An EU high-risk merchant account is a merchant account provided by an EMI or payment institution authorised under PSD2, priced at 3–5.5% per transaction instead of the 1.4–2.2% standard rate, built for businesses mainstream processors reject or shut down. The one thing that makes the EU different from the UK or US: a single licence, passported once under PSD2, works across every EU/EEA country — you’re not negotiating separate acquiring relationships country by country. If you’re running a high-risk business anywhere in the EU, that’s the detail worth understanding before you start comparing providers.
How Do You Get a High-Risk Merchant Account in the EU?
You get one by applying through a provider whose acquiring partner holds EMI or payment institution authorisation with EU passporting rights, having your industry-specific compliance sorted first, and expecting 5–10 business days for underwriting rather than the 1–3 days a standard account takes. Mainstream processors like Stripe or Adyen’s standard onboarding will either reject a high-risk application outright or approve it and freeze the account later once automated risk systems flag the business type. A dedicated high-risk provider prices in that risk up front instead.
What Makes an EU High-Risk Account Different From a Standard One?
Three things: who can license you, how you settle, and what fraud-prevention rules already apply. An EU high-risk merchant account works like any other merchant account structurally — your own MID, settlement into your business account, negotiated rates — but the regulatory and settlement layer on top is distinctly European.
Passporting means one licence covers the whole EU/EEA. Under PSD2, a payment institution or EMI authorised in any single EU member state can passport that licence to operate across all EU/EEA countries. Verify your acquirer’s authorisation on their home regulator’s public register before signing anything — this passporting rule is the reason you don’t need a separate provider relationship per country.
SEPA governs settlement. Euro-denominated settlement runs through the Single Euro Payments Area, using SEPA Credit Transfer or SEPA Instant rails depending on your acquirer’s setup. High-risk accounts typically settle in 2–5 business days versus 1–2 days for standard accounts, since risk holds and reserve calculations add processing time.
Verification of Payee (VoP) is now mandatory across the euro area. Since 9 October 2025, the EU’s Instant Payments Regulation has required euro-area payment providers to offer a free IBAN/name-matching check before executing SEPA transfers. It doesn’t change how your account is set up, but it’s part of the fraud-prevention layer acquirers now factor into payout risk.
PSD3 and a new Payment Services Regulation are agreed, but not yet in force. EU lawmakers finalised the text for PSD3 and a directly applicable Payment Services Regulation (PSR) in April 2026. Once published and phased in — expected roughly 18–21 months after formal publication — these replace PSD2 with a single EU-wide rulebook and tighter fraud-liability rules. PSD2 is still the operative framework today; ask any acquirer you’re evaluating how they’re preparing for the transition.
SCA already applies EU-wide. Strong Customer Authentication — two-factor authentication for most card-not-present transactions — has been mandatory under PSD2 since 2021. Selling into the UK too? The UK kept its own retained version of SCA post-Brexit that’s started to diverge slightly from the EU’s — your checkout may need to handle both.
What Industries Are Considered High-Risk for EU Merchant Accounts?
Supplements, CBD, adult content, gambling, travel, subscriptions, coaching, and crypto — the same categories flagged everywhere — plus a few triggers that are specifically EU-regulatory:
- Gambling and gaming — the EU has no single gambling regulator; licensing is handled per member state (Malta’s MGA is the most commonly used licence for operators serving multiple EU markets, alongside national regulators in Denmark, Sweden, and Germany). Acquirers check for the licence covering the specific markets you serve.
- CBD and supplements — subject to the EU Novel Food Regulation, which requires products containing novel ingredients (including most CBD extracts) to be pre-authorised before sale. Acquirers underwriting this sector check Novel Food catalogue status.
- Vaping and e-cigarettes — governed EU-wide by the Tobacco Products Directive (TPD), which sets packaging, nicotine-strength, and marketing rules acquirers verify before approval.
- Adult content — accepted by high-risk providers but excluded by nearly all mainstream processors; age-verification and content-compliance documentation speeds up underwriting.
- Crypto and digital assets — increasingly overlapping with EU MiCA (Markets in Crypto-Assets) requirements; acquirers will ask where your crypto activity sits relative to MiCA licensing.
- Forex and trading platforms — need acquirers with payment relationships that understand ESMA-aligned regulatory exposure, not generic high-risk providers.
- Subscription and continuity billing — under growing scrutiny across EU member states following consumer-protection enforcement on unclear recurring-billing terms.
What Documents and Compliance Checks Are Required to Open One?
