How to accept payments in the EU: a detailed guide to regulations, rules and restrictions
The EU is one of the most popular new markets for businesses from various countries, ranging from the United States and Canada to Eastern Europe and Central Asia. The logical question of ‘why’ is answered by simple metrics: high security, developed infrastructure, and the purchasing power of the audience. However, along with scale and opportunities comes a large number of regulatory requirements and bureaucratic nuances. The bill_line team is online with this comprehensive guide on how to operate legally and effectively in the EU. You will learn what businesses selling goods or services need to know and what we’re dealing with as a fintech company that processes payments.
What should merchants do?
If you sell goods or services online in the EU, you need to understand the basic regulatory requirements – and there are more than enough of them. Let’s break down the main points and explain what to do.
Data protection and GDPR
Let’s start with the basics, namely data, because literally every merchant works with it in one way or another. The use of customers’ personal data is regulated by the General Data Protection Regulation (or GDPR) in accordance with EU Regulation No. 2016/679. It applies in all EU countries, and if you process customers’ personal data (name, email, payment information) – and you definitely do – then you must comply with its requirements. The website must clearly state the reasons for collecting data and specify exactly what kind of data is needed (because collecting unnecessary data is a violation of rights). The customer right to access their own data and delete it at will must also be defined.
Formatting, e-invoicing, digital commerce
If you sell between EU countries, be sure to pay attention to the rules for electronic invoicing (e-invoicing) and taxing. For example, different EU member states have different deadlines for implementing electronic invoices, which also depend on the size of the business (from mid-2026 to early 2027). The size of your business matters, so always study the regulations carefully.
bill_line’s focus is not to present our partners with a fait accompli, but to help them implement changes – sometimes is required from us to take over the processes ourselves. This is part of our overall swiss-knife knife approach, which allows both the merchant and their payment partner to earn more.
Read also: Why payments fail and how can this be changed for the better?
Registration and status
If you accept payments yourself or work with payment services, Payment Services Directive 2 (PSD2) may apply to you. Directive EU 2015/2366 also mandatory in all EU countries.
But even if you are not a financial institution but accept payments for goods/services, you must cooperate with appropriately licensed payment intermediaries. Your payment partner is responsible for this.
Strong Customer Authentication (SCA) and security
The PSD2 includes a provision on Strong Customer Authentication (SCA), which is described in the link above. This means online payments on merchant’s website or app must operate within a framework in which the payment is initiated by the legitimate card or account holder. It must include:
- two-step identification;
- risk monitoring;
- limited use of ‘simplified’ tools without SCA;
It’s important for merchants to check the legal side: if your payment provider doesn’t comply with the provisions, the risks are transferred to you.
Anti-fraud policy
In 2025-2026, merchants will be subject to increased scrutiny from regulators. For example, the new requirements state that even merchants may be held accountable for fraud under the new rules if they haven’t implemented an adequate anti-fraud system in their project.
That’s why merchants, in cooperation with their payment partners, must ensure effective transaction monitoring, customer verification, and adapt an effective incident response plan. The repeated team training on new anti-fraud measures is also required.
Working with payment services and terms
The ‘payment partner’ we’ve mentioned more than once refers to an acquiring bank, processor or payment service provider (PSP) for the merchant. Before starting work, always conduct due diligence to ensure they have the appropriate licences and security certification, your agreement regulates SCA, specifies the terms of chargebacks and allocates responsibility. Interbank commissions and card payment rules can change, so the payment partner and merchant must always be in dialogue.
bill_line regularly informs its partners about all important changes in the provision of services. Our managers often hold individual sessions to explain the reasons for and importance of certain changes.
Let’s sum up: merchant tasks
When you sell goods or services in the EU, you need to comply with auth rules, protect data, work only with licensed providers, have anti-fraud policies in place, and understand transnational requirements.
Read also: a detailed guide on how to prepare your website or app to accept payments
What should fintech companies do?
Such businesses have a broader focus. Payment companies must understand not only e-commerce processes, but also the acceptance, processing, transactions movement and financial data. That’s why regulatory requirements are more stringent. Here is what to consider.
Licences and payment services
If you provide payment services (accept, initiate, transfer payments), you are fully subject to the aforementioned PSD2. This means you must obtain a licence or be registered as a payment service provider (PSP) in the relevant country, or work under a licensed partner.
However, new regulatory changes are just around the corner, so in addition to PSD2, you should also study the upcoming Payment Services Directive 3 (PSD3), which provides for stricter requirements and monitoring. The directive has not yet entered into force, but you need to be prepared.
Consumer protection
Fintech services must disclose their tariffs, fees, and terms of use. Transparency is one of the basic requirements for payment services in PSD2 regarding the user information.
Operational resilience
Working with customers’ money is a big responsibility precisely because of the high risks involved. Transactions, data transfer – all of this imposes requirements. These cannot exist individually. To unify the latter, the EU has the Digital Operational Resilience Act (DORA), which sets requirements for the cyber resilience of financial institutions and their IT providers.
PSPs are required to have a clear 5-point operational resilience plan: risk management, related incident reporting, digital operational resilience testing, third-party risk management, and information sharing. Here you can find out more about it.
Open finance and access to accounts
Firstly, if you provide payment initiation or account information services (PIS/AIS), you must obtain the appropriate authorisations. For more details, see the link above.
Secondly, new open banking implications means that traditional banks and new players must operate under common rules, including risk management and confidentiality, which are established and maintained by the European regulator.
Anti-money laundering (AML)
If you work with payments, especially with money transfers, KYC (know your customer) procedures, transaction monitoring, and reporting to supervisory authorities are mandatory for you.
Read also: how to maintain payment security
Fintech regulations of the future and digital assets
If you work with crypto payments, tokens, and digital assets in general, pay attention to the Markets in Crypto-Assets Regulation (MiCA), which has already come into force in the EU. With this act, the European Union has established rules for digital asset service providers, making it mandatory for your daily work in the relevant jurisdiction.
Let’s sum up: fintech companies’ tasks
If you accept payments, manage financial flows, and process customer data, you need to act as a full-fledged financial institution whose responsibilities (along with opportunities) are growing every year and approaching the status of banks. A licence or regulatory charter, a stable IT infrastructure, risk control, data protection, clear terms of use, compliance with AML/CTF standards – all of this must be your focus if you don’t want to receive huge fines.
Why it matters
The EU is actively working to harmonise fintech regulation. This means fintech companies are subject to the same basic provisions as other financial institutions.
Merchants, in turn, need to understand regulatory requirements are no longer limited to banks or payment companies: in 2025 the focus will shift to merchant responsibility, especially in digital channels.
Compliance with these regulations in both business scenarios means increased customer trust, reduced risk of fines and blockages, and is also the key to operating internationally.
Read also: how to increase payment conversion
