1. Introduction
PayPal began in 1998 under the name of Confinity and with a narrow focus on ecommerce payments. It was originally founded to facilitate payments between any two parties with email addresses. No costly credit card accounts or merchant terminals were needed.
PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority (FCA) as an electronic money institution (firm reference number 994790). Access to PayPal’s services is contingent upon certain technical requirements. In particular, users must possess an appropriate device—such as a smartphone, computer, or tablet—and maintain a functional internet connection. At its core, PayPal functions as a two-sided platform, connecting consumers who are looking for convenience and safety when conducting their transactions, with merchants requiring reliable payment solutions. With its intermediate role, PayPal makes online shopping feel seamless while making sure they get a piece of the action from both sides. This puts them in a debated spot legally; they aren’t exactly a bank, but they’re definitely more than just a software company.
They’ve become this strange hybrid that processes your data, moves your money, and basically acts as its own judge and jury. PayPal’s global reach requires a sophisticated corporate and regulatory structure. Through the work of jurisdiction-specific subsidiaries, the platform is able to comply with diverse legal regimes while maintaining a unified user experience. This fragmented yet coordinated structure enables PayPal to leverage regulatory differences across regions, balancing compliance requirements with operational flexibility. At the same time, it highlights the growing tension between national regulatory frameworks and the borderless nature of digital financial services.
This article examines PayPal through a comprehensive legal and structural lens, analysing its role as a platform intermediary, its corporate and regulatory design, the mechanics of its payment flows, and its contractual architecture. In doing so, it aims to assess whether PayPal’s current classification adequately reflects its systemic importance, or whether a rethinking of its regulatory treatment is necessary in the evolving landscape of digital finance.
2. PayPal as a Platform Intermediary
PayPal’s core business consists in the issuance of electronic money and the provision of payment services using that electronic money. Through its platform, users are able to make online and in-store payments, donations, along with sending, requesting and receiving electronic money.
In addition to these core functions, PayPal offers a range of supplementary financial and related services.
PayPal is a platform intermediary, since it establishes the bridge between the consumers who want a fast, secure way to pay and the merchants who want reliable payment acceptance with minimal friction, along with help in navigating the digital economy. Therefore, it has as customers both individual consumers and businesses (a unique feature of PayPal). This institution can be part of the interactions that both sides of this network have with each other.
PayPal plays a crucial role in the moment of transactions, since on one side businesses need the basic information of who’s conducting the transaction, but on the other, the shopper is under no obligation to provide said financial information. Accordingly, it is PayPal the one guarding these financial details, since the information is encrypted.
In addition to facilitating transactions, PayPal is an advantageous platform altogether for both sides. Consumers want convenience, speed, security, privacy and benefit from buyer protection and dispute resolution. Merchants want higher conversion rates and global reach, aim to avoid fraud and accept fees in exchange for reduced complicity. As a result, a self-reinforcing loop is established since if more consumers adopt PayPal, then more merchants do so as well, and on the other side, more merchants make PayPal become more useful for consumers.
What is more, for many, PayPal is deemed as a better option than a traditional bank. Most of the interest comes from younger bankers who search for mobile options for more real-time accessibility, personalization, advanced services and money-saving options. We can better understand this, by looking at the pros of PayPal. Firstly, it is possible to apply for a PayPal credit card and use the mobile app to access money 24/7. Secondly, the lack of need to provide personal banking information, which offers an extra level of security against fraud. Thirdly, it allows for multiple payment options, since it allows users to carry a specific PayPal balance, liking existing savings or checking accounts. Lastly, some merchants offer promotions to those consumers who pay using PayPal, among others. These allow us to understand why PayPal is a preferred method, since it is more of a technology-driven coordination layer, when compared to the traditional bank. Despite this, PayPal has been facing intense competition in the payments landscape, ever since the entry of Big Tech firms and newer entrants such as Klarna and Stripe. Big Tech firms, such as Apple and Google, for example, are embedding payments into ecosystems people already use daily, leading them to gain competitive advantage over PayPal in terms of already having a built- in user base, over control over hardware and software system and over seamless integration. PayPal, by contrast, is a standalone platform that people must actively choose to use. Moreover,
Big Tech companies possess broader behavioural and ecosystem data, whereas PayPal only has transaction data. However, when it comes to cross-platform flexibility, to merchant relationships, global reach and trust and brand, PayPal still remains very strong.
As to combat the strong influence of the Big Tech firms PayPal is making some adaptations by expanding into “super app” wallet features, by offering the Buy Now, Pay Later feature, providing its users with more flexibility, by deepening merchant tools and subscriptions.
3. Corporate and Regulatory Structure
3.1. Group Structure
PayPal operates through local subsidiaries that hold the necessary licenses, as to function properly in the specific jurisdiction. Each subsidiary has a specific regulatory role tied to local laws, licensing and the type of service provided. The subsidiaries operate as one platform, from the perspective of the users.
PayPal’s subsidiaries, which are the companies that PayPal owns, either fully or through majority ownership are the following: Venmo, Honey, Xoom, Paidy, Braintree, Zettle,
Hyperwallet, Simility, PayPal Digital, Inc and Curv. By bringing in innovative companies, PayPal stays a leader in payment technology, offering faster and safer solutions for businesses and customers. We can better comprehend the role of subsidiaries by understanding the specifics of some of them.
To start with, Venmo is one of PayPal’s key consumer-facing products, whose focus in on peer-to-peer payments and its usage is more frequent between younger users and in social contexts. It helps PayPal by capturing younger demographics early and by competing with apps like Cash
App and Apple Cash. It’s part of the broader ecosystem along with: Braintree (merchant infrastructure) and Xoom (international remittances). Secondly, we can consider Honey an online coupon and discounting company that offers a browser extension which automatically applies promo codes at checkout on e-commerce sites. Its acquisition by PayPal fulfils a double goal: enhancing the convenience of the shopping and payment process for its users, while also boosting customer engagement and sales for merchants. Thirdly, we can analyse Xoom’s Corp. relevance.
Xoom is an international payment processing company which allows users to send money, pay bills, reload phones and accomplish other tasks for friends and family in other countries. PayPal’s acquisition of Xoom helps it to expand into new markets worldwide, including building its remittances business.
Moving forward, we can now take a look at the jurisdictional fragmentation of PayPal which can be better comprehended, by understanding the following: as the US Domestic and Global
Parent there is PayPal, Inc. which is licensed as a Money Transmitter in all 50 states, and which is regulated by FinCEN (Financial Crimes Enforcement Network – part of the US Department of
Treasury, whose job is to combat financial crimes); this entity holds specific Virtual Currency
Licenses. Governing the EU/EEA (European Union/European Economic Area) operations there is PayPal (Europe) S.à r.l. et Cie, S.C.A. which is a credit institution, a bank, licensed in
Luxembourg and overseen by the CSSF (Commission de Surveillance du Secteur Financier – the financial regulator of Luxembourg) and the European Central Bank. For the operations conducted in Oceania there is PayPal Australia Pty Ltd which is regulated by ASIC (Australian Securities and Investments Commission – Australia’s main financial markets and corporate regulator) and
AUSTRAC (Australian Transaction Reports and Analysis Centre – Australia’s financial intelligence agency) and which holds an Australian Financial Services License (AFSL). Lastly, for operations conducted in Asia and as a Global Hub there is PayPal Pte. Ltd. which is licensed by the Monetary Authority of Singapore (MAS).
Both the jurisdictional fragmentation of PayPal and its subsidiaries are key parts of the functioning of the app since they allow it to properly and effectively comply with all the different legal requirements and standards, regardless of the location. What is more, PayPal’s heavy investment in protective systems, such as AML/KYC systems, fraud detection systems, data protection and consumer safeguards, is essential to maintaining licenses globally.
3.2. Licensing Strategy
According to the different regions in which it operates, PayPal relies on different institutions.
Within the EU, it functions through its Luxembourg entity, which holds a license as a credit institution; this allows PayPal to provide regulated financial services across the European
Economic Area. In the United States, it depends on a system of state-by-state money transmitter licenses, complemented by federal oversight through FinCEN. Moreover, PayPal relies on regulatory passporting within the EU/EEA, enabling it to offer services across multiple member states using its Luxembourg license.
PayPal’s licensing approach is supported by substantial investment in compliance systems, such as AML/KYC procedures, fraud detection technologies, data protection measures, and consumer safeguards. These systems are crucial for maintaining licenses across jurisdictions.
3.3. Regulatory Arbitrage vs Compliance Design
We can now look at PayPal’s regulatory design which refers to the systemic integration of global legal compliance, and risk frameworks in its technical architecture. It ensures compliance with complex, localized financial laws without compromising global transaction speeds.
Following this train of thought, one can better understand the advantages of PayPal not being deemed as a traditional bank. Its operational structure allows it to function with greater flexibility while still providing financial services. This is accomplished by using subsidiaries that possess specific licenses designed for local regulatory categories.
Additionally, rather than being subject to comprehensive banking prudential regulation, PayPal must follow safeguarding rules (e.g., protecting customer funds), capital requirements appropriate to its licensing status, and strict compliance obligations such as AML/KYC.
4. Anatomy of Payment Flows
PayPal’s definition as a digital platform for financial transactions is problematic from a legal perspective. Nevertheless, to analyse PayPal’s controversial position, it is necessary to understand the internal mechanism of payment flows and the stages the transactions go through in the system.
4.1 Account-Based System
PayPal operates an account-based (wallet) system with internal ledgering. This definition is important for the purposes of understanding the internal mechanisms of the payment flows.
PayPal offers an innovative structure, different from a purely external authorisation system, where all access decisions are delegated to a centralised external service.
In the broader scope of financial banking, there are two fundamentally different payment systems: the account-based system and the authorisation-based system. In other words, systems can be classified based on whether value is held and transferred within internal accounts or merely authorised externally.
What distinguishes PayPal from its competitors is that, unlike simple wallets that merely display a balance, this system records every movement of funds (deposits, withdrawals, internal transfers) as both a debit and a credit, ensuring accurate, transparent, and immutable transaction history, similar to traditional bank systems. The core idea is that PayPal has an internal bookkeeping system: the system records your account and updates the ledger (the recorder) with every payment.
In comparison, authorisation-based systems work similarly to card payments, and the significant differentiation comes down to the fact that the user's money is not stored in the payment system, but in the bank. Therefore, before each transaction there needs to be acquired the authorization from the bank.
Furthermore, as for PayPal’s wallet structure system, it is important to note that the app provides users with a digital wallet linked to various funding instruments and capable of holding stored value. The "wallet" is not a physical container but a virtual ledger account that aggregates multiple funding sources. It manages two primary types of value: (1) Internal Stored Value (the PayPal balance itself, which represents a claim on funds held by PayPal in pooled custodial accounts) and (2) External Funding Instruments (which represent the linked cards and bank accounts). The system works based on “top-up” transactions in real-time, in case the internal balance is insufficient.
The last point to bring attention to is the internal ledger feature of this system.
Specifically, PayPal operates with the aid of a double-entry accounting ledger for all financial transactions. Every movement of value is recorded as two immutable entries: a debit from one account and a corresponding credit to another.
A reliable ledger must be immutable, multi-currency, and fully auditable, requirements which
PayPal has consistently proven to meet. Generally, this type of data model includes a transaction table which tracks all the financial decisions of the user, providing a transparent audit inspection.
Given the essential role of the ledger in providing the accurate information of all past financial transactions, a mistake at this level of the payment flow creates many financial and regulatory problems. Therefore, many companies decide not to risk developing their own internal ledger and externalise this service. Nevertheless, this is where PayPal showcases its expertise in providing secure global financial services, as it functions as a closed-loop system: it ensures the centrality of the records within its own systems, rather than relying directly on a bank’s ledger.
4.2 Transaction Lifecycle
The PayPal transaction lifecycle is a complex multi-stage process which provides near-
instantaneous movement of value between parties while managing the slower clearing cycles of traditional banking systems. According to technical analyses, the lifecycle is divided into three primary phases: funding, authorisation/execution, and settlement/clearing.
The lifecycle begins when a user selects a funding instrument from their digital wallet to initiate a payment. PayPal’s system allows for diverse funding, which can be categorised into internal and external instruments. First, there is the internal balance, which represents the funds already held in the user’s PayPal ledger. Afterwards, the funding could be procured through external bank accounts that are linked directly to the internal balance via an automated clearing house (ACH), which is a centralised U.S. electronic network, or a local equivalent for the European framework.
Another funding instrument is the payment cards: these are either credit or debit cards in the possession of the user which are linked through the PayPal platform via global card networks like
Visa or Mastercard. There are also newly established innovative methods, which have given
PayPal an edge over its competitors: cryptocurrencies (Checkout with Crypto, a new feature of the PayPal app), gift cards.
Once a funding source is selected, PayPal’s distributed microservices architecture performs a series of real-time checks to ensure the transaction's integrity. There is an authorisation procedure, through which the system validates the availability of funds from the source chosen for funding.
For card-based transactions, which is the preferred method for most users, PayPal requests authorisation from the card issuer through a payment gateway (a sophisticated system of encrypted transactions between a merchant and their bank). For bank-funded transactions, the underlying bank transfer (eCheck) acts like a paper check and takes several days to clear; however, PayPal's systems evaluate the risk of the transaction, and if it passes, they credit the seller immediately.
After the funds pass the authorisation process, PayPal ensures consistency through the double-
entry ledger previously mentioned. This ensures that the user’s balance showcases transparent movement of the money, even though the bank transfer is still pending. This stage is often called an "on-us" transaction, where the transaction is not required to go through a Clearing and
Settlement Mechanism (however, it is not mandatory). Consequently, the actual movement of funds happens entirely within PayPal’s internal ledger, making the transactions immediate.
The final phase involves the actual movement of currency to the recipient's external financial institution, called settlement or clearing. In this stage, it is important to highlight the timeline, which is optimized though the PayPal system: while the transaction appears “Settled” in the
PayPal UI, the actual movement of funds to a bank account typically takes the transaction day plus one to three days, depending on the banking jurisdiction. This is one of the main points where platforms like PayPal differentiate from normal banking systems and therefore pose a question for the regulatory norms.
4.3 Role as Intermediary
PayPal functions as a two-sided network, creating a unified platform where both the payer and payee are within a single ecosystem.
4.3.1. Principal vs. Agent Debate
In the context of financial intermediation, the distinction between acting as a Principal or an Agent is critical for regulatory and accounting purposes.
In standard payment processing, PayPal acts as an agent. It does not take ownership of the goods being sold, nor does it bear the inventory risk in case of potential financial loss. The platform merely arranges for the transfer of value. From an accounting perspective, PayPal recognises only its transaction fee as revenue, rather than the full transaction volume.
However, PayPal shifts into a principal role when providing credit products (e.g., PayPal Credit or Buy Now, Pay Later). In these instances, PayPal is the lender and takes the credit risk onto its own balance sheet. Additionally, in the case of its stablecoin (PYUSD), PayPal acts as the principal issuer of the digital asset used.
4.3.2. When PayPal Steps into the Transaction Chain
PayPal enters the transaction chain at the application layer, immediately following the consumer's intention to buy. In other words, it intercepts the transaction before it reaches the card or bank frameworks by providing the merchant with a token version of the user’s financial data, without the merchant ever reaching the actual credit card or bank account balance.
This kind of intervention, the regular banking flows come with risks, as PayPal essentially guarantees the user has these funds in the exact moment of the payment. whereas the actual funds from the bank or card networks take days to be confirmed. In order to mitigate the possible risks,
PayPal’s AI-driven risk engine performs a sub-second analysis of the transaction to decide whether to authorise the payment or trigger a security challenge.
4.4 Interaction with Legacy Infrastructure
While PayPal appears to be a standalone system, it is actually relying heavily on the legacy of actually acknowledged card networks (Visa or Mastercard) and other banking partners. This is where the trust in the system originates from: leveraging on the already built reputation of standard banking institutions.
To process a transaction, PayPal sends transaction details to the bank partners. They rely on these bank partners to transmit the transaction details to the relevant card network. The card network then routes the transaction for approval by the bank that issued the card used for payment. The card networks help to ensure that valid transactions are authorised and approved, and that the funds are available so PayPal customers can ultimately receive those payments.
This collaboration with card networks and bank partners is crucial in supporting PayPal’s mission to provide a secure and convenient online payment experience for consumers and merchants.
5. Contractual Architecture
Legally speaking, PayPal is viewed as a contractual entity that operates by its own set of rules.
5.1. User Agreements
The legal framework governing the use of the PayPal account and of the PayPal services is nominated User Agreement, which sets out the terms and conditions of its use. It functions as a form of private legislation governing the platform. Moreover, it is only applicable to accounts of residents of the United Kingdom (UK), Guernsey, Isle of Man and Jersey.
For individuals to open an account, they must be at least 18 years old and possess full legal capacity to enter into a contract, in order to open a PayPal account and use the PayPal services.
For businesses, the business must be registered in one of the countries or territories mentioned previously.
In order to use the PayPal services, one needs to create a PayPal account. By doing so, the individual or business is agreeing to comply with all of the terms and conditions in the user agreement, such as providing accurate identity information, bearing responsibility for account security, among others, which will be valid until terminated, along with compliance with the Fees,
PayPal’s Buyer Protection Program, PayPal’s Seller Protection Program, Acceptable Use Policy and with the Alternative Payment Methods Agreement. On the other hand, PayPal is under the obligation to execute payment instructions, to safeguards funds and to provide dispute resolution mechanisms.
An important function of the User Agreement is to shift and manage risk, where users may bear unauthorized transaction risks or chargeback exposure, PayPal limits its liability through broad disclaimers, caps on damages and conditional protections.
5.2. Merchant Contracts
Merchant agreements are more rigid than consumer agreements, since businesses are presumed to have more “sophistication” and fewer legal protections. The PayPal Merchant
Services Agreement is a legally binding contract between a business and a payment processor that governs payment processing fees, fee structures (e.g. Gross Settlement, Interchange Plus) and fund settlement times. What is more, it defines the legal framework for transactions, ensuring compliance with payment network rules. Lastly, it what governs the use of PayPal’s payment processing tools, including Express Checkout, Direct Payments, and Virtual Terminal.
Through this Agreement PayPal defines transaction fees, cross-border and FX fees and chargeback fees. All of these are dynamically modifiable and often differentiated by risk profile, geography and volume.
The Agreement dictates that the merchant is strictly liable for chargebacks, meaning that PayPal may reverse transactions or debit merchant accounts and it’s the merchants who bear financial responsibility for disputed transactions. For example, even if a merchant proves that they shipped an item, PayPal’s contract may still allow for a reversal fee/dispute fee, regardless of the outcome.
What is more, PayPal operates an internal dispute system. This means that the dispute is entirely governed by contractual standards, which are part of PayPal’s internal adjudication process.
5.3. Private Ordering of Payments Law
It is in the private ordering of payments law that PayPal’s contractual system becomes most structurally important. Private ordering refers to the process where private parties, in this case,
PayPal and the user, set their own rules to bypass or “displace” the default rules of the state. For
PayPal, the User Agreement, the Merchant Terms and the Acceptable Use Policy, combined with technical infrastructure, work as a self-contained legal-regulatory system for payments.
PayPal rules can be understood as supplementing public law, in some areas, since it adds layers on top of regulation, for instance, fraud rules are stricter than actual law, it expanded prohibited activities and defined additional monitoring. Whereas in other areas, PayPal effectively replaces legal processes, for example the fact that disputes are handled internally, rather than through a court. This can be better understood if we take into account that some platform rules determine outcomes before legal review. This specific legislation that displaces public law is especially relevant when it comes to small-value transactions and cross-border disputes.
Private ordering is crucial for PayPal in the sense that it provides for speed and efficiency, since traditional government legislation moves slowly. With private ordering the payment processors are able to adapt their technology and rules dynamically as to counter new forms of fraud.
Additionally, it fosters consumer trust, due to the fact that since online transactions are inherently anonymous and global, this reassures customers that they will not be defrauded. Moreover, it also enhances the success of global operations, as a uniform User Agreement creates a standardized, predictable transacting environment worldwide.
5.4. Unilateral Powers
One of the most distinctive features of PayPal’s contractual architecture is the breadth of unilateral authority it reserves. In other words, PayPal can take action without one’s consent, a hearing or even prior notice.
To start with, PayPal is allowed to suspend accounts or permanently terminate one’s access, at any time and for any or no reason, and without prior notice. Triggers for this may include suspected fraud, policy violations or regulatory concerns. Since it is a private contract one does not have a “Right to a PayPal Account”, contrary to what would happen, was PayPal an actual bank.
What is more, PayPal can freeze balances, delay withdrawals or hold funds for defined or undefined periods. This gives PayPal direct control over user liquidity. This can be better understood if we consider the 180 day hold tool. In addition, PayPal occasionally retains a portion of frozen funds as a penalty for “Acceptable Use Policy” violations, a power that is highly controversial and often challenged in court as an unenforceable penalty clause.
Additionally, PayPal can unilaterally decide that one’s business is high risk and impose a
Reserve, meaning that they may decide to hold, for example, 10% of every dollar you earn for 90
days. Furthermore, they can set a limit on how much one is allowed to sell per month, and if this limit is exceeded the funds are automatically frozen. Funds can also be frozen when investigations are undergoing. These terms are presented as fundamental, meaning that one cannot dispute them.
If one doesn’t agree with the new reserve, he’s contractual “right” is to close the account (at this point, the 180 day-hold kicks in).
6. Risk Governance and Compliance
PayPal's risk governance and compliance framework is structured to manage the inherent tensions between user friction, transaction speed, and regulatory stability. As a global electronic money institution (EMI), PayPal must balance traditional financial regulations with the technological demands of a digital-first platform.
6.1 AML/CFT Obligations – KYC procedures and monitoring
Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) obligations are regulatory requirements designed to prevent criminals from using financial systems to disguise illicit funds or finance terrorism. These obligations mandate that financial institutions and other obligated entities implement a risk-based framework combining customer due diligence, ongoing transaction monitoring, and suspicious activity reporting. PayPal operates under such a risk-based approach, as mandated by global standards like the Financial Action Task Force (FATF) and the
EU’s AML Directives.
Because PayPal is a financial technology company and not a bank, it relies on banking organisations to provide the underlying financial infrastructure. This creates a strained relationship between the Master Account Provider (the bank) and the Master Account Holder
(PayPal). Under this model, the legal and regulatory burden for identifying the customer is split but primarily resides with the fintech institution. The primary duty of PayPal, legally, is to perform all duties related to customer onboarding with KYC (Know Your Customer) verification, which involves collecting personal data, verifying government IDs, checking sanctions/PEP lists, and ongoing monitoring. Moreover, modern digital KYC (which is the case for PayPal) also improves conversion rates by replacing manual, slow processes with AI-powered, real-time verification.
Another duty PayPal must legally oblige is the continuous monitoring and screening of the user’s sub-accounts for suspicious activity. This relationship is governed by the PSD2 (Payment Services
Directive 2), which treats these virtual IBAN sub-accounts as full payment accounts rather than simple technical ledgers.
The unique legal challenge in the models proposed by systems such as PayPal is the overlapping of Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) obligations. Specifically, since every transaction through the virtual IBAN of the user is reflected later in the physical payment account (the bank or card network), transactions are effectively checked twice.
Another point of friction is that banks have the legal authority to unilaterally block suspicious transactions without asking for permission or even informing PayPal (or similar platforms).
Consequently, in case of such blocked transactions, the user complains to PayPal, the platform through which they made the transaction. Nevertheless, the payment flow had been stopped by the bank, and PayPal has no information on the situation, creating confusion and issues in the relationship between the user and PayPal.
6.2 Fraud and Chargeback Risk
Risk in the PayPal ecosystem is a tripartite allocation determined by the Merchant Service
Agreement and specific protection programs. A merchant service agreement (MSA) is a written contract outlining the terms and conditions between a merchant and a payment processing provider. With numerous layers involved, it guarantees transparency and alignment between both parties and acts as a blueprint for what to expect during your partnership. These include things like relationship expectations, payment security, and legal compliance.
Merchants usually take on the risk of chargebacks and "friendly fraud" in regular transactions.
The merchant is frequently responsible for both the refund and a chargeback fee in the event that a client challenges a purchase through their card issuer. In order to lessen this, PayPal employs a
"Seller Protection" approach in which, assuming the merchant satisfies certain shipping and paperwork requirements, it takes on the financial risk for qualified transactions (such as unapproved payments or unreceived goods). "Buyer Protection," which transfers the loss from the user to the merchant or PayPal itself, protects consumers from fraud risk to a considerable extent and promotes "system-based trust" in the platform.
6.3 Algorithmic Risk Management
PayPal’s risk engine has evolved from simple rules-based filters to sophisticated Machine
Learning (ML) and Deep Learning models that analyse thousands of variables in milliseconds to detect anomalies.
Firstly, PayPal has implemented automated detection systems which excel in predictive analytics.
They identify patterns of transactions and can pinpoint account takeovers by signalling transactions that are out of the ordinary for the specific user, a level of data processing which is beyond the capabilities of any human moderators, specifically at such a large scale.
However, a significant legal challenge arises from using a system of data processing. When algorithms automatically freeze accounts or decline transactions, they often trigger private due process concerns. Under regulations like the GDPR (Art. 22), users “have the right not to be subject to a decision based solely on automated processing”, and the data controllers have an obligation to provide safeguards, at least “the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision”. At the same time, the duty of transparency can inadvertently expose algorithmic processes which risk losing intellectual property and the competitive advantage.
6.4 Safeguarding of Funds
Unlike traditional banks, PayPal (as an Electronic Money Institution) does not engage in fractional-reserve banking (a system where banks hold only a small fraction of customer deposits as reserves). Instead, it must follow strict safeguarding regulations.
Under the UK Electronic Money Regulations and similar global frameworks, the funds of the user must be kept separate from PayPal’s operating capital. These sums must be kept in independent bank accounts with authorised credit institutions.
Moreover, in the event of PayPal’s insolvency, these safeguarded funds form a separate asset legally. This ensures that after the costs of the insolvency process are covered, the remaining funds are reimbursed to users before any other creditors can claim them.
7. Legal Characterization
PayPal is characterized legally as a Money Services Business (MSB), a payment processor, and an electronic money (e-money) issuer. Its legality depends on jurisdiction, compliance with financial regulations and how the account is used.
It is understandable how the work and functioning of PayPal is affected by the different jurisdictions in which it operates. For example, in India it can be used for receiving international payments, but not for domestic transactions, in China PayPal operates through partnerships, being subjected to strict financial oversight, and in the Middle East some countries restrict PayPal due to currency control laws.
To ensure legality, PayPal requires identity verification, tax compliance verification and anti-
money laundering. Failure to comply with one of these requirements can result in frozen funds or permanent bans.
7.1. Financial Intermediary vs Technology Provider
PayPal sits in a hybrid category, since it is not just a software, but also not a full traditional bank. Whereas PayPal argues that it is primarily a software platform that facilitates communication between existing financial institutions, regulators generally view it as an intermediary since it actually holds value. In other words, when you have a PayPal balance you are entrusting a third party to handle your ledger, rather than merely using software. (107)
Considering PayPal as a financial intermediary happens since it receives and transmits funds, it holds customer balances, executes payment instructions and manages settlement timing and risk.
Legally, PayPal falls into several categories in different jurisdictions, including money transmitter
(US), e-money institution/bank (EU) and payment institution, in various jurisdictions. As a result, we can comprehend that the purpose is financial intermediation even if the interface appears to be software. (175)
7.2. Agency, Custodial, or Quasi-Banking Model
PayPal’s legal nature is best understood through three overlapping lenses: Agency Model,
Custodial and Quasi-Banking Model.
Starting off with the agency model, PayPal acts on behalf of users, executing payments as instructed; it only transfers money, it has no ownership over it. For instance, simple payment processing falls under this category. In this way, it has lower balance sheet exposer, along with liability solely tied to execution, not with the underlying transaction.
Secondly, considering the custodial model, PayPal acts as a custodian of funds, holding customer balances in separate accounts or inside its regulated organization. Contrary to banks,
PayPal does not lend out the e-money balances that users have with them. When using PayPal, users have a claim against PayPal, not against a bank.
Lastly, although PayPal exhibits a lot of bank-like characteristics, especially in the European
Union, for example, it offers debit cards, credit lines, manages liquidity and settlement timing, it cannot be considered a bank since it has limited or no maturity transformation, customer funds are usually not lent out freely and has a narrower regulatory scope. Consequently, this implies that while it doesn’t have the same “lender of last resort” safeguards, it does escape the enormous capital requirements of a bank. (471)
7.3. Implications for Liability and Regulation
PayPal’s hybrid role complicates liability. When it comes to liability allocation, if a payment fails or is misdirected, PayPal is typically liable as a payment service provider. Moreover, when it comes to fraud and disputes PayPal often voluntarily assumes liability, which goes beyond strict legal requirements, in some cases. Lastly, when acting as merchant of record, it is PayPal who bears chargeback risk.
Legally, users have a direct contractual relationship with PayPal meaning that PayPal ends up being the primary interface and accountable entity. As a customer, one’s liability is mostly protected by PayPal’s goodwill and brand reputation. However, as a banker, one has much less legal remedy, since PayPal can, and does, unilaterally reclaim cash or freeze the working capital for months.
8. Platform Power and Private Governance
PayPal exercises significant platform power through private governance, since it acts as a chosen rule maker that sets, enforces and adjudicates its own rules for digital transactions. By managing and adjudicating problems internally, it send up creating a proprietary environment, often enforcing its own policies.
8.1. PayPal as a Private Regulator of Transactions
PayPal developed a fraud monitoring system that used artificial intelligence to detect potentially fraudulent transactions. It worked on the basis that if 100 separate accounts were transferring
1000$ to one account and then that recipient suddenly tried to withdraw 100,000$ alarm bells would ring and PayPal employees would have to go check up on the situation.
Since PayPal felt the need to solve problems ex ante, it ended up devising its own security measures. It basically assumed the risk of fraud on behalf of customers and profited immensely by reducing it. Private parties benefit and profit by coming up with private solutions.
8.2. Enforcement through Contract rather than Public Law Whereas when one uses a bank, he is protected by Public Law, PayPal’s authority comes primarily from private contracts, not statutes; in this case, we can consider the User Agreement as the private contract.
When users sign up, they agree to flexible terms and to PayPal’s right to interpret and enforce rules. The “Agreement” trap is the most common example of this, since most users click “Accept”
without reading and end up giving PayPal rights that the government doesn’t have, such as, for example, the government ability to freeze accounts for 180 days based on “suspicion” alone.
Moreover, through the Mandatory Arbitration clauses, PayPal ensures that disputes are handled by private hired arbitrators rather than in a public courtroom.
8.3. Due Process concerns and Asymmetry of Power
Due Process is a constitutional right, in a court of law, but it virtually disappears in a private platform environment. Especially when it comes to PayPal, this is where the criticisms arise, since it acts as both judge and jury, unilaterally enforcing algorithmic rules, with broad explanations as to the why, providing little transparency, no neutral oversight and highly restricted paths to appeal.
There is, therefore, an asymmetry of power, since, for instance, for a small business, a 180-day freeze can mean bankruptcy. What is more, PayPal possesses all the information, the user doesn’t.
This means that PayPal has access to one’s entire transaction history, linked banks and IP
addresses allowing them to use this information to build a case against a user, if needed, while, on the other hand, the user doesn’t have access to the internal “risk score” they used to shut it down.
Consequently, consumer protection authorities have forced PayPal to rewrite and clarify overly complex and unfair contract terms.
9. Comparative and Jurisdictional Perspectives (700)
A fundamental divergence between the harmonised, prescriptive model of the European Union and the fragmented, innovation-led regime of the United States characterises the jurisdictional landscape for PayPal. While PayPal operates as a singular global entity, it effectively exists as a different legal persona depending on the "regulatory rails" of the territory.
9.1 EU vs. US Regulatory Approaches
Academic analysis highlights that these two jurisdictions possess "radically different baseline attitudes toward the role of law in finance".
The European Union undertakes a proactive approach towards regulation, using law as a shield protecting consumers from systemic risks. Consequently, the EU has developed a comprehensive, centralised legal framework, which implements high entry barriers on the one hand, but on the other hand, it facilitates a seamless environment for operations. However, there is a growing need for a more flexible regime in order to promote the development of the FinTech market, such as
PayPal, as it has become apparent that strict regulations dissuade the innovation of new technologies.
In comparison, the US approach is characterised as implementing regulatory norms through enforcement rather than legislation. This reflects the US’s overall perspective on technological innovations, where it is regarded as more beneficial to allow for self-regulation and open development of tech companies. This prioritisation of technological innovation, especially in
FinTech, puts the protection of customers as of secondary importance.
9.2 PSD2/PSD3/PSR vs. US Fragmented Regime
The technical execution of PayPal’s services is governed by how these conflicting jurisdictions define "money".
Under the Payment Services Directive (PSD2/PSD3) and the Electronic Money Directive (EMD),
PayPal is licensed as an Electronic Money Institution (EMI). The EU’s objective is the harmonisation of the functioning of apps like PayPal across the Member States, by allowing them to operate under a single universal license provided by a “home” regulator (e.g., Commission de
Surveillance du Secteur Financier in Luxembourg). Moreover, the upcoming Payment Services
Regulation (PSR) will apply directly across the EU, removing the need for national transpositions and further standardising PayPal’s operational requirements for Strong Customer Authentication
(SCA) and Open Banking.
In contrast, the US lacks a federal "fintech" or "e-money" license. The US lacks the harmonisation that the EU ensures through a stricter regulatory system. PayPal must obtain state-by-state licensing. This forces the platform to navigate 50 distinct sets of rules regarding bonding, net worth, and reporting. Furthermore, given the federal structure of the state, at the higher federal level, PayPal is classified as a “Money Services Business” (MSB) by the Financial Department.
However, at the same time, the platform is subject to the consumer protection rules at the federal level and, in case of conflicts, it must settle the issues at the Federal Reserve. This fragmentation increases compliance costs significantly. Therefore, while the EU regulatory approach creates high entry barriers, once inside the market, PayPal can operate more effectively and seamlessly across states, while in the US, innovation can be pursued further and more freely.
9.3 Emerging Global Trends
As of 2026, the global payment landscape is shifting toward programmable money and agentic commerce, an advanced AI-driven shopping model where autonomous agents act on behalf of users to search, compare, and complete purchases.
The EU’s Markets in Crypto-Assets (MiCA) regulation provides a clear procedure for the functioning of PayPal’s cryptocurrency coin (PYUSD). In the US, however, stablecoin regulation is yet to be implemented at the federal level, leaving PayPal operations in a regulatory grey zone, where it is obliged to comply with the strict rules of New York State, but has no direct instructions or clarity of the regulatory framework from higher federal authority.
Furthermore, with the advent of AI agents, a legal challenge will be debated in the following years on whether and how to verify a payment made by an AI agent without the authorisation from the human user. This is an upcoming point of discord on which platforms like PayPal will have to address to protect their customers and the relationship with the merchants.
10. Normative Assessment
The normative assessment of PayPal’s regulatory status involves a debate over whether the platform's systemic scale has outgrown its classification as a mere "technology service provider" or "Electronic Money Institution" (EMI). As of 2026, this debate centres on three critical pillars: regulatory gaps, the "Bank-Like" classification, and the innovation-protection trade-off.
10.1 Gaps in Current Regulatory Frameworks
Academic and policy research identify two primary "regulatory voids" that PayPal exploits by operating in the space between technology and traditional finance.
The first issue that can be observed in PayPal’s global network is the “patchwork” jurisdiction of the US, previously described. Due to lack of harmonisation at federal level, there is no standard of consumer protection being upheld, particularly when it comes to the protection of sensitive data of user’s financial situation in case of technical failure of the platform.
Furthermore, a significant gap exists in the governance of AI regulation, specifically in light of the two competing approached in the west: US and the EU. As PayPal pivots towards an AI-first architecture, current regulations like the AI Act and GDPR, or the US equivalent, struggle to provide meaningful “due process” for cases when the algorithm takes financial decisions or freezes accounts or signals suspicious transactions. For example, one of the uses of innovative AI
technology is the advent of agentic commerce, which carry out autonomous transactions based on predetermined rules like price thresholds or product conditions, without the need for real-time user interaction. These create liability gaps as it raises the question who bears responsibility when an AI agent authorised by a user makes a high-value transaction and that user later disputes?
10.2 Should PayPal be Regulated More Like a Bank?
The argument for "banking-style" regulation is driven by PayPal's transition into a Systemically
Important Payment System (SIPS). Recent studies by the International Monetary Fund (IMF) and
S&P Global (2026) suggest that Non-Bank Financial Institutions (NBFIs) like PayPal now represent a "top systemic risk". PayPal, even though it operates outside the traditional banking systems, it leverages on the relationship with established banking institutions in order to gain credibility, especially when it was at its incipient stages. Thus, PayPal became deeply integrated with the “legacy rails”, whereas a failure within its internal ledger could potentially adversely affect the whole standard banking system.
Conversely, PayPal does not engage in fractional-reserve lending (the core activity of a bank).
Regulating it as a bank would force the platform to save up large amounts of funds in reserves instead of letting it circulate, consequently, less liquidity would be available for transactions, and this would slow down and constrain economic activity.
