PSD3, eIDAS and the CX Case for One-Click Authentication

What happened

Speaking at EBAday 2026 in Copenhagen, Katja Lehr, EMEA Payments Industry and Advocacy Lead at J.P. Morgan, outlined her assessment of where European payments regulation stands — and where it needs to go. In a conversation with FinextraTV, Lehr argued that the industry is in a constructive holding pattern: with PSD3 and the Payment Services Regulation (PSR) still 18 to 24 months from implementation, there is meaningful runway to prepare and to build on an already solid regulatory foundation.

Lehr raised a pointed structural concern: the traditional ten-year review cycle for these regulations may no longer be adequate given the pace at which payments technology and consumer behaviour are evolving. Regulatory frameworks designed for one decade's landscape risk arriving out of date before they are even fully embedded.

On the opportunity side, Lehr highlighted eIDAS — the EU's electronic identification and trust services framework — alongside other digital verification initiatives as the mechanisms most likely to transform the customer journey. Her framing was direct: the industry has the tools to move from authentication processes that are, in her words, fairly clumsy, to experiences that are genuinely smooth and one-click.

Why it matters

For anyone responsible for customer experience in financial services, Lehr's remarks reframe regulation not as a compliance burden but as a design brief. The gap between where authentication sits today — friction-heavy, multi-step, often abandoned — and the one-click ideal she describes is precisely the gap that drives cart abandonment, erodes trust and pushes customers toward whichever competitor makes the process feel effortless. Behavioral economics is unambiguous on this: every additional step in a payment or verification flow is a decision point where doubt, effort and drop-off compound.

eIDAS and harmonised verification standards matter because they address the root cause rather than the symptom. Patching individual checkout flows or layering biometric shortcuts onto broken underlying processes produces marginal gains. Standardised digital identity infrastructure, applied consistently across markets, is what makes frictionless authentication structurally possible rather than a one-bank exception. Service designers should be watching the PSD3/PSR implementation timeline not as a compliance deadline but as a product roadmap milestone.

By the numbers

• 18–24 months remain before PSD3 and the Payment Services Regulation are expected to be implemented across the EU.
• Approximately every 10 years has been the traditional review cadence for these payments regulations — a cycle Lehr suggests is no longer fit for purpose.

The Renascence take

The conversation around PSD3 tends to get absorbed into compliance teams and legal briefings, which means the customer experience implications rarely reach the people who could act on them earliest. That is the real risk of the 18-to-24-month window: it gets treated as a waiting period rather than a design sprint.

The move from clumsy to one-click is not primarily a regulatory achievement — it is a service design achievement that regulation makes possible. Most operators will wait for the rules to land and then retrofit their journeys; the customer-obsessed ones will use the implementation window to architect identity and authentication experiences around eIDAS now, so that compliance and delight arrive simultaneously. The behavioral principle here is simple: perceived effort shapes trust, and trust shapes loyalty. Every organisation that treats frictionless verification as a technical checkbox rather than a brand promise will hand the emotional high ground to a competitor who understood it was both.