Author Details

Franklin Cachia

Abstract

This article examines whether the European Union’s post-PSD2 regulatory architecture is capable of supporting scalable embedded finance. It argues that PSD2 established the legal basis for embedded payments through third-party access to payment accounts, but did not create the conditions for frictionless, legally certain and operationally resilient platform-based finance. The article analyses the PSD3/PSR compromise texts published in April 2026 alongside Regulation (EU) 2024/886 on instant payments, DORA, and the proposed Financial Data Access Regulation (FiDA). It advances two claims. First, the EU is moving from an access-based open banking model to a broader regime of governed interoperability in which liability allocation, fraud prevention, consent architecture and third-party risk management are as important as connectivity itself. Secondly, that transition may strengthen trust and supervisory coherence while simultaneously increasing user-friction and compliance costs in embedded-finance journeys. The article therefore proposes a proportionate supervisory framework for Malta and the wider EU based on functional distribution, interface control, and operational dependency. In doing so, it seeks to bridge the gap between the legal design of open finance and the practical realities of platform-based financial intermediation.

Information

Type	Embedded Finance; PSD3; PSR; Open Banking; Open Finance; Governed Interoperability; DORA; Financial Data Access – the work of Franklin Cachia
Information	Journal of Financial Supervisors Academy, Volume 2, November 2026, pp. 145–158
Creative Commons	This is an open access article under the CC BY license. Journal of Financial Supervisors Academy © 2026. Licensed under CC BY 4.0.
Copyright	© The Author, 2026. Published by Journal of Financial Supervisors Academy

Introduction

The Second Payment Services Directive (PSD2)¹ fundamentally reshaped the European payments landscape by mandating that banks grant regulated third parties access to customer payment accounts via secure application programming interfaces (APIs), subject to user consent. This “access-to-account” (XS2A) regime, operationalised through the introduction of Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs), created the legal foundation for open banking and, by extension, embedded finance, that is to say, the integration of financial functions directly into non-financial digital environments.

However, PSD2 should not be understood in isolation. As Arner, Buckley and Zetzsche argue, Europe’s transition from open banking to open finance has been driven not by a single legislative act, but by the interaction of multiple regulatory pillars, including PSD2, GDPR, digital regulatory reporting and digital identity. Embedded finance is therefore best understood not simply as a payments-law development, but as part of a broader EU architecture of data-driven finance in which access rights, data governance, identity infrastructure and competition concerns interact.² By codifying third-party rights to initiate payments and aggregate account data, PSD2 dismantled the exclusive control banks had over customer interfaces, allowing fintechs and platform companies to embed financial services into everyday consumer journeys such as in-app payments, e-commerce checkouts, and balance-aware offers.³

However, the directive’s practical implementation revealed several constraints that limited embedded-finance scale and uniformity across the EU. First, the absence of a harmonised API standard led to inconsistent API quality and reliability, with variable performance, authentication flows, and downtime across institutions and Member States.⁴ Second, Strong Customer Authentication (SCA) rules, though enhancing security, introduced user-experience friction—particularly in recurring or low-risk embedded-payment contexts where repeated authentication interrupts seamless platform journeys.⁵ Third, PSD2’s scope remained narrowly confined to “payment accounts”, excluding savings, credit, insurance, and investment data needed for richer embedded-finance use cases.⁶ Finally, liability allocation among ASPSPs, AISPs, PISPs, and host platforms was often ambiguous, creating uncertainty that discouraged wider commercial participation.⁷

Consequently, while PSD2 successfully “opened the doors” to embedded finance by legalising third-party API access, its structural and operational limitations constrained the depth and scale of embedded-finance adoption, paving the way for the PSD3/PSR reform package and the forthcoming Financial Data Access Regulation (FiDA), which together aim to resolve these legacy frictions. The EU is moving from an “access mandate” model under PSD2 to a “governed interoperability” model under PSD3/PSR, the Instant Payments Regulation, DORA and FiDA; the real determinant of embedded-finance growth is no longer whether access exists, but whether liability, fraud controls, consent architecture and third-party governance are designed proportionately enough to preserve platform-level usability.

