SlimPay

The Skeptic

The named list is SEPA Direct Debit, SEPA Credit Transfer and open banking, in euros only, across the euro zone — I found no public information on cards, wallets, or country-specific local methods such as iDEAL, Bancontact or BLIK, so any customer who pays by card is out of scope. Coverage is stated precisely (euro zone, thirty-four-country SEPA, EUR only), which I credit, but the breadth is one scheme family deep and single-currency. 1 3 4

Report an error

The Skeptic

Four documented checkout modes — pop-in, iframe, redirect with white-label option, and full API control — plus mandate-with-document signing scenarios and a verified IBAN collected from the bank is more than a bare redirect page. But I found no public information on 3-D Secure, SCA exemption handling, merchant-configurable fraud rules or PCI DSS scope, and the only fraud statement in the captures is transaction monitoring owed under French anti-money-laundering law — a duty SlimPay owes its supervisor, not conversion protection for the merchant. 2 5 6

Report an error

The Skeptic

Mandates are the core product and it shows: electronic signature combined with contract signing, one-off and recurring direct debits, payment plans, import of existing mandates with compliance validation, bulk import, export carrying the mandate reference and IBAN, revocation and IBAN change with history, plus a named automatic retry. I found no public information on pre-notification, dunning detail, or subscription logic such as trials and proration, and no card-on-file capability is evidenced — coherent for an account-to-account specialist, but plan management beyond a passing mention of payment plans is not shown. 1 5 8

Report an error

The Skeptic

Payout is stated as a 24-hour average, fees are itemised by named code — direct debits, rejects, returns, refunds, fund transfers — and appear as separate lines in a CSV account statement the provider itself describes as built for reconciliation, with balance, available funds and reserve laid out and report automation available on request. I found no public information on webhooks, a test mode, API versioning or a status page, and settlement is euro-only on a fixed 24-hour average rather than configurable schedules. 1 9 10

Report an error

The Skeptic

The regulated entity is named and real — SlimPay, a French payment institution authorised and supervised by ACPR, registered in Paris under number 518 991 336, acting as both processor and acquirer since 2012 — and the reserve is actually defined: a €300 minimum balance of fixed plus variable coverage held against rejected payments, with no fixed reserve for B2B direct debit. What I did not find is the bad-day paperwork: no safeguarding statement, no ACPR register number, and no published freeze, termination, notice-period or dispute terms at all. 1 2 10

Report an error

The Skeptic

An EU entity under an ACPR licence contracts, servers are stated to be located entirely within the European Union on named infrastructure (Amazon Web Services), and any transfer outside the EU/EEA is covered by adequacy decisions or standard contractual clauses. But the privacy policy itself permits processing in non-EU countries via SlimPay processors and Trustly Group affiliates, the host is US-headquartered with the CLOUD Act exposure that carries, and the data processor list is referenced but no named processors or locations are evidenced — the parent group's ownership is not documented here either. 1 2

Report an error

The Skeptic

Not one rate appears anywhere I can see: I found no public information on the direct debit fee, the reject fee, the return fee, the refund fee or the fund transfer fee — only their existence as five named fee codes charged to the payment account on a monthly email invoice. The sole figure published is a €300 minimum balance coverage; for a mid-market and enterprise sales motion the effective cost of a merchant's own mix is a sales conversation, not a computable number. 9 10

Report an error