Reference🔭 Ecosystems & horizonsIntermediate⏱ 18 min read

🏪 Marketplaces and the safeguarding of funds

Collecting payments on behalf of third-party sellers is a regulated payment service: licensing, safeguarding, seller KYC, payment splits, and DAC7 reporting.

Why marketplaces are subject to specific rules

A marketplace connects buyers with third-party sellers: individuals, artisans, small businesses, or brands. It collects the buyer’s payment and then passes it on to the seller, minus its commission. Routing the money through the platform’s accounts serves three distinct purposes. It protects the buyer, since the money is released only after confirmation or delivery. It gives the seller a single point of contact for payments received, credit memos, and disputes. And it lets the platform take its commission along the way, with no separate billing and no debt recovery to organize. Throughout that time, the platform temporarily holds funds that do not belong to it. Holding those funds brings its business within the scope of payment services, which require a license or an exemption.

⚠️
Collecting on behalf of third parties is a payment service
Receiving funds intended for a third party and then paying them over is the service of acquiring payment transactions and executing credit transfers under PSD2 (transposed in Articles L. 314-1 et seq. of the French Monetary and Financial Code). France’s banking supervisor, the ACPR, spelled out that characterization as early as its position 2013-P-01. A marketplace that collects for its sellers without a license or an exemption is illegally acting as a payment service provider, even if the funds sit in its accounts for only a few hours. In France, the offense carries criminal penalties of up to 3 years in prison and a €375,000 fine. Criminal penalties are set by each member state.
  • Holding funds: the money passes through an account the platform controls, even if only for a few hours.
  • Control over the funds: the platform decides when and how much to pay out (timing, holdbacks, disputes).
  • De facto financial intermediation: the buyer’s debt to the seller is discharged as soon as the buyer pays the platform. Regulators treat this as the decisive criterion.
  • Insolvency risk: without protection, sellers’ funds would become part of the platform’s estate, available to its creditors.
≈ 2/3
of global e-commerce flows through marketplaces
Industry estimates (Mirakl, Forrester)
€175.3B
French e-commerce in 2024, a growing share of it through marketplaces
FEVAD, 2024 review
2013
ACPR position 2013-P-01 on collecting on behalf of third parties
ACPR
How funds move on a compliant marketplace
Buyer
Pays €100 by card on the marketplace
The payment is actually collected by the platform’s licensed PSP
Licensed PSP (PI/EMI)
Collects the funds and credits a payment account in the seller’s name
The funds are safeguarded, off the marketplace’s balance sheet
Marketplace
Triggers the split: €85 to the seller, €15 in commission
Via API, often after delivery is confirmed
Licensed PSP (PI/EMI)
Executes the payout to the seller’s IBAN
Provided the seller’s KYC is complete

Three routes to compliance

A platform that wants to collect for its sellers has three options, which differ in how much regulatory responsibility it is willing to take on. It can obtain its own license as a payment institution (PI) or e-money institution (EMI); it can become the agent of a licensed PSP; or it can rely entirely on a PSP for platforms that collects on its behalf. A fourth route exists, the so-called commercial agent exemption (Article 3(b) of PSD2), but its scope has become very narrow. It requires acting on behalf of only one of the two parties, the seller or the buyer, whereas a typical marketplace serves both. Under the restrictive reading imposed by PSD2 and the EBA, a platform generally cannot demonstrate this.

🏛️
Own license (PI or EMI)
The platform becomes a PSP itself, licensed by the ACPR (or by another EEA authority, with a passport). Maximum control, but a 9- to 18-month process, regulatory capital (from €125,000 for a PI), an AML/CFT program, internal controls, and ongoing reporting. Only for very large platforms (such as Amazon, through Amazon Payments Europe, an EMI licensed in Luxembourg, or Uber, through Uber Payments in the Netherlands).
🤝
PSP agent
The platform is appointed by a PI or EMI and listed in the register of agents kept by the competent supervisor (REGAFI in France). It can collect in the name and under the responsibility of its principal. Faster to implement (2 to 4 months), but the principal PSP closely monitors its agent’s compliance.
🔌
PSP for platforms (the market standard)
Mangopay, Lemonway, Stripe Connect, or Adyen for Platforms collect directly, so the marketplace never touches the funds. API integration takes a few weeks, and the PSP carries the compliance burden. This model dominates, from crowdfunding sites to B2B marketplaces.
CriterionOwn licenseAgent statusPSP for platforms
Time to implement9 to 18 months2 to 4 monthsa few weeks
Upfront costhigh (capital + application + compliance team)moderatelow (integration costs)
Regulatory responsibilityfullborne by the principal, which is fully liable for its agent’s actions (Article 20 of PSD2)borne by the PSP
Holds the fundsyes, with safeguardingin the principal’s namenever
Margin on payment flowsmaximumnegotiatedshared with the PSP
Best forvery large platformsgrowing platformsthe vast majority of cases
The three routes compared
ℹ️
EU passporting
A PI or EMI license granted in one EEA country can be passported into the other 29, with no new license required in each country of operation. Mangopay operates on its Luxembourg EMI license (CSSF), Stripe on its Irish EMI license, Adyen on its Dutch banking license, and Lemonway on its French PI license (ACPR). For the client marketplace, the PSP’s home country makes no difference day to day, but it determines which supervisor is in charge.

Safeguarding: protecting third-party funds

Safeguarding (also called ring-fencing) is the obligation for a firm to keep the funds it receives from its users separate from its own funds. It is the quid pro quo for being allowed to hold customer money. A payment institution must strictly segregate the money it receives on behalf of its users, however long it holds it. In practice, under Article L. 522-17 of the French Monetary and Financial Code for PIs and Article L. 526-32 for EMIs, marketplace sellers’ funds are deposited in a safeguarding account opened with a credit institution and kept separate from the PSP’s operating accounts.

Buyerpays €100.00€100.00licensed PSP (PI or EMI): third-party fundsSafeguarding accountat a credit institutionSeller wallet€90.00 owed to the sellerCommission wallet€10.00 owed to the platformsafeguarded = Σ wallets + commissions owedPlatform balance sheetOwn cash€10.00 commissionnever the seller's €90commission× prohibitedpayoutSellerreceives €90.00 (payout)Chargeback: €100 in one gothe buyer is refunded, the PSP claws back everything− €90: seller wallet− €10: platformthird-party funds, seizure-proofplatform commissionchargeback / prohibited flowFrench Monetary Code L. 522-17 (PI) / L. 526-32 (EMI): funds segregated by the next business day at the latest.Safeguarding ≠ deposit insurance: the funds are not covered by the FGDR, France's deposit guarantee fund.
  • Segregated deposit: a dedicated safeguarding account at a bank, no later than the end of the business day after the funds are received.
  • Alternative: investment in secure, liquid, low-risk assets, held in separate accounts.
  • Another alternative: coverage by an insurance policy or a comparable guarantee from an insurer or a credit institution.
  • Daily reconciliation: the PSP must continuously reconcile total customer balances against the safeguarded balance. Any discrepancy is a major compliance incident.
🔑
The decisive legal effect
Safeguarded funds are protected from the PSP’s creditors and fall outside insolvency proceedings. If the firm fails, they are returned to users outside the insolvency estate, with absolute priority, before any ordinary creditor is paid. The protection that marketplace sellers enjoy rests on this mechanism alone. No government guarantee backs it.
CaseSafeguards
Failure of the PSP (PI/EMI)✅ Safeguarded funds returned first, outside the creditors’ estate
Failure of the marketplace itself✅ The funds sit with the PSP, not on the platform’s balance sheet
Failure of the bank holding the safeguarding account⚠️ More complex: deposit spreading and specific coverage rules apply
Fraud or internal misappropriation at the PSP⚠️ Safeguarding reduces the risk but does not eliminate it, which is why the competent regulator supervises the firm (the ACPR in France)
Commercial dispute between buyer and seller❌ Out of scope: handled by the platform’s policies and consumer protection law
What safeguarding does and does not cover
⚠️
Safeguarding ≠ deposit insurance
A payment account at a PI or EMI is not covered by a deposit guarantee scheme, which applies only to bank accounts. In France, that scheme is the Fonds de garantie des dépôts et de résolution (FGDR, €100,000 per depositor); every member state has its own. Protection rests solely on safeguarding and prudential supervision. The PSP’s terms and conditions must spell out this distinction.

