High-risk merchant accounts for businesses in Europe (EU and EEA)

EU consumer law governs social casino games: the CPC network's key principles of March 2025 ask for transparent pricing of virtual currencies, respect of the withdrawal right and care for children, and the network opened coordinated actions against game publishers on September 30, 2026. National gambling law draws the line: Belgium's Gaming Commission treats paid loot boxes as gambling, while the Dutch Council of State ruled FIFA packs were not.

European Commission: coordinated actions on online games(opens in a new tab)Sector page

No CBD food or supplement is authorized in the EU: EFSA set a provisional safe level of about 2 mg a day in February 2026, but the Commission has since closed many CBD applications without authorization. Under the Kanavape ruling, a member state may restrict CBD lawfully made elsewhere only to protect public health. France allows low-THC flowers; Italy has banned hemp flowers and their extracts since April 2025.

EFSA: provisional safe level for cannabidiol as a novel food (February 2026)(opens in a new tab)Sector page

EU law harmonizes the vitamins and minerals allowed in food supplements, but plants and other substances stay under national rules, and member states may require notification before sale: Germany asks for it at the BVL before first marketing, Italy through the health ministry's online system for each product. No authority approves the product beforehand. Health claims must come from the EU register, and new ingredients need novel food authorization.

European Commission: food supplements(opens in a new tab)Sector page

EU consumer law applies: buyers have 14 days to withdraw from a distance contract, and digital content delivered at once loses that right only with the buyer's prior express consent and acknowledgment, while a coaching service loses it only once fully performed. Member states had to require an online withdrawal function from June 19, 2026, though several were late. Misleading promises of income or results are unfair commercial practices everywhere.

Directive (EU) 2023/2673, the online withdrawal function(opens in a new tab)Sector page

No EU license exists for IT support sold to consumers: the 14-day withdrawal right, the online withdrawal function due from June 19, 2026 and the ban on unfair practices apply. The risk lies in scam models: France's national cyber assistance service says fake tech support, built on alarming pop-ups, remote access to the computer and paid sham repairs, ranked fourth among threats to individuals in 2025.

Cybermalveillance.gouv.fr: main threats to individuals in 2025(opens in a new tab)Sector page

Direct selling through independent distributors is lawful across the EU. What the Unfair Commercial Practices Directive bans in all circumstances is a pyramid promotional scheme: one where consumers pay for the chance of compensation that comes mainly from recruiting other consumers rather than from selling or consuming products. The directive's blacklist is the same in every member state, so the line does not move from one market to the next.

Directive 2005/29/EC (Unfair Commercial Practices Directive), Annex I, point 14(opens in a new tab)Sector page

Adult content is lawful for adults, but self-declaring an age no longer passes: in March 2026 the Commission preliminarily found Pornhub, Stripchat, XNXX and XVideos in breach of the Digital Services Act for letting minors in. France requires age verification under Arcom's technical framework of October 2024, and Italy has required it of adult sites since November 12, 2025, with fines up to €250,000.

European Commission: preliminary findings against four adult platforms under the DSA (March 2026)(opens in a new tab)Sector page

Dating services follow EU consumer and platform law. A subscriber who starts the service, then withdraws within 14 days, owes only a pro rata share of the contract price, the Court of Justice ruled in the Parship case in 2020. Some states add matchmaking rules: in France, contracts aimed at marriage or a stable union last a year at most, never renew tacitly and allow seven days to withdraw.

Court of Justice of the EU: PE Digital (Parship), Case C-641/19 (2020)(opens in a new tab)Sector page

Package organizers must hold security that refunds every payment and repatriates travelers if they become insolvent, and some states also license them: Ireland requires an aviation authority license and a bond. A revised directive, published in May 2026, makes vouchers optional, valid 12 months and covered by insolvency protection, leaves down payments to national law, and applies from March 29, 2029.

Directive (EU) 2026/1024 amending the Package Travel Directive(opens in a new tab)Sector page

The EU Timeshare Directive covers timeshares, long-term holiday products such as discount clubs, resale and exchange. Buyers get 14 calendar days to withdraw without reason, and no advance payment, guarantee, card hold or acknowledgment of debt may be taken before that period ends; resale services may take nothing before the sale. Long-term holiday products are paid in equal yearly installments.

Directive 2008/122/EC (Timeshare Directive)(opens in a new tab)Sector page

EU law sets no resale price cap, but since May 28, 2022 reselling tickets bought with automated tools that bypass purchase limits is banned everywhere. National rules then diverge: Ireland bans resale above face value for designated events and venues, and Italy allows secondary sales only by authorized primary sellers, or occasionally by individuals at face value or below, with fines from €5,000 to €180,000.

Directive (EU) 2019/2161 (Omnibus), Annex I point 23a of the UCPD(opens in a new tab)Sector page

Above €10,000 a year in EU cross-border sales, VAT is charged at the buyer's rate through the OSS, or the IOSS for imports up to €150. Since December 13, 2024 each product needs an EU-established economic operator. Non-EU parcels up to €150 pay a temporary €3 duty per item category since July 1, 2026, and distance-sold imports pay a €2 handling fee per item from November 1, 2026.

European Commission: guidance on the temporary €3 customs duty and the Union handling fee (October 2026)(opens in a new tab)Sector page

EU law gives 14 days to withdraw, and member states had to require an online withdrawal function from June 19, 2026; a subscriber who asked for an early start owes only a pro rata share. Several states add cancellation rules: Germany requires a button labeled "Verträge hier kündigen" for online subscriptions, and France has required a free online termination function, the "three-click" cancellation, since June 1, 2023.

Germany: § 312k BGB, termination of consumer contracts online(opens in a new tab)Sector page

Alcohol sold at a distance to consumers in another member state bears excise duty in the destination country, and before dispatch the seller or its tax representative must register there and guarantee payment. Minimum ages are national: in Germany, beer and wine may be sold from 16, other alcoholic drinks only from 18, and drinks may not be sold through public vending machines open to minors.

Council Directive (EU) 2020/262 on the general arrangements for excise duty, art. 44(opens in a new tab)Sector page

The EU has no gambling-specific law, and since the Santa Casa ruling of September 8, 2009 a member state may bar operators licensed elsewhere in the EU from offering online games to its residents. Each market needs its own license: from the MGA in Malta, or the GGL in Germany, which lists permitted sites on a whitelist. Ireland has banned credit cards for gambling since February 5, 2026.

Court of Justice of the EU: Santa Casa judgment, Case C-42/07 (2009)(opens in a new tab)Sector page

No EU rule defines a skill game, so each member state's gambling law decides. Spain's law covers any paid game depending even partly on chance, whether skill predominates or not, so paid fantasy contests need a license there. The Dutch Betting and Gaming Act targets prizes awarded by chance on which players generally have no predominant influence, leaving more room for skill-based contests.

Spain: Ley 13/2011 on the regulation of gambling, art. 3(opens in a new tab)Sector page

Selling CFDs or rolling spot forex to EU consumers is an investment service needing MiFID II authorization. ESMA's 2018 measures, which most national authorities made permanent in 2019, cap retail leverage from 30:1 on major currency pairs to 2:1 on crypto, close positions at 50% of required margin and cap losses at the deposit. Belgium bans their distribution to consumers on electronic platforms; France bans most of their electronic advertising.

ESMA: final product intervention measures on CFDs and binary options (2018)(opens in a new tab)Sector page

Crypto-asset services to EU clients need MiCA authorization as a crypto-asset service provider, granted in one member state and passported to the others. The transitional periods for firms active before December 30, 2024 ended everywhere by July 1, 2026, and ESMA told unauthorized providers to stop onboarding EU clients and wind down. Transfers carry originator and beneficiary data under the travel rule.

ESMA: public statement on the end of the MiCA transitional period (June 2026)(opens in a new tab)Sector page

The new Consumer Credit Directive applies from November 20, 2026: creditors and credit intermediaries go through admission, registration and supervision by an independent authority, and every member state must make independent debt advice available at limited charge. Fee-based debt settlement is left to national law, and some states shut it: the Netherlands bans debt mediation unless it is free or done by municipalities, lawyers, bailiffs or accountants.

Directive (EU) 2023/2225 on credit agreements for consumers(opens in a new tab)Sector page

Under the cross-border healthcare directive, telemedicine counts as provided in the member state where the provider is established, under that state's law, quality standards and professional licensing. Each state sets its own rules on remote consultations: Germany's model code for doctors allows care exclusively at a distance only case by case, when medically justifiable. A prescription from another member state can in principle be dispensed where the medicine is authorized.

Directive 2011/24/EU on patients' rights in cross-border healthcare(opens in a new tab)Sector page

EU food authorities treat kratom (Mitragyna speciosa) as an unauthorized novel food, so it cannot be sold as a food or supplement anywhere in the EU; a Dutch appeals tribunal upheld that in June 2025. Sweden classed it as a narcotic from March 11, 2025 and Denmark controls it, while Czechia has allowed licensed sales to adults since November 12, 2025.

RASFF Window: unauthorized novel food (Mitragyna speciosa), notification 2022.6904(opens in a new tab)Sector page

The Tobacco Products Directive caps nicotine liquid at 20 mg/ml, refill containers at 10 ml and tanks at 2 ml, and requires manufacturers and importers to notify every product to each member state where it is sold. Member states may ban cross-border distance sales; where allowed, the seller registers in its own state and in the buyers' state. France has banned disposable vapes since February 26, 2025.

Directive 2014/40/EU (Tobacco Products Directive), arts. 18 and 20(opens in a new tab)Sector page

Under EU law only a person authorized to supply medicines to the public in its member state may sell them online, and its site must show the EU common logo, which links to the national register of legal online sellers. Each state may ban prescription medicines online: France allows only non-prescription medicines, while Germany issues mail-order permits to licensed pharmacies.

European Commission: EU logo for online sale of medicines(opens in a new tab)Sector page

EU firearms law lets only licensed persons acquire firearms, bans the most dangerous category for civilians and requires every member state to license dealers and brokers. When firearms, essential components or ammunition are sold at a distance, a licensed dealer or a public authority must check the buyer's identity and authorization before or at delivery. Germany allows handover only to persons whose entitlement is evident or proven.

Directive (EU) 2021/555 on control of the acquisition and possession of weapons(opens in a new tab)Sector page

Moving vehicles for others by road is regulated haulage: the operator needs a stable establishment, good repute, professional competence and capital of at least €9,000 for the first vehicle, then a Community license for international carriage, issued by its home state for up to 10 years. Since May 21, 2022 that also covers vans of 2.5 to 3.5 tonnes. Vehicle brokers and exporters have no EU sector license.

Regulation (EC) No 1072/2009 on access to the international road haulage market(opens in a new tab)Sector page

Member states may ban cross-border distance sales of tobacco, as Belgium does for all online sales; where allowed, the retailer registers in its own state and in the consumer's state, and excise is due where the buyer lives. Tobacco for oral use, snus, is banned everywhere except Sweden. Nicotine pouches fall outside the directive, so states decide: France has banned their sale since April 1, 2026, Belgium since 2023.

Directive 2014/40/EU (Tobacco Products Directive), arts. 17 and 18(opens in a new tab)Sector page