Some payment implementations as e.g. PayPal use an external payment page, so that merchants shouldn't have to take any action. What confuses me though is a recommendation for Magento Commerce (and Open Source?) 1.x that was sent in a Magento newsletter today:
When and/or where use of 3DS 2.0 is required, Merchants will either need to replace PayPal with Braintree or upgrade to Magento 2.3.x.
I reached out to Piotr Kaminski, who is a Lead Product Manager at Magento and he replied as follows:
The PayPal integration that is in 1.x for some of the PayPal payment methods require use of Cardinal for 3D secure. The Cardinal integration only supports 3DS 1.0. PayPal Standard/Express/HSS Pro is not affected. All the others (PayFlow Pro, PayFlow Link, PP Payments Pro 2.0/3.0, PP Advanced) are affected and the recommendation is to switch to Braintree
If you payment implementation does not redirect to an external payment page, the merchant has to update or replace the payment module to be compliant with PSD2.
Here's another quote from the same Magento newsletter:
This new directive has a significant compliance impact on most payment processing services involving credit cards or bank transfers for goods & services sold to customers in the EU.