Payments
Payment platforms process transactions, manage merchant accounts, and handle settlement and reconciliation. For EU buyers, the key criteria are regulatory status under EU payment law (PSD2/EMD) and whether the operator's ownership chain exposes transaction data to the US CLOUD Act. Top-rated EU options on EU Vetted include Adyen (Netherlands, 5/5) and Worldline (France, 5/5).
Payment platforms cover the infrastructure needed to accept, process, and settle financial transactions. This includes payment gateway functionality (routing transactions to the correct network), payment processing (acquiring and settling funds between banks), and in some cases issuing (providing cards or accounts to end users). The category spans full-service payment processors (Adyen, Worldline), marketplace and platform payment specialists (Lemonway, Mangopay), open banking and account-to-account payments (Volt, Trustly), and buy-now-pay-later providers (Klarna, Alma, Scalapay).
For EU buyers, payment data sits at the intersection of financial regulation and data protection law. Platforms authorised under PSD2 (Payment Services Directive) or the EMD (E-Money Directive) are supervised by EU financial regulators and must comply with GDPR as data processors. However, regulatory authorisation does not determine ownership exposure. A PSD2-licensed EU subsidiary of a US parent can still be compelled under the CLOUD Act to produce transaction records it controls. EU-incorporated public companies such as Adyen (Netherlands, 5/5) and Worldline (France, 5/5) are not subject to that direct exposure. Klarna (Sweden, 3/5) and Mollie (Netherlands, 3/5) both carry significant US investor positions in their ownership chains, which EU Vetted's editorial score reflects at the 3/5 level despite their EU headquarters.
The listings below show each platform's country of incorporation, ownership signal, hosting country where disclosed, regulatory status, and EU Vetted's editorial compliance score on a 1–5 scale. Use the filters to narrow by ownership signal, payment method support, or regulatory scope. For buyers whose primary concern is transaction data sovereignty, filter to EU-owned (5/5) platforms first; for those optimising for payment method breadth or developer experience, the full set of listings provides the broader picture.
-
AdyenVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Dutch publicly-listed payments giant (Euronext Amsterdam), DNB-licensed credit institution + EU/UK/US banking licences; €1.4T processed/yr.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
NL · 0 sub-procs Open ↗ -
WorldlineVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
French payment giant (Worldline SA, Paris-listed WLN), #4 PSP worldwide, 18k employees, free-float >90% with no controlling shareholder.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
FR · 0 sub-procs Open ↗ -
AlmaVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Paris-area French BNPL for merchants — 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
GoCardlessVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
London-based UK direct-debit and recurring-payments specialist (FCA-authorised); Mollie acquisition announced Dec 2025.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other This listing Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
KlarnaVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Stockholm-based Klarna Bank AB (Finansinspektionen-licensed Swedish bank) — BNPL + checkout giant, 150M+ consumers, US IPO pending.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
LemonwayVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Paris-based ACPR-licensed pan-European marketplace payment institution (since 2007), €12.4B 2025 volume, 400+ marketplaces.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
FR · 0 sub-procs Open ↗ -
MangopayVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Luxembourg CSSF + UK FCA-EMI-licensed marketplace payments (2013), 2,500+ platforms (Vinted, Malt, Wallapop), Advent International-owned since 2022.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
MollieVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Amsterdam-based DNB-licensed payments platform — strong European payment methods (iDEAL, SEPA), 250k+ merchants; US-VC-funded cap table.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
NL · 0 sub-procs Open ↗ -
SumUpVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
London-based mPOS fintech (originally Berlin), 4M+ SMBs, heavy US-VC funding (Goldman Sachs led €1.5B 2024); €15B IPO in prep.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
TrustlyVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Swedish open-banking A2A payment innovator (Trustly Group AB, 2008), $10B annual volume, 33+ markets; Nordic Capital + BlackRock PE owned.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
SE · 0 sub-procs Open ↗ -
VoltVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
London-based open-banking A2A real-time payments (Volt Technologies, 2019), FCA EMI, 2,500 banks across 31 territories; US-VC-led.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
ScalapayVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Milan-based Italian BNPL (Scalapay S.r.l., 2019) — 3 interest-free installments, 1,500+ merchants, 9 EU markets; US-VC-funded at $700M Series B.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗
| Compare | Owner | CLOUD Act | Cert. | Sub-procs | ||||
|---|---|---|---|---|---|---|---|---|
|
Adyen
Dutch publicly-listed payments giant (Euronext Amsterdam), DNB-licensed credit institution + EU/UK/US banking licences; €1.4T processed/yr.
|
AMSTERDAM · NL
Netherlands
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Worldline
French payment giant (Worldline SA, Paris-listed WLN), #4 PSP worldwide, 18k employees, free-float >90% with no controlling shareholder.
|
PARIS · FR
France
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
ISO/IEC 27001
|
0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Alma
Paris-area French BNPL for merchants — 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.
|
—
France
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
GoCardless
London-based UK direct-debit and recurring-payments specialist (FCA-authorised); Mollie acquisition announced Dec 2025.
|
—
United Kingdom
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Klarna
Stockholm-based Klarna Bank AB (Finansinspektionen-licensed Swedish bank) — BNPL + checkout giant, 150M+ consumers, US IPO pending.
|
—
Sweden
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Lemonway
Paris-based ACPR-licensed pan-European marketplace payment institution (since 2007), €12.4B 2025 volume, 400+ marketplaces.
|
PARIS · FR
France
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Mangopay
Luxembourg CSSF + UK FCA-EMI-licensed marketplace payments (2013), 2,500+ platforms (Vinted, Malt, Wallapop), Advent International-owned since 2022.
|
—
Luxembourg
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Mollie
Amsterdam-based DNB-licensed payments platform — strong European payment methods (iDEAL, SEPA), 250k+ merchants; US-VC-funded cap table.
|
AMSTERDAM · NL
Netherlands
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
SumUp
London-based mPOS fintech (originally Berlin), 4M+ SMBs, heavy US-VC funding (Goldman Sachs led €1.5B 2024); €15B IPO in prep.
|
—
United Kingdom
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Trustly
Swedish open-banking A2A payment innovator (Trustly Group AB, 2008), $10B annual volume, 33+ markets; Nordic Capital + BlackRock PE owned.
|
STOCKHOLM · SE
Sweden
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
ISO/IEC 27001
SOC 2
|
0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Volt
London-based open-banking A2A real-time payments (Volt Technologies, 2019), FCA EMI, 2,500 banks across 31 territories; US-VC-led.
|
—
United Kingdom
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Scalapay
Milan-based Italian BNPL (Scalapay S.r.l., 2019) — 3 interest-free installments, 1,500+ merchants, 9 EU markets; US-VC-funded at $700M Series B.
|
—
Italy
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ |