In this Payments on Fire episode, Glenbrook’s Chris Uriarte and Samantha Gordon continue their global payments regulation series with Scott McInnes, Partner at Bird & Bird, focusing on the European Union.

Tune in as they explore the EU’s highly regulated landscape, the challenges of inconsistent national enforcement across 27 member states, and developments on current regulatory topics:

• Payment Services Directive – PSD2 to PSD3 evolution
• Payment Services Regulation (PSR) objectives and adoption timeline
• Digital euro goals and requirements
• European Digital Identity Wallet framework and ambitions
• SEPA Instant obligations
• Upcoming BNPL regulation
• Apple NFC access and wallet competition
• Strong Customer Authentication (SCA) implications for agentic commerce

 

Watch the full episode on YouTube: 

 

 

 

Episode Transcript

Chris Uriarte: And I’m Chris Uriarte, a partner at Glenbrook, and it’s great to have you back with us today for another episode of Payments on Fire. But before we get started, I want to once again remind you that we’ve got another one of our famous Glenbrook Partners Boot Camps that’s happening on September 29th and September 30th. The Payments Boot Camp on those two days, followed by a one-day Advanced Payments workshop on October 1st So whether you are new to the industry or whether you are a cranky old veteran like myself, the boot camp is always a great idea to help develop your professional skills in the payments industry. So head over to glenbrook.com for more information and to register for the boot camp.

And speaking of New York City, Sam, you and I were in New York last week. We had some great visits with clients. We held a strategy session with one of our global clients. Had a great time up in the city. Good to have you with us today. Samantha Gordon, senior engagement manager here at Glenbrook, co-hosting with me today. Hey, Sam, how are you?

Samantha Gordon: Good. Great to be back.

Chris Uriarte: Good to have you back. And we’re on episode two of this multi-part series that we’re doing on payments regulation around the globe, and we just published our first episode, which is focused on the crazy patchwork of regulation that we have in the United States, or lack of regulation in many cases in the United States, which was interesting. And I think today is gonna be a really interesting sort of compare or contrast situation between different models as we look at payments regulation in the European Union. And probably I should first stress, Sam, because we get this all the time from folks, sometimes there’s a little confusion out there. Just to remind folks that we’re really talking about the European Union today. We’re not talking about the UK. Brexit did happen. It’s about 10 years now, I think, since Brexit occurred, the 10th anniversary, and I think the UK has taken its own path in payments, justified enough to have its own episode coming soon. But today to talk about payments regulation, we have with us Scott McInnes, who’s a Partner at the global law firm of Bird & Bird. Hey, Scott. How are you? Great to have you today.

Scott McInnes: Hey, Chris. I’m good, thank you, and it’s good to be on the show. Thanks for having me.

Chris Uriarte: Yeah, great to have you with us. And just a little background for our audience. I’ve mentioned this before, if you’ve listened to some of our previous episodes and I talked about this last week on the US regulation episode, is we’ve got this great forum that we’ve been running for about twenty years globally. And it’s a little less than that in the European Union, but we have our Merchant Payment Roundtable that we run in the United States, and we have a European version of that, and that is comprised of the largest of largest, most innovative omnichannel merchants around the globe.

We estimate that makes up somewhere between twenty and thirty percent of omnichannel commerce between those merchants. And we get together twice a year. We have a great time for a few days in the fall and in the spring in London and in great cities elsewhere in Europe. We were in Madrid just this past spring, and Scott and his team at Bird & Bird have graciously been a participant in that forum, giving the team a great overview and a great landscape of what’s going on in both Europe and the UK from a payments regulatory perspective.

So Scott, we appreciate all the work that you’ve done on that. It’s always insightful and looking forward to you bringing some of that light to our listeners here at Payments on Fire. But first, we have to get into the stuff about your background, which is always very important for us. So why don’t we, why don’t you tell us a little bit about yourself and your role at Bird & Bird?

Scott McInnes: Sure. So I’ve been at Bird & Bird for 10 years. I’m a member of our financial services regulatory team. We obviously advise on financial services regulations, I mean, very often on cross-border projects. That means that very often we’ve got different Bird & Bird countries involved in projects. I think we cover about 30 or 31 countries around the world ourselves, mainly in Europe and in Asia. And I focus in particular on payment services regulations, so trying to help different participants in the merchant ecosystems, whether it’s card issuers or schemes or acquirers or merchants, essentially understand payments regulations, comply with payments regulations, and all sorts of regulations that somehow have an impact on payments flows, essentially.

Chris Uriarte: Gotcha. And you’re based in Brussels, right, which is a pretty important spot from an EU perspective, right?

Scott McInnes: Based in Brussels. It’s where all those EU regulations get drafted indeed, so I’m trying to keep my ears very close to the ground here in Brussels to listen to what’s going on and see, if on occasion I can get a leaked draft of this text or that text on occasion.

Chris Uriarte: Yeah, I’m sure. So the classic Payments on Fire question that we always ask our first time guests is how did you wind up in this crazy payments industry and what has your path been in the industry thus far?

Scott McInnes: Actually, I fell into payments when I was offered a job at Mastercard many years ago. So back in 2012. It’s Mastercard who asked me, “Hey, would you like to stop being an external advisor in a law firm, essentially, and come and join the party in-house here at Mastercard?” So I spent four years in the legal department at Mastercard, which was great.

It was great, really good payments university for me ’cause a lot of tech people at Mastercard, business people at Mastercard were kind enough to basically lift up the bonnet of how the payments engine is supposed to work and to connect the dots for me so that I could understand more or less how this whole thing called payments works. Well, some bits at least of the payments chain work.

So it was great payments university, and that’s when I fell in love with things like PSD1 back then, and then PSD2 and the interchange fee regulation and all sorts of EU regulations impacting payments, and essentially decided see if I could make a living out of it. And after four fun years at Mastercard, joined Bird & Bird back in 2016, and I’ve been here for 10 years now, enjoying all of that good stuff.

Chris Uriarte: Yeah So we’re gonna talk a lot about PSD2 today. I think you might be the first person in the history of this podcast to say you’ve fallen in love with PSD2. Probably the only person we’ve had thus far but we’ll keep that on the record and maybe you could explain that a little bit more.

Maybe just digging a little bit deeper, tell us a little bit about the clients that you serve, what are some of the challenges that you see? We asked this of one of your industry peers, Duncan Douglass, when we were talking about US regulation and we’ve got a much different payments regulation landscape in the US and I’m just curious how we might see things a little differently in the EU and how maybe that affects your day-to-day job.

Scott McInnes: Think it’s fair to say in the EU, we love to regulate. So you mentioned before that from the previous podcast involving the US, some things are not regulated in the US. That tends to be less the case, I think, in Europe. We love our regulations in Europe, as you probably know. On occasion, we take pride in being the first to regulate this or the first to regulate that, like open banking. We’re one of the first to regulate open banking in Europe. We were one of the first countries to actually regulate interchange fees, although I guess Australia was first, and there was obviously the Durbin amendment in the US as well.

But nonetheless, we’re one of the few jurisdictions to regulate interchange too. So we love our regulations. It’s getting more and more complicated, frankly, to understand which regulations applies to which businesses. There are lots of crossovers, lots of touch points or connection points between different regulations. So if you’re a regulated payment service provider in Europe, you not only have to look at PSD2, look at a bunch of other regulations that interconnect with PSD2, whether it’s the GDPR, whether it’s the Digital Markets Act, the DMA, the Digital Services Act, the DSA, the eIDAS regulation. So all sorts of regulations to see if there’s something in there that impacts you basically, and that’s getting more and more difficult.

And another issue we’ve got in Europe, might be the same in the US, I’m not sure, is that enforcement is typically left to the national regulators in the twenty-seven EU member states. So on occasion, they look at the same texts if it’s an EU regulation. On occasion, they look at different texts if it’s a directive as opposed to a regulation, i.e. a directive that has to be incorporated into the national laws. So but even when they look at the same text, same regulation, on occasion, you can see that those twenty-seven national regulators don’t agree on what the text actually means, how it should be enforced, what the consequences are, the requirements are.

So on occasion, it’s a bit frustrating, frankly, to see that you get different answers from different regulators in different EU countries who can’t align on a common position. Makes it difficult for businesses to operate in various EU member states if it’s not essentially the same rules that apply everywhere. So we try on occasion to bring the knowledge from one country to another country and say, “Hey, well, that’s not exactly how your counterpart in another country interprets that rule. So can we find a common ground here?” That’s one occasion. Some people call for having one unique central regulator that would regulate on a pan-European basis, but that’s, I mean, not easy to implement, of course.

But that’s what we do here. So it’s a lot of advising on payment services regulations, trying to connect the dots, trying to make sure we cover all bases, not only payment services regulations, but any regulations that are relevant, and try to essentially find a way to interpret those regulations so that they can be enforced ideally by regulators throughout the EU in the same way just to make the business easier, essentially.

Chris Uriarte: Yeah let’s dig a little deeper into that because a common question that we often get is who is actually regulating payments in the European Union? Because it is this really rich regulatory landscape as you’ve talked about, this rich regulatory environment. You’ve talked about this interesting nuance around sort of regulation that is being implemented at the EU level and then sort of the implementation and enforcement of the adoption of that at the individual member state level. A lot of complexity here. How do I look at, if I’m a regulated entity your first question always is who’s my regulator, right? Who do I have to, who am I concerned about? From an EU perspective, how do we look at sort of these regulatory authorities and who’s actually setting the agenda here when it comes to payments?

Scott McInnes: Yeah. So broadly speaking in relation to payment services, the laws are adopted at the EU level. So they’re adopted by the EU legislator or co-legislators, i.e., the European Parliament, the European Council. However, the enforcement is left to the national regulators in the twenty-seven countries. Today, for payment services, our core legal text is an EU directive called PSD2, which is the second payment services directive, and that is a directive.

That means that regulators don’t, in the various member states, don’t enforce PSD2 as such. PSD2 had to be incorporated into the national laws of France, Belgium, Germany, Netherlands, et cetera. And it’s that incorporated text into the national laws that national regulators enforce. First of all, the Dutch regulator, for example, is not enforcing the exact same rules as the German regulator or the French regulator because the text might not be exactly the same in Germany, France or the Netherlands.

It comes from the same level one text, PSD2, not PSD2 as such they’re enforcing. It’s the incorporation into the national laws of PSD2 they’re enforcing. That’s something that the EU legislator is trying to fix now because PSD2 will not be replaced by just another directive, PSD3, which would go through the same process of being incorporated into the national laws of EU member states and therefore not necessarily the same text. PSD2 will be replaced by two texts. PSD3, that’s another directive, but also a Payment Services Regulation, a PSR, and that will be the same text for everybody.

So the Dutch regulator, the French regulator, the German regulator will all be enforcing the same level one text, and that will be the Payment Services Regulations, the PSR. So at least they will be looking at the same text, enforcing the same text. It doesn’t mean they will all read the text in the same way, enforce it in the same way, understand it in the same way. Of course not, ’cause otherwise it would be too easy. and arguably I would be out of a job, which would be a shame, we can all agree, I’m sure.

But at least they will all be looking at the same text, and they will be strongly encouraged by European Commission, European Banking Authority to interpret those texts in the same way through guidance, for example, from the EBA, the European Banking Authority, to try and help those twenty-seven national regulators to read the PSR in the future in the same way and to enforce it in the same way in an ideal world.

Chris Uriarte: So you’re hitting on a key question, I think, that we get a lot from folks as they’re thinking about this new regulatory regime. They hear this term PSR and they’re used to the concept of a PSD, right, because PSD2 was a huge change huge regulatory framework that was implemented, major changes required throughout the payments value chain and the payments ecosystem. Folks understand what PSD2 is. They understand, I think, that PSD3 is the evolution of that. But now we introduce this concept of PSR and folks either kind of ignore that because they just call this generally PSD3 is what we hear from folks sometimes, but in reality it’s a really important distinction, I think, between PSD3 and the PSDR and PSR.

And I think it’s a interesting evolution that kind of shows the thinking of the regulator and how they want to see these regulations followed and implemented within the EU. It’s a very different structure than what we have in the US. We generally either have regulations at the federal level or we have regulations at the state level. There really isn’t this concept of a directive being set at the federal level and then having to be implemented at a state level. The states kind of do their own thing in cases where they are.

But I mean, we certainly see a big interest in what’s happening with PSD3. And just to set the stage a little bit for our listeners if you’re not familiar, PSD2 obviously was the predecessor to PSD3 and PSR that was rolled out from about 2000, what was it 2008?

Scott McInnes: PSD2 was adopted in 2015 and essentially went live at the beginning of 2018.

Chris Uriarte: Yeah, 2018 was the initial rollout. Rolled out over the course of the next couple years, introduced a lot of really important concepts that payments acceptors and processors and everybody in between has to follow today such as the concepts of strong customer authentication, was the original introduction of open banking the regulation around that open banking APIs and regulations, introduced a very strict supervisory framework for the likes of fintechs and thirdparty processors. Lots of things also embedded in there around consumer rights and things like that. So we could go on forever about PSD2 but now we’re moving forward with PSD3 and, Sam, I know we talk, you and I talk about this all the time right, merchants are really concerned about what this actually means to them and how they interpret this, right?

Samantha Gordon: They are. And I mean, going back to moons ago in PSD2, I was working at a European PSP at the time working with American merchants, and I remember all my merchants were freaking out about when do we do SCA, strong customer authentication, and half of them were referring to the directive as R2-D2, like from Star Wars. So this was a huge thing for American merchants to wrap their heads around.

But I’m curious, Scott, though, like from a merchant perspective, we said, and it was true, that PSD2 was such a shock to the system and implemented a number of major changes that were very immediate to the way merchants process payments in Europe, SCA requirements being one of them. But what we keep hearing is that PSD3 and PSR, we keep hearing them being referred to as more evolution, not revolution. So tweaks and adjustments to PSD2’s concepts, but it’s not really as much of a sea change for merchants and their payments operations. So Scott, I’m curious, do you agree with that, and what are some of the particularly important changes to highlight to merchants?

Scott McInnes: So I would agree that PSD3 PSR are largely evolutions of things we already have under PSD2, not so much revolutions. Although there are a couple of things in there that I think are quite revolutionary, but I don’t think they will be revolutionary for merchants in particular.

So if, we look at SCA, for example, SCA, strong customer authentication, that has been a revolution in PSD2. It obviously not only impacted the payment service providers, for example, the card issuers, the acquirers. It obviously impacted merchants in terms of how they implemented 3D-Secure, which version of 3D-Secure, which transactions would have to go through an SCA, the potential impact on transactions that may fail for lack of SCA, whatever it might be. So that was obviously a revolution for merchants.

Open banking was a revolution because it allowed those historically unregulated players, but now regulated under PSD2 players, to access a bank account in order to do stuff with that bank account, whether it’s to push a payment out of the bank account or to pull the data from that bank account. That created an opportunity for merchants to accept those new means of payments if they wanted to as an alternative to card-based payments like Mastercard and Visa. So those were the two main revolutions, I would say, in PSD2.

They’re not changing that much in PSD3 PSR. In other words, SCA remains broadly the same under PSD3 PSR. There are a few clarifications that were brought to how SCA works under PSD2 that have been incorporated into the level one text, so the future PSR text. But that’s essentially a copy-paste exercise. It’s not really something new. It’s just, it’s putting all those clarifications in one text. So it’s a bit easier to access laws, if you like, on SCA and to understand them.

When it comes to open banking, same thing, some evolutions, but not really revolutions, in particular for merchants. However, there are some interesting things in PSR PSD3, in particular the possibility for regulated payment service providers to exchange information with one another for the purposes of fighting fraud, something that European regulated PSPs have been asking for a long time, i.e., if one bank, for example, one PSP in Europe has detected a certain fraud type, there were laws that prevented that PSP from alerting other PSPs as to the new types of fraud that its customers were facing, for example.

And we would all agree that it would have been great for that exchange to take place so that we collectively get better at fighting fraud. But there were laws that were preventing that. One of them called the GDPR. Essentially for data protection reasons, it was not possible for the first PSP to share information with others. PSR is trying to solve that by actually allowing, actually requiring that exchange of information between regulated PSPs so that they can fight fraud together, essentially.

And also the exchange of information about fraud between regulated PSPs and non-regulated PSPs, such as very large online platforms like maybe Meta or Google or Facebook, because those actors obviously have a role to play in fighting fraud. Some of the fraud that consumers face in Europe, scams that they come across on those very large platforms, and eventually it’s PSPs that pick up the bill. So if I, as a consumer, I fall into a trap, lose my money, PSR is making it more likely that my PSP will have to refund me for the money that I’ve lost. Therefore, PSPs have said, “Hold on a minute. Isn’t it fair that Facebook or Meta or Google actually foots that bill if originally the fraud that my consumer faced and that I picked up the bill for originated from a scam he came across on Facebook or Meta or Google?”

And in order to prevent that, it will allow for the exchange of information between regulated PSPs and non-regulated PSPs, like those platforms that I mentioned, for example, to share information in order to fight fraud in the first place so that nobody has to pick up any kind of bill because there won’t be any fraud in the first place. That is a bit revolutionary, I would argue. Not necessarily for merchants, but nonetheless, a very interesting development, I think.

Samantha Gordon: Completely different way of thinking of data protection and looking at the benefits of data sharing as opposed to the risks and such a strong data protection regime.

Chris Uriarte: Yeah, Scott, those of us that have been following PSD3 and PSR now for seems like a number of years, we’ve seen the evolution and the drama associated with the back and forth and the very formal process that the EU has, which, by the way, there’s a lot of criticism maybe about the complexity and the pace of the process here very often. But at the same time, I think it’s a really interesting process and it’s a process where there is some transparency into what’s going on through kind of the formal QA that goes back and forth with the European Commission and the European Union and such, the ECB.

So it has been interesting following this, but I know we’ve recently hit some very major milestones with this legislation in just the past couple months. So could you just give us an update as to where we stand now with this, with it?

Scott McInnes: Yeah. So essentially we now have the almost final versions of the PSD3 and PSR texts. So they’re ninety-nine point nine percent final, if you like. They’re essentially going through a legal and linguistic proofreading or cleanup, if you like, before final adoption of the text by the European Parliament and the Council, so the two EU co-legislators, before the end of the year.

I don’t know when exactly the latest interval is. Maybe, well, at the latest in December 2026. Frankly, I’m a bit surprised that we have to wait until December since we have, as I said, the almost final text already. But it looks like there are technical reasons why the vote might not perhaps take place before December. But we’re definitely looking at, I think, adoption of these two texts by the end of the year. But that doesn’t mean that they immediately come into force.

The whole process is very long, as you mentioned. The original drafts, by the way, were from June 2023, so we’re already three years later now, we have to wait probably another three or four months before they actually get adopted. They get adopted, then the clock starts ticking for enforcement, and that’s an additional twenty-one months. So if we look at adoption of those texts formally, formal vote, if you like, of the text in December 2026, you then add twenty-one months, so close to two years, before the texts actually become applicable. So you’re looking at, what? 2028.

Chris Uriarte: 2028.

Scott McInnes: 2029 at this point, before the texts are applicable, right? So it takes a long time, which is part of the criticism. I mean, a lot of people say good things about the process because it’s a bit slow, but at least it gives an opportunity for people to contribute. It’s transparent, et cetera, but it takes a very long time.

And by the time we actually adopt the laws and we enforce the laws, a lot of things have changed in the marketplace. New technologies have emerged, et cetera, et cetera, and potentially you start enforcing a law that is already to some extent outdated. Not perfect.

Chris Uriarte: Yeah.

Scott McInnes: By no means.

Chris Uriarte: But we’re close, right? We’re at the 99.9 percent. We’re at the point where you upload the text to ChatGPT and you’re asking it to find find errors and inconsistencies, probably is what’s going on somewhere in Brussels right now, but we’re close to it. Yeah, so quite a while. So really from the conversation that we’re having today in July of 2026, we’re probably looking at two years from today, right, until we see implementation?

Scott McInnes: Yes.

Chris Uriarte: Super interesting. So of course we’ll be keeping track of the vote and the progress and the implementation. But I wanna switch topics for a bit to another hot button topic over the past few years that has recently reappeared in the headlines and that is the digital euro. And the digital euro, for those of our listeners who are maybe not familiar with it, is a Central Bank Digital Currency, or CBDC, that’s being proposed by the European Central Bank.

We’ve talked a lot about CBDCs on this podcast. We talk a lot about CBDCs in our Glenbrook thought leadership, in our payments boot camps, and all sorts of other discussions that we have. And just to be clear, CBDCs are actually central bank issued currencies They are fiat currencies. They’re not cryptocurrencies or the likes of Bitcoin. They are not stablecoins, just to make that clear. There’s very often a little bit of confusion there where folks say, “Oh CBDC is a stablecoin”, and that’s absolutely not the case. It’s essentially the same as cash, any other fiat currency that’s issued by the central bank.

But before we go into where this digital euro proposal stands and some of the motivations behind it, it might be good, Scott, if we get into some of the basics here. So first, my understanding is that the EU is proposing that both customers and consumers and businesses who wish to use a digital euro, the concept here is that you will essentially have a bank, a regular bank account as we’ve always had, and then you would have a separate segregated bank account that’s a digital euro account. Is that right? Is that kinda how that will work?

Scott McInnes: That’s absolutely right, and you understand that, but I wonder if the average EU consumer in the future will understand that. But that’s exactly what it is. So the idea is that you would have some kind of account or wallet in which you will be able to store your digital euros up to a certain amount, and if, whether you transact online or in a shop, you’ll be able to decide which payment method you want to use, depending on the payment methods that the merchant offers, of course, that he accepts. But one of them will probably be the digital euro, and you will decide whether you want to pay with your bank account, whether you want to pay with your card, for example, your Visa, your Mastercard, or whether you want to spend your digital euros in order to make that payment. So your digital euros would be basically a digital version of euro banknotes, that you can spend, in a shop or online, to make a payment.

Samantha Gordon: It sounds like the EU is proposing that customers, consumers, and businesses will transact sort of like any other digital wallet. Is that correct?

Scott McInnes: It is correct, with the big difference that Chris mentioned, which is I would not be using a private means of payment. I will be paying with a digital version of essentially fiat currencies. So I will be paying with public money, central bank money. That’s one big difference.

And frankly, the other big angle here is that I will be paying European when I pay with my digital euros. I will not be paying non-European. For example, I would not be paying with an American form of money, for example, Mastercard or Visa. I would be paying with a European form of money, which will be public money as opposed to private money. And frankly, that’s essentially what we’re talking about here.

digital euro is seen as a form of sovereignty for Europe, to be more independent, more sovereign when it comes to payments. Yes, we have euro banknotes and coins we can use in shops. Shops are forced to use them. But when it comes to online payments, frankly, except cash on delivery, which frankly is not very attractive, I can’t use my euro banknotes or coins when I make a purchase online. And digital euro project is about making sure that I can do precisely that, that I can use euros, to transact online as opposed to using a private form of payment, in particular, potentially a non-European, for example, US, form of payment. So that’s essentially what we’re talking about here.

Samantha Gordon: So I want to double-click into everything you just said, Scott, starting with, again, with the operational view. One of the big questions most merchants are asking is whether they’ll be forced to accept the digital euro and what the implications are for them. I mean, does this mean more integrations, more operational processes, how to account for disputes? So is the proposal such that all merchants will have to accept the digital euro since it is, as you say, fiat currency?

Scott McInnes: There are a few exceptions to the mandatory acceptance in the text, like self-employed lawyers, self-employed doctors, SMEs, et cetera. If they don’t accept a competing form of electronic payments, they will not be forced to accept the digital euro. But those are exceptions. I mean, all other normal merchants, and, in particular large merchants, very large merchants that accept competing forms of electronic payments, yes, will be forced to accept the digital euro, just like they are forced in a brick-and-mortar context to accept euro banknotes and euro coins. Absolutely.

That means that it will require some technical integration. At this stage, I don’t think we know exactly what it looks like. There are provisions in the text that are there to say, “Look, we should try to make sure that we surf as much as possible on the existing infrastructure.” So all those merchants that have a technical infrastructure, in particular in brick-and-mortar shops, like a payment terminal that accept Mastercard, Visa, maybe other forms of payment, domestic card schemes in the countries, you know, in those EU countries that have a domestic card scheme, for example, like in France or Belgium, et cetera. We should try to surf on that infrastructure to make it easier for merchants to accept those digital euros in the future. It’s not clear at this stage if or to what extent it will be possible surf on that existing infrastructure or whether something in parallel will have to be built. That is yet to be seen.

That’s why the regulation says that if and when it gets adopted, that regulation, it would have to be immediately followed by a pilot phase during which all this will be tested. That pilot phase will be supervised by the European Central Bank, ECB. The ECB has recently announced that it has already selected a few regulated payment service providers in different EU countries that will have to participate in that pilot phase so as to test things out, see how it works in terms of acceptance on the merchant side, how it works on the payer, on the consumer side.

So to test that out, through essentially trials and errors, I guess, to some extent, so that two years later, potentially by 2029, we are ready for a real live world launch of the digital euro where with, again, a few exceptions, all brick-and-mortar shops in the Eurozone and all merchants that have activities in the Eurozone are prepared to accept payments through the digital euro.

Assuming that consumers want to use it to pay them and actually understand what this baby is, as opposed to their regular card they’re used to or their bank account that they’re used to, for them to understand there’s another form of money out there, in some form of app or wallet that they can use to make their payments up to a certain amount.

Samantha Gordon: So where does this stand today? I know we’ve had some recent important announcements.

Scott McInnes: Yeah. So if you had asked me that question maybe about, I don’t know, 9, 12 months ago, I think I would have told you it’s, dead, almost dead. The commission proposed it back in 2023, at the same time it proposed PSD3 and PSR, by the way, and very quickly it got traction. EU legislators got engaged. They started editing the text, discussing about the text.

A lot of questions raised in particular on things like AML supervision and things like data protection, frankly. I mean, who sees the data related to my digital euro transactions? Is it only my regulated PSP, or will the European Central Bank or potentially other regulators get to see those transactions I’m doing with my digital euros in the future?

About a year ago, a reporter in the European Parliament issued a report on the whole proposal that was pretty damning, essentially saying, “Look, you’re trying to fix a problem here, which is that people pay too much with private means of payments as opposed to public, and too much with non-European payment methods as opposed to European payment methods. But there are many other ways to fix that problem that you’re trying to solve. The digital euro is not the plan A or plan B or frankly C or D to solve that problem. It’s probably plan M or N, whatever it is. There are other ways to fix that through other initiatives, so we should not go ahead with that digital euro as a form of retail payment. We should drop the project altogether.”

And it was a very compelling report, I thought. And at that stage, I thought the digital euro proposal was probably dead. And, like the phoenix, it rised. It came back to life, from the ashes. And now it’s very much back alive, about to be potentially adopted, i.e., the European Parliament has recently adopted the changes it wants to make to the text, but it wants this to go ahead now. And so the commission, the council and the European Parliament are now, will in the coming weeks and months, sit together and agree on the final version of the text. I don’t know when exactly, if it’s still gonna be in 2026 or potentially 2027.

But at this stage, I think there’s absolutely no doubt anymore that this thing is gonna come to life at some point. The text will be adopted, as I said, maybe this year, maybe next year. And then the pilot phase that I talked about before. And then eventually I will be issued a digital euro wallet in which I will be able, if I want to, store my digital euros in there, spend them, and see how this works.

And of course, I will try it out, as a payments geek, to see what it looks like and if it has any interest for me as a European consumer, essentially. But it’s very much gonna come to life, in the not too distant future, which is something I would not really not have bet on a couple of months ago, as I said.

Samantha Gordon: Yeah, it’s interesting as you talk about this being not plan A, B, C, because one of the big questions many have asked is what problem is the digital euro actually solving? Like if we pin it down, because we already have many electronic payment options today that are very well embedded in European consumer behavior. And I know I’ve been asking you a lot of questions about merchant application and implementation, but taking a step back, it seems like this is addressing some larger forces at work. Payment sovereignty has been a major theme over the past two years, which seems to play into the EU’s decision to move forward with this, and you’d touched on this earlier. And can you speak a bit more to that since again, it’s a different perspective than we as Americans tend to think of?

Scott McInnes: Yeah. It’s fair to say that I’m not aware of any European merchant or European consumer having ever asked for the digital euro because he didn’t have essentially enough options available to him when it comes to making payments. I mean, we do have plenty of options in Europe when it comes to electronic payments.

If you ignore cash even, we obviously have bank transfers via open banking rails or via the normal regular rails. We do have card schemes in a few European countries that operates next to Mastercard and Visa, so they’re competitors to Mastercard and Visa, and obviously we do have those two major players as well. So when it comes to making payments, whether in shop or online, I mean, we’ve got plenty as European consumers. That’s why I don’t think any European consumer has ever thought, “Hey, something’s missing here. I really miss a public way of, actually paying with euro bank notes and coins.”

Chris Uriarte: Please, please give me a CBDC. That’s really all I want is a CBDC, right?

Scott McInnes: Absolutely. Absolutely. So it is a political project, very clearly. It is a political project driven by the European Central Bank, by the European Commission, which is connected to sovereignty, as we discussed before. It is about sovereignty. It is about paying, one, with public money more as opposed to private money, and in particular with public European money as opposed to private non-European monies. That’s essentially what’s at stake here.

So in case someday someone told, maybe Mastercard, Visa, maybe others to stop servicing Europe, we’re essentially not left in the dark when it comes to payments allegedly, although again, plenty of alternatives already exist. But we would have an alternative to pay in Europe, basically. We would not be left in the dark when it comes to payments.

So it is a politically motivated project. That’s for sure. Merchants will be forced to accept it, as I mentioned before, with a few exceptions. Because merchants will be forced to accept it, merchants don’t want it to be expensive. Actually, quite the opposite. They want it to be ideally free for merchants.

Chris Uriarte: Right.

Scott McInnes: Or cheap. Cheap. And there are a lot of discussions at the moment as to how much a digital euro transaction is gonna cost the merchants. I mean, if you’re forcing me to accept this, which is quite unusual. I mean, if you’re a brick-and-mortar merchant in the Eurozone, yes, you’re forced to accept banknotes and coins, that’s for sure. But if you’re an online merchant or even a brick-and-mortar merchant, with some exceptions, you’re not forced to accept electronic means of payments at all. Nobody can force you to accept Mastercard. Nobody can force you to accept Visa. Nobody can force you to accept open banking payments.

But now somebody’s telling you, “no, even for online merchants, you will accept this.” So if I’m forced to accept it, then the quid pro quo is that it should be either free of charge, and it won’t be, but it should be cheap. But somebody’s gonna have to define what cheap means. So lots of discussions at the moment as to what cheap means.

