Adyen

Adyen N.V. is a Dutch naamloze vennootschap registered at Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Kamer van Koophandel KvK 34259528. The same parent entity signs the merchant agreement worldwide, with local Adyen affiliates becoming co-parties where applicable local law requires it. Adyen N.V. is listed on Euronext Amsterdam (ticker ADYEN, ISIN NL0012969182) since 13 June 2018; an unsponsored Level 1 ADR (ADYEY) trades over-the-counter in the US but does not create an SEC reporting obligation.

Yes. Adyen N.V. holds a Dutch banking (credit-institution) license issued by De Nederlandsche Bank (DNB) in 2017 and appears on the DNB public register under WFTKF with relation number F0001. As a Dutch credit institution Adyen is also supervised by the ECB Single Supervisory Mechanism. The UK Branch is additionally authorised and regulated by the FCA (FRN 779800); Adyen Singapore Pte. Ltd. is licensed by MAS as a Major Payment Institution under the Payment Services Act 2019; Adyen Inc. (US) is registered with FinCEN as a Money Services Business and holds Money Transmitter Licenses across the US states that require them.

Yes, indirectly, but the parent entity is not. Adyen N.V. is a Dutch credit institution and is not US-incorporated; the US ADR (ADYEY) is unsponsored Level 1 and does not trigger SEC reporting obligations. However, Adyen has substantive US operations through Adyen N.V. (San Francisco Branch) and Adyen Inc. (Delaware), which would be reachable by US legal process including CLOUD Act warrants for data they control. Adyen's stated mitigation is that payment data is stored in Europe and an isolated India environment, limiting what US-side entities have in custody.

No. Adyen states explicitly at adyen.com/infrastructure: 'We do not outsource any administration to third parties, nor do we use any public cloud services for payment processing.' All development, system administration, networking, database administration and security activities are performed in-house. Adyen runs its own RIPE-allocated address space (AS200596) and operates main systems across separate data centres in Europe, the United States, India, Singapore and Australia. Public-facing edges (the marketing site on Netlify, documentation on Cloudflare, shopper-facing checkout fronted by Cloudflare) are operated by US-incorporated CDNs, but cardholder data processing happens on Adyen's own platform.

The official list lives at https://www.adyen.com/legal/list-of-adyen-subprocessors and currently names 11 Adyen group entities only (Adyen N.V. UK Branch, Adyen N.V. San Francisco Branch, Adyen do Brasil, Adyen Mexico, Adyen Australia, Adyen Singapore, Adyen Japan, Adyen Canada, Adyen MEA in the UAE, plus two Adyen India entities). Third-party processors are described categorically in the privacy statement (identity verification, credit reference agencies, CRM providers, cloud service providers, payment schemes, card-printing partners, social media providers and tax authorities) but not enumerated by name; data subjects can email the DPO for details. Subscribe to subprocessor updates at https://www.adyen.com/newsletter/legal-subprocessors.

Adyen holds PCI DSS v4.0 Level 1 (annual external audit by a Qualified Security Assessor), PCI PIN, PCI P2PE, PCI 3DS, SOC 2 Type 2, SOC 1 (also called ISAE 3402) and ISO 27001. Merchants can request the PCI Attestation of Compliance (AoC) from their account contact or by emailing pcisupport@adyen.com. As a Dutch credit institution Adyen also publishes an annual Pillar III Transparency and Disclosure Report (CRR/Basel regulatory capital disclosure) alongside the Annual Report.