Seller KYC: onboarding under AML/CFT rules

The PSP that holds the sellers’ accounts is subject to anti-money laundering and counter-terrorist financing (AML/CFT) rules. It must identify and verify every seller before paying out any funds, a check known as seller KYC (or KYB, Know Your Business, for legal entities). How this check is run matters directly to the marketplace, for two very different reasons. A smooth sign-up process is a competitive advantage in recruiting sellers. And sloppy KYC exposes the PSP to penalties, along with the platform whose payments it processes.

  • Identity: ID document of the legal representative (for an individual, the seller themselves), verified by a document check or video identification.
  • Business existence: Kbis extract (the French certificate of incorporation) or equivalent, articles of association, address.
  • Ultimate beneficial owners (UBOs): identifying the individuals who hold more than 25% of the capital or voting rights.
  • Payout account: an IBAN in the seller’s name (name/IBAN match, reinforced by Verification of Payee, or VoP, mandatory since October 2025).
  • Screening: sanctions and asset-freeze lists, politically exposed persons (PEPs), high-risk countries.
  • Ongoing monitoring: watching for unusual flows (amounts inconsistent with the business, triangulation fraud patterns, self-purchasing).
Onboarding a business seller
Seller
Signs up on the marketplace and fills in their profile
Business identifier (SIREN number in France), legal form, business activity, IBAN
Marketplace
Sends the application to the PSP via API
Documents uploaded directly in the sign-up flow
PSP (PI/EMI)
Verifies identity, Kbis, UBOs, sanctions
A mix of automation (OCR, registry databases) and manual review
PSP (PI/EMI)
Decides: approved, more information needed, or rejected
Usually a few minutes to 48 hours
Marketplace
Enables listings and payouts
Some PSPs allow sales before KYC is complete but block payouts
⚠️
The deferred KYC trap
Many platforms let a seller start selling with light KYC, keeping payouts frozen until the file is complete. This setup backfires when funds pile up and the seller stops responding: the platform is left managing orphaned balances and complaints. The usual fix is a strict cap on pre-KYC sales, combined with automatic reminders to the seller until the file is complete.

Since 2023, these financial obligations have been joined by a tax obligation: the DAC7 directive requires platforms to collect their sellers’ income data and report it to the tax authorities (see the last section). KYC and DAC7 overlap heavily, since both require the seller’s identity, address, and bank details. A well-designed architecture therefore collects the data once (identity, SIREN/tax ID, address, IBAN) for both regimes, in a single step when the seller signs up.

Splits, commissions, and payouts

A payment split allocates a single payment among several recipients: the sellers (one cart can include several), the platform (its commission), and sometimes third parties (carrier, insurer, franchisor). Technically, the PSP credits payment accounts (often called wallets or balances) opened in each seller’s name. It then executes payouts to their bank accounts at the chosen frequency: instant, daily, weekly, or on delivery under an escrow model.

Example: creating a split payment through a platform PSP’s API
{
  "amount": { "currency": "EUR", "value": 12000 },
  "reference": "ORD-2026-84512",
  "splits": [
    {
      "account": "seller_8f3a21",
      "amount": { "value": 7200 },
      "description": "Seller A - sneakers"
    },
    {
      "account": "seller_c94d07",
      "amount": { "value": 3300 },
      "description": "Seller B - accessories"
    },
    {
      "account": "platform_fees",
      "amount": { "value": 1500 },
      "description": "Marketplace commission 12.5%"
    }
  ],
  "capture": "on_delivery",
  "payout_schedule": "T+2_after_capture"
}
  • Multi-seller cart: a single debit on the buyer’s side, N credits on the sellers’ side. The split must be accurate to the cent, including refunds.
  • Partial refund: claw back the seller’s share and recalculate the commission; some contracts let the platform keep its commission.
  • Escrow / delayed capture: funds are released only on delivery or when the cooling-off period expires, standard practice in C2C (clothing, ticketing).
  • Variable commission: by category, by seller, by promotional campaign. The split engine must be rules-driven, not hard-coded.
  • Negative seller balance: a refund issued after payout creates a receivable from the seller, to be recovered from future sales.
ℹ️
Payout timing: balancing risk against seller appeal
Two opposing forces determine payout timing. Fast payouts attract sellers, but they increase the platform’s risk exposure: the funds have already left its accounts when a cancellation, a chargeback, or seller fraud occurs. Most C2C marketplaces pay out after the buyer confirms receipt, or when the cooling-off period expires. B2B and services marketplaces pay out at D+2 to D+7, with a rolling reserve of 5% to 10% on high-risk profiles.