Chris Uriarte: Yeah I that’s a very interesting aspect of this is around what the economics are gonna look like for processing. Obviously when you look at the press releases that have recently come out, they trumpet the broad participation of the likes of PSPs and processors and everybody in the value chain who’s gonna participate in these proof of concepts. But obviously they’re also in it to make money as well. And if it is a very cheap form of payment the question is how motivated are those providers gonna be to bring good robust services to the market to help make this a reality?

And the other thing I just want to note, as you’ve pointed to Scott, is that we’ve been tracking just the trend around digital wallet growth in general throughout Europe over the past couple of years. And there is a very robust and very popular set of countrycentric wallets that have just kind of exploded over the years like Bizum in Spain, Swish and Bwave, Blik in Poland and many others that are gaining traction and growth throughout member nations. And on top of this we have this pan-European Wero initiative, right, which is backed by many major banks, definitely has the support of the EU government. They love the sovereignty aspect of this, as we were talking about.

Maybe just more of a comment than a question but I mean the digital euro is entering an already crowded consumer payment landscape in Europe. And as you had said, I don’t think personally I haven’t heard of any of our merchants in Europe say “I really want this to happen, this sounds great.” It’d be interesting to see what happens here.

But let’s shift topics a bit. Sam, identity validation, electronic identity validation, big topic these days. Have a lot of challenges throughout the globe when we look at AI and a lot of the methods that we’re using related to identity validation. So the EU taking a very interesting approach, right?

Samantha Gordon: They are, and this is shifting us to another major regulatory initiative that’s being discussed in the payments sphere, which is the European Digital Identity Wallet, which as you say, Chris, is a government-backed identity wallet, and it allows citizens, individuals, and businesses to prove who they are and securely share and store official credentials such as your primary government ID. Scott, before we dig in with a couple of questions, let’s first start by talking about where we stand with this initiative

Scott McInnes: Yeah. So that’s obviously another European regulation. Again, we love our regulations here. It’s actually an update of a previously existing regulation. It was called the eIDAS regulation, so now we’re talking about the eIDAS 2 regulation, and it contains in particular that thing about the European digital identity wallet that I tend to call the EDIV.

And indeed, that’s the idea, is that I would have some kind of identity wallet in which I can store my identity credentials, whether it’s an ID card, a passport, driver’s license, things like that. So the regulation is adopted. It was adopted in 2024, I believe, we’ve seen some implementation to act. So essentially some level two texts that are either adopted already or in the process of being adopted for a formal rollout of this baby by the end of the year, 2026.

Although I’m in constant discussions with our colleagues who do a lot of work on digital identity stuff, and they tell me that, yes, some countries will be on time implementing this. Some digital identity wallets are already live actually in a few European countries. But there are other countries that clearly are going to be late or going to miss the deadline of the end of the year to roll out their digital identity wallets. So it’s gonna take time for those wallets to roll out everywhere, but it’s indeed this ambition that all EU citizens, at some point, be able to have and to rely on this EU digital identity wallet.

Samantha Gordon: So my understanding is that this is much more than what we think of as a digital wallet, right? This is really defining a full ecosystem framework to make this work because you need the credential issuers, the end users, then the other parties, the merchants, banks, government agencies, other private entities. Everyone needs to play a part.

And I’m curious, in our view, what does this mean for the banking and payments world? Specifically could this be used as part of account opening processes or to validate individuals as part of a payments transaction?

Scott McInnes: The answer is yes. So the ambition here, I mean, it’s a very ambitious project, is that whatever credentials or attributes, verified attributes as they’re called, that are stored in my future EU digital identity wallets can be used for multiple purposes, and clearly financial services, banking in particular, are listed amongst those potential use cases.

So the example you mentioned of me, for example, trying to open a bank account with a bank and the bank having to perform some kind of AML KYC on me, the idea is that in the future, I will just grant access to that bank to my digital identity wallets. I will select the things that I want the bank to see in terms the attributes that I’ve stored in my digital identity wallet, that the bank can perform that KYC in a very efficient, very convenient way for me as a consumer, as opposed to having actually download documents and forms and to print and s-send things, et cetera.

I’ll just say, “Yep, I’m happy to give you access to my passport,” for example, or my driver’s license, whatever it might be, and an invoice of some sort, for example, and boom, that will allow the bank to perform KYC on me in a very efficient way. So that, that is absolutely one of the use cases. authentication of payments is definitely another one.

So that is actually covered in the regulation too. In PSD2 today, we’ve got something that we talked about before, Strong Customer Authentication. In principle, every time I perform a payment, I push a payment, my PSP has to perform SCA on me unless it can essentially identify an exemption that avoids that SCA requirement on that particular transaction. The idea is that, if I want to in the future, I will be able to tell my PSP, “I don’t want my authentication, my SCA to be performed via face ID on my iPhone,” for example, or touch ID on my Google device, whatever it might be. I want SCA to take place via my digital identity wallet. So it’s a requirement imposed on payers, PSPs to support the digital identity wallet as a form of them complying with their strong customer authentication.

There’s been a little bit of debate, frankly. Some people have said, “Well, is it really that the regulation requires?” Because in eIDAS 2.0 they talk about strong user authentication, whereas PSD2 is about strong customer authentication. Some people are saying, “Well, is it really the same thing?” SUA, strong user authentication, and SCA. There’s been a bit of debate around that. Some discussion with the European Commission, which obviously has clarified it and said, strong user authentication in eIDAS 2.0 includes strong customer authentication for the purposes of PSD2, absolutely. So you need to implement this. And if the payer wants to be authenticated, be SCA’d via his wallet, he can do that. Absolutely.

Chris Uriarte: In the grand scheme of these incredibly complex texts, I’m sure the European Commission will clarify the meaning of some of these acronyms for sure as we move forward with it. It’s very interesting to see where this is gonna head. It’s a quite an interesting framework. Not new necessarily to a lot of different nations, as you have said, the concept of digital identity and the frameworks to support it have been around in some countries for years. Our friends in Estonia are probably looking at this and laughing they’ve had this infrastructure in place for twenty years or so, digital identity wallet. You could vote online in Estonia and validate yourself using your digital identity wallet. But we’re not all as innovative as some of these faster-moving tech-forward governments that we’ve seen over the course of the last couple of decades. But we’ll be keeping an eye on it.

