How PSD2 affects high-risk merchants operating in Europe

A poorly configured payment flow can cost a high-risk merchant a significant share of its European sales. PSD2 is an EU directive governing electronic payment security, strong customer authentication and payment service providers. Although most requirements apply to banks and PSPs, they directly affect merchants’ checkout, approval rates, refunds and chargebacks. For gaming, crypto, forex and other high-risk sectors, providers often restrict exemptions, impose reserves and increase monitoring. Some measures, however, arise from AML rules, card schemes and internal risk policies rather than PSD2. In this article, we explain where PSD2 requirements end and how high-risk merchants can maintain stable payment acceptance in Europe.

What PSD2 regulates and why it matters to merchants

PSD2 regulates payment services in the EU and EEA. It sets requirements for payment institution authorisation, transaction security, strong customer authentication, disclosures and liability for unauthorised payments.

The directive applies to banks, payment institutions, electronic money institutions and other authorised providers. It covers:

• Operating payment accounts;
• Executing card payments and bank transfers;
• Acquiring payment transactions;
• Money remittance;
• Payment initiation services;
• Account information services.

A merchant that only accepts payment for its own goods or services does not normally become a payment service provider. However, it is a payee and payment service user, so its checkout and acquiring agreement operate within the PSD2 framework.

In practice, PSD2 affects merchants through:

• SCA for certain electronic payments;
• Technical requirements for authentication and transaction data;
• Payment execution and refund periods;
• Liability for unauthorised transactions;
• Disclosures on fees, currency conversion and payment status;
• Bank or acquirer requirements for security and fraud prevention.

High-risk merchants are not a separate PSD2 category. Gaming, crypto, forex, adult content and supplement businesses may face stricter terms because of fraud exposure, AML obligations, card scheme rules and provider risk appetite, not a specific PSD2 provision.

This distinction matters when negotiating with a processor. Merchants should identify which requirements come from legislation, card scheme rules or the provider’s contract. Otherwise, an acquirer’s internal restriction may be mistaken for a universal PSD2 prohibition.

Why high-risk merchants face stricter payment controls

PSD2 does not require automatic rejection of gaming, crypto, forex, adult or other high-risk merchants. Enhanced checks usually result from AML/CFT requirements, fraud exposure, consumer risk, card scheme rules and provider policies.

Before onboarding, an acquirer or payment institution assesses both the legal entity and the entire payment model. The review usually covers:

• Beneficial owners, directors and source of funds;
• Licences and the right to serve selected jurisdictions;
• Website, products, pricing and marketing practices;
• Average transaction value and expected turnover;
• Customer geography and currencies;
• Refund, chargeback and fraud history;
• Delivery model and evidence of services;
• Processors, affiliates and other related parties.

The EBA report on ML/TF risks associated with payment institutions states that providers’ risk exposure depends on their customer base, products, delivery channels and geography. Merchants with opaque ownership, third-party payments or operations in high-risk jurisdictions therefore face closer review.

After onboarding, the provider compares actual activity with the information disclosed. Rapid turnover growth, a new product, different geography or a higher chargeback ratio may trigger further requests.

The acquirer may also impose:

• A rolling reserve or delayed settlement;
• Transaction and monthly volume limits;
• Restrictions on countries, products or payment methods;
• Prior approval for new websites;
• More frequent reporting and immediate termination rights.

These terms do not always arise directly from PSD2. They are often set by the processing agreement or card scheme rules. Merchants should review them before onboarding, as PSD2 compliance does not require a provider to accept every level of commercial or financial crime risk.

How strong customer authentication affects checkout

Strong customer authentication requires verification through at least two independent elements: knowledge, possession and inherence. For remote electronic payments, authentication must also link the transaction to a specific amount and payee.

When SCA is required

• SCA generally applies when a payer:
• Accesses a payment account online;
• Initiates an electronic payment;
• Performs a remote action involving payment fraud risk.

For card payments, the merchant normally sends the authentication request through 3D Secure, while the issuer makes the decision. Incorrect integration may cause soft declines, repeated requests and lost conversions even for legitimate transactions.

Which exemptions may apply

Commission Delegated Regulation (EU) 2018/389 provides exemptions based on the amount, recurrence, channel and risk level. These may include:

• Low-value transactions;
• Recurring payments of the same amount to the same payee after initial SCA;
• Payments to a trusted beneficiary;
• Secure corporate payment processes;
• Transaction risk analysis where fraud thresholds are met.

A merchant-initiated transaction is not a standard exemption. If the merchant initiates payment under a prior customer mandate, it may fall outside the SCA scope. However, establishing the mandate usually requires authentication, and the transaction data must be correctly flagged.

High-risk merchants have no guaranteed right to an exemption. The acquirer may decline to submit an exemption request, while the issuer may require SCA based on its risk analysis. The merchant’s fraud rate also affects whether the provider supports a frictionless flow.

Companies should test approval rates by country, issuer, card type and authentication route. Increased declines after checkout changes require analysis of SCA data, not repeated payment attempts without explanation. Mislabeling recurring or merchant-initiated payments to bypass authentication creates chargeback and contractual risk.

Acquiring, payment accounts and provider relationships

A high-risk merchant depends on its acquirer as much as on its bank account. PSD2 authorisation confirms that a provider may offer specific payment services, but not that it accepts a particular industry, geography or transaction profile.

Before signing, the merchant should verify the provider in the national register and the EBA Register of Payment and Electronic Money Institutions. Confirm:

• The exact name of the licensed entity;
• Authorised payment services;
• Countries where services may be provided;
• Use of agents or distributors;
• Any restrictions or withdrawn authorisation.

The processing agreement also requires review. Key terms include the settlement schedule, rolling reserve, chargeback fees, transaction limits and the provider’s right to withhold funds. It may also restrict certain products, countries, marketing methods or website changes without prior approval.

Monitoring continues after onboarding. The acquirer compares actual payments with the stated business model and may request licences, invoices, proof of delivery, customer communications or source-of-funds evidence. The merchant must report new products, domains, beneficial owners and target markets where required by the agreement.

The termination clause is particularly important. A provider may stop processing, increase the reserve or delay settlement following a fraud spike, regulatory concern or breach of card scheme thresholds. The merchant should understand notice periods, immediate termination grounds and how withheld funds will be released.

A backup acquirer reduces concentration risk but must not conceal activity or bypass restrictions. All processors should receive consistent and accurate information. Otherwise, routing transactions through multiple accounts may be treated as transaction laundering and lead to termination of all relationships.

Refunds, chargebacks and payment liability

PSD2 liability and card scheme chargebacks are separate mechanisms. PSD2 governs relations between users and payment providers, while chargebacks usually follow Visa, Mastercard or other scheme rules and the acquiring agreement.

Unauthorised payments under PSD2

If a payer reports an unauthorised transaction, their provider must generally refund it by the end of the following business day. An exception may apply where there are reasonable grounds to suspect fraud and the provider reports them to the competent authority.

The merchant does not normally refund the payer directly under these rules. However, the issuer may recover the amount through the acquirer, which debits the merchant account or deducts it from the reserve.

Chargebacks and merchant evidence

A chargeback may result from:

• Alleged fraud or lack of payment consent;
• Non-delivery of goods or services;
• Duplicate or incorrect charges;
• A cancelled recurring payment;
• Failure to issue an agreed refund;
• An unclear billing descriptor.

SCA or 3D Secure may shift liability for certain fraud claims but do not protect against every dispute. They do not resolve claims involving service quality, misleading terms or non-delivery.

Merchants should retain proof of consent and authentication results, accepted terms, transaction data, delivery evidence and refund correspondence. PSD2 allows users to notify providers of certain unauthorised or incorrectly executed transactions within 13 months. Card scheme dispute periods may differ and are often shorter.

Repeated chargebacks may lead to higher reserves, scheme monitoring, penalties and termination. Merchants should therefore identify the cause: fraud, unclear checkout, product issues or delayed refunds.

Cross-border sales and territorial scope

PSD2 application depends not only on the merchant’s country of registration but also on the location of payment providers, currency and transaction structure. One checkout may process payments subject to different regulatory treatment.

PSD2 applies most fully to two-leg transactions where both the payer’s and payee’s providers are in the EEA. Certain provisions also cover other currencies and one-leg transactions where only one provider is in the EEA. In such cases, the rules apply only to the European part of the transaction.

SCA rules generally apply to online payments where both the issuer and acquirer are in the EEA. A European customer’s card does not always make SCA mandatory: provider locations and how the transaction is initiated also matter. However, an acquirer may require 3D Secure beyond the minimum scope to reduce fraud risk.

Merchants should check:

• The issuer’s and acquirer’s locations;
• Supported currencies and settlement accounts;
• Applicable SCA rules and exemptions;
• Fees and currency conversion disclosures;
• Restrictions on surcharging;
• Local consumer and sector regulation.

PSD2 prohibits additional charges for certain common consumer payment methods where both providers are in the EEA. The European Central Bank states that the ban covers specified card payments, direct debits and credit transfers. Where the ban does not apply, surcharges may still be limited to the merchant’s actual costs and restricted by national law.

Payment processing does not replace authorisation for the underlying activity. Gaming, investment, crypto and other regulated businesses may require a local licence even when using an authorised European acquirer. Checkout geography must therefore match authorised markets, the licence scope and information disclosed to the provider.

What high-risk merchants should implement

PSD2 compliance goes beyond enabling 3D Secure. Merchants need an internal payment control framework connecting checkout, fraud prevention, provider agreements and actual business activity.

Minimum measures include:

1. Mapping entities, countries, currencies, providers and settlement accounts;
2. Verifying each acquirer’s and processor’s authorisation;
3. Accurately documenting products, MCC, customer geography and expected volumes;
4. Configuring SCA routing and exemptions with the provider;
5. Applying fraud controls for devices, velocity, IP, beneficiaries and payment history;
6. Retaining customer consent, checkout terms and proof of delivery;
7. Establishing one process for refunds, chargebacks and complaints;
8. Monitoring approval rates, fraud, disputes and reserves;
9. Obtaining prior approval for new domains, products and jurisdictions;
10. Maintaining incident escalation and payment continuity plans.

Merchants should not change the MCC, billing descriptor or transaction type to bypass issuer controls. Mislabeling recurring, merchant-initiated or low-risk payments may temporarily improve approval rates but creates chargeback, scheme penalty and termination risks.

Reporting should not focus only on total turnover. Results should be separated by country, issuer, card type, payment method and authentication outcome. This identifies whether lower conversion results from SCA, fraud rules, technical errors or provider restrictions.

Business model changes require a payment impact assessment before launch. Compliance, finance and product teams should determine whether provider approval, checkout changes or updated customer disclosures are needed.

Management should also review concentration risk. If all revenue depends on one acquirer or settlement account, a short review may stop operations. Backup infrastructure should be arranged in advance, with actual transaction routing disclosed to all providers.

How Key2Law supports high-risk merchants in Europe

The Key2Law team advises high-risk businesses on payment regulation, onboarding and agreements with European providers. We help distinguish mandatory PSD2 requirements from AML, card scheme and contractual restrictions.

Key2Law can:

• Determine how PSD2 applies to the payment model;
• Verify acquirers and payment providers;
• Assess SCA flows and exemptions;
• Review processing agreements and reserve conditions;
• Examine refunds, chargebacks and transaction records;
• Develop fraud and payment control procedures;
• Prepare provider onboarding and compliance documents;
• Assess the transition to PSD3 and PSR.

If your business faces declined payments, increased reserves or processing termination risk, contact the Key2Law team. We will identify regulatory and contractual gaps and develop a payment framework aligned with European requirements and the company’s actual risk profile.

___________________________________________________________

This material is for informational purposes only and does not constitute legal, tax or investment advice. Licensing, capital and conduct requirements depend on the jurisdiction, financial instruments and the broker’s actual activities. Obtain advice tailored to your business before adopting or changing an execution model.