On 1 August 2025, the CJEU issued a landmark ruling in *IL v. Veracash* (C-665/23), clarifying how PSD1 and PSD2 govern liability for unauthorised transactions. The Court confirmed that customers must notify both without undue delay and within 13 months, but that reimbursement can only be denied where intent or gross negligence is proven. This judgment provides important guidance for banks, fintechs, and payment providers on balancing consumer protection with effective risk management.

The National Bank of Hungary (MNB) acting as financial conduct authority has issued a position on the interpretation of PSD2. MNB analysed the activity of  an online e-commerce platform portal whether it qualifies as a payment service. The excemptions PSD2 provides were analysed in this case.