Klarna
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Stockholm-based Klarna Bank AB (Finansinspektionen-licensed Swedish bank): BNPL + checkout giant, 150M+ consumers, NYSE-listed since September 2025 under UK parent Klarna Group plc.
Klarna offers EU hosting in Sweden, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Payments.
Assessment notes
Klarna Bank AB (publ) (Stockholm, Sveavägen 46; Org. nr 556737-0431) holds a full Swedish Finansinspektionen banking licence since 2017 and processes for 200,000+ merchants across 17+ countries with 150M+ consumers, but the group is no longer privately held: the parent was redomiciled from Sweden to the United Kingdom as Klarna Group plc (England and Wales) and completed its IPO on the New York Stock Exchange on 10 September 2025 (ticker KLAR, priced at US$40). Sequoia Capital (US) remains the largest single shareholder at roughly 20-23%. The licensed bank entity and its Swedish supervision are unchanged, but the listing venue, the UK holding company and the US-VC anchor shareholder keep ownership_signal: eu_hq_us_funded and cloud_act_exposure: material; no public DPA or sub-processors list is accessible.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Klarna
Klarna is the Stockholm-headquartered BNPL (buy-now-pay-later) and checkout giant operated by Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm; Org. nr 556737-0431). Founded in 2005, Klarna received a full Swedish banking licence from Finansinspektionen in June 2017, making it one of the few BNPL providers with bank-grade regulatory anchoring rather than just a payment-institution licence. The company partners with 200,000+ merchants across 17+ countries, serves 150M+ active consumers globally, and offers Pay-in-3 / Pay-Later / Pay-Now / Klarna One-time-card / Klarna Card products plus a Klarna Plus subscription tier.
For an EU-sovereignty audit Klarna is in the awkward middle ground: legally a Swedish bank under Finansinspektionen supervision (strong EU anchor) but with a cap table that is heavily US-VC-funded (Sequoia Capital, Silver Lake, and others alongside Bestseller and other Nordic backers) and a listing on a US exchange. The group completed its IPO on the New York Stock Exchange on 10 September 2025 under the ticker KLAR at US$40 a share, and the parent was redomiciled from Sweden to the United Kingdom as Klarna Group plc (England and Wales). Sequoia Capital (US) remains the largest single shareholder at roughly 20-23%. The licensed bank entity and its Finansinspektionen supervision are unchanged, but the US listing venue, the UK holding company and the US-VC anchor shareholder are what set the ownership signal: EU HQ, US-funded.
Pricing for merchants is bundled into transaction fees that vary by payment method and country (BNPL ranges roughly 2.99% to 4.99% + fixed components per the Adyen comparison reference); Klarna does not charge merchant monthly fees on standard plans and offers volume-negotiated enterprise contracts. Best fit: EU retailers and marketplaces needing strong BNPL / Pay-in-3 conversion lift, especially in DACH and Nordic markets where Klarna has the strongest consumer adoption. Procurement-grade EU-only buyers concerned about the US listing venue and the US-VC anchor shareholder should weigh Adyen (Euronext-listed Dutch credit institution) or Worldline (Euronext-listed French acquirer) instead.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Klarna
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.klarna.com/international…
Alternatives in this category
-
NetherlandsEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
NorwayEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Adyen
Netherlands
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Alma
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Dintero
Norway
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |