PayPal: how it works and what merchants pay
PayPal is a staged wallet. In a staged wallet, the payment breaks down into two successive transactions. The customer pays PayPal, which then funds the payment from the stored source: a card, a bank account by direct debit, or the PayPal balance. The merchant never sees the customer’s payment details, only an email address and a PayPal payment guarantee. PayPal is licensed as a credit institution in Luxembourg, supervised by the CSSF, and operates in France under an EU passport.
| Transaction type | Fee | Notes |
|---|---|---|
| Standard domestic payment | 2.90% + €0.35 fixed fee | Well above a standard card MSC (0.5%–1.5%) |
| Cross-border payment | +1.29% to 1.99% surcharge | Depends on the payer’s region |
| Currency conversion | 3% to 4% FX markup | Over the reference rate |
| Dispute fee | ≈ €14 per dispute lost or left unanswered | On top of any refund |
Merchants pay more than they would for card acquiring, and in return they get conversion. PayPal has more than 400 million active accounts worldwide and offers a two-click checkout with no card number to type. The Buyer Protection attached to these transactions eases shoppers’ hesitation on an unfamiliar site. In C2C, secondhand, and cross-border sales, not offering PayPal costs more in lost sales than the fee itself.
Merchants face two dispute tracks. The customer can open a dispute in PayPal and, when the funding source is a card, can also file a chargeback with their bank. In that second case, PayPal passes the scheme procedure on to the merchant, following the cycle described below.
BNPL: the model, the risks, and how Klarna, Alma, and Oney are regulated
BNPL (buy now, pay later) covers installment plans (pay in 3 or pay in 4) and deferred payment of 15 to 30 days. The provider pays the merchant the full amount when the order is placed, so the merchant is paid upfront and guaranteed, in exchange for a fee of 1.5% to 6%. The consumer often pays 0%. The merchant bears the cost and weighs it against the lift in average order value, typically +20% to +60% on financed orders.
| Company | Origin / status | Products | Merchant fee (indicative) | Distinguishing feature |
|---|---|---|---|---|
| Klarna | Sweden, licensed bank | Pay in 3 or 4, deferred, Klarna account, shopping app | 2% to 5% + fixed fee | Global volume, strong consumer app; went public in 2025 |
| Alma | France, finance company and payment institution | Pay in 2, 3, 4, 10, or 12; deferred; B2B | 1.5% to 4% depending on volume and number of installments | French leader, strong in brick-and-mortar retail and PSP integrations |
| Oney | France, bank (BPCE/Auchan group) | Pay in 3 or 4, a long-time staple of mass retail | 1.5% to 2.5% | Pioneer of in-store pay-in-3 by card; strong retail presence |
Three risks are now well documented. Loan stacking across several platforms escapes any consolidated view of household debt. Late fees make credit advertised as free more expensive. Approval rests on instant scoring built on limited data. Regulators therefore see BNPL as consumer credit in all but name.
SEPA direct debit, credit transfers, and pay by link
SEPA Direct Debit (SDD) is a creditor-initiated payment: the creditor debits the debtor’s account under a mandate the debtor has signed. It remains the backbone of recurring payments. Two schemes coexist, built on opposite logic.
| Criterion | SDD Core | SDD B2B |
|---|---|---|
| Debtor | Consumers or businesses | Businesses only |
| No-questions-asked refund | 8 weeks after the debit, no reason needed | No refund right |
| Unauthorized transaction | Disputes up to 13 months | Also 13 months, but the mandate is checked upfront |
| Mandate check by the debtor’s bank | Not required | Required before any debit (mandate registration) |
| Typical use | Subscriptions, bills, energy, telecoms | Commercial rent, suppliers, B2B payment plans |
- Standard credit transfer (SCT): the workhorse of B2B and invoice payments, free or nearly free, but settled on D+1 (business day) and initiated by the payer. Its built-in weakness, having to wait and then reconcile, is exactly what instant payments and Verification of Payee (VoP) fix.
- Pay by link: the merchant sends a payment page URL (by SMS, email, or WhatsApp), a popular option for remote sales without a website (tradespeople, quotes, collecting overdue invoices). Technically, it is a PSP-hosted payment page, usually for card or credit transfer.
- Request to Pay (SRTP): the EPC scheme for structured payment requests. The creditor sends a request, the debtor approves it in their bank’s app, and an SCT or SCT Inst goes out in response. It is a key building block for future invoicing flows and one of the rails under consideration for A2A e-commerce.
Pay-by-bank and open banking
PSD2 created the payment initiation service provider (PISP) license. With the customer’s consent, this licensed third party can initiate a transfer from the customer’s bank account via API. Combined with SCT Inst, which the EU Instant Payments Regulation (IPR) made universal and priced no higher than a standard transfer, the PISP license makes pay-by-bank possible. The customer pays the merchant straight from their account, with no card, using strong authentication in their banking app.
Leading providers include Tink, acquired by Visa, TrueLayer, Token.io, and, in France, Fintecture and Bridge. B2C adoption remains modest: the redirect to the bank lengthens checkout, and a transfer carries no buyer protection. Adoption is taking off in B2B and high-ticket purchases, such as invoice payments, cars, and travel. In those segments, the savings over cards are large and paying by transfer is a familiar habit.
Crypto-assets and stablecoins under MiCA
Crypto payments remain marginal in European commerce. Their legal framework is now set by the MiCA regulation (Markets in Crypto-Assets, EU 2023/1114). For payments, what matters is the fiat-backed stablecoin, legally an e-money token (EMT), the only kind stable enough for merchants to accept. Its value tracks the reference currency; without that peg, a merchant could neither display a price nor collect the matching amount.
Merchants accept crypto through crypto PSPs such as Binance Pay, BitPay, or, in France, Lyzi, which handle instant conversion to euros. The merchant shows a price in euros and receives euros, with no volatility and no crypto on its balance sheet. The licensed provider carries the AML/CFT obligations, including the travel rule and KYC.
Meal vouchers and gift cards
In France, the titre-restaurant is an employer-subsidized meal voucher, a payment instrument restricted to a specific use. The employer funds 50% to 60% of it, exempt from payroll charges up to a cap revised each year. Historically paper-based, the market has largely moved to cards and mobile. Edenred, Pluxee (formerly Sodexo), Up, and Swile share most of the roughly 5 million employees who use them. Card acceptance runs on the Conecs network, the interbank “scheme” for digital meal vouchers, which POS terminals route as a dedicated payment application.
- Spending limit in France: €25 per day, for food purchases only; usable on weekdays (Sundays and public holidays only if the employer allows it).
- The exemption allowing the purchase of any food product in supermarkets, including items not ready to eat, has been extended by law through the end of 2026, while a structural reform of the system is still under discussion.
- For the merchant: an acceptance fee specific to the meal voucher network (historically 3% to 5% on paper, lower on cards), with reimbursement within a few days.
Gift cards work differently. They are closed-loop instruments, usable at a single retailer or within a limited network. They benefit from PSD2’s “limited network” exclusion, transposed in France into Articles L. 521-3 and L. 525-5 of the Monetary and Financial Code. No payment institution or e-money license is required. France does, however, require notification to the ACPR once volume exceeds €1 million over 12 months. By contrast, a gift card usable anywhere, running open-loop on the Visa or Mastercard network, is legally e-money and subject to the related KYC limits.
Elsewhere in the world. The same mechanism, elsewhere.
Bringing installment payments under consumer credit rules
Unregulated deferred payment, renamed “deferred payment credit,” comes under Financial Conduct Authority supervision on July 15, 2026, under the final rules in policy statement PS26/1. From then on, lenders must give consumers the information they need to make an informed decision, lend responsibly and affordably, and support customers in financial difficulty.
Financial Conduct Authority, “Regulating Buy Now Pay Later” and PS26/1, https://www.fca.org.uk/firms/regulating-buy-now-pay-later
Since June 10, 2025, any credit activity involving a BNPL contract has required an Australian credit license with the matching authorizations, under the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024. The act creates a separate category, the “low cost credit contract,” whose providers can opt into lighter responsible lending obligations. Membership in AFCA, the financial ombudsman service, has been required since the same date.
ASIC, “Buy now pay later credit contracts: Credit licensing,” https://asic.gov.au/regulatory-resources/credit/buy-now-pay-later-credit-contracts-credit-licensing/
The trend has reversed. On May 22, 2024, the CFPB issued an interpretive rule that treated the digital account used to access a BNPL loan as a credit card and applied Subpart B of Regulation Z to it. The CFPB withdrew that rule on May 12, 2025, along with several other guidance documents. Firms can no longer rely on it, and no specific federal rule governs BNPL.
Consumer Financial Protection Bureau, “Buy Now, Pay Later (BNPL) Products,” https://www.consumerfinance.gov/compliance/compliance-resources/consumer-cards-resources/buy-now-pay-later-bnpl-products/
Payer control over recurring debits: advance notice, disputes, and mandate withdrawal
The Reserve Bank of India requires the issuer to notify the customer at least 24 hours before each recurring debit, stating the merchant name, amount, date, and mandate reference. Additional authentication is required only above ₹15,000 per debit (₹100,000 for insurance premiums, mutual fund subscriptions, and credit card bill payments). The customer must be able to change the mandate’s duration, withdraw it at any time, or decline a single debit.
Reserve Bank of India, Master Direction on e-mandates and recurring transactions, https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13374
There is no no-questions-asked refund comparable to the eight-week window of SEPA’s SDD Core. Regulation E covers only unauthorized debits, on a sliding scale of deadlines. If the consumer reports within two business days of discovery, liability is capped at $50; after that, it can reach $500. A consumer who fails to report an unauthorized debit within 60 days after the statement is sent bears any later debits.
12 CFR § 1005.6 (Regulation E), https://www.law.cornell.edu/cfr/text/12/1005.6
Protection comes from a voluntary code, not from statute. The ePayments Code, administered by ASIC, sets who bears losses from unauthorized transactions and provides a recovery process for mistaken internet payments. It covers cards, EFTPOS, online and mobile banking, and BPAY. It protects only customers of institutions that subscribe to it, which consumers have to check for themselves.
ASIC, “ePayments Code,” https://asic.gov.au/regulatory-resources/financial-services/epayments-code/
Dedicated food payment instruments: limits, format, and merchant rules
Belgian meal vouchers are electronic only and issued in the worker’s name, credited to a dedicated meal voucher account. To remain exempt from ONSS social security contributions and from tax, the employer’s share cannot exceed €8.91 per voucher, and the worker must contribute at least €1.09. Vouchers are valid for 12 months from the credit date, or 3 months for a voucher reactivated after expiry.
SPF Emploi, Travail et Concertation sociale (Belgium’s federal labor ministry), “Titres-repas” (Royal Decree of November 28, 1969, Art. 19bis; Art. 38/1 CIR 92), https://emploi.belgique.be/fr/themes/remuneration/titres-repas
Decree No. 11,678 of August 30, 2023, which amends Decree No. 10,854/2021 governing Brazil’s Workers’ Food Program (Programa de Alimentação do Trabalhador), targets the sector’s shadow economy. It bars issuers from paying invoices, bills, or payment slips on employers’ behalf, including through points programs (Art. 175, § 4º, I), and bans any cashback-style rewards program (Art. 175-A). Employees can have their credited balances moved to another provider free of charge (Art. 182).
Decreto nº 11.678, de 30 de agosto de 2023, https://www2.camara.leg.br/legin/fed/decret/2023/decreto-11678-30-agosto-2023-794644-publicacaooriginal-169069-pe.html
Vales de despensa (grocery vouchers) are deductible from corporate income tax only if they go to all employees through a monedero electrónico (e-wallet) approved by the SAT, Mexico’s tax authority, with a CFDI (electronic invoice) carrying the “vales de despensa” complement (Art. 27, Section XI, LISR). The wallet cannot be used to withdraw cash, buy alcohol or tobacco, or pay water, electricity, or phone bills, and it works only at affiliated merchants in Mexico.
Servicio de Administración Tributaria, “Preguntas frecuentes: monederos electrónicos de vales de despensa,” https://www.gob.mx/sat/acciones-y-programas/preguntas-frecuentes-monederos-electronicos-de-vales-de-despensa