Skip to content
EU VETTED

GoCardless

Payments · United Kingdom
Founded 2011 · gocardless.com

London-based UK direct-debit and recurring-payments specialist (FCA-authorised); Mollie acquisition announced Dec 2025.

GoCardless offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Payments.

Assessment notes

GoCardless Ltd (Sutton Yard, 65 Goswell Road, London EC1V 7EN; Companies House 07495895) is the UK direct-debit-and-recurring-payments specialist, FCA-authorised under the Payment Services Regulations 2017 (597190), but in December 2025 Dutch Mollie announced an acquisition agreement valuing the company at ~US$1.1B, the deal subject to regulatory approval and still not closed at the August 2026 re-verification, so the immediate ownership state is in transition; UK post-Brexit jurisdiction plus a historical cap-table mix (Permira UK + BlackRock US + Accel US + Balderton UK) results in cloud_act_exposure: material and ownership_signal: other (transition pending Mollie acquisition close); there is no self-serve DPA, though a versioned sub-processor list naming 23 suppliers is published.

Findings

CLOUD Act
Ownership
Sub-processors
23 · 17 US

Verified signals

Jurisdiction
  • EU / adequacy hosting: Yes
  • EU / adequacy operator: Yes
  • No US CLOUD Act exposure: No
Transparency
  • Public DPA: No
  • Sub-processors disclosed: Yes
  • Open-source clients: No
  • Third-party certification: No
Jump to

About GoCardless

GoCardless is a London-headquartered UK payments platform specialising in direct debit and recurring payments, operated by GoCardless Ltd (Sutton Yard, 65 Goswell Road, London EC1V 7EN; Companies House 07495895). Founded in 2011 by Hiroki Takeuchi, Tom Blomfield, and Matt Robinson, the company is authorised by the UK's Financial Conduct Authority under the Payment Services Regulations 2017 (registration 597190) and supports a uniquely broad set of bank-to-bank schemes: Bacs (UK), SEPA Direct Debit (Eurozone), ACH (US), BECS (Australia and New Zealand), PAD (Canada), Autogiro (Sweden), and Betalingsservice (Denmark). The product is positioned as the direct-debit-and-recurring-payments alternative to Stripe/PayPal, particularly strong for subscription SaaS, B2B invoicing, charities, and any business with predictable recurring billing.

Two ownership signals matter for an EU-sovereignty audit at this time. First, the historical cap table includes Permira (UK), BlackRock (US), Accel (US), and Balderton (UK) alongside other backers: mixed-jurisdiction with material US-VC exposure that, on its own, would place GoCardless in the eu_hq_us_funded-equivalent UK band. Second, and more importantly, in December 2025 Dutch Mollie announced an agreement to acquire GoCardless for approximately US$1.1B, over 90% in Mollie shares. The deal has not closed: GoCardless's own customer FAQ still describes completion as expected in mid-2026 subject to regulatory approvals, and no completion announcement existed at the August 2026 re-verification. If the acquisition closes as announced, GoCardless will become a subsidiary of Mollie B.V. (Amsterdam, DNB-licensed EMI), shifting the primary regulatory anchor from FCA to a Dutch parent, though Mollie itself carries a US-funded cap table (TCV, General Atlantic, Blackstone, Alkeon; see Mollie's listing). Ownership signals remain in transition pending acquisition close: cloud_act_exposure: material, and no self-serve DPA, though a sub-processor list is published as a versioned PDF ("GoCardless material supplier list v2026.06", accurate as of 12 June 2026) naming 23 suppliers, among them Google Cloud, AWS, Cloudflare, Segment, Okta, Zendesk, SendGrid and LexisNexis on the US side.

Pricing in GBP is volume-tiered: Standard 1% + £0.20 (capped at £4 domestic UK), Advanced 1.25% + £0.20 (capped £5, with auto failed-payment recovery), Pro 1.4% + £0.20 (capped £5.60, with fraud protection), and Custom for >£1M annual volume. International payments run on the Wise mid-market FX engine and carry an extra 0.3% on amounts over £2,000. Branding add-ons: £50/month for bank-statement branding, £150/month for fully customised checkout. Best fit: UK and EU subscription SaaS, mid-market B2B invoicing, NGOs and membership organisations collecting recurring direct debits across multiple jurisdictions. EU procurement-grade buyers needing strict EU-controlled ownership should re-evaluate after the Mollie acquisition closes or use Mollie directly for cards/iDEAL/SEPA workflows.

Sub-processor map · 23

Source
  • Amazon Web Services US
    United States

    File storage and scale computing (data location: EU-West region)

  • Braze US
    United States

    Sending operational emails

  • Celigo US
    United States

    Partner connection, NetSuite integration (data location: Germany)

  • Cloudflare US
    United States

    Optimisation and protection of the GoCardless website and API

  • Dun & Bradstreet US
    United States

    Company credit scoring and identity verification

  • Finastra Limited US
    United Kingdom

    Direct debit scheme provider software (Bacs)

  • GitHub US
    United States

    Software development

  • Google US
    United States

    Hosting the GoCardless Service on Google Cloud Platform and other cloud services (data location: Netherlands)

  • LexisNexis Risk Solutions US
    United States

    Background and AML checks, fraud prevention

  • Looker US
    United States

    Data platform and analytics

  • Mastercard Payment Services US
    Denmark

    Payment scheme operator, chargeback processing (Betalingsservice)

  • Okta US
    United States

    Employee access management and merchant authentication (2FA)

  • Provenir US
    United States

    Credit decisioning

  • Segment US
    United States

    Anonymous online event tracking and analytics

  • SendGrid US
    United States

    Sending transactional emails

  • Zendesk US
    United States

    Support ticketing software

  • Flagright non-US
    United Kingdom

    Payment screening and monitoring

  • Form3 non-US
    United Kingdom

    Direct debit scheme provider software (Bacs)

  • Onfido non-US
    United Kingdom

    Identity verification

  • Pure JAM non-US
    United Kingdom

    Support telephony service

  • Trulioo non-US
    Canada

    Identity verification

  • Vonage US
    United States

    Support telephony service

  • Wise non-US
    United Kingdom

    FX services

Source: the vendor’s published sub-processor list, read 26 Aug 2026.

17 of 23 sub-processors are US-owned or US-based. CLOUD Act exposure applies.

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-26).

Capability matrix

Table 2Capabilities of GoCardless

Card payments No
SEPA Direct Debit Yes
Buy now, pay later No
Open banking (A2A) Yes
Recurring / subscriptions Yes
Payment links Yes
In-person / POS No
Marketplace / split No

Integration & access

REST API Yes
SSO (SAML / OIDC) Yes

Compliance & governance

Audit log Yes
Self-host / on-prem option No

Pricing & tiers

Custom pricing

Contact vendor for tier or volume pricing.

View pricing page

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    gocardless.com/privacy…
    Open

Alternatives in this category

  • Adyen
    Netherlands
    EU-Hosted
    Public DPA: Yes Sub-processors: Yes Open source: No
  • Alma
    France
    EU-Hosted
    Public DPA: No Sub-processors: No Open source: No
  • Dintero
    Norway
    EU-Based
    Public DPA: Yes Sub-processors: Yes Open source: No
See all payments alternatives