Skip to content
Independently verified · Quarterly re-audit
EU VETTED

GoCardless

VERIFIED
Payments · United Kingdom
Founded 2011 · gocardless.com ↗

London-based UK direct-debit and recurring-payments specialist (FCA-authorised); Mollie acquisition announced Dec 2025.

In short

GoCardless, in the Payments category, offers EU hosting with United Kingdom as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

GoCardless Ltd (Sutton Yard, 65 Goswell Road, London EC1V 7EN; Companies House 07495895) is the UK direct-debit-and-recurring-payments specialist, FCA-authorised under the Payment Services Regulations 2017 (597190), but in December 2025 Dutch Mollie announced an acquisition agreement valuing the company at ~US$1.1B, the deal subject to regulatory approval and expected to close by mid-2026, so the immediate ownership state is in transition; UK post-Brexit jurisdiction plus a historical cap-table mix (Permira UK + BlackRock US + Accel US + Balderton UK) results in cloud_act_exposure: material and ownership_signal: other (transition pending Mollie acquisition close); no public DPA or sub-processors list accessible at audit.

CLOUD ACT
OWNERSHIP
SUB-PROCS
25 · 19 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About GoCardless

GoCardless is a London-headquartered UK payments platform specialising in direct debit and recurring payments, operated by GoCardless Ltd (Sutton Yard, 65 Goswell Road, London EC1V 7EN; Companies House 07495895). Founded in 2011 by Hiroki Takeuchi, Tom Blomfield, and Matt Robinson, the company is authorised by the UK's Financial Conduct Authority under the Payment Services Regulations 2017 (registration 597190) and supports a uniquely broad set of bank-to-bank schemes: Bacs (UK), SEPA Direct Debit (Eurozone), ACH (US), BECS (Australia and New Zealand), PAD (Canada), Autogiro (Sweden), and Betalingsservice (Denmark). The product is positioned as the direct-debit-and-recurring-payments alternative to Stripe/PayPal, particularly strong for subscription SaaS, B2B invoicing, charities, and any business with predictable recurring billing.

Two ownership signals matter for an EU-sovereignty audit at this time. First, the historical cap table includes Permira (UK), BlackRock (US), Accel (US), and Balderton (UK) alongside other backers: mixed-jurisdiction with material US-VC exposure that, on its own, would place GoCardless in the eu_hq_us_funded-equivalent UK band. Second, and more importantly, in December 2025 Dutch Mollie announced an agreement to acquire GoCardless for approximately US$1.1B, with regulatory approvals expected to complete the deal by mid-2026. If the acquisition closes as announced, GoCardless will become a subsidiary of Mollie B.V. (Amsterdam, DNB-licensed EMI), shifting the primary regulatory anchor from FCA to a Dutch parent, though Mollie itself carries a US-funded cap table (TCV, General Atlantic, Blackstone, Alkeon; see Mollie's listing). Ownership signals remain in transition pending acquisition close: cloud_act_exposure: material, no public DPA, and no public sub-processors list until the Mollie-owned entity publishes updated disclosures.

Pricing in GBP is volume-tiered: Standard 1% + £0.20 (capped at £4 domestic UK), Advanced 1.25% + £0.20 (capped £5, with auto failed-payment recovery), Pro 1.4% + £0.20 (capped £5.60, with fraud protection), and Custom for >£1M annual volume. International payments via the Wise mid-market FX engine cost ~1% more. Branding add-ons: £50/month for bank-statement branding, £150/month for fully customised checkout. Best fit: UK and EU subscription SaaS, mid-market B2B invoicing, NGOs and membership organisations collecting recurring direct debits across multiple jurisdictions. EU procurement-grade buyers needing strict EU-controlled ownership should re-evaluate after the Mollie acquisition closes or use Mollie directly for cards/iDEAL/SEPA workflows.

SUB-PROCESSORS

Sub-processor map · 25

Source ↗
  • Amazon Web Services US
    United States

    File storage and scale computing

  • Celigo US
    United States

    Partner integration platform

  • Cloudflare US
    United States

    Website and API optimisation and protection

  • DataVisor US
    United States

    AML and fraud checks

  • Dun & Bradstreet US
    United States

    Company credit scoring and identity verification

  • Finastra Limited US
    United Kingdom

    Direct debit scheme provider software (BACS)

  • GitHub US
    United States

    Software development

  • Google US
    United States

    Hosting on Google Cloud Platform and other cloud services

  • LexisNexis Risk Solutions US
    United States

    Background and AML checks, fraud prevention

  • Looker US
    United States

    Data platform and analytics

  • Mastercard Payment Services US
    Denmark

    Payment scheme operator, chargeback processing (Betalingsservice)

  • Okta US
    United States

    Employee access management

  • Pardot US
    United States

    Sending transactional emails

  • Provenir US
    United States

    Credit decisioning

  • Segment US
    United States

    Anonymous online event tracking and analytics

  • SendGrid US
    United States

    Sending transactional emails

  • ThreatMetrix US
    United States

    Fraud identification

  • Zendesk US
    United States

    Support ticketing software

  • Creditsafe non-US
    United Kingdom

    Background and AML checks

  • Onfido non-US
    United Kingdom

    Identity verification

  • PayGate non-US
    United Kingdom

    Direct debit scheme provider software (BACS)

  • Pure JAM non-US
    United Kingdom

    Support telephony service

  • Trulioo non-US
    Canada

    Identity verification

  • Vonage US
    United States

    Support telephony service

  • Wise non-US
    United Kingdom

    FX services

19 of 25 sub-processors are US-incorporated. CLOUD Act exposure applies.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-11).
FEATURES

Capability matrix

Card payments No
SEPA Direct Debit Yes
Buy now, pay later No
Open banking (A2A) Yes
Recurring / subscriptions Yes
Payment links Yes
In-person / POS No
Marketplace / split No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    gocardless.com/privacy…
    Open ↗
ALTERNATIVES

Alternatives in this category

Adyen
Netherlands · Founded 2006
EU-BASED

Dutch publicly-listed payments giant (Euronext Amsterdam), DNB-licensed credit institution + EU/UK/US banking licences; €1.4T processed/yr.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR
Alma
France · Founded 2019
EU-HOSTED

Paris-area French BNPL for merchants: 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Dintero
Norway · Founded 2017
EU-BASED

Oslo fintech (Dintero AS): Finanstilsynet-authorised PI and, since 2025, the only Norwegian-owned direct Visa/Mastercard acquirer; checkout for e-com, marketplaces and physical retail.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR