Merchant of record vs payment service provider: the full cost for a game studio

The difference in one sentence

A merchant of record (MoR) sells to the player in its own name and takes on the seller’s tax, fraud, dispute and consumer-law duties, while a payment service provider (PSP) moves the money and leaves you as the seller with all of those duties.

Everything else on this page follows from that. A PSP’s price covers card processing. An MoR’s price covers processing plus the work of being the seller. So comparing Stripe’s 2.9% + 30¢ with Paddle’s 5% + 50¢ compares two different bills. To compare like with like, you add to the PSP’s rate what it costs you to do the rest yourself. The merchant of record guide explains the MoR side in detail; this page prices the do-it-yourself side.

What you take on with a PSP

EU VAT: no threshold for sellers outside the EU

EU VAT law classes games as electronically supplied services. Annex II of the VAT Directive lists “supply of music, films and games.” Article 58 taxes them where the player lives, at that country’s rate. Standard rates run from 17% in Luxembourg to 27% in Hungary, with Germany at 19%, France 20% and Italy 22%.

There is a €10,000 threshold in Article 59c, but it only covers a supplier “established … only in one Member State.” A studio in the US, UK, Japan or anywhere else outside the EU owes VAT in each player’s country from the first sale.

Most non-EU studios use the non-Union One Stop Shop (OSS), which replaced the older MOSS on 1 July 2021. You register in one member state and file one return “for each calendar quarter, whether or not services covered by this special scheme have been supplied,” due by the end of the following month. OSS records must be kept for 10 years.

For each sale you need “two items of non-contradictory evidence” of where the player lives (Article 24b of Implementing Regulation 282/2011). The accepted list includes the billing address, the IP address or other geolocation, the location of the player’s bank account, and the SIM country code. A player who gives you an EU VAT number counts as a business; everyone else is a consumer.

UK VAT: no threshold either

GOV.UK is direct: you must register “regardless of taxable turnover” if your business is based outside the UK and you supply any goods or services to the UK. The £90,000 threshold applies only to UK-established businesses. The standard rate is 20%.

HMRC also wants two pieces of information showing where each player normally lives. Its guidance suggests that small businesses selling through PSPs pair the billing address or phone country code with the PSP’s two-letter country code. A UK studio selling to EU players is a non-EU business for EU purposes and uses the non-Union OSS.

US sales tax: economic nexus and uneven taxability

Since South Dakota v. Wayfair on 21 June 2018, a state can require a seller with no physical presence to collect its sales tax. The law upheld in Wayfair applied to sellers that deliver “more than $100,000 of goods or services into the State or engage in 200 or more separate transactions.” That test became the common benchmark.

The transaction count is disappearing, which helps studios with many small orders. Illinois dropped it from 1 January 2026, leaving “$100,000 or more in cumulative gross receipts.” Utah and Kentucky passed laws doing the same, reported to take effect in July 2025 and August 2026. A studio selling $20 items reaches 200 transactions in a state at $4,000 of sales, so the dollar-only test delays registration a long way.

Whether your items are taxable at all depends on the state. Pennsylvania lists as taxable “Apps and games that are downloaded, add-ons to an app or game, and subscriptions to online games.” Indiana went the other way in a 2025 ruling for one publisher, which reportedly found its in-game items and virtual currency not taxable. You need a state-by-state view of what you sell: base game, subscription, virtual currency, items. Tax engines supply a matrix, but the classification is still your decision.

FastSpring, as a comparison, says it collects in “all 45 applicable states.”

Other countries: the ones that reach games first

A studio selling through a PSP is the “foreign supplier” in every row below. Rates and thresholds are as published on 21 September 2026. “Reported” means the figure comes from an adviser’s summary, not the tax authority.

Each registration comes with its own portal, filing calendar and currency. The tax guide covers the rest.

Payments security: PCI DSS and 3-D Secure

PCI DSS v4.0.1 has been the only active version of the card data standard since 31 December 2024. With a hosted checkout or payment iframe from Stripe, Adyen or similar, you usually qualify for SAQ A, the shortest self-assessment. Since 31 March 2025 SAQ A also requires you to confirm your site “is not susceptible to attacks from scripts that could affect the merchant’s e-commerce system(s).” PCI’s guidance gives two ways to meet it: apply the script protections yourself, or get confirmation from your processor that its embedded checkout includes them. With an MoR, the payment page is the MoR’s, and this falls away.

In the EEA, PSD2 requires strong customer authentication (in practice, 3-D Secure) on electronic payments. Exemptions exist: payments of €30 or less, until the player has made five in a row or spent €100 since the last check, and low-risk payments under the processor’s transaction risk analysis. The issuing bank can still demand authentication. If you skip it, Article 74(2) puts the loss on you: the payee “shall refund the financial damage caused to the payer’s payment service provider.” The EU agreed a revision (PSD3 and the Payment Services Regulation) in November 2025, and it still needs formal adoption as of September 2026.

Chargebacks: Visa and Mastercard watch your own merchant account

With a PSP, every dispute and every fraud report counts against your merchant account.

Visa’s Acquirer Monitoring Program (VAMP) divides the count of fraud reports plus disputes by settled card-not-present transactions. The “Excessive” merchant threshold dropped from 2.2% to 1.5% on 1 April 2026 in the US, Canada, the EU and Asia Pacific, the regions Visa’s fact sheet names. Latin America was already at 1.5%, and Central Europe, Middle East and Africa stays at 2.2%. A merchant also needs at least 1,500 fraud reports and disputes in the month to be flagged. Visa does not publish fine amounts; acquirers set them in their own contracts.

Mastercard’s Excessive Chargeback Merchant tier starts at 100 chargebacks in a month and a ratio of 1.5%, measured against the previous month’s transactions. Stripe’s documentation lists fines from $1,000 in the second month to $100,000 a month from the nineteenth. It adds that Mastercard counts a chargeback “regardless of whether it was hidden due to a refund … and regardless of its outcome.”

At $10M a year and $20 per order, you settle about 42,000 card transactions a month; 1.5% of that is 625, under Visa’s minimum count of 1,500. At $50M it is about 208,000 a month, and 1.5% is 3,125, over the count. Larger studios are the ones Visa’s threshold catches. Mastercard’s minimum of 100 chargebacks a month is far lower.

On top of the programs, each dispute costs a fee. Stripe charges $15 when a dispute arrives and $15 more if you contest it, the second returned only if you win. Its Smart Disputes service takes 30% of the disputed amount on disputes it wins. The chargebacks guide covers evidence and prevention.

Consumer law: the seller carries it

EU consumers have 14 days to withdraw from an online purchase. For digital content, they lose that right only if you get three things before delivery: their “prior express consent” to immediate delivery, their “acknowledgement” that they lose the right, and a confirmation from you (Article 16(m) of the Consumer Rights Directive). Miss one, and a player who withdraws “shall bear no cost,” even for items already delivered. The UK’s Consumer Contracts Regulations 2013 set the same rule in regulation 37.

From 19 June 2026, EU traders must also offer a withdrawal function that is “easy for the consumer to find, continuously available and clearly visible during the withdrawal period” for contracts that carry a withdrawal right (Directive 2023/2673). Our reading is that instantly delivered items with a valid waiver carry no remaining right, while pre-orders, subscriptions and any flow without the waiver need the function. Check national transpositions with counsel.

Regulators are targeting in-game currency directly. The EU’s consumer protection authorities published key principles on 21 March 2025: show the real-money price of items bought with virtual currency, avoid “mixing different in-game virtual currencies” to obscure cost, avoid forcing players to buy currency they do not want, and do not give yourself a right “to unilaterally modify the value of in-game virtual currencies.” In the US, the FTC’s 2022 settlement required Epic Games to pay $245 million in refunds over purchase flows it called dark patterns, and barred Epic from locking the accounts of players “for disputing unauthorized charges.” The FTC sent 969,173 refund payments totalling more than $126 million in June 2025.

With an MoR, the MoR is the trader for the sale and handles the checkout waiver and receipts. The in-game store design and currency rules stay with you under either model.

Sanctions and data protection

OFAC expects companies dealing with the US to run a risk-based sanctions program with five parts: management commitment, risk assessment, internal controls, testing and auditing, and training. With a PSP, you geo-block sanctioned regions and screen buyers yourself; the EU and UK run parallel regimes.

GDPR applies to a non-EU studio that offers services to people in the EU (Article 3(2)), requires such a studio to appoint a representative in the EU in most cases (Article 27), and allows fines of up to €20 million or 4% of worldwide annual turnover. With a PSP you control the checkout data, which includes the billing address and IP address you keep as VAT evidence.

What the tools and the people cost

Tools cover part of the work. Published prices on 21 September 2026:

Watch the per-transaction tax fee. At a $20 average order, Stripe Tax’s API price of $0.50 is 2.5% of the sale, five times the no-code rate.

No tool files your Japanese consumption tax, answers an auditor, sets your refund policy or fights a chargeback. People do. We could find no published benchmark for this staffing, so the calculator uses labelled assumptions you should replace: $30,000 a year for tax advisers, registrations and returns, and $45,000 for half of one person’s time on payments operations, disputes and reconciliation. Both are low for a studio selling in 20 countries.

The worked comparison at $1M, $10M and $50M a year

Every figure below comes from the site’s calculator engine, using each provider’s preset and the calculator’s default business: $20 average order, 25% of sales on foreign cards, 25% needing currency conversion, 1% refunds, 0.35% of orders disputed, 40% of disputes won. Annual cost includes processing, surcharges, conversion, dispute fees and lost sale value, refunds, fraud screening, tax tools, advisers and staff.

Here is where the money goes at $10M a year:

Four assumptions drive the result.

Your fixed costs. Stripe’s variable costs, including its tax engine and Radar, come to about 6.3% of sales. Paddle’s come to 8.5%. So a PSP beats Paddle’s list price as long as your tax advisers, filings and payments staff cost less than about 2.2% of revenue: $22,000 a year at $1M, $220,000 at $10M, $1.1M at $50M. At $1M that is hard to do. Stripe Tax Complete’s top UK tier alone costs £14,400 a year for 10 registrations, before advisers or staff. At $50M, $1.1M buys a team.

Your dispute rate. At 1% of orders disputed instead of 0.35%, Stripe at $10M rises from 7.0% to 7.9% of sales and Paddle from 8.5% to 9.6%. Both pass chargeback costs to you, so the gap barely moves. The rate matters more against a provider that absorbs chargeback losses, because that provider’s price stays the same.

Your average order. Fixed per-order fees dominate small baskets. At a $4.99 order, before tax and disputes, Paddle’s list price is 15.0% of the sale and Stripe’s domestic card rate 8.9%. Paddle asks studios selling products under $10 to contact it for custom pricing.

Negotiated rates. The table uses list prices. A studio at $50M can usually negotiate, and interchange-plus pricing changes the result. On Adyen’s published $0.13 plus 0.60% markup, with our estimate of 1.8% + $0.10 for interchange and scheme fees, the $50M case falls to about 4.7% of sales including the calculator’s default tax and staff costs. MoRs negotiate too, and several game-focused MoRs, including Xsolla and Appcharge, publish no rate at all.

When a PSP makes sense

The numbers and the obligations point to the same studios. A PSP is the better choice when most of these hold:

• You sell more than about $10M a year through the web shop, so 2 points of revenue pays for a tax and payments team.
• You already hold VAT, GST and US sales tax registrations for other products, and someone files them today.
• Your dispute rate is low, you keep delivery and usage logs as evidence, and you have someone to fight disputes.
• You need control an MoR will not give: your own receipts and statement name, your own refund policy, checkout on your own domain, a single view of player payments across games.
• You can negotiate interchange-plus pricing with a processor.

An MoR is the better choice when you are below that scale, entering many countries at once, short of finance staff, or selling a product with a high dispute rate that would put your own merchant account at risk.

The choice is not all or nothing. You can run a PSP in the markets where you already file tax and use an MoR elsewhere, or start with an MoR and move volume to a PSP once the numbers cross. If you plan to switch later, check on day one that you can export player and transaction data.

Decision checklist

1. Pull last year’s web and projected web revenue, average order value, refund rate and dispute rate from your current provider or store reports.
2. List every country and US state where you expect sales above $10,000 in the next year, and check each against the thresholds above.
3. Ask your tax adviser for a written quote for registrations, returns and advice in those places.
4. Price the people: who files, who reconciles payouts, who answers disputes, and what share of their time it takes.
5. Enter all of it in the calculator against at least one PSP and two MoRs, using contract rates where you have them and published rates from the provider fees table where you do not.
6. Check the result at your dispute rate plus 0.5 points and your average order minus 30%.
7. Read the MoR contract for chargeback cost pass-through, payout delays, reserves and what you may sell. The merchant of record guide lists the clauses.
8. Put the decision, the assumptions and the date you will revisit them in front of your CFO.