Providers, DAC7, and trends

Leading PSPs for platformsMangopayLELemonwayStripe ConnectAdyen for PlatformsPayPal Commerce Platform
CompanyLicense typePositioningExample clients
MangopayEMI licensed in Luxembourg (CSSF)The long-standing specialist in marketplaces and white-label wallets, with a strong presence in European C2CVinted, Chrono24, Wallapop
LemonwayPI licensed by the ACPRB2B marketplaces, crowdfunding, and regulated platforms; several hundred client platformsFrench crowdfunding platforms
Stripe ConnectEMI licensed in IrelandThe most integrated offering for SaaS platforms and the on-demand economy, with highly automated seller onboardingSaaS platforms, gig economy
Adyen for PlatformsBanking license (DNB, Netherlands)Large international platforms, integrated acquiring, omnichannelmajor retail and mobility platforms
PayPal Commerce PlatformBanking license (Luxembourg)The reach of PayPal’s buyer network, eBay heritagemid-market marketplaces
How the main providers are positioned
2007
DSP1
The payment institution license is created: collecting on behalf of third parties is no longer a bank monopoly.
2013
ACPR position 2013-P-01
The ACPR orders French marketplaces to bring their collection on behalf of third parties into compliance.
2018
PSD2 takes effect
Narrow reading of the commercial agent exemption: compliance through a PSP becomes the norm.
2020
P2B Regulation
Platforms must be transparent with their business sellers (ranking, suspension, mediation).
2023
DAC7 takes effect
Mandatory collection of seller tax data; first reports filed in January 2024.
2025-2026
Consolidation
Platform PSPs consolidate, while integrated invoicing and seller financing (embedded finance) grow.

DAC7 in practice. Every platform (marketplaces for goods, services, property rentals, or vehicle rentals) must report its sellers’ income to the tax authorities each year, by January 31. The report includes each seller’s identity, tax ID, address, and IBAN. A two-part threshold excludes occasional sellers of goods: fewer than 30 sales and €2,000 or less in the year. The data is then exchanged automatically among EU tax authorities. The marketplace must block any seller who refuses to provide tax information, which ties tax compliance to the sign-up flow described above.

✅
Key takeaways
Collecting on behalf of third parties is a payment service, and nearly every marketplace relies on a licensed PSP for platforms that safeguards the funds, handles seller KYC, and executes splits. Three architecture choices set a well-built platform apart. Sign-up data is collected once for both KYC and DAC7, so sellers never have to enter it twice. The split engine runs on configurable rules instead of hard-coded logic. And payout timing is adjusted to each seller’s risk profile instead of being applied uniformly.

Elsewhere in the world. The same mechanism, elsewhere.

Protecting funds collected on behalf of third-party sellers

In the UK, safeguarding is governed by regulation 23 of the Payment Services Regulations 2017 and regulation 20 of the Electronic Money Regulations 2011, supplemented by chapter CASS 15 of the FCA Handbook. The firm can either segregate the funds in a separate account or cover them with an insurance policy or a comparable guarantee from an insurer or a credit institution. The obligation starts as soon as the firm is entitled to receive the funds, often when they are credited to an account in its name.

https://www.fca.org.uk/firms/emi-payment-institutions-safeguarding-requirements

In the US, there is no federal license: collecting on behalf of third parties requires a money transmitter license, issued state by state, following the Conference of State Bank Supervisors’ Money Transmission Modernization Act. Section 10.03 requires licensees to hold, at all times, “permissible investments” with a market value, calculated under US GAAP, of no less than their total outstanding money transmission obligations. In an insolvency, those assets are deemed held in trust for the benefit of the holders of those obligations and are shielded from other creditors.