In this respect, the incoming PSD3⁸ and PSR⁹ package, together with the Instant Payments Regulation¹⁰ (VoP/“confirmation of payee”), DORA¹¹ and the forthcoming Financial Data Access Regulation (FiDA)¹², aims to tighten fraud defences, harmonise supervision, and widen data access beyond payments, potentially unlocking safer, more interoperable embedded journeys. The PSD3/PSR reform package should now be analysed by reference not merely to the Commission’s 2023 proposals, but to the final compromise texts published by the Council on 23 April 2026 following the political agreement reached in trilogue in November 2025.¹³ This matters because the legal and policy assessment of embedded finance must now be anchored in the settled architecture of the co-legislators’ compromise, rather than in earlier consultation-stage debates.

However, post-implementation assessments indicate that the effectiveness of PSD2 as an enabler of embedded finance has been constrained by practical and structural limitations. Most notably, the absence of a fully harmonised API framework has resulted in fragmented technical standards and inconsistent service quality across Member States, reducing the reliability required for seamless embedded-finance journeys. In addition, recurring authentication requirements, while justified from a security perspective, can interrupt user experiences that depend on low-friction interactions. The directive’s scope is also limited to payment-account data, restricting the development of more sophisticated embedded-finance propositions involving credit, savings, investments or insurance products. Together with divergent supervisory approaches and continuing uncertainty regarding liability allocation among participants in the open-banking ecosystem, these factors have limited the scalability of PSD2-enabled business models. The European Parliament has therefore recognised that, while PSD2 materially increased competition and innovation, significant barriers remain to the creation of a fully integrated open-finance environment. This recognition provides much of the policy rationale behind PSD3 and the FiDA, both of which seek to address these shortcomings through broader data access, improved harmonisation and clearer governance arrangements.

How Does PSD2 Enable Embedded Finance?

PSD2 is widely recognised as the foundational regulatory enabler of embedded finance in the EU. By introducing the regulated categories of AISPs and PISPs, PSD2 established, for the first time in Union law, a legal right of access to payment accounts by authorised third-party providers. Under Article 66, PISPs were granted the right, with the payer’s explicit consent, to initiate a payment order directly from a payment account held with another payment service provider (the account-servicing PSP or ASPSP). Complementarily, Article 67 created the category of AISPs, empowering them to access consolidated account information held by one or more ASPSPs, again only with the payment service user’s consent.

To facilitate these new services, PSD2 obliged account-servicing PSPs to ensure secure, non-discriminatory technical access to payment accounts, (XS2A) framework through dedicated interfaces defined under Articles 66(4), 67(3) and detailed in Commission Delegated Regulation (EU) 2018/389 (the Regulatory Technical Standards on Strong Customer Authentication and Secure Communication).¹⁴ Together, these provisions provided a stable regulatory foundation for open banking, reducing structural barriers to market entry by enabling non-bank entities to perform regulated payment-initiation and account-information services.

It follows that PSD2 transformed the EU payments landscape: services such as account-to-account checkout, in-app payment initiation, and data-driven financial recommendations became both technically feasible and legally authorised within non-bank digital platforms. By mandating secure interoperability between banks and licensed third parties, PSD2 effectively opened the pathway toward embedded-finance models, in which financial functionality is integrated directly into non-financial customer journeys. Having said that, PSD2 should not be viewed only as a legal access regime; it is better understood as a regulatory intervention in industry architecture, reallocating control over customer data and customer-interface ownership. Subsequent reforms under PSD3/PSR and FiDA therefore concern not merely technical performance, but the governance of a platformed financial ecosystem.¹⁵ The strategic significance of open banking lies not merely in third-party access to accounts, but in the way open APIs reduce transaction costs, facilitate modular service integration, and enable financial functions to be incorporated into broader digital platforms. The resulting transformation was therefore not simply one of increased competition, but of altered bargaining power across banks, fintechs and digital platforms.

From an economic-theory perspective, PSD2 supported the emergence of embedded finance as an extension of platform economics: digital platforms increasingly act as orchestrators of multi-sided ecosystems, and financial services become a complementary functionality that increases engagement, reduces transaction friction and strengthens the platform’s role as the primary consumer-interface layer. Embedded finance, therefore, represents a strategic shift in the locus of customer ownership-away from traditional financial institutions and toward platform operators.¹⁶

In addition, inconsistent supervisory practices and the reliance on fallback mechanisms in parts of the market limit service continuity and scalability, while unresolved liability allocation across ASPSPs, AISPs/PISPs and hosting platforms creates legal uncertainty—weakening commercial incentives for non-financial firms to embed regulated services. The European Parliament therefore observes that PSD2 has delivered significant technical and competitive transformation, yet its benefits remain uneven and constrained by persistent structural barriers.¹⁷

Accordingly, PSD2 is increasingly characterised as a necessary but insufficient precursor to the integrated open-finance ecosystem required for fully mature embedded finance. This view is consistent with broader scholarship treating PSD2 as one element of a wider EU transition toward data-driven finance.¹⁸

What Changes Ender PSD3/PSR (And Why It Matters to Embedded Finance)?

The European Commission’s PSD3 and Payment Services Regulation (PSR) constitute a targeted response to structural and operational limitations that constrained embedded-finance adoption under PSD2. Central to the reform is the transition from a directive to a regulation for primary payment-services rules, facilitating direct applicability and reducing national divergences that previously led to fragmented consumer protection, inconsistent interface standards, and dispersed supervisory practices. This greater legal uniformity is vital for embedded-finance providers, which depend on cross-border scalability and consistent technical conditions across Member States.

A key priority of the reforms is enhancing open-banking functionality and access to bank accounts. The PSR and PSD3 proposals introduce clearer obligations on banks to ensure stable API availability and prohibit “unjustified refusals” to provide payment accounts for licensed payment institutions, addressing widespread “de-risking” practices that hinder platform onboarding of embedded-service providers. Strengthening API performance, consent management and bank-nonbank connectivity directly benefits embedded-finance models that rely on continuous data access and seamless account-to-account initiation inside non-financial platforms.

The package also places major emphasis on fraud-mitigation and consumer-protection, reflecting rising concerns over impersonation, social-engineering and authorised push-payment (APP)-style scams in digital environments. The reforms introduce strengthened transaction-monitoring requirements, enhanced data-sharing obligations among payment-service providers (PSPs), and clearer reimbursement models for victims – currently being refined in trilogue negotiations. For embedded-finance journeys, this implies tighter pre-transaction risk checks and more explicit scam-education interventions within hosted user experiences. In parallel, Verification of Payee (VoP)¹⁹ obligations under Regulation (EU) 2024/886, payment service providers in euro-area Member States have been required since 9 October 2025 to offer a VoP service for both standard and instant euro credit transfers, while later implementation dates apply in non-euro-area Member States and to certain payment and e-money institutions. The significance for embedded-finance design is therefore no longer prospective: hosted payment journeys must now be capable of presenting and operationalising VoP outcomes as part of live payment execution logic.²⁰

Operational-resilience reforms further reinforce trust and safety in embedded finance. Since 17 January 2025, the Digital Operational Resilience Act (DORA)²¹ has applied across the EU financial sector, meaning that embedded-finance analysis can no longer treat ICT-risk governance as an emerging overlay. It is now part of the operative legal baseline against which platform-based financial distribution arrangements must be assessed.

Embedded-finance ecosystems frequently rely on multiple external technology providers, making DORA’s third-party risk controls and incident-management rules particularly consequential for platforms offering embedded financial services.

Collectively, these reforms represent a regulatory evolution from the foundational but incomplete open-banking architecture of PSD2 toward a more resilient, secure, and inclusive framework capable of supporting scalable embedded-finance ecosystems. PSD3 and the PSR aim to shift embedded finance from fragmented pilot deployment to a trusted, harmonised, and infrastructure-integrated component of EU digital markets. The April 2026 compromise texts make clear that the reform package is not simply a clean-up exercise. It represents a rebalancing of the payments framework around four priorities: stronger anti-fraud architecture, more coherent open-banking functionality, a more level relationship between banks and non-bank PSPs, and greater legal harmonisation through the use of a directly applicable regulation for core conduct rules. From an embedded-finance perspective, the package is therefore significant not because it “creates” platform-based finance, but because it redefines the legal conditions under which embedded customer journeys can remain scalable and trustworthy.

Beyond Payments Data: FiDA and Open Finance

Rather than constituting a discrete regulatory initiative, open finance can be understood as the next stage in the EU’s broader effort to facilitate the secure and consent-based sharing of financial data across sectors. FiDA is not conceptually a stand-alone innovation, but the latest legislative expression of a longer transition from payment-account access toward customer-controlled financial data mobility across sectors.

While the reforms under the PSR and PSD3 significantly strengthen the embedded-finance ecosystem within payments and account-data domains, the concept of open finance moves the frontier beyond payments data alone. The proposed Financial Data Access Regulation (FiDA)²² explicitly seeks to extend standardised, consent-based data-sharing obligations into broader financial-services realms, including insurance, investments, credit, pensions and more. By doing so, FiDA aims to power richer embedded-finance propositions, for example, personalised credit or insurance offers triggered at the point of sale, or savings and investment modules appearing contextually within a retail app.

