For years, payments transformation was relatively easy to justify. Investments in digital channels, faster payments and open banking were often linked to customer growth, new products or operational efficiencies. Today, many banks face a different reality.
A growing share of payments investment is now driven by regulation rather than commercial ambition. Banks and payment service providers are expected to invest in capabilities that regulators require, customers increasingly expect as standard and competitors already offer.
In conversations across the industry, we consistently see concerns about rising regulatory investment. This raises an important question: how can institutions turn mandatory change into business value?
Three recent European regulations bring this challenge into focus. While each requires significant investment, each also creates opportunities for banks and payment service providers that see compliance as more than a regulatory obligation.
Instant Payments: the foundation for new services
One of the major transformations for banks is the EU's Instant Payments Regulation (IPR), which came into force in 2024, with deployment extending through 2025.
Instant payments had been available in many markets for years. However, the regulation accelerated adoption by requiring banks to offer instant euro payments under the same conditions as traditional credit transfers. The introduction of Verification of Payee (VoP), mandatory for euro-area providers from 9 October 2025, further increased the complexity of implementation.
To deliver these requirements, participating banks had to make significant changes not only to payment architecture but also to sanctions screening, fraud controls, customer channels and operational support models.
The challenge is that instant payments are increasingly becoming a standard service rather than a premium offering. Under the IPR, charges for instant euro payments cannot exceed those applied to traditional credit transfers. As a result, many banks face substantial implementation costs without a clear revenue opportunity.
While real-time payments offer limited monetization on their own, banks that treat instant payments as infrastructure rather than the end product will be well positioned to create new revenue over the long run. As a foundation, instant payments open the door to value-added services such as instant merchant refunds, real-time corporate treasury services and Verification of Payee services for third-parties.
PSD3 and PSR: preparing for a new liability landscape
The forthcoming PSD3 and Payment Services Regulation (PSR) framework reinforces a broader regulatory trend towards stronger customer protection, fraud prevention and ecosystem trust.
The rising cost of payment fraud is one of the main reasons regulators are introducing stricter rules. Across the European Economic Area, payment fraud reached €4.2 billion in 2024, up 17% year on year, with authorized payment scams becoming increasingly common.1 In many of these cases, customers who are tricked into authorizing a payment still bear most of the financial loss.
The direction is clear. Liability is shifting steadily towards payment service providers. As a result, banks are expected to strengthen fraud controls, improve customer transparency and deliver more consistent protection against payment scams. As proposed reimbursement obligations expand and expectations around fraud prevention become more prescriptive, payment service providers will need to invest heavily in behavioral analytics, mule account detection, real-time monitoring and customer intervention capabilities.
While these investments require significant time and resources, they also create real value. Stronger fraud prevention helps banks build customer trust, reduce operational disruption and prepare for evolving regulatory requirements. Capabilities such as behavioral analytics, mule account detection and real-time fraud intervention help banks stop more scams before money leaves an account, reduce reimbursement costs and strengthen long-term customer relationships.
For a more detailed look at these rules, see Capco's PSD3 and PSR: eight areas of impact on banks and payment providers and Strengthening fraud prevention and consumer protection in digital payments.
DORA: operational resilience as a competitive advantage
The Digital Operational Resilience Act (DORA) represents another major investment area.
While not exclusively focused on payments, DORA has significant implications for payment operations and technology platforms. As payment services become increasingly real-time and always-on, operational resilience is no longer simply a technology concern. It is becoming a core requirement for maintaining customer trust and meeting regulatory expectations.
Early experience with DORA has shown that resilience depends on more than technology. Banks also need reliable, high-quality data to identify risks, report incidents and demonstrate compliance. During the first industry testing exercise, only 6.5% of registers met all the required data-quality standards, which highlights how much work remains.
With DORA, banks must demonstrate stronger controls around third-party risk, incident management, operational resilience testing and business continuity.
As customers increasingly expect payment services to be continuously available, the resulting resilience will contribute to trust, retention and operational efficiency. As many institutions continue to mature their DORA capabilities, early adopters have an opportunity to simplify their technology landscape while strengthening both regulatory readiness and customer confidence.
Rethinking the business case
Recent regulatory initiatives focus on improving customer experience while laying the foundations for the future of payments. Banks increasingly find themselves in the unusual position of investing in major transformation programs with no clear path to monetization.
Industry estimates suggest that European banks collectively invested billions of euros in implementing PSD2 and Open Banking capabilities. Similar levels of investment are now being directed towards instant payments, fraud prevention, resilience and regulatory reporting. Yet, unlike many previous transformation programs, the commercial benefits are often indirect and difficult to monetize.
Ultimately, banks should avoid treating each regulation as a standalone compliance exercise. The most successful organizations are using mandatory change programs as opportunities to modernize payment architectures, simplify technology landscapes and strengthen data capabilities. Capco's Payment Trends 2026 sets this shift in its wider market context.
Instant Payments establish the infrastructure for new real-time services. PSD3 and PSR encourage fraud capabilities that reduce future liability and strengthen customer trust. DORA provides an opportunity to build more resilient and efficient operations.
Institutions that successfully link regulatory investment with commercial strategy will be better positioned to improve customer experience, increase operational efficiency and create long-term competitive advantage.
How Capco can help
Capco works with banks and payment service providers across the full lifecycle of payments transformation and regulatory change.
Our teams help clients assess the impact of emerging regulations, define target operating models, modernize payment infrastructures and deliver complex implementation programs across Instant Payments, Verification of Payee, PSD3/PSR, fraud prevention, ISO 20022 and operational resilience.
Most importantly, we help organizations move beyond a compliance-only mindset. By aligning regulatory initiatives with broader transformation objectives, banks can use mandatory investment programs to improve efficiency, strengthen customer experience and build more resilient payments capabilities for the future.
Contact us to discuss how you can approach compliance as a catalyst for transformation rather than purely an obligation, to be best positioned to create long-term value.