Conference of State Bank Supervisors, Money Transmission Modernization Act, section 10.03 — https://www.csbs.org/sites/default/files/2023-02/CSBS%20Money%20Transmission%20Modernization%20Act.pdf

Brazil

In Brazil, protection comes not from a safeguarding account but from the statute itself. Article 12 of Lei nº 12.865/2013 provides that funds held in a conta de pagamento (payment account) “constituem patrimônio separado” (form assets separate) from those of the instituição de pagamento (payment institution). They do not answer for any of its obligations, cannot be seized or attached for its debts, are not part of its assets in bankruptcy or liquidation, and cannot be pledged as collateral.

Lei nº 12.865, de 9 de outubro de 2013, art. 12 — https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2013/lei/l12865.htm

Singapore

In Singapore, the Payment Services Act 2019 requires licensees to treat the money they receive as belonging to the customer, deposit it in a trust account with a safeguarding institution, and never commingle it with their own funds. The obligation kicks in when a firm becomes a major payment institution, above the thresholds in section 6(5) of the Act: S$3 million in monthly transactions for one type of service, S$6 million for two or more, or S$5 million in daily e-money float.

Monetary Authority of Singapore, Guidelines on Licensing for Payment Service Providers (PS-G01) — https://www.mas.gov.sg/regulation/payments/licensing-for-payment-service-providers

Platforms’ reporting obligations on their sellers’ income

In the UK, the same OECD model rules are implemented by the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023: reports go to HMRC by January 31 following the calendar year. The small-seller exemption (fewer than 30 sales and €2,000, or about £1,700, or less) applies only to sales of goods, not to services, transportation rental, or property rental.

https://www.gov.uk/guidance/reporting-rules-for-digital-platforms

In the US, reporting covers gross payments rather than income, on Form 1099-K. The One Big Beautiful Bill Act of 2025 retroactively restored the previous threshold: a platform reports to the IRS only if payments to a single payee exceed $20,000 AND more than 200 transactions. Payment card transactions, however, are still reported with no threshold at all.

Internal Revenue Service — https://www.irs.gov/newsroom/irs-issues-faqs-on-form-1099-k-threshold-under-the-one-big-beautiful-bill-dollar-limit-reverts-to-20000

Australia

In Australia, the Sharing Economy Reporting Regime requires electronic distribution platforms to report to the ATO twice a year (by January 31 for July–December transactions and by July 31 for January–June), with no de minimis threshold for small sellers. The regime took effect on July 1, 2023, for taxi and ride-hailing services and short-term accommodation, and was extended on July 1, 2024, to other services (asset rental, meal delivery, digital goods). It covers services, not sales of goods.

Australian Taxation Office — https://www.ato.gov.au/businesses-and-organisations/preparing-lodging-and-paying/third-party-reporting/sharing-economy-reporting-regime

Minimum capital required of an intermediary that collects on behalf of third parties

Singapore

In Singapore, MAS requires base capital of S$100,000 for a standard payment institution and S$250,000 for a major payment institution. On top of that, a security must be posted before operations start (a cash deposit with MAS or a bank guarantee): S$100,000 if average monthly volume does not exceed S$6 million for one payment service, and S$200,000 in all other cases.

Monetary Authority of Singapore, Guidelines on Licensing for Payment Service Providers (PS-G01), tables 3 and 4 — https://www.mas.gov.sg/regulation/payments/licensing-for-payment-service-providers

India

In India, the Reserve Bank of India looks at net worth rather than capital: a payment aggregator must show ₹15 crore (₹150 million) in net worth when it applies for authorization, then maintain ₹25 crore at all times from the end of its third financial year. It must hold collected funds in an escrow account at a scheduled commercial bank and settle with merchants at T+1.

Reserve Bank of India, Guidelines on Regulation of Payment Aggregators and Payment Gateways — https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11822

In the US, the CSBS model sets a minimum tangible net worth equal to the greater of $100,000 or 3% of total assets up to $100 million, 2% of assets between $100 million and $1 billion, and 0.5% above that. Licensees must also post a surety bond equal to the greater of $100,000 or 100% of the average daily outstanding money transmitted in the state, capped at $500,000.

Conference of State Bank Supervisors, Money Transmission Modernization Act, sections 10.01 and 10.02 — https://www.csbs.org/sites/default/files/2023-02/CSBS%20Money%20Transmission%20Modernization%20Act.pdf