The walls seem to be closing in on PAYONE GmbH, the German payment services provider and subsidiary of Worldline SA. The company, already embroiled in multiple legal battles with a former employee-turned-whistleblower, has now been hit with a stunning regulatory intervention from BaFin, the German Federal Financial Supervisory Authority.
BaFin’s intervention, as detailed in their press release of 29 January 2025, has brought to light significant deficiencies in Payone’s operations, particularly regarding its organizational structure and compliance with anti-money laundering (AML) regulations. These findings raise concerns about the company’s overall compliance culture, its commitment to compliant business practices, and its ability to effectively mitigate risks associated with AML non-compliance, impacting the AML and security of both the public and the retailers it serves.
This Multi-Pronged intervention is not a mere slap on the wrist but a multi-pronged interception on Payone’s operations, targeting both their organizational structure and their compliance with anti-money laundering (AML) regulations.
Who are Payone GmbH:
- 2017 B+S Card Service merged witha small ecommerce fintech PAYONE GmbH to form BS PAYONE GmbH. While the merger occurred in 2017, B+S Card Service had already entered the UK market around 2013. This earlier expansion was aimed at capitalizing on the lack of UK retailers accepting China UnionPay as a payment method on their card devices. This strategy aligned with the growing importance of Chinese tourists in the UK retail market, as UnionPay was then the preferred payment brand for many Chinese visitors
- 2019 BS PAYONE GmbH merged with Ingenico Payment Services GmbH and other Ingenico companies to form PAYONE GmbH.
- 2021 PAYONE GmbH acquired Worldline’s Merchant Services Business in Germany and Austria.
- 1 March 2021 As part of the Worldline acquisition, PAYONE’s shareholder structure changed, with Worldline Group holding a 60% stake and the DSV Group holding 40%.
These mergers have transformed PAYONE from its origins as B+S Card Service into the largest player in the DACH region for payment services
Payone infrastructure according to CGI
Cloud Infrastructure: PAYONE has implemented an on-premises cloud environment using Kubernetes for container-based applications
According to CGI, a global IT and business consulting services firm, Payone’s IT landscape was complex due to a history of mergers and joint ventures. Payone’s cloud transformation journey, may inadvertently reveals potential vulnerabilities that might have contributed to the regulatory scrutiny the company faces. It highlights a complex IT landscape shaped by a history of mergers and acquisitions, which could have resulted in fragmented systems, inconsistent processes, and challenges in maintaining a unified security posture.
According to CGI, Payone at some point relied on external expertise for managing certain critical IT functions, such as container-based applications using Kubernetes. While outsourcing can be a strategic approach, it requires robust oversight and control mechanisms to ensure that third-party providers adhere to the same stringent security and compliance standards as the company itself. CGI do not not delve into the specifics of Payone’s outsourcing governance, leaving open the possibility that gaps in this area might have contributed to the concerns raised by BaFin.
Finally, Payone’s focus on efficiency and cost control, which are undoubtedly important business objectives. However, it’s important to ensure that these goals do not compromise other critical aspects, such as security, compliance, and risk management. A lopsided overemphasis on cost optimization could potentially lead to underinvestment in essential security measures or a lack of resources dedicated to compliance efforts, which might have attracted the attention of regulators.
Payones CTO highlights the company’s modernization efforts, stating that,
“with a secure, private cloud underpinning operations, PAYONE can build on its success to achieve better cost control, agility and innovation”
and that “the implementation of a modern software engineering standard supports integration of the various company entities and locations”. While these improvements are positive, they might have come after BaFins audits, suggesting legacy deficiencies in Payones IT infrastructure and processes. Moreover, the CTOs emphasis on cost control, agility and innovation raises questions about the companys past prioritization of security and compliance. The statement lacks specifics about controls related to risk management and data security, leaving it unclear whether these aspects are fully integrated into the new IT model. While Payones efforts to modernize are a step in the right direction, it remains to be seen if these changes will imminently address BaFins concerns and demonstrate a commitment to robust security and compliance practices.
It’s important to note that the CTO’s statement, as published by CGI, may not represent the entirety of his commentary on the matter. Therefore, it’s possible that the full context of his remarks included more details about controls related to risk management and data security.
Manual onboarding
Payone’s reliance on manual processes, particularly in its onboarding procedures, could have been a contributing factor to the deficiencies identified by BaFin. A September 2023 UK court judgment described Payone’s onboarding process as involving “multiple stakeholders involved in the exchange of emails clarifying details about a contract,” suggesting a significant degree of manual handling and intervention.
Furthermore, the judgment revealed instances where sales staff bypassed the sales support team to directly contact the anti-money laundering (AML) team about a complex contract (Westgate). This practice, coupled with the acknowledged tension between sales and sales support teams regarding onboarding priorities, raises concerns about potential control gaps and inconsistencies in Payone’s processes. Directly contacting the AML team could circumvent industry established procedures and potentially lead to inconsistent application of AML checks or inadequate documentation. Such practices, especially in relation to a contract circa 2018 mentioned in the judgment, may be an example contributing to BaFin’s concerns about Payone’s ability to maintain adequate corporate management, control mechanisms, and IT processes, particularly in the context of onboarding new customers.
Increase Capital Reserves
This measure, taken under Section 15(2) Sentence 3 of the German Payment Services Supervision Act (ZAG), is a direct response to Payone’s failure to meet the requirements for proper business organization and outsourcing. BaFins audit revealed deficiencies in Payones corporate management, control mechanisms, and IT processes, suggesting a systemic disregard for regulatory standards.
BaFin might have identified weaknesses in Payone’s oversight of key activities like payment processing, IT infrastructure management, and customer support, particularly those that were outsourced. The regulator may have found deficiencies in Payone’s ability to ensure that its third-party providers adhered to the same rigorous standards for security, data protection, and compliance as required by the ZAG.
Payone’s integration of various business units, including those from the Worldline merger, may have exacerbated existing weaknesses in its IT systems and processes. However, evidence from a September 2023 court judgment suggests that significant deficiencies existed well before the merger. The judgment revealed concerning practices, such as the translation of highly sensitive documents using online translation tools by non-German speakers, highlighting potential security and confidentiality breaches. These likely pre-existing vulnerabilities, coupled with the challenges of integrating diverse business units, might have contributed to the issues identified by BaFin.
Should Payone fail to address these fundamental shortcomings, it is likely to face further regulatory action from BaFin, potentially including fines, restrictions on its operations, or even the revocation of its license to operate as a payment service provider. This could have severe consequences for the company’s business, reputation, and financial stability.
Payone is currently in a position akin to a tightrope walker trying to regain balance after a near fall. They are under intense scrutiny, and any further missteps could have further invasive consequences. They need to demonstrate a genuine commitment to improving their security, compliance, and risk management practices to regain the trust of regulators and maybe even the public, to the extent that has been lost. Failure to do so could lead to a significant loss of business, damage to their reputation. They had alrady lost some 130 million Euro as a result of the 2023 special audit.
This presents a significant opportunity for Payone to step up and demonstrate its commitment to security, compliance, and customer protection. By proactively addressing the deficiencies identified by BaFin and implementing robust controls and processes, Payone can emerge from this challenge as a stronger organization. This is a chance for Payone to not only rectify its shortcomings but also to set a new standard for excellence in the payments industry, enhancing its reputation and building greater trust with its customers and third party partners. Embracing this opportunity for positive change can transform this regulatory scrutiny into a catalyst for growth and long-term success.
