Simple for your customers.
Connected for your team.

PSD2 governs payment services, including authorisation, customer information, payment rights and security. Its authentication rules include dynamic linking for applicable remote electronic payments. MoneyLink’s hosted provider flow, exact amount checks and server-confirmed outcomes are relevant controls; they do not by themselves prove PSD2/SCA conformity.

To establish conformity: confirm the operator’s authorisation and service scope, safeguarding, disclosures, complaints and refund obligations, plus the provider’s SCA/3DS responsibilities and evidence. Track the PSD3/Payment Services Regulation reform and its eventual applicable transition dates.

The EU anti-money-laundering framework addresses customer due diligence, risk assessment, monitoring and suspicious-activity reporting. MoneyLink provides versioned verification, transfer evaluations, limit checks and review-case workflows. Synthetic checks in QA are not live identity verification or sanctions screening.

Operational requirements: approved risk policies, qualified data and screening providers, beneficial-ownership and PEP controls where applicable, reporting procedures, retention and trained accountable staff. Plan for the new EU AML package alongside the currently applicable national framework.

GDPR requires a lawful and accountable basis for processing personal data, with appropriate security and respect for individual rights. Encryption, access restrictions and minimised operational output support that work.

Operational requirements: controller and processor responsibilities, privacy notices, lawful bases, retention and legal holds, data-subject requests, breach response, processor contracts and safeguards for international data transfers. These require an approved privacy programme; encryption alone is not GDPR compliance.

DORA has applied since 17 January 2025 to financial entities within its scope. It covers ICT risk management, incident reporting, resilience testing and third-party technology risk.

Operational requirements: determine the operator’s scope, maintain an ICT risk framework and supplier register, assess contracts, test recovery, and establish reporting and oversight. Application audit history is useful evidence, but it is not a DORA assessment or certification.

Regulation (EU) 2023/1113 sets requirements for payer and payee information accompanying transfers of funds within its scope. MoneyLink links the customer, beneficiary and transfer revision, but payout-provider message mapping and verification must also be demonstrated.

Operational requirements: validate required information, verification rules, handling of missing details and the responsibilities of each payment-chain participant for the relevant corridor.

EU restrictive measures can limit transactions involving designated people, entities, sectors or territories. Their applicability changes with the parties and the corridor.

Operational requirements: current sanctions data, ownership and control checks, escalation and freezing or rejection procedures where required, plus corridor-specific legal review. A configured destination or a demo compliance decision does not authorise transactions to that destination.

The Instant Payments Regulation introduces obligations for in-scope euro credit-transfer services, including verification of payee, with phased deadlines. Cross-border payment rules also address charges and currency-conversion transparency.

Operational requirements: assess the institution and service scope, applicable deadlines, scheme participation, provider support and disclosures. The EUR-to-PEN demo is not evidence of SEPA Instant or verification-of-payee support.

The European Accessibility Act has applied since 28 June 2025, including to consumer banking services within scope. Accessible design should cover the complete journey, including authentication, documents, payment and support.

Operational requirements: assess scope and any applicable exemptions or transitional provisions, test with assistive technologies, document accessibility and remediate barriers. A responsive website or labelled app controls alone do not demonstrate full conformity.