FiDA remains a pending legislative proposal rather than enacted EU law. Its significance for embedded finance is therefore twofold: first, as an indicator of the direction of travel from open banking to open finance; and second, as a site of unresolved policy choices concerning scheme governance, market access, compensation, and the treatment of potential gatekeepers.
Current regulatory debates encompass critical questions regarding platform eligibility (which types of non-financial platforms may become data holders or data recipients), and whether large technology firms (“Big Tech”) should gain access to such financial-data ecosystems on equal footing with banks and fintechs. These discussions are material for embedded-finance providers because they define the future architecture of data-flows, value-shares, and competitive gatekeeping in embedded-financial services.

From an embedded-finance viewpoint, FiDA could transform user experiences: rather than limiting integration to payment initiation and account-balance checks, platforms could embed deeper financial-services layers—credit scoring, personalised investment nudges, insurance bundling—triggered at precise behavioural or purchase moments. The richer data context (for example, investment holdings, pension accruals, insurance gaps) enables targeted, real-time offers within the host platform’s user journey. This shifts embedded finance from “payments inside an app” toward “full-stack finance inside the platform”. The regulatory clarity FiDA proposes (consent regime, data-provider obligations, standardised APIs) reduces friction for non-banks and platforms aiming to embed these advanced financial services.

FiDA should be analysed less as imminent positive law than as the EU’s most explicit attempt to generalise the logic of customer-controlled data sharing beyond payment accounts. Although the proposal remains pending and trilogue discussions have not yet culminated in adoption, its policy significance already lies in the questions it forces the legislator to answer: which data sets should become portable, on what commercial terms they should be shared, how scheme governance should be organised, and whether access should be conditioned to prevent new gatekeeping dynamics. For embedded finance, those questions are decisive because they determine whether the next phase of integration will produce genuinely contestable “open finance”, or simply a broader but still highly intermediated market for platform-shaped financial distribution.

Supervisory View on Embedded Finance Risks

National supervisors have increasingly flagged the emerging risks inherent in embedded-finance models, particularly where non-financial platforms distribute financial services with a financial-institution partner. In its 2024 analysis, DNB²³ observes that embedded-finance value chains exhibit heightened complexity and interdependencies, for example when a licensed financial institution is responsible for regulatory compliance while the partnering non-financial platform manages customer relationships and sales processes. Such structures generate conduct risk, outsourcing and third-party risk, and potential concentration risk, especially if large platforms become dominant distributors of financial products.

The supervisory significance of embedded finance lies precisely in the mismatch between legal responsibility and interface control. The regulated institution retains ultimate accountability, yet the platform may shape customer acquisition, user choice architecture, data prompts and transactional context. This separation is what makes embedded finance legally distinctive and why conventional outsourcing analysis is not always sufficient.

Conduct, AML & Outsourcing Risks

DNB emphasises that “the partnering financial institution bears ultimate responsibility and accountability for the risks, while the non-financial partner often manages the sales process and customer relationships.”²⁴ This division of roles can create gatekeeper-failures, where high-risk customers are accepted via the platform partner, or weak customer due diligence (CDD) is exercised. The supervisory focus thereby encompasses AML obligations, consumer-protection requirements and clear governance of intermediary (platform) conduct.

From an outsourcing perspective, DNB notes that the high degree of automation and digitalisation in embedded-finance value chains may complicate resolution tools, such as transaction freezes, because dependencies span licensed institutions and non-financial affiliates. The result is elevated operational-resilience risk, but also liability-allocation risk: when a platform intermediary fails, clarity on which party is accountable becomes blurred.

Concentration and Interconnectivity Risks

Beyond individual conduct and outsourcing concerns, supervisors worry about systemic implications of embedded-finance proliferation. DNB warns that as platforms scale, business-model dependencies and narrow banking or product-specialist models may emerge, increasing interconnectivity and potential fragility in the system. Although DNB assesses that embedded finance “does not currently appear to pose a direct risk to the safety and soundness of financial institutions” (largely because the scale remains modest), it emphasises that “it is crucial to keep an eye on the ball” as the market evolves.²⁵

Implications for National Supervisory Recommendations (e.g., for the Malta Financial Services Authority (MFSA))

For jurisdictions like Malta, which seek to oversee platforms embedding financial services or hosting financial-services features, supervisory guidance can be shaped by these risk observations:

