PSD2 Penetration Testing Requirements (2026 Guide)

Here is the position every organization bound by PSD2 is in. Your competent authority (and now DORA overlap) expects independent penetration tests at least annually on your payment and authentication systems — if you can't produce a current, independent pentest report on request, you risk supervisory findings, blocked open-banking API access, and a stalled bank/partner onboarding deal.

Most teams answer this the expensive way: they buy a single, five-figure, point-in-time manual penetration test, sweat through weeks of scheduling, then hope nothing changes until the next cycle. It always changes. This guide breaks down exactly what the PSD2 penetration testing requirements demand, what an assessor needs to see, and how to stay continuously in-scope — without a five-figure invoice every time your environment moves.

PSD2 Art. 95 mandates operational/security risk management; the "how" is set by the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04, built on PSD2 Art. 95(3), applicable from 30 June 2020, consolidated May 2026). Section 3.4.7 "Information security reviews, assessment and testing" requires PSPs to run a testing programme carried out by independent testers that includes vulnerability scans AND penetration tests — at least ANNUALLY for critical systems/applications, and at least every 3 years (risk-based) for non-critical systems. For PSPs, scope must explicitly cover payment terminals/devices (POS, ATMs), authentication devices/tokens, and PSP-supplied software. Separately, from 17 Jan 2025 DORA (Reg. (EU) 2022/2554) applies to most PSPs and adds Threat-Led Penetration Testing (TLPT, RTS on TLPT) at least every 3 years for significant entities; smaller PSPs outside DORA scope continue under the PSD2/EBA guidelines. Cadence: penetration test at least annually for critical systems.

Who must comply: All payment service providers in the EU/EEA under PSD2 — banks/credit institutions offering payment services, payment institutions (PIs), electronic money institutions (EMIs), and third-party providers (AISPs/PISPs/open-banking fintechs). Larger PIs/EMIs (e.g. above the ~EUR 150bn transaction threshold) additionally fall under DORA's TLPT regime; smaller ones remain under the EBA ICT guidelines.

A compliant test has to hit the environment from two directions — the external internet-facing surface and the internal surface reachable from inside your network — and at both the network and application layers. The most common reason a first attempt fails review is incomplete scope: the public site was tested, but the internal APIs, admin panels, and the controls that isolate sensitive systems were not.

A traditional manual penetration test runs roughly $10,000–$30,000 and lands as a PDF that is accurate for about a day. Then your environment changes and you are out of coverage until the next cycle. That is a lot of money for a snapshot, and it leaves you blind between assessments.

Pentestas is pentesting as a service: an AI penetration testing system that runs PSD2-aligned internal and external tests on your environment continuously — automatically, after every deploy — starting at $79/month. It is penetration testing with AI at the core, orchestrated by frontier models (we run penetration testing with Claude for deep reasoning and cost-controlled penetration testing with DeepSeek for high-volume passes), delivered as a B2B SaaS pentest platform that maps every finding straight to the requirement it satisfies.

The platform exercises the external surface from the internet and the internal surface through a lightweight agent inside your network, so one engagement covers both directions. It tests the application and network layers, re-tests every exploitable finding after you fix it (capturing before-and-after evidence), and — because it re-runs after every change — handles the “after significant change” obligation automatically instead of turning it into a fire drill. Every finding ships with real exploit evidence, a severity rating, and remediation steps.

Bottom line: PSD2 is not satisfied by one lucky PDF per cycle. It rewards continuous coverage of the whole environment, internal and external, re-tested after every change — exactly the shape of problem an AI penetration testing system is built to solve, at a fraction of the cost of being compliant for one day out of the year.