High-risk merchant accounts for businesses in Belgium

Nine authorities set the rules a Belgian online merchant meets, from the payment license to the checkout button.

Bancontact is Belgium’s domestic scheme: nearly 18 million cards in circulation and 2.5 billion payments in 2025, 393 million of them online through mobile solutions. On March 16, 2026 the “Payconiq by Bancontact” app became Bancontact Pay, and online payments now carry three names: Bancontact Pay for mobile, Bancontact Card for the debit card online, and Bancontact One Click for a stored card. Former Payconiq merchant tools moved under the name Bancontact Pro. Wero, the European account-to-account wallet, went live for e-commerce in Belgium on March 3, 2026, with more banks joining through the second half of the year.

When both the issuer and the acquirer sit in the European Economic Area, the EU Interchange Fee Regulation caps interchange on consumer cards at 0.2% for debit and 0.3% for credit; commercial cards, cash withdrawals and three-party schemes sit outside the caps. PSD2 still governs card payments, and its technical standards let payment providers skip Strong Customer Authentication on a remote payment of €30 or less while the unauthenticated total stays within €100 or five payments, on a recurring series of the same amount after the first payment, and on low-risk payments up to €500, €250 or €100 depending on the provider’s fraud rate. Each exemption is an option for the providers, never for the merchant. PSD2, written into Belgian law at article VII.44 §2 of the Code of Economic Law, adds a sharp consequence: a payee that does not accept Strong Customer Authentication reimburses the loss it causes to the cardholder’s bank. The 3-D Secure guide covers the mechanics.

Since July 1, 2022, every business selling to consumers, whatever its size, must offer at least one electronic payment method. It may not charge extra for it or refuse it below a set amount, and it may vary the methods by amount only if it says so clearly before the purchase. Meal vouchers, eco-cheques and cryptocurrencies do not count. More broadly, a payee may not charge the payer for using a given payment instrument.

The duty to accept cash, in force since March 31, 2024, applies when the business and the consumer are physically present at the same time, so it does not reach remote online sales. A cash payment above €3,000 for one or more linked debts is banned, with criminal fines from €2,000 to €1,800,000.

Distance contracts carry a withdrawal period of 14 calendar days, and the trader refunds every payment, standard delivery included, within 14 days of being told; for goods it may wait until it has them back or proof they were sent. When the trader fails to inform the consumer of the right, the period runs 12 months longer. Digital content supplied at once loses the right only with the consumer’s prior express consent and acknowledgment, confirmed on a durable medium.

Three duties shape the checkout itself:

• the withdrawal function: since August 14, 2026, under a law of July 19, 2026, an online distance contract needs a clearly visible function labeled “renoncer au contrat ici” or equally clear, available for the whole period, followed by a confirmation step and an immediate acknowledgment with the date and time;
• the order button: when ordering obliges the customer to pay, the button must say “commande avec obligation de paiement” or something as unambiguous, or the consumer is not bound by the order;
• payment methods and delivery limits, shown clearly at the start of the ordering process.

A fixed-term service contract may renew tacitly only if the clause sits in bold, in a separate box on the front of the first page, with the consequences and the last date to object; after the first renewal, the consumer may end it without compensation on two months’ notice at most. Fixed-term contracts for goods, such as magazine subscriptions, fall outside. The subscription billing guide shows how to build a flow that meets these rules.

Since January 1, 2026, Belgian VAT-liable businesses must exchange structured electronic invoices with each other, through the Peppol network by default; a PDF sent by email or through a platform is no longer enough. Invoices to consumers sit outside the obligation, but every VAT-liable business, small businesses under the €25,000 franchise scheme included, must be able to receive structured e-invoices from its suppliers. Businesses without a fixed establishment in Belgium are outside the obligation, even when VAT-identified there.

The FPS Finance said it would apply no penalties for offenses specific to the new rule during the first three months of 2026, for businesses that had taken timely and reasonable steps, and refused any general postponement. Lacking the technical means to issue and receive e-invoices now costs €1,500 for a first offense, €3,000 for a second and €5,000 for each further one, and a business customer needs the structured invoice to deduct the VAT.

A payment user obtains correction of an unauthorized or badly executed payment only by notifying its bank without delay and at the latest 13 months after the debit. The bank refunds an unauthorized payment immediately, and at the latest by the end of the next business day, unless it has good reason to suspect fraud and reports it in writing to the FPS Economy. Before reporting a loss or theft, the cardholder bears at most €50, or the full loss after fraud or gross negligence, and nothing when the fraud could not be detected, the bank’s agent caused it, the bank did not require Strong Customer Authentication or the payee did not accept it.

Card chargebacks run under the card schemes’ rules, with deadlines at each step that the acquirer communicates. Each one counts toward your chargeback ratio.

The Crossroads Bank for Enterprises gives every company a single identification number used by all authorities. Its free Public Search shows the company’s status, legal form, registered office, directors, activity codes and licenses, any ex officio striking-off for unfiled annual accounts or UBO failures, and links to its publications in the Belgian Official Gazette. Under NACE-BEL 2025, activity codes no longer reflect the sales channel: the old seven-digit e-commerce codes were replaced automatically where companies had not corrected them by December 31, 2025, so a registered activity may no longer match what the company sells.

Companies register their beneficial owners in the UBO register within one month of incorporation or of any change, and confirm the data every year; failures can bring administrative fines of €250 to €50,000. On VAT identification, the enterprise number becomes the VAT number.

Euro settlement runs over SEPA; other currencies settle as agreed in your offer. Instant transfers reach the payee within 10 seconds and may cost no more than standard transfers, and since October 9, 2025 the payer’s bank must offer a check of the payee’s name against the IBAN before a euro transfer is authorized: the account you are paid into should carry the same name your customers see.

1. Selling vapes, tobacco or weapons online to Belgian consumers. The distance sale is banned outright, and no license opens it.
2. Sending PDF invoices to Belgian business customers in 2026. Peppol is compulsory between VAT-liable businesses: non-compliant invoices draw the usual invoice fines, and lacking the means to send and receive them costs €1,500, €3,000, then €5,000.
3. No withdrawal function on the site. It is compulsory since August 14, 2026, and missing withdrawal information stretches the 14 days by 12 months.
4. Adding a fee for paying by card. Belgian law bars any charge for using a payment instrument.
5. A vague order button. Without “commande avec obligation de paiement” or equally clear words, the consumer is not bound, and the payment has no contract behind it in a dispute.
6. A tacit renewal clause hidden in the terms. Renewals billed under a clause that is not bold, boxed and on the first page invite “I never agreed” disputes.
7. Skipping 3-D Secure on risky traffic. The payee that does not accept Strong Customer Authentication reimburses the bank’s loss, and the cardholder has 13 months to contest.
8. A lapsed UBO filing, unfiled accounts or activity codes that do not match. The CBE Public Search shows the activity codes and any striking-off for unfiled accounts or UBO failures, and an acquirer reads it before boarding.

Most of these are fixed before go-live. A business model that needs one of them to work is declined, whatever its volume.