Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Mangopay

VERIFIED
Payments · Luxembourg
Founded 2013 · mangopay.com ↗

Luxembourg CSSF + UK FCA-EMI-licensed marketplace payments (2013), 2,500+ platforms (Vinted, Malt, Wallapop), Advent International-owned since 2022.

In short

Mangopay, in the Payments category, offers EU hosting with Luxembourg as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Mangopay S.A. (Luxembourg, founded 2013, marketplace-payments specialist for Vinted / Malt / Wallapop / Chrono24 / 2,500+ platforms) holds an EMI licence from the CSSF (Luxembourg) plus a UK EMI from the FCA (strong EU regulatory anchoring) but was acquired in April 2022 by Advent International (US private equity, Boston) with €75M primary capital injection; ownership_signal: eu_hq_us_funded, cloud_act_exposure: material (US-PE controlling shareholder) despite the Luxembourg licence; no public DPA or sub-processors list accessible at audit.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Mangopay

Mangopay is a Luxembourg-headquartered marketplace-payments specialist operated by Mangopay S.A. and founded in 2013. The product is purpose-built for two-sided marketplaces and platforms: multi-party wallet infrastructure, multi-currency accounts, FX, KYC / KYB across 16+ countries, payouts to merchants, and the regulated end-to-end flow that Stripe Connect and Braintree compete on. The customer base includes Vinted (EU's largest second-hand fashion marketplace), Malt (freelance marketplace), Wallapop (Spanish C2C), Debenhams, and Chrono24; 2,500+ platforms in total, processing €68B across 207M wallets to date.

Regulatory posture is strong on paper: Mangopay S.A. holds a CSSF (Commission de Surveillance du Secteur Financier) Electronic Money Institution licence in Luxembourg for EU/EEA passporting, plus a UK Electronic Money Institution licence from the FCA for post-Brexit UK operations. Luxembourg's CSSF-EMI framework is among the most demanding in Europe and is widely used by Fortune-500-grade fintech. Where the EU-sovereignty audit complicates things is ownership: in 2015 Mangopay (alongside Leetchi.com, the consumer-side sister product) was acquired by Crédit Mutuel Arkéa, the French cooperative bank, a clean EU-owned chapter. In April 2022 Crédit Mutuel exited and Advent International (a US private-equity firm headquartered in Boston, Massachusetts) acquired Mangopay with €75M of primary capital. The US-PE controlling shareholder results in ownership_signal: eu_hq_us_funded and cloud_act_exposure: material even though the licensed entity remains Luxembourgish.

Pricing is enterprise / volume-negotiated for marketplaces; no public per-transaction pricing applies, and starts_from_eur is left null. Best fit: marketplace and platform operators in the EU who need multi-party regulated payments and KYC at scale and accept a US-PE-owned counter-party. Procurement-grade EU-only marketplaces should consider Lemonway (FR, also marketplace-focused, listed later in this category) or build on top of Adyen / Worldline (NL/FR public-listed) instead.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-11).
FEATURES

Capability matrix

Card payments Yes
SEPA Direct Debit Yes
Buy now, pay later Yes
Open banking (A2A) Yes
Recurring / subscriptions Yes
In-person / POS No
Marketplace / split Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    mangopay.com/legal…
    Open ↗
ALTERNATIVES

Alternatives in this category

Adyen
Netherlands · Founded 2006
EU-BASED

Dutch publicly-listed payments giant (Euronext Amsterdam), DNB-licensed credit institution + EU/UK/US banking licences; €1.4T processed/yr.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR
Alma
France · Founded 2019
EU-HOSTED

Paris-area French BNPL for merchants: 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Dintero
Norway · Founded 2017
EU-BASED

Oslo fintech (Dintero AS): Finanstilsynet-authorised PI and, since 2025, the only Norwegian-owned direct Visa/Mastercard acquirer; checkout for e-com, marketplaces and physical retail.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR