigger this step risk declined payments.

Exemptions

The same standards allow SCA exemptions in defined cases, including contactless and low-value payments, recurring transactions, low-risk remote payments and limited online account access. Conditions differ for each. For example, a contactless payment at a point of sale may skip SCA if it does not exceed EUR 50 and the cumulative amount since the last SCA stays under EUR 150, or no more than five consecutive transactions have been made.

Exemptions are applied by the payer’s provider, not by the merchant alone. Treat them as a way to reduce friction that your provider may or may not grant, not as a right.

Fraud controls that sit next to SCA

SCA reduces fraud but does not remove it. The Commission’s evaluation found that PSD2 reduced fraud through SCA while leaving gaps elsewhere. If you take card payments, see our guides to card fraud prevention for businesses in Lithuania and card tokenization. Handling card data also brings its own scope questions, and this overview of PCI compliance for small business explains how hosted checkout keeps card data off your own systems.

Open banking duties

PSD2 requires account-servicing providers to maintain secure interfaces through which PISPs can initiate payments and AISPs can read account information, always with the user’s consent.

For a business customer, this means:

You can authorize an authorized third party to read your account data, for example for bookkeeping or cash-flow tools.
You can let a PISP initiate a payment from your account without a card.
You can withdraw consent, and a provider should show you which third parties have access.

If you want to build products on this access, read how to launch open banking integration in Lithuania without licensing delays.

Duties of licensed institutions: agents, outsourcing and white labeling

Many fintech and platform models rely on partners. The Bank of Lithuania’s best practice recommendations state that a PI or EMI may provide services through agents, but remains responsible for regulatory compliance. They also make clear that outsourcing must not turn a licensed institution into an empty shell: it has to keep an organizational structure and control over its activities.

If you plan to distribute a licensed provider’s products, your contract, your customer communication and your controls all need to fit that responsibility model.

Customer identification is another duty. For a payment initiation service provider, the Bank of Lithuania explains that customers must be identified when a business relationship is established, regardless of transaction size, or for one-off services when linked transactions total at least EUR 15,000, subject to other legal grounds.

Crypto businesses should note that, from 2 March 2026, CASPs providing services related to e-money tokens that qualify as payment services must hold a payment institution licence or outsource those services to licensed entities.

A practical PSD2 checklist for an SME

Map your payment flows. Write down who receives money, who holds it and who pays it out. If you only receive your own revenue, you are a user. If you hold or move third-party funds, you may be a provider.
Confirm your provider’s status. Check that your account or payment provider is authorized in the EU and see which supervisor oversees it.
Test SCA at checkout. Place test orders with 3-D Secure cards and confirm that declines are handled with a clear retry message.
Review fees and execution times. PSD2 transparency rules mean your provider should present them plainly. Compare them with your contract.
Audit third-party access. List every app that reads your account or initiates payments, and verify each is authorized.
Set user roles. Limit who can approve payments and issue cards, and use separate accounts for separate purposes.
Document your risk process. Our guide to payment risk management for businesses in Lithuania is a good starting point.

What PSD3 and the Payment Services Regulation will change

The Commission proposed a reform package in June 2023. Its aims are to strengthen anti-fraud measures, improve open banking, facilitate non-bank PSP access to payment systems and merge the e-money and payment services frameworks. On 27 November 2025, the European Parliament and Council reached provisional political agreement on PSD3 and the Payment Services Regulation (PSR).

The Commission’s own evaluation also noted that open banking uptake under PSD2 was mixed and that the playing field remained uneven. The new package targets both. Check the Bank of Lithuania and EUR-Lex for the final texts and application dates before you plan a compliance project.

Our perspective

We see the same pattern in cross-border SMEs, e-commerce companies and fintech startups: PSD2 becomes a problem when a company cannot say who holds its money and who is responsible for each payment step. That is why we build Demivolt as regulated, EU-compliant infrastructure, with dedicated IBAN accounts, segregated client funds and risk-based onboarding that is fast, secure and transparent.

Our approach is to make the compliance structure visible. Multi-account setups and role-based user management let finance teams separate operating funds, client funds and card budgets, and control who can approve what. Published fees give a CFO the numbers to plan cash flow without surprises.

For advisors and partners, we offer a reseller programme and white-label models. We design them so that regulatory responsibility is clear from the first conversation, because PSD2 rewards clarity about roles.

dd

How Demivolt supports PSD2-ready operations

If your business needs a regulated account to receive and send payments, we can help. Demivolt offers business accounts with dedicated IBANs, payment processing for SEPA and SWIFT, and card programmes with virtual and physical Visa business cards. Our compliance services support onboarding and ongoing requirements for international operations.

Published fees are straightforward: account opening, account verification, a Dedicated Client Manager, monthly maintenance, account closure and internal transfers between Demivolt accounts are all €0. Payment fees are as follows.

Payment type	Fee
SEPA In	€0
SEPA Out	€0.40 per transfer
SWIFT In	€25.00
SWIFT Out	€30.00

You can estimate outgoing transfers with the SEPA fee calculator. Advisors who refer clients can learn about our reseller programme. To open an account, get started with Demivolt or contact us.

FAQ

Does PSD2 apply to my online shop?

PSD2 does not license a shop that only accepts payments through a regulated provider. It does affect you indirectly, because online card payments need strong customer authentication and your provider must give you transparent fee information. Make sure your checkout supports the SCA flow.

Do I need a licence to accept payments for other businesses?

Possibly. Holding or transferring other people’s funds, or running a marketplace payment flow, can count as a payment service that needs PI or EMI authorization or agent status. Ask the Bank of Lithuania or a regulatory lawyer to assess your specific model before launching.

Which transactions can skip strong customer authentication?

The EU technical standards allow exemptions for contactless and low-value payments, recurring transactions, low-risk remote payments and limited online account access. Each has its own conditions, and your payer’s provider decides whether to apply it.

Is PSD2 being replaced?

The EU reached provisional political agreement on PSD3 and the Payment Services Regulation on 27 November 2025. PSD2 continues to apply until the new rules become applicable, so follow official publications for the final dates.

PSD2 Requirements for Businesses in Lithuania