• Conduct and AML: Supervisors should ensure that platform-financial-institution partnerships allocate clear responsibilities for CDD, customer suitability, transparency, and monitoring of embedded-product distributions. Platforms should not simply act as distribution channels without proper oversight.
• Outsourcing / Third-party Risk: Given the layered value chain, supervisors should require firms to map their outsourced service providers, monitor concentration of services (e.g., cloud, API providers) and ensure business-continuity/resolution plans cover the platform relation.
• Concentration Risk: Supervisors should monitor growth of dominant platform-financial-institution arrangements, assess whether approvals/licences or oversight frameworks adequately capture distribution risk, and consider whether thresholds or reporting obligations should apply when embedded-finance volumes expand materially.
• Governance & Liability: Supervisory frameworks should clarify accountability across the chain: the licensed institution remains responsible, but platforms must be subject to supervision where they materially contribute to the provision of financial services.
• Resolution and Interconnectivity: Even where embedded finance is currently small-scale, supervisors should proactively require scenario-analysis, stress-testing and exit strategies for platform-related arrangements given the potential for rapid scale-up.

Conclusion and Policy Recommendations

The evolution from PSD2 to PSD3 and the PSR, complemented by the forthcoming VoP and FiDA, signals a decisive regulatory transition: embedded finance is no longer a peripheral innovation but a core architectural feature of Europe’s digital-market strategy. Moreover, embedded finance in the EU is no longer limited by the legal existence of access rights; it is now limited by how the regulatory framework allocates friction, control, liability and governance across increasingly platformised financial ecosystems.

However, as national authorities such as De Nederlandsche Bank emphasise, embedded-finance ecosystems introduce heightened conduct, operational and systemic risks that must be governed proactively. Building on these developments and supervisory insights, Malta can advance an innovation-supportive yet risk-sensitive regulatory stance that aligns with EU priorities while preserving customer trust and financial stability.

Accordingly, the undersigned proposes five policy recommendations for the Maltese and EU supervisory context:

Proportionate VoP UX Design

As payee-verification obligations roll in, embedded-checkout journeys should support tiered VoP responses (e.g., “close match” risk warnings paired with scam-education messaging) rather than universal hard-stops—reserving friction for high-risk patterns. This balances conversion and fraud mitigation while maintaining user awareness.

Standardised API Diagnostics

PSPs should be required to publish reliable uptime and error telemetry for open-banking interfaces, enabling platforms to detect and mitigate hidden frictions that impair embedded access-to-account workflows. This operational transparency aligns with the PSR objective of improving open-banking functioning.

DORA-Proofed Outsourcing Governance

Supervisors should mandate clear end-to-end accountability maps when financial services are embedded in non-financial platforms, including operational-resilience exercises (e.g., API-failure simulations, data-leak scenarios). This ensures that third-party interdependencies in embedded-finance stacks are consistent with DORA’s ICT-risk and incident-reporting expectations.

Fraud-Data Collaboration

Payment institutions and third-party providers in Malta should participate in secure fraud-intelligence exchange mechanisms under PSR legal bases, prioritising mule-account detection for embedded payout models. This enhances collective defence against social-engineering and impersonation fraud while safeguarding user trust.

FiDA-Ready Consent Frameworks

Regulators should pilot interoperable consent receipts and cross-platform revocation UX, anticipating multi-sector data portability (e.g., across credit, insurance, pension data) under FiDA. This prepares embedded-finance providers for the next phase of open-finance interoperability.

Embedded finance should be supervised according to functional influence rather than formal legal labels. Where a platform materially shapes customer decision-making, data use, or operational execution, the law should recognise that the platform forms part of the regulated distribution architecture, even if the authorised institution remains the licensed provider. The analysis in this article suggests that embedded finance should not be supervised solely through the formal lens of licensing perimeter and outsourcing classification. Where a platform materially influences customer decision-making, controls user-interface architecture, intermediates key data flows, or creates operational dependency for the regulated provider, it forms part of the functional distribution chain and should be treated as such for supervisory purposes.

Embedded finance holds significant promise for Malta’s digital-services economy, strengthening platform competitiveness, supporting SME access to financial tools, and improving consumer convenience. Realising this potential requires policy that recognises embedded finance as both financial distribution and digital infrastructure, governed proportionately, resiliently, and with user-trust at its core.