Let’s take a break from some of the bigger heavy topics and do a quick very quick hits, a few quick hits before we wrap up. Europe’s faster payment system, SEPA Inst or the SEPA Instant Credit Transfer system, has been live for some time now. But I think right at the end of last year it’s been required now for all financial institutions in the EU to support both the sending and receiving of transaction those rails, right? So I can send or receive a real-time instant bank account to bank account payment to and from any bank in the EU. Is that right?

Scott McInnes: Within any bank in the Eurozone at this stage. So all banks in the Eurozone, i.e., in the countries which currency is the euro, all banks in the Eurozone have to support instant payments in terms of pushing out instant payments or receiving instant payments. That is live now. So essentially as a practical matter now, as a customer of a Eurozone-based bank, every time I push out a payment now to another bank based out in the Eurozone, the recipient receives the money within seven seconds maximum. So that’s great.

It was also part of this EU sovereignty theme. There’s a connection point there between those fast bank account payments and open banking, i.e., open banking under PSD2 was there to bring competition versus the large international card schemes. And the idea is that the combination of open banking and those really fast payments from one account to another account potentially make open banking even more attractive to consumers and or to merchants as part of this theme of EU sovereignty.

There’s a connection there. It’s gonna be expanded. So as from next year, there are deadlines for, in the Eurozone, for other regulated institutions that are not banks, that we call payment institutions and e-money institutions, to be subject to the same requirements, i.e., they will also have to support the receiving and the pushing out of instant payments. Next year also is the deadline for the players that are located outside of the Eurozone, so in the EU, but outside the Eurozone, to again, to support sending and receiving of instant payments. So it’s supposed to become the new normal in the EU, if you like, by next year.

Chris Uriarte: So we’re getting close to parity, essentially, with the faster payment system in the UK and some of the regulations there I think similar to the UK as well. We’ve been tracking BNPL regulations, Sam, this has come up again and again as well. A lot of concerns of merchants as to where BNPL reg is going.

Samantha Gordon: It does because, Scott, correct me, but similar to the UK, I believe that BNPL loans including pay in three and pay in four schemes are now fully regulated like any other kind of financing. Is that right? And any other headlines we should know of there?

Scott McInnes: They will soon be. So as from, I believe it’s November 2026, BNPL providers will indeed be regulated, that’s absolutely right, with a few exceptions. If there’s no interest being charged, for example. But otherwise, yes, they will be regulated. BNPL providers were leveraging an exemption under the law, essentially, historically that if the loan was short-term only and owe no interest, it was not regulated. But that will no longer be the case going forward as from November.

So actually any kind of lending will be regulated. That doesn’t mean the merchant itself is regulated. It’s okay for a merchant to extend some trade credit to a buyer, although even the duration of that trade credit is to some extent regulated. There’s actually a difference depending on the size of the merchants. If it’s an SME merchant, it’s essentially fifty days, I think, of trade credit. If it’s a larger online merchant, it’s only fourteen days, but that’s fine.

It’s only when a third-party player gets injected into that flow basically, and it’s a third party that provides the credit essentially to the buyer that this activity will now be regulated going forward, as I said, as from November. There’s already a problem there that we talked about before. This is a directive, it’s not a regulation, so the text is in the process of being incorporated. So the EU text is being incorporated into the national laws, and we already see differences between how it gets incorporated into different countries, so it’s already creating issues there.

But broadly speaking, yes, any kind of issuance of credit in a BNPL flow by a third party other than the merchant is gonna get regulated in terms of that provider having to do some pre-contractual disclosure to the buyer, some credit worthiness assessment of the buyer, some rules on advertising of that credit, et cetera, et cetera. yes.

Chris Uriarte: Yeah. Switching topics a bit, talk a little bit about the big tech companies. It’s really, it’s tough, Scott, being a big American tech company. I think I’ve read that last year’s total profits between the Big Six have exceeded 500 billion dollars. Tough times-

Scott McInnes: Yeah, that sounds tough.

Chris Uriarte: -In Silicon Valley of course. But we have seen a number of lawsuits, enforcement actions, and fines levied against Google and Apple in a few different areas by the European regulators. To start, the big headline that we’ve focused on the last year or two was around the NFC chip that was in iPhones, in particular that enables Apple Pay to function. Apple had historically sort of kept that within their little walled garden. You didn’t have the ability to access that and perhaps implement your own NFC-driven wallet. The regulators have changed that now.

There was a lot of speculation that perhaps there would be big waves in innovation around in-person POS payments as a result of that. But I don’t think we’ve seen that, right? Have you seen any major success stories in the European Union with Apple Pay alternatives? And I mean, just in general, are these wallet providers, are they actually regulated in any way? Because Apple’s not a bank. They’re not a payments network. They’re not a payment tender type per se. It’s a technology platform. But is there regulation that somehow governs them in any way?

Scott McInnes: The short answer is no when it comes to payment services regulations, at least. Essentially a wallet, like the Apple Pay wallet, which essentially a safe container in which I can store my card credentials, is not a regulated activity. They don’t provide a payment service. The party providing the payment service is still the entity that issues the card. That is the regulated player and the acquirer on the other side of the transaction.

But Apple being that safe container in which I can store my card details is not a regulated activity in Europe. In some previous shapes and forms of the PSD3 and PSR text that we talked about before, there were some suggestions that we should impose some types of obligations on those wallet providers to do some reporting, for example, of how many transactions flow through their wallet infrastructure, their safe container, and so on and so forth. But those didn’t make it through to the 99.9% final text that we talked about. So they’ve been dropped.

So no, if your wallet provider like Apple Pay or Google Pay or Android Pay, I can’t remember what it’s called, I think it’s Google Pay now, it’s not a regulated activity per se. And when it comes to the NFC antenna, you’re obviously right. The NFC antenna has been an issue of discussion in Europe, because it had the negative effect, to put it that way, that there was only one place in which I could store a card on an iPhone and allow that card to work in an NFC fashion in a shop, and the only place where I could store it, and it would work basically, was the Apple Pay wallet.

If I had a competing wallet on the phone, store my card in there, I could tap my phone as much as I wanted my iPhone, I could tap it as much as I want on the terminal in the shop. It would never work because that card would not have access to the NFC antenna to talk to the terminal because, well, the lack of access to the NFC chip. So that’s a topic that the European Commission has found to be a topic of antitrust concern, what we call competition law here in Europe.

Essentially the commission has forced Apple to give commitments, i.e., to voluntarily, quote unquote, “offer changes” to the way that the chip behaves to allow competing wallets in which a card would be stored to talk to the terminal through the NFC antenna. I wasn’t sure how popular that was going to be, in particular because that access to the NFC antenna for competitor is not free of charge, so it’s subject to friend requirements, It’s fair for Apple to impose certain requirements on that competitor as long as they’re fair, reasonable, and non-discriminatory, including a fee that has to be fair, reasonable, and non-discriminatory.

A lot of people were saying, “Well, look, if Apple is gonna charge me the same fee they charge me as a card issuer for an Apple Pay transaction, why would I build that competing wallet if I’m still gonna pay the same fee that I pay on an Apple Pay transaction?” So a lot of people were saying, “Well, not really attractive.” But we’ve seen a few launches. I remember one in particular, I think last year, or 18 months ago maybe, I can’t remember, Norway,

Chris Uriarte: Norway. That’s right. Yeah.

Scott McInnes: Right, yeah. Called Vipps. So that was the first launch of a competitor basically to the Apple Pay wallet, on an iPhone. In the meantime, I think I’ve seen a few announcement of companies like Curve, or Blik maybe. So it looks like there are a few instances of those wallets being built, but it’s not been a massive wave or tsunami, I think, of, competitors to the Apple Pay wallet that have been launched on the market. Certainly not.

I don’t know why exactly, but it could be related to what I mentioned before, which is the level of the fee that has to be paid, and if you still have to pay the same fee you would have on an Apple Pay transaction, then essentially why bother?

If your consumer has a great experience through the Apple Pay wallet, which in my experience is the case, it’s my Apple Pay wallet, so it’s very convenient, it’s great, then, why spend the money, to build a competing wallet, pay fees to Apple anyway that might or might not be similar to the fee on an Apple Pay transaction, and have also to convince consumers to store their card somewhere else on the iPhone and to use it, et cetera. That’s part of the answer, I’m not sure.

Chris Uriarte: We’re running short on time, but we could probably spend seven to 10 business days just talking about additional regulations that have been proposed or implemented around things like app stores, marketplaces, the payment types that are supported in app stores, and then beyond payments, all sorts of other things like ensuring that your phone has a USBC port in it and a removable battery and all sorts of fun things like that. Never a lack of regulation in the EU, no doubt. But Sam, I think when we’re talking about regulation, we of course are legally required to finish every podcast on one topic, right?

Samantha Gordon: One must. So Scott, I will ask you since it’s the law, we can’t end without talking about agentic commerce. It is the topic of the year, or at least the last couple of months. So have we seen any movement from the European regulators related to this, or are they just standing by waiting to see how this all evolves?

Scott McInnes: The EU legislator is ignoring agentic commerce entirely at this stage. I mean, obviously we’ve been talking about agentic commerce for what, 18, 24 months? It’s been the topic that everybody talks about. No single hit. If you look for agentic in the future final PSD3 PSR text, there’s no agentic in there. It’s been completely ignored.

So the requirement to do SCA on every transaction is still there. At the same time, everybody’s talking about agentic commerce, me telling an agent, “Please go online, buy me a new pair of shoes to play tennis, that color, maximum budget of X,” and somehow an invisible payment will take place without me having to do anything. Well, no. In Europe, there’s something called strong customer authentication, and unless my PSP, my bank, for example, my card issuer, can find an exemption, then I will have to do an SCA when the moment comes to pay for that pair of shoes that my agent has found online.

There’s no way around it at this stage. So that obviously to me stands completely in the way of invisible payments via an agent through agentic commerce, et cetera. I would have hoped that the EU legislator would have be brave enough to say, “Hey, this is happening.” And again, it takes a long time to adopt this text, and then twenty, twenty-one months to comply with it. Our text is very quickly gonna be outdated. Let’s do something about agentic, it’s not there. It’s not there at all.

So, somebody’s gonna have to get creative somehow, somewhere for agentic commerce to be allowed. I mean, fully agentic without me not being involved, that transaction, the payment transaction, somebody’s gonna have to get creative at some point to allow it. The European Banking Authority, the EBA, has a mandate to provide more clarity, if you like, on how the SCA requirements in the future PSD3 PSR texts are going to work. I’m sure the EBA is gonna be lobbied heavily to allow some agentic flows to take place without an SCA.

That creativity could involve a kind of mandate that I could give in advance, i.e., when I tell my agent, “Please go and buy a new pair of tennis shoes, maximum budget two hundred euros,” by the way, maybe at that stage I could give a mandate to the agent and say, “Look, this is a mandate that I’m giving. I don’t know who the merchant’s going to be yet because you, the agent, need to find that merchant, but here’s a mandate for that merchant to pull from my card, whoever that merchant is going to be. Here’s a mandate for that merchant to pull from my card via a transaction, an MIT, to pull from my card without me having to do an SCA. And I’ll do an SCA right now at the give, at the moment I’m giving you, my agent, this mandate this yet unidentified merchant.” Could be, I think, a creative solution so that when the payment takes place, I don’t need to be brought back into some kind of session to perform SCA.

I don’t know if the EBA will agree with that kind of creativity if and when they draft the level two text that allows for exemptions to SCA. But I hope they will get creative because as I mentioned before, the level one text has no creativity. It just says any payment that I initiate, SCA unless exemption. And an exemption, for example, is a low value payment below thirty euros. So that’s obviously not going to cut it. So that’s where we are I think at the moment.

Chris Uriarte: Very interesting to see. Some very, very interesting nuance in EU. But I think despite all the disparities we see amongst payment regulation across the globe, this is one thing we see in common from the regulators. Regulators are quite quiet on agentic right now as they’re waiting to see where it’s going to go.

Unfortunately, we’re out of time. But Scott, it’s always a pleasure to chat with you. Scott McInnes, who is a partner at the global law firm of Bird & Bird, joining us today to talk about EU payments regulation. So on behalf of my co-host, Samantha Gordon, and the rest of my colleagues here at Glenbrook, thanks so much for listening. Have a great day. Do good work, and we’ll talk to you next time. Bye-bye.