You’ll need government-issued ID, EU business registration documents, 3–6 months of bank statements, an EU-format bank account (IBAN) to settle into, processing history if you have it, and a compliant website with a clear refund policy and terms in the languages you sell in. On top of that, expect standard KYC (know-your-customer) checks on your business’s owners and directors, and AML (anti-money-laundering) screening as part of underwriting — every EU-authorised payment institution is legally required to run these regardless of your industry, not just high-risk sectors. Sector-specific compliance — a gambling licence, Novel Food authorisation, TPD compliance — needs to be sorted before you apply; acquirers won’t underwrite without it.
High-Risk Merchant Account vs. Payment Gateway: Which Do You Need?
You need both, and they’re not substitutes for each other. The merchant account is where your funds settle and where your risk profile, rates, and reserve terms are set. The payment gateway is the technology layer that captures and encrypts the transaction at checkout and passes it through to your acquirer. A high-risk merchant account with the wrong gateway still won’t process smoothly, and a great gateway can’t fix an account that gets frozen because it was set up through a mainstream processor that doesn’t underwrite your industry.
E-Money Institution vs. Acquiring Bank: What’s the Difference?
An EMI issues and holds e-money and can process payments under its own PSD2 authorisation, without being a traditional bank — most EU high-risk providers work through EMI partners because EMIs move faster and take on risk profiles traditional banks won’t touch. A traditional acquiring bank is a licensed bank that underwrites and settles card transactions directly; slower to approve high-risk sectors, but sometimes offering lower long-term rates once a merchant has a track record. For most EU high-risk merchants starting out, an EMI relationship is the faster and more realistic path to approval.
What Does an EU High-Risk Merchant Account Cost?
Expect 3.0–5.5%+ per transaction on interchange-plus pricing, a €25–€60 monthly fee, and a 5–10% rolling reserve held for 90–180 days — roughly double the cost of a standard EU account, with underwriting taking 5–10 business days instead of 1–3.
| EU Standard Account | EU High-Risk Account | |
| Processing rate | 1.4–2.2% | 3.0–5.5%+ (interchange-plus) |
| Monthly fee | €0–€15 | €25–€60 |
| Rolling reserve | Rarely required | 5–10% held for 90–180 days |
| Settlement | SEPA, 1–2 days | SEPA, 2–5 days typical |
| Contract length | Month-to-month | 12 months typical |
| Approval time | 1–3 days | 5–10 business days |
Rates are market averages based on publicly available EU pricing data. Your actual rate depends on sector, monthly volume, chargeback history, and trading history.
How Long Does EU High-Risk Approval Take?
Typically 5–10 business days with complete documentation. Sectors needing licensing in place first — gambling, CBD — can take longer if that licensing isn’t already sorted, since acquirers won’t start underwriting until it is.
EU vs. US High-Risk Merchant Accounts: Key Differences
The biggest practical difference is licensing structure: one EU passported licence covers every EU/EEA country, while a US high-risk merchant account means negotiating acquiring relationships state by state or processor by processor with no equivalent passporting. Settlement currency, authentication rules, and gambling licensing also diverge:
| EU | US | |
| Licensing model | One EMI/PI licence, passported across all EU/EEA states | Acquirer relationships negotiated per processor, no EU-style passporting |
| Settlement rails | SEPA (euro) | ACH / wire (USD) |
| Chargeback terminology | “Chargeback” / dispute, same card network rules (Visa, Mastercard) | Same card network rules — network-driven, not country-driven |
| Authentication | SCA mandatory under PSD2 for most card-not-present transactions | No blanket 2FA mandate; card networks set their own fraud tools (3D Secure optional/risk-based) |
| Gambling licensing | Per member state (e.g. Malta MGA covers many EU markets) | Per state, generally more restrictive and fragmented |
Common Questions
Yes — that’s the point of passporting. An EMI or payment institution authorised in one EU member state can operate across the whole EU/EEA under a single authorisation, simpler than the UK or US, where cross-border acquiring relationships need separate arrangements.
Just your acquirer needs EMI or payment institution authorisation — you don’t need your own licence to accept card payments unless you’re operating as a payment service provider yourself. You do need industry-specific licensing where it applies, like a gambling licence for the markets you serve.
The same triggers as anywhere — chargeback ratios above roughly 1%, sudden volume spikes, or industry-specific compliance lapses. EU acquirers are also paying closer attention to fraud exposure now that Verification of Payee is mandatory across the euro area, and preparing internally for the tighter fraud-liability rules coming under PSD3/PSR.
Get Set Up With an EU Acquirer That Understands Your Business
DirectPayNet works with EMI and payment institution partners across the EU to place high-risk merchants with acquirers that understand their industry — not a generic risk algorithm that freezes an account the moment it scales. Talk to us.
