Vixio outlines payment-rule changes with potential implications for online gambling
Regulation2 min read
A Vixio analysis describes changes to buy now, pay later rules and the EU’s proposed PSD3 and Payment Services Regulation framework, with potential effects on online gambling transactions and fraud controls. It says UK oversight of certain third-party deferred-credit products began on 15 July 2026, while the EU’s updated consumer-credit directive is due to apply from 20 November 2026 under national implementation measures.
Changes to consumer credit rules and proposed EU payment regulations may affect online gambling transactions and fraud controls, according to Vixio analyses of the rules.
In the UK, certain third-party deferred-credit products have been subject to FCA oversight since 15 July 2026. Australia introduced authorisation requirements for buy now, pay later operators in June 2025, while the EU's updated consumer credit directive, CCD2, is due to apply from 20 November 2026 under national implementation measures. The changes extend consumer credit rules to products that previously could qualify for exclusions or different treatment, particularly interest-free instalment plans. The EU rules place greater emphasis on creditworthiness checks, pre-contract information and consumer rights.
Vixio said a service's legal classification depends on what it actually does. A provider offering only a technical link between a merchant and a lender may be treated differently from one that offers credit, helps conclude contracts or manages subsequent payments. Authorities are paying greater attention to complaints, partial refunds and unpaid instalments.
The proposed EU payments package comprises PSD3, focused on authorisation and supervision of payment institutions, and the Payment Services Regulation (PSR), which would set directly applicable rules on payments, security, fraud prevention and user protection. Vixio said Council of the EU texts from October 2026 would bring payment and electronic money institutions under a common regulatory framework. Subject to conditions, transitional provisions would let authorised operators continue for up to 27 months after the rules take effect while authorities assess compliance.
The PSR proposes stronger transaction checks, more sharing of information to identify suspicious transactions and refund rights for certain impersonation frauds, subject to conditions and exceptions. Those measures would sit alongside existing EU rules on verification of transfer beneficiaries and strong customer authentication. The proposals seek to improve the reliability of open banking interfaces, make authentication systems more accessible and add safeguards for customer funds.
The payment obligations mainly concern regulated financial entities and would not automatically impose new licences or specific requirements on gambling licensees. Any effect on gambling platforms would depend on the services used, transaction characteristics and intermediaries' responsibilities. Changes to fraud controls, authentication and refunds could affect the technical and contractual processes used for digital payments.
At the time of Vixio's review in October 2026, the PSD3-PSR package had not been published in the EU's Official Journal. The main provisions were expected to apply about 21 months after entry into force, with final deadlines dependent on completion of the legislative process.