Europe’s next challenge is therefore not to “open” finance in the abstract, but to decide what kind of openness it wants: openness that disperses innovation and customer agency, or openness that is formally accessible yet substantively dominated by a small number of platforms. The answer will depend on whether the post-PSD2 framework can calibrate interoperability, security, liability and data power in a way that preserves both trust and contestability. For smaller, innovation-oriented jurisdictions such as Malta, that question is not theoretical; it is central to how platform-based financial intermediation will be supervised in practice over the coming years.

Footnotes

¹ Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, pp 35–127).

² Arner DW, Buckley RP and Zetzsche DA, ‘Open Banking, Open Data and Open Finance: Lessons from the European Union’ [2021] UNSWLRS 69, forthcoming in Linda Jeng (ed), Open Banking (OUP 2021) ch 8.

³ Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market (PSD2) [2015] OJ L 337/35, arts 66–67 (AISP and PISP provisions); European Commission, Q&A: Payment Services Directive (PSD2) (2023).

⁴ European Credit Research Institute, Study on the Application and Impact of PSD2 (2023) https://www.ecri.eu/sites/default/files/a-study-on-the-application-and-impact-of-directive-ev0423061enn.pdf accessed 1st June 2026.

⁵ European Banking Authority, Opinion on the Elements of Strong Customer Authentication under PSD2 (EBA/Op/2022/10).

⁶ European Financial Services Round Table, PSD2 and Open Finance: Unleashing Europe’s Data Economy (EFR Paper 145, 2023).

⁷ European Parliament Research Service, Payment Services Framework – Briefing (EPRS 775891, 2025).

⁸ Directive: Proposal for a Directive of the European Parliament and of the Council on payment services and electronic money services in the Internal Market (amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/110/EC) (COM (2023) 366 final) {2023/0209 (COD)}.

⁹ Regulation: Proposal for a Regulation of the European Parliament and the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010 (COM (2023) 367 final) {2023/0210 (COD)}.

¹⁰ Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro (Text with EEA relevance) (OJ L 886, 19.3.2024).

¹¹ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) (OJ L 333, 27.12.2022, pp 1-79).

¹² Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) 2022/2554 and Directive (EU) 2019/1937 (COM (2023) 360 final) {2023/0209 (COD)}.

¹³ https://data.consilium.europa.eu/doc/document/ST-8220-2026-INIT/en/pdf accessed 1st June 2026.

¹⁴ Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication [2018] OJ L 69/23.

¹⁵ Markos Zachariadis and Pinar Ozcan, The API Economy and Digital Transformation in Financial Services: The Case of Open Banking (SWIFT Institute Working Paper No 2016-001, 15 June 2017). Markos Zachariadis and Pinar Ozcan, explain open banking not merely as a compliance obligation, but as part of a broader shift towards API-based platform business models, “banking-as-a-platform”, modularity, interoperability, complementor ecosystems, and the reallocation of customer-interface power. The paper explicitly discusses open APIs, digital platforms, transaction-cost economics, network effects, and “banking-as-a-platform” as the strategic logic behind open banking. Zachariadis and Ozcan provide an early but still useful account of open banking as an API-enabled platform transformation in financial services, highlighting the roles of modularity, interoperability, transaction-cost reduction, customer-interface control, and complementor ecosystems. Their analysis is relevant here because embedded finance can be understood as a later and more operationally mature manifestation of the same platform logic, albeit now shaped by a denser post-PSD2 regulatory environment.

¹⁶ A study on the application and impact of Directive (EU) 2015/2366 on Payment Services (PSD2) FISMA/2021/OP/0002 www.ecri.eu accessed 30^th October 2025.

¹⁷ European Parliamentary Research Service (EPRS), Payment Services Framework – Revision of EU Rules on Payment Services (EPRS Briefing 775891, 29 August 2025).

¹⁸ Ibid no,15

¹⁹ Regulation (EU) 2024/886 (the “Instant Payments Regulation” or IPR) for a “verification of payee” service (often called VoP). 6.

²⁰ https://www.ecb.europa.eu/paym/retail/instant_payments/html/instant_payments_regulation.en.html accessed 1st June 2026.

²¹ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (OJ L 333, 27.12.2022, p. 1–79).

²² Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554, COM(2023) 360 final, 2023/0205 (COD), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52023PC0360 accessed 1st June 2026.

²³ https://www.dnb.nl/en/sector-news/supervision-2024/embedded-finance-striking-a-balance-between-convenience-and-risk-in-the-digital-economy/?utm_source=chatgpt.com accessed 1st June 2026.

²⁴ Ibid.

²⁵ Ibid.