Paypal
Verified“US-owned payments giant with a real EU-regulated bank inside it.”
- Listing
- NASDAQ: PYPL
- Revenue (2024)
- $31.8B
- Employees
- ~24,000
- EU regulator
- CSSF (Luxembourg)
28 = midpoint of Control 32 & Data 23
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 12 sourced facts across 9 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
45
Parent is Delaware-incorporated and San Jose-run, so ultimate control is US. But European users contract with PayPal (Europe) S.a r.l. et Cie, S.C.A., a Luxembourg credit institution authorized and supervised by the CSSF since 2007 — a real EU operating entity that EU law and an EU banking regulator directly reach. EU-operating under a foreign parent puts this in the 40-60 band; the live EU bank charter lifts it toward the top of that range.
Why 45? 3 sourced facts · click to expand
EU operating entity is a CSSF-supervised Luxembourg bank
PayPal LU About Us · as of 2026-06
EU bank charter granted by CSSF, effective 2007
PayPal Newsroom (2007) · as of 2007-05
Control & Ownership
18
Single class of common stock, one-vote-per-share, listed on NASDAQ (PYPL). Roughly 78% held by institutions, with the largest voting blocks — Vanguard, BlackRock, State Street — all US asset managers. No EU voting or economic majority anywhere; control and economics are overwhelmingly US. Foreign-control band (0-30).
Why 18? 3 sourced facts · click to expand
Largest holders are US asset managers
Fintel ownership · as of 2025
Data →
Where your data lives and who can reach it
Data & Infrastructure
18
PayPal runs a hybrid, multi-cloud stack on US hyperscalers (Google Cloud, AWS, Azure) plus its own data centers, with publicly featured key infrastructure in Google's Salt Lake City (Utah) region. As a US-parented company on US cloud providers, CLOUD Act / foreign-law exposure is high regardless of where individual records sit. No evidence of EU-owned infrastructure or guaranteed EU-only data residency for the core platform. US/foreign-hosting band (0-20).
Why 18? 3 sourced facts · click to expand
Multi-cloud on US hyperscalers + own data centers
FintechFutures / 9to5Google · as of 2020-02
Key infrastructure paired with US Google Cloud region
9to5Google · as of 2020-02
US parent => CLOUD Act exposure on US-provider infra
SEC EDGAR 10-K (FY2023) · as of 2024-02
Operations & People
30
Corporate HQ, CEO (Alex Chriss) and senior leadership are US-based; reporting currency is USD; the company is run from San Jose. There is a substantial European operational footprint anchored by the Luxembourg HQ of the EU bank and EU customer/compliance operations, but the operational center of gravity and leadership are American. Mixed-to-foreign-centered (around 30).
Why 30? 3 sourced facts · click to expand
European operations anchored by Luxembourg EU HQ
PayPal Newsroom (2007) · as of 2007-05
Workforce size and USD reporting
Wikipedia / StockAnalysis · as of 2025
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Where does EEA user data physically reside, and is there contractual EU-only data residency?
PayPal runs multi-cloud on US hyperscalers; without confirmed EU-only residency the infra score stays low. EU bank status implies some EU data handling but not guaranteed US-free hosting.
- ?
To what extent is EEA personal data routinely transferred to PayPal, Inc. in the US?
PayPal's user agreements historically disclose US transfers; the exact controller/processor split and SCC reliance affects real-world CLOUD Act exposure for EU users.
- ?
Exact current employee headcount and the EU share of workforce/operations.
Affects the operations score; a larger verified EU footprint would nudge operations upward.
EU Cloud Sovereignty Framework lens
SEAL maps a cloud-provider sovereignty framework onto a payments company — this is an analogous mapping for comparability, not a certification.
Strategic
US-parented, US-led, NASDAQ-listed; strategy set from San Jose, not Europe.
Legal & jurisdictional
Delaware parent, but EU users served by a Luxembourg CSSF-supervised bank reachable by EU law.
Data & AI
Core platform on US hyperscalers (GCP/AWS/Azure); CLOUD Act exposure, no confirmed EU-only residency.
Operational
US HQ and leadership, but a real EU operational base in Luxembourg serving the EEA.
Supply chain
Key cloud and infrastructure dependencies are US providers.
Technological
Platform and engineering centered in the US; US cloud-native stack.
Security & compliance
EU entity under CSSF banking supervision and EU AML/PSD2 rules; group governance is US-led.
Environmental sustainability
Not evaluated in this profile.
EU alternatives
Amsterdam-headquartered, Euronext-listed licensed bank; EU-incorporated and EU-controlled payments platform.
Dutch payment service provider, EU-based and regulated; popular PayPal alternative for European merchants.
Swedish-licensed bank and EU-operating, but is NYSE-listed (2025) with significant US investors, diluting pure EU ownership.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology