Start with the sentence that unlocks everything else in this handbook: when you pay someone, no money travels anywhere. What actually happens is that numbers change in a series of account books, called ledgersA ledger is an account book: a record of who holds how much. Banks, schemes and clearing houses are, at their core, ledger keepers.. Your bank reduces the number next to your name. Somebody else's bank increases the number next to theirs. The entire payments industry, every company, rail and regulation in this handbook, exists to make those ledger updates fast, safe, cheap and trustworthy between parties who have never met.

This raises an immediate question. If your bank and the shop's bank are different institutions, whose ledger connects them? The answer is that banks hold accounts with each other and, above all, with the central bankThe institution at the top of a currency's ledger hierarchy. In the euro area this is the Eurosystem: the ECB plus national central banks such as DNB.. Money in your current account is a claim on your commercial bank, called commercial bank money. Money that banks hold at the central bank is central bank money, the safest form there is, because a central bank in its own currency cannot run out. Nearly every payment you will study in this handbook ends its journey as a transfer of central bank money between two banks' accounts at the central bank.

Picture the system as a pyramid of ledgers. At the top, the central bank keeps accounts for banks. In the middle, banks keep accounts for people and companies. At the edges, wallets, PSPs and platforms keep their own sub-ledgers on top of bank accounts. A "payment" is a coordinated update running down one side of the pyramid and up the other. The further apart the two ends are, the more intermediaries the update passes through, and, as Part II of this handbook will show in detail, every intermediary in the chain has a business model.

Card tap, iDEAL push, PayPal click, bank transfer, direct debit: they feel like different products, and commercially they are. Mechanically, every one of them walks through the same six steps. Learn these six and you can dissect any payment method you will ever encounter, including ones that do not exist yet.

A useful habit from day one: whenever you meet a new payment method, ask which party performs each of the six steps and who bears the cost and the risk at each one. That single exercise explains most pricing, most regulation, and most of the competitive strategy you will see in Part III.

The six steps hide a two-track structure that professionals use constantly. Track one carries information: requests, approvals, files, statuses. Track two carries value: the actual ledger updates. The two tracks run at different speeds, and almost every confusing thing about payments becomes clear once you separate them.

When a card terminal says "approved" in a shop, only the information track has run. The issuer has promised to pay; settlement follows one or two business days later.^F1.5 When an iDEAL screen says "paid," by contrast, both tracks have already completed: the money settled through the instant payment infrastructure within seconds. Same green checkmark, profoundly different mechanical reality. Card language has its own pair of words for the information track: authorization (the promise, at the moment of purchase) and capture (the merchant's later instruction to actually collect, typically at shipment). Between the two, the money is reserved on your account, visible as a "pending" transaction.

The gap between the tracks is where risk lives, and risk is priced. If a merchant ships goods on the strength of an authorization and the payment is later reversed, someone eats the loss. Whole layers of the industry, guarantees, chargebacks, fraud tooling, reserve requirements, exist to manage that gap, and they are all part of what you pay for in the fee. Rails where the gap is near zero, like instant transfers, can be radically cheaper, at the price of offering less protection. That trade sits at the heart of Chapter HB-06.

Between the payer's bank and the payee's bank sits shared plumbing: clearing and settlement mechanismsCSMs: the shared systems where banks exchange payment files and settle the resulting positions, such as STEP2, RT1 and TIPS in Europe.. Two designs dominate, and the difference between them explains why some payments are instant and others take a day.

Deferred net settlement batches everything up. All day, banks exchange payment files; at cut-off, the system nets them ("bank A owes bank B €40M, bank B owes bank A €38M, so A pays B €2M") and settles the difference in central bank money. Enormously efficient in liquidity, and the historical workhorse of retail payments, but the payee's bank only receives value at the next settlement cycle. Real-time gross settlement settles every transaction individually and immediately in central bank money, with instant finality. This used to be reserved for large-value payments; the instant payment revolution of the last decade brought it to your €3 coffee, at a per-transaction infrastructure cost that has fallen to fractions of a cent.^F1.3

Theory ends here. Below, one customer pays one merchant €100 online, four times, once on each of the four great rail families of European retail payments. Press play and watch the message travel, the money follow, and the fees peel off at each hop. The ledger on the right keeps score: what the merchant finally receives, when the money is truly theirs, and who took what along the way. All fee figures are illustrative mid-points from the sources in the footnotes, as of July 2026.

Professionals compress everything in this chapter into five questions. Ask them of any payment method, existing or proposed, and its economics and regulation become predictable. Here they are, answered for the four rails you just watched.

Notice the pattern down the cost row: price tracks protection and convenience, per euro of value. Percentage pricing pays for guarantee machinery and habit; flat-cents pricing reflects infrastructure cost. Which rail "wins" for a given merchant depends on basket size, margin, purchase frequency and dispute exposure, which is precisely the analysis Chapter HB-06 performs. And the roles you met here, issuer, acquirer, scheme, wallet, CPSP, each map to a license type and a business model, developed in HB-03 and HB-05.

Strip away the brands and the checkout buttons, and European retail payments run on two base rail families plus everything built on top of them. The card rails are private networks operated by schemes. The bank rails are the SEPA instruments running over shared clearing infrastructure. The overlay rails, wallets, A2A schemes and BNPL, are products layered over one or both. And cash remains the physical reference rail against which every digital method competes.

Three classification axes from Chapter HB-01 organize everything here. First, push versus pull: does the payer send, or does the payee collect? Second, batch versus instant: are transactions settled in cycles or one by one in real time? Third, open loop versus closed loop: can any bank join the network under common rules, or does one company sit on both sides of the transaction? Hold a new payment method against these three axes and it will land somewhere on the map below.

Cards are the workhorse of European consumer payments and the richest source of industry vocabulary. Two architectures matter, and the difference between them shapes pricing, regulation and competition.

The four-party model is the architecture you traced in Exhibit 1 of HB-01. Four roles: the cardholder, the issuerThe bank or licensed institution that gives the customer their card and account, authorizes payments and bears the customer relationship. (the cardholder's bank), the acquirerThe bank or licensed institution that signs up the merchant, receives card funds on its behalf and bears merchant-side risk. (the merchant's payment bank), and the merchant. The scheme, Visa or Mastercard, is deliberately outside the count: it owns the network and rulebook connecting thousands of issuers to thousands of acquirers, without holding either relationship itself. Money flows from issuer to acquirer through scheme settlement; interchangeThe fee paid by the acquirer to the issuer on each card transaction, capped in the EU at 0.2% (debit) and 0.3% (credit) for consumer cards. flows the other way, from acquirer to issuer, as the issuer's reward for funding the system. This open-loop design is why card acceptance is near universal: any bank can join either side under common rules.

The three-party model collapses issuer, acquirer and scheme into one company. American Express is the canonical case: it issues the card, signs the merchant and runs the network. Closed loop, full control of both relationships, and one commercial consequence worth remembering: with no interbank interchange fee inside the model, the EU interchange caps do not bite the same way, which is part of why three-party cards remain relatively expensive for merchants and rich in rewards for holders.

Beneath the international schemes sit Europe's domestic schemes: Cartes Bancaires in France, girocard in Germany, Bancomat in Italy, Dankort in Denmark. Most physical cards in those markets are co-badgedA card carrying two scheme brands, typically a domestic scheme plus Visa or Mastercard, letting the transaction route over either network.: the domestic scheme handles cheap national transactions, the international badge handles everything abroad and online. EU law requires that the merchant, and ultimately the consumer, can choose which brand a co-badged transaction routes over^F2.6, which makes routing choice a live commercial battleground. The Netherlands is the notable absence in this list: its domestic debit scheme, PIN, was wound down in 2012 in favour of Maestro and later Visa Debit and Debit Mastercard, which is part of why the Dutch A2A story of Chapter HB-18 matters so much.

The bank rails are the public roads of European payments: standardized instruments defined by the European Payments CouncilThe EPC: the payments-industry body that writes and maintains the SEPA scheme rulebooks for credit transfers, instant transfers and direct debits. rulebooks, open to every bank in the Single Euro Payments Area, cleared through shared infrastructure. Three instruments carry nearly all the traffic.

Most of what consumers experience as "payment methods" are overlays: consumer products wrapped around the card or bank rails, adding authentication, guarantees, brand and convenience, and charging for the addition. Three overlay families dominate Europe.

A2A schemes. iDEAL, Wero, Bizum, BLIK, MB Way, Swish, Vipps MobilePay: each wraps a scheme rulebook around bank transfers. The customer authenticates in their own bank app; the scheme adds what a bare transfer lacks: pre-filled payee details, a merchant guarantee on the "paid" status, standardized refunds, and a recognizable checkout brand. As HB-01's Exhibit 1 showed, the result is near-card convenience at flat-cents cost. These schemes were historically national; the EuroPA alliance and EPI's Wero are the current attempts to make the model pan-European, a story Chapter HB-18 and your organization live inside.

Wallets, in two architectures. A pass-through wallet, Apple Pay or Google Pay, stores a tokenizedTokenization replaces the real card number with a device-specific stand-in, so a stolen token is useless elsewhere. The scheme runs the token vault. card and passes each transaction straight to the card rails: the wallet authenticates, the card underneath pays, and the economics remain card economics. A staged wallet, PayPal or Alipay, runs its own ledger: it settles the purchase internally first, then squares up with the banking system through a separate funding leg. The distinction decides who holds the customer balance, who sets the fee, and which regulator cares: pass-through wallets barely touch payments regulation, staged wallets are licensed institutions in their own right, a thread picked up in HB-03.

BNPL. Buy-now-pay-later overlays a credit decision on the checkout: Klarna, Riverty or in3 pays the merchant now and collects from the consumer later, in installments. The rail underneath is ordinary, a transfer or direct debit; the product is the credit risk taken in the two seconds of checkout, priced to the merchant as a percentage well above card rates, in exchange for higher conversion and bigger baskets. Regulation is catching up: the revised EU Consumer Credit Directive pulls BNPL into scope, the subject of a panel in Chapter HB-12.

Two older rails complete the map, and one of them is far from gone. Cash remains the most used instrument at the physical point of sale in the euro area: 52% of POS transactions by volume in the ECB's 2024 payment-attitudes study, though only 39% by value and declining steadily^F2.5. Cash is the benchmark every digital rail is implicitly measured against: instant, final, free at point of use, anonymous, and offline. Every property a digital method lacks relative to cash, finality without a middleman, privacy, resilience when networks fail, eventually resurfaces as a regulatory demand or a product gap, from cash-acceptance rules to the offline digital euro.

Cheques survive only at the margins, folded with money remittances into the residual 1% of euro area non-cash transactions^F2.1, with France the last significant holdout. They matter to this handbook mainly as a contrast object: a pull instrument with no real-time authorization at all, which is why cheque fraud stayed stubborn for decades, and why their disappearance from Europe was mourned by almost no one. The US, as Chapter HB-17 will show, tells a different story.

The matrix below compresses this chapter into one reference table. Read it column by column when you meet a new use case, and row by row when you meet a new rail. Costs are merchant-side, indicative, and carry the same caveats as HB-01's footnotes.

One closing observation carries into Part II. Each rail's cost shape, percentage, cents, or nothing, reflects who takes risk and who owns the customer moment, never the raw cost of moving the bits. The next three chapters take that observation apart: HB-03 maps who is legally allowed to do what, HB-04 dissects the card fee stack line by line, and HB-05 turns the whole map into business models.

Every payment has a customer side and a merchant side, with shared infrastructure in between. The industry's role names simply label positions along that chain. The diagram fixes the geography; the cards beneath it define each role in two sentences. Learn these ten and most payments conversation becomes legible.

One warning about all these labels: they name functions, never companies. Real firms stack several functions at once, and the stacking choices are the strategy. That is the subject of Section II.

Ask of any payments company: which roles from Section I does it perform, and which does it rent from others? The answer locates it on the map, predicts its margins, and explains its behavior toward everyone else in the chain.

Adyen is the full-stack answer on the merchant side: gateway, processor and acquirer in a single build, plus a banking license so it settles funds without renting a bank. One contract, one system, no revenue shared with intermediaries; the model that made "full stack" a payments strategy term. Stripe began at the opposite end, as the developer-friendly payfac front end on top of other acquirers, and has steadily descended the stack, acquiring and issuing across markets. Mollie runs the PSP bundle for European SMEs on a payment institution license. Apple Pay performs authentication and user experience only: the card underneath does the paying, which is why Apple needs almost no payments license for it. PayPal, the staged wallet from HB-02, performs so many roles at once, wallet, acquirer-equivalent, issuer-equivalent, scheme-equivalent inside its own loop, that it holds a full banking license to cover them.

European law sorts everyone who touches payments onto a ladder of authorization. Each rung up adds powers, hold funds, issue money-like balances, take deposits and lend, and adds capital, supervision and compliance weight. One license, granted in one member state, passportsEU passporting lets an institution authorized in one member state provide the same services across the whole EU/EEA without separate national licenses. across the entire EU, which is why license domicile, Amsterdam, Dublin, Luxembourg, Vilnius, is itself a strategic choice.

Match real companies to the ladder and a pattern appears: the license each firm holds tracks the money it wants to make, never merely the compliance it must endure. Domiciles and license types below are stated as of July 2026, per public regulatory registers and company disclosures^F3.6.

Three closing observations turn this chapter's map into an analytical tool you will use for the rest of the handbook.

First, the license sets the ceiling on the business model. A payment institution can charge fees for moving money; an e-money institution can additionally earn on float; a bank can additionally lend. Each rung up unlocks a revenue line the rung below is legally denied. This is why "fintech gets a banking license" is a recurring headline: it is the moment a fee business tries to become a balance-sheet business.

Second, the license allocates trust, and trust is the product. Safeguarding, capital and supervision exist so that customers need never evaluate the firm's solvency themselves. The deeper lesson of HB-01 returns: payments run on institutions absorbing risk on behalf of strangers. The license ladder is that principle, written into law and priced in capital.

Third, the ladder itself is moving. The PSD3/PSR package merges the e-money rung into the payment institution regime and opens designated payment systems to non-bank PSPs directly, eroding one of the banks' oldest structural privileges^F3.5. Every shift of the ladder reshuffles who can compete for which layer, which is why Part IV of this handbook treats regulation as a market force rather than a compliance appendix.

When a merchant accepts a card, it pays one bill to its acquirer: the merchant service chargeMSC, also called the merchant discount rate (MDR): the all-in fee a merchant pays its acquirer for accepting a card payment.. That single bill is really three fees stacked on top of each other, flowing to three different parties. The stack below is the master diagram of card economics; everything else in this chapter is commentary on one of its layers.

Notice what the diagram does not contain: any line for the raw cost of moving the data. Authorization messages and clearing files cost fractions of a cent at scale, as HB-01's bare-transfer leg made vivid. The stack prices three other things entirely: the issuer's role in funding and guaranteeing the system, the network's rulebook and reach, and the acquirer's risk-bearing and service. Card economics is institutional economics.

Interchange is the fee the acquirer pays the issuer on every transaction, and therefore the fee the merchant side pays the customer side. It exists to solve a two-sided market problem: card networks only work if both merchants and cardholders join, and interchange lets the network subsidize the side that is harder to recruit. In practice, merchant fees fund issuers' cards, apps, fraud systems and rewards.

Because interchange is set by the scheme rather than negotiated between the paying and receiving parties, regulators treat it with suspicion, and Europe acted decisively: since 2015, the Interchange Fee Regulation caps consumer card interchange at 0.2% for debit and 0.3% for credit across the EEA^F4.1. That single rule is why European card acceptance is structurally cheaper than American, where debit interchange is capped only for large banks and credit interchange is uncapped, routinely running 1.5 to 2.5%, a contrast Chapter HB-17 develops.

Two important carve-outs survive inside Europe, and both matter commercially. Commercial cards, issued to businesses, sit outside the caps^F4.7: their interchange commonly exceeds 1%, which is why "corporate card" makes acquirers wince and why B2B payment flows price so differently. And inter-regional transactions, a US-issued card paying a European merchant, run under separate commitments Visa and Mastercard gave the European Commission in 2019: 0.2% and 0.3% when the card is present, but 1.15% for debit and 1.50% for credit online^F4.2. For a Dutch webshop selling to American tourists, the same €100 basket can carry five times the interchange.

The second layer flows to the network itself. Scheme and processing fees are the least visible part of the stack: dozens of line items, authorization fees, clearing fees, cross-border fees, FX fees, tokenization fees, reporting fees, value-added services, published in schedules that acquirers see and merchants mostly do not.

Two facts anchor the layer. First, unlike interchange, scheme fees are uncapped, and they have been rising: the UK Payment Systems Regulator's market review found Mastercard and Visa raised scheme and processing fees to acquirers by more than 30% in real terms over five years, with little evidence of matching service improvement, in a market where the two networks carry 99% of UK card payments by value^F4.3. The regulator's final report and remedies, running through 2026, are the sharpest official statement yet that the scheme layer prices like the duopoly it is. Second, scheme fees are where the growth is: as interchange sits frozen under caps, network revenue growth comes from new fee lines, FX, tokens, data products, fraud tools, a dynamic that reappears in the scheme business model in HB-05 and the Visa and Mastercard profiles in HB-08.

The final layer is the acquirer's own margin: compensation for merchant risk, funding the settlement gap, integration, support and fraud tooling. Unlike the layers beneath it, this one is genuinely negotiated, and how it is packaged defines the two pricing models every payments professional must know.

Blended pricing quotes the merchant one flat rate, say 1.4% plus ten cents, covering everything. Simple, predictable, and opaque: the merchant cannot see whether a fee rise came from interchange, scheme or margin, and cheap debit transactions subsidize expensive credit ones inside the blend. It is the default for small merchants. Interchange-plus-plus (IC++) passes interchange and scheme fees through at cost, transparently itemized, and adds a disclosed acquirer markup on top, often quoted in single-digit basis pointsOne basis point is 0.01%. Acquirer margins for large merchants are commonly quoted in basis points plus a small fixed fee per transaction. for enterprise volume. Large merchants demand it, because at their scale the blend hides real money^F4.4.

The competitive consequence is the shape of the whole acquiring industry: margins on enterprise IC++ deals are thin and volume-driven, while SME blended pricing carries the profit pool, which is why every modern PSP fights for small-merchant bundles and why the payfac model of HB-03 exists at all.

Now assemble the stack yourself. Set the transaction, choose the card, the channel and the pricing model, and the bar shows where every cent of the merchant service charge goes. All parameters are indicative mid-points; the exact figures and their sources sit in the assumptions panel and footnotes below.

One last question completes the economics: where does the merchant service charge finally land? The answer is a chain of pass-throughs with a sting at the end.

Merchants treat card fees as a cost of doing business and price them into goods. In the EU they largely cannot do otherwise at the till: surcharging consumer cards whose interchange is capped is banned under PSD2^F4.6, so the fee disappears into shelf prices paid by everyone, including customers who pay with cheaper methods. Meanwhile the interchange collected funds issuer rewards, which flow back disproportionately to heavier card users. The distributional result is well documented and quietly regressive: the cost of the card system is spread across all shoppers, while its benefits concentrate on those who use cards most. Understanding that loop is essential preparation for the political economy of Part IV, where every interchange debate, surcharge rule and routing mandate is at bottom an argument about who should carry this stack.

And with the card bill fully decomposed, the natural next question is the one your colleagues actually ask: who gets rich on each layer, and how? That is Chapter HB-05.

Return one last time to the €100 of Exhibit 1. To the customer it was one purchase; to the industry it was simultaneous revenue recognition in up to seven places: the issuer booked interchange, the scheme booked network fees, the acquirer booked its margin, the PSP booked its markup, the wallet (if used) booked its take rate, the fraud vendor booked a per-check fee, and someone, somewhere, earned overnight interest on the money in transit. Payments is unusual among industries in exactly this respect: a single event monetizes at every layer it touches. The layer cards below open each P&L. Every card follows the same anatomy: revenue lines, who actually pays, main costs, and the one KPI professionals watch.

The seventh P&L belongs to the infrastructure and processing layer: issuer processors, core banking vendors, orchestration platforms, fraud engines. Its model is the simplest and steadiest in payments: per-transaction cents or software licensing, sold to the six layers above rather than to merchants or consumers. Low take, low risk, high retention: the picks-and-shovels position, profiled with Marqeta and Thought Machine in Part III.

One revenue line runs across several layers without appearing on any price list: floatFloat is the interest earned on customer money while it sits with an institution: wallet balances, funds in settlement transit, prepaid balances.. Whenever money pauses, in a wallet balance, in settlement transit between T+0 and T+2, in a prepaid account, someone earns interest on the pause.

Three places to look for it. Wallet balances: a staged wallet holding tens of billions in customer funds earns meaningful interest on safeguarded balances, and pays customers none of it, one reason the e-money license rung of HB-03 is attractive at scale. Settlement timing: every day between the customer's payment and the merchant's payout is a day of float in the chain, which is why "faster settlement" is partly a negotiation about who surrenders interest income. Deposit funding: Klarna's bank license converts customer deposits into the cheapest possible funding for its BNPL book, float weaponized as cost of goods. The line is invisible in fee schedules and vivid in interest rate cycles: when rates rose after 2022, float quietly became one of the strongest profit swings in the industry, and when rates fall it evaporates just as quietly. Analysts who forget float misread half the sector's earnings.

Close Part II's economics with the industry's one-sentence strategic consensus: take rates on pure money movement trend toward zero, so value migrates to the layers that ride on top. The evidence is all around this chapter.

The instant rail moves €100 for under half a cent. Interchange is frozen by regulation. Acquiring take rates grind down under enterprise IC++ competition, Adyen's 16 basis points being the pace-setter. Open banking prices checkout in cents. What still commands percentage pricing is exactly what is hard to commoditize: risk absorption (credit, fraud, disputes), customer ownership (wallets, brands, habits), and software and data (orchestration, tokenization, intelligence). The scheme layer is the instructive case: with its transaction fee under pressure, its growth engine is value-added services, precisely the migration the thesis predicts, and precisely what the PSR is now probing^F5.7.

Hold the thesis while reading Part III, because it is the scorecard for every player profile: for each company, ask which side of the compression it sits on. And hold it while reading HB-23, because agentic commerce is the thesis at its endpoint: when software agents route payments, habit and brand weaken, and the layers that survive are risk, identity and rules. The next chapter, HB-06, first finishes the economics by asking the merchant's version of the question: given all these models, which rail should carry my checkout?

Everything in this chapter follows from one piece of arithmetic. Percentage-priced rails scale with the basket: a card fee doubles when the basket doubles. Flat-priced rails do not: an A2A fee is the same €0.29 on a coffee and on a laptop. The consequence is a set of crossover points, basket sizes above which each flat rail becomes cheaper than each percentage rail, and merchant behavior organizes itself around them. Drag the slider and watch the ranking reorder.

Three readings of the exhibit before moving on. At a €12 coffee-shop basket, flat fees are proportionally heavy and percentage rails are competitive: cards deserve their small-ticket dominance. At the €100 e-commerce median, the A2A rail is already several times cheaper than any percentage rail. And at a €250 airline ticket, the gap becomes decisive: this is the geometry behind every travel merchant that pushes bank payments, and behind the internal debates any A2A scheme has about pricing in cents versus basis points, since the choice decides which side of this chart it lives on.

The sticker fee is where the analysis starts, never where it ends. A merchant's true cost per rail adds four further lines: fraud losses, dispute operations, failed-payment handling, and conversion, the revenue silently lost when a checkout deters buyers. Europe's fraud data gives the first line real numbers.

The pattern behind the numbers: SCAStrong Customer Authentication, the PSD2 two-factor requirement. The EBA/ECB find it effective against the unauthorized-use fraud it was designed for. largely works against the fraud it was designed for, stolen credentials and unauthorized use, which is why card fraud rates keep falling per transaction. The growth is in authorized push payment fraud: the victim is tricked into approving a real, perfectly authenticated transfer to a fraudster. Instant, irrevocable rails make that theft efficient, and today the loss lands mostly on the user, a liability allocation now under direct regulatory attack: the UK already mandates reimbursement of APP fraud victims up to £85,000 split between sending and receiving PSPs^F6.6, and the EU's PSR package moves in the same direction. For merchants the translation is simple: the cheap rails are cheap partly because their protection machinery is thin, and regulation is in the process of pricing some of that machinery back in.

Merchants are never passive price-takers. Within legal limits they steer customers toward cheaper rails, and the strength of that steering power is itself a competitive variable between merchants.

The legal frame first: EU merchants may not surcharge consumer cards whose interchange the IFR caps, nor SEPA transfers and direct debits^F6.3. What survives is softer and highly effective: the ordering and pre-selection of payment methods at checkout, default options, one-extra-click friction on expensive methods, commercial-card surcharges where still lawful, and outright non-acceptance of premium instruments. Checkout design is fee policy conducted by other means.

Steering intensity is predictable from four merchant traits, documented in the travel vertical where the pressure is strongest^F6.5: high average transaction value, which makes the crossover geometry of Exhibit 3 decisive; thin operating margins, which put every basis point of payment cost on the board agenda; predominantly one-off purchases, which neutralize stored credentials and loyalty advantages; and strong control of the checkout, which makes steering executable. Airlines score maximum on all four, which is why Europe's most aggressive pay-by-bank pushes come from carriers, and the same four traits forecast the next steering battlegrounds: ticketing, utilities, the public sector, and high-value electronics.

Part II closes where Part III begins. Compress the three economics chapters into four sentences and you hold the scorecard for every player profile that follows.

One: percentage rails defend their pricing with protection, habit and reach; flat rails attack with the crossover geometry; and the instant base layer keeps resetting the cost floor beneath both. Two: the profit pool sits wherever risk is absorbed and customers are owned, and it is migrating from money movement toward software, data and credit, the compression thesis of HB-05. Three: merchants steer with growing sophistication exactly where the four traits align, so rail market share shifts vertical by vertical, never uniformly. Four: regulation keeps re-pricing the game, capping one layer, forcing openness in another, reallocating fraud liability in a third. Every company in the coming chapters, from Visa to the smallest startup on the radar, is a strategy for exactly this board.

Fourteen players and fifteen rivalries look like chaos until you notice that nearly every fight on the map belongs to one of three structural battles. Hold these three in mind and the landscape organizes itself.

The sovereignty battle. International card schemes carry roughly 61% of euro area card payments, only nine national card schemes survive in the EU, and thirteen euro area countries depend entirely on Visa and Mastercard for card transactions^F7.1. The ECB's Executive Board now states plainly that nearly two-thirds of euro area card transactions run through non-European companies and calls the dependence a strategic vulnerability^F7.2. Against this stands the European counter-project: EPI's Wero at 52.5 million registered users^F7.3, the EuroPA alliance of national A2A schemes, and their interoperability agreement reaching a combined 130 million users across thirteen markets^F7.4, all built on the instant rail whose economics Part II established. This is the battle your organization lives inside, and Chapter HB-18 gives it a full chapter.

The checkout battle. Whoever owns the moment of payment owns the percentage, the lesson of HB-05's take-rate table. So wallets, BNPL providers, A2A schemes and the card networks all fight for the same few pixels: the default button, the stored credential, the tap. The EU changed this battle's terms by forcing Apple to open the iPhone's NFC interface to competing wallets^F7.6, converting a hardware monopoly into contested ground.

The stack battle. Beneath the consumer surfaces, modern full-stack players (Adyen, Stripe) grind against the assembled legacy estates of European acquiring (Worldline, Nexi) for the merchant relationship, while open banking players attack the entire card stack from below with initiation priced in cents. This is HB-05's compression thesis playing out as corporate strategy: everyone descending, ascending or defending the stack to reach the layers where margin survives.

Hover or tap any player. Its rivalries light up, everything else recedes, and the panel below the map names each fight and its prize. The dashed green connection is the one relationship on the map that is a handover rather than a war.

First, the schemes touch everything. Visa and Mastercard have edges into every band: they fight the A2A rails for volume, tax the wallets that ride them, and sell services to the PSPs that route around them. That centrality is their strength and their regulatory exposure at once: whoever is connected to every fight is also named in every complaint.

Second, the most important relationships are the ambiguous ones. PayPal rides card rails while competing with card checkout. Wero and the EuroPA schemes cooperate on interoperability while implicitly competing to define pan-European A2A. Apple hosts its rivals' cards while charging their issuers. The industry term is coopetition, and the map marks these edges as fights because the cooperative surface always covers a contest for position.

Third, the succession edge is unique. iDEAL to Wero is the only connection on the map where one player is deliberately handing its position to another: the Dutch e-commerce default migrating onto the pan-European scheme through 2027. It is also the edge with the least room for error, since a fumbled succession would hand the Dutch checkout to every other player on the map. Chapter HB-18 treats it at full length.

Fourth, absence is information. No edge connects the open banking layer to the wallets, yet: pay-by-bank has fought the card stack first. And big tech appears only through its wallets; the deeper platform question, agents, devices and defaults, is deferred to HB-13 and HB-23, where it becomes the main event.

Chapters HB-08 through HB-14 profile every group on this map, and each profile applies the same four-question scorecard built in Part II. The table states the questions and what each battle turns them into.

Before the profiles, kill the most common misconception in the industry: the schemes do not earn interchange. Interchange flows from acquirers to issuers; the scheme merely sets its level where regulation permits^F8.6. What the scheme sells is everything around that flow: the rulebook that makes strangers' banks trust each other, the network that routes the messages, the brand that makes a card usable in Lisbon and Lima alike, the dispute machinery, and increasingly a shelf of paid services on top. Its own revenue is the scheme-fee layer of HB-04's stack plus the value-added services bought by issuers, acquirers and merchants.

Keep two Part II results in hand throughout this chapter. The scheme's take is small per transaction, low double-digit basis points across total volume, and colossal in aggregate, because it touches everything and carries almost no financial risk: the rulebook allocates credit risk to issuers, merchant risk to acquirers, and fraud loss by liability shift. And the scheme layer is uncapped and rising, the PSR's 30%-in-real-terms finding^F8.7, which is why this chapter's strategic story is regulatory as much as commercial.

Read the two profiles against HB-07's map and the duopoly's grand strategy becomes visible: own the connective tissue of whatever wins. If cards hold, the transaction machine earns. If A2A rises, Vocalink, Tink and Aiia earn. If agents take the checkout, token and identity services earn. The bet is placed on every square of the board at once, funded by a cash machine growing 11 to 16% a year. The one scenario the strategy cannot hedge is the regulatory one: a Europe that caps or structurally separates the scheme layer itself, which is why Part IV matters to these two companies more than any competitor does.

Recall the two architectures from HB-02: pass-through wallets tokenize a card and let it do the paying; staged wallets run their own ledger and settle with the world afterwards. Different plumbing, same strategic position: the wallet stands at the exact moment of initiation, which HB-05's take-rate table identified as the most monetizable square on the board. The staged wallet monetizes the merchant at roughly 2 to 3.5%; the pass-through wallet monetizes the issuer and the ecosystem; both monetize the habit, the stored credential and one-click default that make every alternative one step further away.

That is also why this chapter's fights are existential in both directions. For A2A schemes and banks, the wallets sit between them and their own customers. For the wallets, the twin threats are regulation prying open their surfaces, the EU has already forced the iPhone's payment chip open^F9.4, and the agentic scenario of HB-23, in which software rather than habit chooses the payment method.

Recall the anatomy from HB-03 and HB-04: this layer bundles gateway, processing, acquiring, risk and payout into the merchant's single payments contract, and earns the spread between the MSC collected and the interchange and scheme fees passed through. The market splits cleanly along the pricing line drawn in HB-04: enterprise volume on IC++ at wafer-thin basis points, where the game is scale, reliability and software; and SME volume on blended pricing at healthy margins, where the game is distribution, simplicity and bundling. Every profile below is a strategy for one side of that line, or an attempt to hold both.

Between the enterprise war and the estate defense, a middle tier picks its segments with discipline. Three representatives, one line each on model and math^F10.6.

Apply the scorecard and the layer resolves into one sentence per question. Compression: this is the most compressed layer in the book on pure processing, so every durable player is racing to attach software, risk tools, terminals-as-software or embedded finance. License: the leaders climbed rungs deliberately, Adyen to bank, Stripe and the challengers to EMI, exactly as HB-03 predicted for models needing settlement independence and float. Rail exposure: the layer is formally rail-neutral and will route A2A, cards or wallets alike, which makes it the natural distribution channel for every new rail, including Wero's merchant rollout, a dependency HB-18 returns to (Worldpay's EPI membership being the tell). Customer moment: it owns the merchant relationship rather than the consumer moment, taking prices set upstream while controlling which methods appear at checkout, the steering lever of HB-06 in corporate form.

Two PSD2 articles created this layer. Article 66 gives licensed payment initiation providers the right to trigger a payment from any payment account with the customer's consent; Article 67 gives account information providers the right to read it. Banks must grant the access without a contract and without charging for it^F11.3. Combine that with the AISP and PISP rungs of HB-03's ladder and the instant rail of HB-02, and the business model writes itself: sell merchants checkout initiation for flat cents on rails whose inputs the law made free.

The model's strength and weakness are the same fact, as HB-05 flagged: what is built on free inputs and priced in cents invites competition to the floor. Everything strategic in this chapter is an attempt to escape that floor.

The UK, with its standardized CMA-mandated APIs and a single monitoring entity, publishes the cleanest adoption data in the world, and 2025 was the year its curve bent upward decisively.

Read the composition, and the strategy behind the growth appears. Sweeping VRPs (automated me-to-me transfers) nearly doubled and reached roughly 16% of all open banking payments^F11.1: recurring, programmatic flows rather than one-off checkouts. That matters because recurring is where open banking finally attacks entrenched incumbents on their own ground: direct debit's batch cycles and cards' stored credentials. Commercial VRP, extending the mechanism from own-account sweeps to paying businesses, is the layer's most important product launch since PSD2 itself: SCA once at mandate setup, frictionless payments thereafter, instant settlement, no chargebacks, consumer-controlled limits^F11.2. The EU equivalent ambition travels under the SPAA scheme, the EPC's framework for premium, compensated API services beyond the PSD2 free baseline^F11.4.

Route one: recurring rails. Commercial VRP in the UK and SPAA-style premium services in the EU convert one-off initiations into standing mandates, stickier, programmatic, and priced per portfolio rather than per click. Once a consumer's utility bills, subscriptions and top-ups run on bank mandates, switching costs finally exist in a layer that never had them^F11.2.

Route two: the fraud dividend. Bank-authenticated, pre-verified push payments show markedly lower fraud rates than the surrounding mix, industry analyses put open banking payment fraud several times below other methods in the UK's first half of 2025^F11.6, and HB-06's liability wave (VoP, reimbursement regimes) raises the value of exactly that property. Selling verified, name-checked initiation as a risk product rather than a cheap pipe is the layer's most credible premium story.

Route three: regulation's second act. The PSD3/PSR package hardens API performance baselines, and the FIDA framework extends access from payment accounts to broader financial data^F11.7. Every improvement to the free baseline commoditizes yesterday's workarounds and pushes the pure-plays further up the value stack, the compression thesis applied to the compressors themselves.

Strip the branding and BNPL is three commitments made simultaneously at checkout: the provider pays the merchant now (minus a fee of roughly 2 to 6%, F5.6), takes the consumer's credit risk on the spot, and funds the receivable until installments arrive. The merchant buys conversion and bigger baskets; the consumer buys deferral, marketed as free because the merchant side carries the cost; the provider bets that checkout-native underwriting beats the losses.

The unit economics therefore live in one spread: merchant fee minus credit losses minus funding cost minus processing. Every number in this chapter is a reading on one of those four dials, and every strategic move in the layer, bank licenses for deposit funding (HB-03), longer interest-bearing terms, late fees, subscription tiers, is an attempt to widen the spread or steady it through the credit cycle.

BNPL's growth decade ran through a regulatory gap: short, interest-free deferrals largely escaped the old Consumer Credit Directive. The revised directive closes the gap: Directive (EU) 2023/2225 applies from 20 November 2026, pulling interest-free BNPL and deferred payment into consumer-credit law across the Union^F12.4.

What changes in practice: creditworthiness assessment before granting even small interest-free credit, standardized pre-contractual information, advertising rules that end the frictionless-fun framing, a right of withdrawal, and access to debt-advice framing in national implementations. The UK travels the same road on its own vehicle, bringing BNPL under FCA regulation in 2026^F12.7. The strategic consequence follows the handbook's standing logic: compliance costs scale-advantage the large (Klarna, already a bank, absorbs affordability checks into existing machinery) and squeeze the thin-margin regional specialists, pushing the layer toward exactly the consolidation and PSP-embedded distribution the profiles above describe.

Big tech's approach to payments is consistent across all four companies and refreshingly easy to state: own the moment, rent the rails, avoid the license. Payment for a platform is rarely a profit center; it is a friction remover and a data-and-lock-in engine for the businesses that actually earn: devices, advertising, commerce commissions, cloud. Hence the recurring shape: pass-through architectures riding cards (HB-09), minimal license footprints (HB-03's lightest viable rung), and monetization one layer away from the payment itself.

This is also why Europe's response is legal rather than commercial. You cannot out-compete a company that does not need payments to make money; you can only regulate the surfaces it controls. The NFC commitments (F9.4), the DMA's gatekeeper obligations^F13.1, and the sovereignty program of HB-07 are all versions of the same answer: if the surface is infrastructure, it will be governed like infrastructure.

An honesty note before the names, stronger than the handbook's usual sourcing discipline because the territory demands it: startup facts decay in months. Every entry below is tier B at best, drawn from company disclosures, license registers and consistent press coverage as of July 2026, and marked tier C where the category itself is still forming^F14.1. Inclusion is analytical relevance, never endorsement; absence means nothing.

Each category header names the structural shift it bets on, from the chapters where that shift was established. The closing table then generalizes the layer's graduation paths: the four ways a payments startup historically exits the radar, because knowing the destinations tells you how to read the journeys.

Payments startups exit the radar along four well-worn paths, and Part III already profiled the destinations. Reading any radar name, ask which path its investors are actually underwriting^F14.5.

Four distinctions are enough to read everything on the timeline below. First, directive versus regulation. A directiveEU law that binds member states to a result but must be transposed into national law, creating implementation lags and national variation. PSD2 is a directive. must be transposed into 27 national laws, which takes 18 months or more and produces national flavor; a regulationEU law that applies directly and identically in every member state from its application date, no transposition needed. The IFR and IPR are regulations. applies directly, identically, everywhere, on one date. The trend of the corridor is the shift from directives to regulations: PSD2 was a directive; its successor splits into PSD3 (licensing, a directive) and the PSR (conduct rules, a regulation), because the Commission grew tired of 27 versions of the same rulebook.

Second, adoption versus application. Every act has a date it becomes law and a later date it starts biting; the gap is the industry's build time, and confusing the two dates is the most common error in payments journalism. Third, level one versus level two. The headline act delegates technical detail, the SCA rules that shape every checkout live in an EBA-drafted RTSRegulatory Technical Standards: detailed binding rules drafted by the EBA under a mandate in the level-one act, adopted by the Commission. The SCA RTS under PSD2 is the canonical payments example., and the level-two layer is where lobbying wars are quietly won. Fourth, the pipeline states. Proposal, Parliament position, Council mandate, trilogueClosed-door negotiation between Parliament, Council and Commission to reconcile their texts into one. Ends in a provisional political agreement, which then still needs formal adoption and publication., provisional agreement, formal adoption, Official Journal, entry into force, application: an act is only law at the end of that chain, and the timeline's status colors encode exactly where each act stands^F15.1.

Sixteen acts on three tracks: the payments law track that built the market, the data and competition track that opened its surfaces, and the money itself track now redefining what settles. Click any node for what it is, what it changed, and where it stands today. Filter by track; the colors encode status.

The five sections above read the corpus at survey altitude. The six chapters below read it at article level. Each takes one part of the corpus, states the binding clauses, and sets them against the equivalent rules in the United Kingdom and the United States, so the reader can see where the same obligation is drafted, priced or enforced differently across the three regimes.

Two devices run through the series. A comparison matrix appears in every chapter, always on the same eight axes: who is bound, the core duty, the level two delegation, the application date, the enforcement body, the penalty exposure, the degree of national variation, and the extraterritorial reach. An obligations ledger accretes across the chapters, recording what each reference entity must build or absorb under each act; it opens empty here and closes at HB-15f. Section VI on this page holds the master version of the matrix; Section V defines the ledger and its columns.

One clause lands differently on a payment institution, a card issuing bank, a token issuer and a lender, because each holds a different licence and touches a different rail. The series tracks four regulated archetypes plus one gatekeeper foil, all anonymized to role, and shows how each named obligation applies to each. The archetypes are stated once here and reused without reintroduction in every chapter.

The ledger is the series' cumulative artifact. Each chapter adds one block of rows recording, per reference entity, the licences, controls, disclosures and liabilities that chapter's acts impose. The columns are fixed and shown below; the rows are empty here and fill as each chapter publishes. By HB-15f the ledger is a single sheet a compliance owner can read down one column to see everything a given entity must carry.

The master version of the matrix that appears in every chapter. Twelve acts that bind payments today or will inside the decade, read across the eight fixed axes. Filter by track. Cells here are at survey depth; the clause level detail, with article numbers, lives in the linked sub chapter. Provisional cells reflect the agreed PSD3 and PSR text pending Official Journal publication; pipeline cells are proposals, not law.

PSD2 is a single directive that member states transposed into 27 national laws, which produced divergence in conduct rules that were meant to be identical. The successor splits the same subject in two: PSD3, a directive that carries licensing and supervision, and the Payment Services Regulation, directly applicable and carrying the conduct rules on access, authentication, fraud and refunds that no longer need national transposition^F15A.1.

The Commission proposed both instruments on 28 June 2023: PSD3 as COM(2023) 366 and the PSR as COM(2023) 367, together repealing PSD2 (Directive 2015/2366) and the E-Money Directive (Directive 2009/110). The Parliament and Council reached provisional political agreement on 27 November 2025. Official Journal publication is expected in the first half of 2026, with the PSR applying after a transition of roughly 18 to 21 months and the payee verification duty and its liability applying at 24 months after entry into force, so real application lands in 2027 into 2028^F15A.2.

The practical consequence of the instrument change is that a conduct rule written in the PSR applies on one date, identically, in every member state, which removes the forum shopping that PSD2's national variation allowed. Licensing stays a directive under PSD3 because authorisation and supervision remain national functions. The two jurisdictions this chapter compares moved differently: the United Kingdom onshored PSD2 as the Payment Services Regulations 2017 and is now writing its own rules, and the United States never had a single payments statute to begin with^F15A.5.

Article 66 is the payment initiation right. A licensed payment initiation service provider may initiate a credit transfer from the user's account on the user's explicit consent, and the account servicing PSP must permit that access without requiring a contract. The provider may not store the user's personalised security credentials (Art 66(3)(e)) and may request them only where needed to provide the service (Art 66(3)(f))^F15A.1. Article 67 is the account information right, on the same consent basis and through the same interface, with credentials handled only as needed and in encrypted form under Article 22 of the SCA RTS.

The PSR carries both rights with direct effect and hardens them: dedicated interface performance and availability standards, non-discrimination against third party providers, contingency measures where an interface fails, and permission dashboards through which a user can see and withdraw the access it has granted^F15A.2. The access right itself does not change; the enforceability and the operational duties around it do.

Article 97 requires strong customer authentication when the payer accesses an account online, initiates an electronic payment, or carries out a remote action that carries a risk of fraud. The detail lives in the level two act: the SCA RTS, Delegated Regulation (EU) 2018/389, which sets the two factor requirement and the exemptions that became a competitive discipline in their own right, transaction risk analysis, low value, and merchant initiated transactions^F15A.3. The RTS applied from 14 September 2019, with e-commerce SCA enforcement phased in afterward.

The PSR keeps SCA and extends the liability around it. Where a scheme, a technical service provider or a payment gateway fails to apply SCA and that failure enables fraud, liability can attach to that party rather than resting only with the account holder's PSP^F15A.4. Authentication moves from a duty on one party to a chain of accountable parties.

Under PSD2, Article 73 requires the PSP to refund an unauthorised transaction, and Article 74 caps the payer's liability with a small excess unless the payer acted fraudulently or with gross negligence. The gap that mattered is that this regime covers unauthorised transactions and not authorised push payment fraud, where the payer is tricked into authorising a transfer to an account outside their control^F15A.1.

The PSR closes part of that gap. It extends reimbursement to impersonation, or spoofing, fraud, where a criminal poses as the payer's own bank or PSP, with reimbursement within short deadlines unless the consumer acted with gross negligence or was complicit. It attaches liability to failures in the name and IBAN verification, and it adds platform liability in defined impersonation scenarios so that online marketplaces enter the fraud prevention chain^F15A.4. The economics of fraud prevention move from a customer protection cost to a balance sheet exposure.

PSD2 Title II licenses payment institutions, and the E-Money Directive licenses electronic money institutions separately. PSD3 merges the two into a single payment institution authorised to issue e-money. Existing PIs and EMIs are grandfathered into the category rather than re-authorised from scratch, but they must update authorisation files, governance documentation and reporting to the new taxonomy, and safeguarding tightens, including a duty to spread safeguarded funds across more than one credit institution to address concentration risk^F15A.2. HB-15c returns to the merger from the token issuer's side.

Select a clause to read it four ways: as it stands in PSD2, as the PSD3 directive and the PSR carry it forward, and how the United Kingdom and the United States treat the same subject. The point of the exhibit is the divergence: the same obligation is drafted, priced or absent in different places.

The chapter's bespoke version of the series matrix, applying the eight axes to conduct and access across the three regimes.

The first block of the cumulative ledger, covering the two reference entities this chapter binds. Later chapters add the EMT issuer, the BNPL lender and the gatekeeper, and add rows for prices, money, data and financial crime.

These three acts share a purpose, moving a cost or a risk off the party that could not control it, and split cleanly by target. The Interchange Fee Regulation caps a price. The Instant Payments Regulation compels a capability. Consumer Credit Directive 2 extends a protective regime to a product that had escaped it. Two are regulations that apply identically across the union; the third is a directive that each member state transposes, which is why the Dutch detail matters in the third section^F15B.1.

The Interchange Fee Regulation, Regulation (EU) 2015/751, caps the fee an acquirer pays an issuer on a card transaction. Article 3 sets consumer debit interchange at 0.2% of the transaction, Article 4 sets consumer credit at 0.3%, and Article 5 counts any net compensation with the same effect as part of the interchange fee, which closes the obvious route around the cap. The caps applied from 9 December 2015^F15B.1. This is the act that halved European card economics and opened the space the account to account challengers grew into.

The business rules matter as much as the caps. Article 7 requires the separation of a four party scheme from its processing entity in accounting, organisation and decision making, so a scheme cannot bundle processing to lock out rivals. Article 8 governs co-badging, Article 10 is the Honour All Cards rule, which stops a scheme forcing a merchant to accept every product to accept any, and Article 11 preserves the merchant's right to steer a customer toward a cheaper instrument. PSD2 adds the surcharging ban on regulated cards, so a merchant cannot pass the cost back at the till^F15B.1.

The Instant Payments Regulation, Regulation (EU) 2024/886, does not create a new rail. It amends the SEPA Regulation, Regulation (EU) 260/2012, to make the existing instant rail compulsory, and it inserts four obligations^F15B.2. Article 5a is reachability: a euro area PSP must be able to receive instant credit transfers, in force since 9 January 2025, and to send them, in force since 9 October 2025, with payment institutions and e money institutions following by 9 April 2027. Article 5b is price parity: the charge for an instant transfer may be no higher than for a standard credit transfer, which removes the premium that had kept instant a niche product.

Article 5c is verification of payee: before the payer authorises, the PSP must match the payee name to the IBAN and flag a mismatch, at no extra charge, with reimbursement where a verification failure causes a misdirected payment. Article 5d replaces per transaction sanctions screening with daily screening of the PSP's own customer base against EU restrictive measures lists, because a ten second payment leaves no time to screen the transaction itself^F15B.2. The PSR (HB-15a) later extends the same name check across all credit transfers, not only instant ones.

Consumer Credit Directive 2, Directive (EU) 2023/2225, repeals the 2008 directive and widens the perimeter of regulated consumer credit. It removes the EUR 200 lower threshold that had let small and short term credit escape the regime and raises the ceiling to EUR 100,000, which pulls buy now pay later, deferred debit cards and authorised overdrafts into scope for the first time at EU level^F15B.3. Inside the perimeter, Article 18 requires a creditworthiness assessment before the credit is granted, the SECCI pre contract form standardises disclosure including the annual percentage rate, and advertising and withdrawal rules apply.

The application date is 20 November 2026, one year after the transposition deadline set in Article 46, and the directive form means the Dutch detail is set nationally. The Netherlands implements CCD2 through the Wft, with an Implementation Act and Implementation Decree due in force by that date; the Dutch text applies the minor to credit restriction to most agreements while treating BNPL deferred payment as an exception in that specific provision^F15B.3. A BNPL lender that is unregulated today becomes a supervised creditor on that date.

Select a clause to read it three ways: as it stands in the EU instrument, and how the United Kingdom and the United States treat the same subject. On prices and credit the three regimes diverge more than on any other part of the corpus.

The chapter's bespoke version of the series matrix, applying the eight axes to prices and credit across the three regimes.

The second block of the cumulative ledger, covering the three reference entities this chapter touches. The card issuer and A2A PSP carry forward from HB-15a; the BNPL lender enters here.

This chapter leaves conduct and price behind and turns to what settles and who is present. Three instruments carry the frontier. MiCA governs privately issued crypto money and the firms that service it. eIDAS2 builds the public identity layer that will sit underneath authentication. The digital euro would put central bank money into retail hands for the first time. Two are regulations already in force; the third is a proposal in trilogue, so its detail is stated as pipeline^F15C.4.

MiCA, Regulation (EU) 2023/1114, sorts crypto assets into three buckets by reference (Article 3). An e money token (Title IV) references a single official currency and is treated close to e money. An asset referenced token (Title III) references a basket, another asset or a mix, and carries heavier reserve and governance duties. Everything else, the utility and exchange tokens, falls under Title II with a whitepaper obligation (Article 6). The stablecoin titles, III and IV, applied from 30 June 2024^F15C.1.

The e money token rule is the one that connects to the rest of this series. Under Title IV, only a credit institution or an authorised e money institution may issue an EMT, and the token must be fully reserved, redeemable at par at any time at no cost, and may not pay interest. That issuer requirement runs straight into the PI and EMI licence merger of HB-15a: the entity that issues a euro stablecoin is the same regulated species the PSR reshapes. Significant tokens come under additional EBA supervision.

The service side is Title V. A crypto asset service provider must be authorised by a national competent authority, meet the Article 67 capital classes of EUR 50,000, 125,000 or 150,000 depending on the services it offers, and may then passport across the EU. Title V applied from 30 December 2024, and the Article 143 transitional window that let incumbents keep operating under national law closes on 1 July 2026. The Transfer of Funds Regulation, Regulation (EU) 2023/1113, adds the crypto travel rule alongside^F15C.2.

eIDAS2, Regulation (EU) 2024/1183, amends the original eIDAS Regulation (910/2014) and creates the European Digital Identity Wallet. Article 5a requires every member state to provide at least one certified EUDI wallet, free of charge and voluntary to use, by the end of 2026, with the five core implementing regulations adopted on 28 November 2024 setting the technical rules. Regulated sectors, banks and PSPs among them, must accept the wallet as an authentication method by the end of 2027^F15C.3.

The payments relevance runs through authentication. The wallet can carry strong customer authentication under PSD2 and the PSR (HB-15a), and it can carry onboarding and know your customer credentials, which places public identity infrastructure underneath a checkout, an account opening and, in time, a payment credential. A member state may provide the wallet itself, mandate a provider, or certify a private one, so national rollout speed will vary.

The digital euro package, proposed on 28 June 2023, would establish retail central bank money alongside notes and coins, distributed to the public through PSPs rather than by the ECB directly. The design questions that matter for the market are the holding limits that cap how much digital euro a person may hold, so bank deposits do not drain into central bank money; the compensation model for the banks that distribute it; and the offline form, which the Parliament's position frames as a tokenised version of cash with cash like privacy below a threshold^F15C.4.

On status, the ECB concluded its preparation phase and moved to the next phase on 29 October 2025, building technical capacity ahead of a possible decision to issue. The Council adopted its negotiating position in December 2025 and trilogues ran through 2026, with the co legislators aiming to finalise the regulation in the course of the year. The ECB targets a possible first issuance during 2029, contingent on the legislation, with a pilot as early as 2027. Whatever its final shape, its design would redraw the map of HB-07 and HB-20 more than any private initiative could, which is why this handbook tracks it as the slow giant rather than a near term product.

Select a clause to read it three ways: as it stands in the EU instrument, and how the United Kingdom and the United States treat the same subject. On money and identity the three regimes have reached different settlements, and the digital euro clause is still a proposal.

The chapter's bespoke version of the series matrix, applying the eight axes to money and identity across the three regimes.

The third block of the cumulative ledger. The EMT issuer enters here; the A2A PSP and the card issuer appear where identity and central bank money reach them.

Two questions run through this chapter. Who may reach a customer's financial data, and who controls the surface a payment runs across. The first is the data access agenda that runs from open banking to open finance. The second is the platform competition agenda that the Digital Markets Act aims at the firms that own the phone, the app store and the tap. The European Union legislates both by ex ante rule; the United Kingdom uses a designation regime and a data statute; the United States relies on a contested data rule and antitrust litigation^F15D.1.

The data access agenda starts with PSD2. Articles 66 and 67 gave licensed third parties access to payment accounts, and the PSR hardens that access with interface performance duties and permission dashboards (HB-15a). Open banking is the working proof that a mandated data right can create a market. The next step is to widen the aperture from payment accounts to the rest of a customer's financial life^F15D.1.

FIDA, the Financial Data Access Regulation (COM(2023) 360), is that step. It would extend regulated, permission based access to savings, investments, pensions, insurance and credit, organised through industry run financial data sharing schemes that set standards, compensation for data holders and liability, with customers managing consent through permission dashboards. It would also restrict designated gatekeepers' access to sensitive financial data. FIDA nearly fell out of the Commission's 2025 work programme, survived, and sits in trilogue as of mid 2026, with phased application expected from 2027 into the end of the decade. It is the least certain node on the corridor, and is stated here as pipeline^F15D.2.

The Digital Markets Act, Regulation (EU) 2022/1925, aims at the firms that own the surfaces a payment crosses. It designates gatekeepers by quantitative thresholds (Article 3), and the obligations then apply per se to every designated firm from the designation date, with penalties up to 10 percent of global turnover and 20 percent on repeated infringement^F15D.3. Three obligations matter for payments. Article 5(4) is anti steering: a gatekeeper must let developers point users to alternatives. Article 5(7) is the per se rule that stops a gatekeeper forcing users to take its own in app payment system, identification service or browser engine. Article 6(7) requires effective interoperability with the same hardware and software features the gatekeeper uses, which reaches the iPhone NFC input.

The enforcement is real. On 23 April 2025 the Commission imposed its first DMA fines, EUR 500 million on Apple for breaching the Article 5(4) anti steering obligation and EUR 200 million on Meta for its consent or pay model^F15D.4. On the tap specifically, the Apple NFC commitments (case AT.40452, July 2024) open the iPhone NFC to rival wallets free of charge for ten years, alongside the Article 6(7) duty^F15D.5. Together these are the legal doorway through which a European wallet, Wero above all, reaches the physical point of sale.

The gatekeeper archetype enters the ledger here, and the same clauses read as constraints on it. Article 5(7) removes its ability to require its own payment system; Article 6(7) and the AT.40452 commitments force it to open the NFC it once reserved; Article 5(4) obliges it to permit steering; and the April 2025 fine shows the Commission will price non compliance in hundreds of millions. For the A2A PSP and the European wallet, the same rules run the other way: they are the parties the opening is for, and the tap becomes reachable in law rather than only in ambition.

Select a clause to read it three ways: as it stands in the EU instrument, and how the United Kingdom and the United States treat the same subject. On data and platforms the sharpest contrast is method: the EU legislates ex ante, the US litigates.

The chapter's bespoke version of the series matrix, applying the eight axes to data access and platform competition across the three regimes.

The fourth block of the cumulative ledger. The gatekeeper column activates here; the A2A PSP and card issuer appear where data access and platform rules reach them.

Anti money laundering is the one duty that sits across every other chapter in this series. A payment institution, a card issuer, a token issuer and a lender are all obliged entities, required to know their customers, monitor transactions, screen against sanctions and report suspicion. The instrument that carries this duty is changing shape. The EU is replacing a directive that each state transposed, which produced 27 versions of the same rulebook, with a directly applicable regulation and a central authority to enforce it consistently^F15E.1.

The AMLR, Regulation (EU) 2024/1624, is the core of the 2024 package. Because it is a regulation it is directly applicable, so the same text binds every obliged entity in every member state from 10 July 2027, with no national transposition buffer^F15E.1. It carries the customer due diligence, beneficial ownership and reporting rules that were previously scattered across national implementations of the fourth directive.

Three provisions matter for a payments firm. The list of obliged entities expands to include crypto asset service providers, high value goods dealers and others alongside the familiar banks and payment institutions. A union wide cash limit of EUR 10,000 applies to business transactions, with customer identification required for cash payments of EUR 3,000 or more. And enhanced due diligence attaches to high value relationships, with thresholds around EUR 5 million in assets or EUR 50 million in net worth. Obliged entities must respond to a financial intelligence unit request within five working days^F15E.1. The directive half of the package, AMLD6 (Directive (EU) 2024/1640), keeps what is better left national: beneficial ownership registers, the powers of financial intelligence units and how national supervisors operate, transposed by the same July 2027 date^F15E.2.

The AMLA, the Authority for Anti Money Laundering established by Regulation (EU) 2024/1620, is the enforcement half of the reform. Based in Frankfurt and operational since 1 July 2025, it will select around forty of the highest risk cross border financial entities for direct supervision from 2027, coordinate national supervisors for the rest, issue binding guidelines and technical standards, and reach full operation by January 2028^F15E.3. It does not replace national supervisors; it sits above them to end divergent practice.

The crypto perimeter is closed by the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, which has applied since 30 December 2024. It carries the crypto travel rule: a crypto asset service provider must collect and transmit verified originator and beneficiary information with every transfer, the same traceability that has long applied to wire transfers^F15E.4. Together with MiCA (HB-15c), it brings the token issuer and the exchange fully inside the financial crime regime.

For a payments firm the package resolves into a set of running controls: customer due diligence at onboarding and on an ongoing basis; transaction monitoring for suspicion; sanctions screening, which the Instant Payments Regulation already made a daily customer level duty rather than a per transaction one (HB-15b); beneficial ownership verification; suspicious activity reporting to the financial intelligence unit; and the travel rule for any crypto leg. The strategic point is cost. A harmonised, higher standard raises the fixed compliance cost of operating a licence, which scale advantages the largest PSPs and feeds the compliance tooling category the handbook tracks in HB-14^F15E.7.

Select a clause to read it three ways: as it stands in the EU instrument, and how the United Kingdom and the United States treat the same subject. On financial crime the sharpest 2025 divergence was beneficial ownership, where the EU strengthened transparency and the US narrowed it.

The chapter's bespoke version of the series matrix, applying the eight axes to anti money laundering across the three regimes.

The fifth block of the cumulative ledger. Every reference entity is an obliged entity here; the gatekeeper enters the AML perimeter only where it provides payment or crypto services.

Read end to end, the five domains resolve into three findings that hold across the whole corpus^F15F.1.

One, the instrument is shifting from directive to regulation. PSD2 becomes the directly applicable PSR; the fourth AML directive becomes the AMLR; the IFR, the IPR, MiCA, eIDAS2 and the DMA are all regulations. The effect is the same each time: one text applies identically on one date across the union, which removes the national variation that transposition produced and closes the room for forum shopping. Licensing stays a directive, under PSD3 and AMLD6, because authorisation and supervision remain national functions.

Two, the three regimes legislate by different methods. The European Union acts ex ante and comprehensively, writing detailed rules that bind before harm occurs. The United Kingdom diverges: a bespoke designation regime under the DMCC in place of the DMA's per se obligations, refined directive derived rules in payments and AML, and a first mover position on APP fraud reimbursement and BNPL. The United States relies on litigation and has partly retreated: the debit interchange cap vacated in court, the BNPL interpretive rule withdrawn, beneficial ownership reporting narrowed, and the iPhone tap pursued through an antitrust suit rather than a rule, while it legislated stablecoins through the GENIUS Act and declined a retail CBDC.

Three, the direction of travel is consistent. Across twenty years the corpus has opened closed access surfaces, capped scheme and interchange rents, placed public infrastructure beneath private layers, and now centralises supervision in the AMLA. Each domain is a version of the same move: take a control an incumbent held, and hand the opening to the challenger the rule was written to enable^F15F.4.

The five domains of the series, read across the three regimes by method and instrument.

The per chapter matrices read one domain at a time. Read at corpus level, the eight axes separate the three regimes cleanly. The filterable per act version lives in the HB-15 hub^F15F.2.

The ledger the series opened at the hub, closed. Each reference entity read across the five domains: everything it must hold, build, price or absorb under the EU corpus. Read down one column to see a domain; read across one row to see an entity's full load^F15F.3.

What applies when, across the three regimes. Filter by regime. Dates in the future are expectations from the primary sources of the earlier chapters, not law, and the pipeline nodes move; status tag them when quoting^F15F.3.

Every domain in this series is a contest over one layer of a payment. Conduct and access decide who may reach the account. Prices and credit decide what the transaction costs and when deferral becomes regulated lending. Money and identity decide what settles and who is present. Data and platforms decide who controls the surface and the customer's data. Financial crime decides who is accountable for the record of trust. The EU's answer, read across all five, is to legislate each layer open by regulation, place public infrastructure beneath the private one, and supervise the result centrally^F15F.5.

For a desk inside the iDEAL to Wero migration, the practical reading is direct. The IPR made the cheap rail mandatory, the PSR re prices fraud, the DMA and the NFC remedy open the physical tap, and eIDAS2 supplies the identity layer. The corpus was written, in large part, to enable the account to account challenger this handbook follows. The work now is to price the pipeline in Section V into each roadmap, and to re verify the forward dates each quarter against the primary sources, because the pipeline moves.

Three structural facts make British developments predictive for EU practitioners. One, common ancestry: UK payments law is onshored PSD2, the retained IFR caps, and SCA rules, so divergence is legible edit by edit rather than system by system. Two, concentrated machinery: a single economic regulator for payment systems (the PSR, now being absorbed into the FCA^F16.1) could mandate outcomes, reimbursement, API standards, remedies, faster than 27 member states can agree on lunch. Three, the world's most measured open banking market (HB-11's dashboard), which turns British policy experiments into published data everyone else gets to learn from.

The strategic frame arrived in November 2024 as the National Payments Vision: government's statement that infrastructure renewal, open banking payments and fraud protection are national priorities, with account-to-account payments explicitly backed as the growth path^F16.2. Read it as the UK's equivalent of the EU sovereignty agenda, minus the geopolitics, plus a delivery plan.

File one: APP fraud reimbursement, the liability experiment. Since 7 October 2024, victims of authorized push payment fraud on Faster Payments (and CHAPS) are reimbursed by default up to £85,000, with the cost split equally between sending and receiving institutions^F16.3. The design is the world's most aggressive answer to HB-06's who-bears-the-loss question: putting receiving banks on the hook financializes mule-account control, and the claims-cost line now prices fraud prevention directly into every UK PSP's P&L. The EU's PSD3/PSR fraud-liability provisions are a moderated cousin of this file; watching UK claims data is watching Europe's future argument.

File two: scheme fees, the remedies file. The PSR's market reviews concluded that card scheme and processing fees rose over 30% in real terms without competitive justification, and that post-Brexit cross-border interchange increases lacked one too; remedies under development span pricing transparency obligations and potential caps^F16.4. This is the file HB-08's duopoly watches most closely worldwide, because a UK cap methodology becomes every other regulator's template.

File three: open banking's commercialization. The Vision's centerpiece in practice: the 351M-payment year, the UKPI's commercial VRP scheme with first live payments in Q1 2026, and an FCA-led framework making seamless account-to-account payment an explicit policy objective^F16.5. HB-11 carries the numbers; the regulatory point is the method: convene the firms, set the deadline, publish the data.

File four: BNPL enters the perimeter. Deferred payment credit comes under FCA regulation during 2026: affordability checks, disclosure standards, and access to the Financial Ombudsman for complaints^F16.6, the British sibling of CCD2's 20 November 2026 (HB-12), landing on roughly the same calendar by a different legal route.

Start with the structural absence: no single authority owns US payments. The Federal Reserve regulates banks and runs rails; the OCC charters national banks; the CFPB writes consumer rules; the FTC and DOJ police competition; fifty states license money transmitters one by one, which is why HB-03's single-passport EMI has no American equivalent and every fintech carries a fifty-state license binder. Rulemaking in the gaps is settled the American way: by litigation, as this chapter's centerpiece file shows.

The economic consequence Europeans feel first: credit interchange is uncapped, commonly 1.5 to 2.5% plus fixed cents, funding the rewards ecosystem that makes American cards beloved and American acceptance expensive^F17.1. Only debit is capped, by the Durbin Amendment's Regulation II (roughly $0.21 plus 0.05% for covered banks, with dual-routing rights)^F17.1. Every US-side number in HB-04 through HB-12, PayPal's 1.9% take, Klarna's 3.29% pricing, Stripe's 2.9% list, lives on this uncapped substrate; the Atlantic margin difference is regulatory before it is competitive.

File one: Section 1033, open banking by ordeal. The saga in one paragraph: the CFPB finalized its Personal Financial Data Rights rule in October 2024, giving consumers PSD2-style data access with phased compliance from April 2026; banks sued; a federal court in Kentucky enjoined the rule, finding it likely exceeded statutory authority; the CFPB under new leadership sided with the plaintiffs, calling its own rule unlawful, and reopened rulemaking, including whether banks may charge for data access, the exact opposite of PSD2's free baseline; the April 2026 deadline passed without effect, with revised rules expected but unsettled^F17.2. For a European reader the lesson is structural: the same policy (account access) that arrived in Europe as a directive with a date arrives in America as a decade of rulemaking, injunction and revision, and the US aggregator market (Plaid and peers, HB-11) grew up in the gap on private bilateral agreements instead.

File two: instant payments without a mandate. The US now runs two modern instant rails, the clearing banks' RTP (2017) and the Fed's FedNow (2023), plus the bank-owned Zelle P2P network moving over a trillion dollars a year^F17.3. What it does not have is an IPR: no reachability mandate, no parity pricing, no VoP by law. Adoption is therefore commercial and gradual, exactly the pre-IPR European pattern of HB-02, and cheques persist in B2B flows at volumes that astonish European treasury teams.

File three: the GENIUS Act, dollars tokenized under law. Signed July 2025, the first federal stablecoin statute: issuer licensing, full-reserve requirements, redemption rights, and supervisory allocation between federal and state regulators^F17.4. The live flashpoint at writing is yield, whether exchanges and issuers may pass interest-like rewards to holders, with bank groups pushing for prohibition^F17.4. Strategically this is the file with the largest spillover into this handbook's home market: MiCA-regulated Europe and GENIUS-regulated America now form the twin legal foundations under HB-14's digital-money category and HB-20's stablecoin settlement scenarios.

File four: the credit-card fee wars. The Credit Card Competition Act (routing rights for credit, the Durbin logic extended) remains introduced and stalled; the long-running merchant litigation against the networks produced settlements without structural change; and the political theatre continues, including presidential demands for interest-rate caps that banks publicly resist^F17.5. The file to watch for HB-08's duopoly: any credit-routing mandate would be the American IFR moment, and its repeated failure to pass is why US economics remain the counterfactual rather than the trend.

File five: consumer protection's two regulations. Regulation E (electronic transfers: unauthorized-transaction liability limits, dispute rights) and Regulation Z (credit: disclosure, billing rights) are the workhorses beneath every US dispute flow^F17.6. The persistent gap, familiar from HB-06: authorized push payment fraud sits largely outside Reg E's unauthorized-transfer protections, and the UK-style reimbursement mandate has no US counterpart, making Zelle scam liability a recurring political and litigation battleground.