11. Conclusion
To conclude, PayPal is an innovation for the Fintech industry, a virtual tool which transcends traditional banking systems. PayPal does not fit into any standard definitions of digital platform or financial institution; it is a business model which can be conceptualised as an engineered intermediation between these two forms. PayPal’s broad scope includes corporate structuring, licensing strategies, contractual design and risk allocation mechanisms, all of these features constructing its advantageous role in the financial ecosystem. Through its internal ledger, payment architecture, and machine learning systems, PayPal implements legal rules of due diligence directly into its technological infrastructure, blurring the distinction between law and algorithm. This article also brings to light the broader implication that regulatory frameworks—both in the
EU and the US—struggle to keep pace with pioneering actors that operate simultaneously across legal categories, using sensitive data of customers in immediate transactions. PayPal’s capacity to rapidly ensure transactions to merchants, keep the internal balance, provide transparency for audits in transaction backlog, and quasi-banking features highlights persistent gaps in the harmonisation of consumer standards at a global level, specifically in the area of AI-driven decision-making and cross-border compliance.
Looking forward, the evolution of platform finance—driven by AI, programmable money, and increasing systemic relevance—suggests a trajectory toward greater regulatory convergence. The key challenge will be to design frameworks that preserve innovation and efficiency while ensuring accountability, transparency, and effective protection for users in an increasingly platform-
mediated financial system.
12. Bibliography https://research.tue.nl/en/publications/lets-speak-the-same-language-a-formally-defined-model-
to-describe/
https://www.risk.net/node/7961795?_ptid=%7Bkpdx%7DAAAAm-
PnCZLwjAoKTnUweUs1VHJwZRIQbW9yYnhmM3F6Z2prenVxdxoMRVgwMDE4OVRRVF
BRIiUxODIzOWMwMGRjLTAwMDAzN2ZqZ2Z2ZGE5bG91YTF1NTRyOXNrKhRydW5Kc
0RSVU1RSFBOU09WRjI3OVISdi1tb3JicXpjY3JpeGczcTVlWg0xOTMuMjA1LjIyLjE5YgN
kd2Nov43ozwZwEHgI
https://www.systemdesignhandbook.com/guides/paypal-system-design-interview/
https://codelit.io/arch/paypal-payment-system https://www.paypal.com/us/brc/article/what-is-a-payment-gateway
E-COMMERCE, CYBER, AND ELECTRONIC PAYMENT SYSTEM RISKS: LESSONS
FROM PAYPAL LAWRENCE J. TRAUTMAN
https://www.paiementor.com/on-us-transactions-
intrabank/#:~:text=November%2018%2C%202017,There%20is%20no%20other%20option.
https://kurvpay.com/blog/merchant-agreement/
https://gdpr-info.eu/art-22-gdpr/
https://www.paypal.com/au/cshelp/article/supported-activities-by-paypal--help1035
https://www.hubifi.com/blog/agent-vs-principal-
revenue#:~:text=Defining%20Principal%20and%20Agent%20Roles,to%20provide%20goods%
20or%20services.&text=Principals%20recognize%20revenue%20based%20on,only%20their%
20commission%20or%20fee.
https://sdk.finance/blog/the-ultimate-guide-to-design-a-payment-system/
PayPal and the Financial Wellness Initiative Zeynep Ton and Sarah Kalloch
Virtual IBAN as a Service in the Law of the European Union and Poland Michał Grabowski Leveraging artificial intelligence for real-time fraud detection in financial transactions: A fintech perspective Narendra Kandregula * Independent Researcher. World Journal of Advanced
Research and Reviews, 2019, 03(03), 115-127
https://www.diva-portal.org/smash/get/diva2:1994010/FULLTEXT01.pdf https://www.paypal.com/uk/legalhub/paypal/useragreement-full https://shanikaw.medium.com/10-payment-processing-trends-that-will-impact-fintech-in-2026-
80b018c8fef8
https://www.paypal.com/uk/legalhub/paypal/useragreement-full?locale.x=en_GB
https://investor.paypal-corp.com/financials/annual-reports/default.aspx?utm https://www.paypal.com/uk/legalhub/paypal/home?locale.x=en_GB.&utm https://newsroom.paypal-corp.com/2022-10-27-A-Peek-Inside-PayPals-Two-Sided-
Network-of-Consumers-and-Businesses https://finance.yahoo.com/markets/stocks/articles/franklin-electric-nasdaq-fele-could-
121839569.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&
guce_referrer_sig=AQAAADULzq6iMWsX0dIgqzqjtJpOwll8ZZUHN1OvmhfRjF2_sPDO6_zEg pDZvMRR8z-dL258nvoDnH0hu1TDR_cCLjQ6zcXV9auq-
H_klt32GGoIwfcDNT2hfZprwV0OP9AE5JdMXhQ6Zx5OO1nAINFYM3Xr-
grZtnX32W_tyLI6xiKB
https://thefinancialbrand.com/news/payments-trends/is-paypal-now-a-bigger-threat-to-
most-banks-than-bofa-or-chase-137670
https://www.reuters.com/business/paypal-tops-first-quarter-estimates-resilient-
consumer-spending-2026-05-05/
https://www.investopedia.com/articles/company-insights/082416/top-5-companies-
owned-paypal-pypl.asp https://www.investopedia.com/articles/company-insights/082416/top-5-companies-
owned-paypal-pypl.asp https://insights.greyb.com/paypal-subsidiaries-and-acquisitions/
https://www.paypal.com/au/legalhub/paypal/merchservices-full https://www.investopedia.com/articles/company-insights/082416/top-5-companies-
owned-paypal-pypl.asp