Bizum & Spanish E-Commerce Payment Methods 2026: Cards, PayPal, Wallet & Open Banking Guide

The 2026 Spanish Payment Landscape at a Glance

Few European countries have a payment mix as diverse as Spain's. The cards below summarise the ten rails in this guide.

1. Bizum — Spain's Native Mobile Payment Standard

Bizum at a Glance

Bizum is the centre of gravity of Spanish retail payments in 2026. Launched October 2016 by a consortium of 27+ Spanish banks (Santander, BBVA, CaixaBank, Sabadell, Bankinter, ING España, Openbank and others), it is a bank-owned mobile-payment scheme letting users send money instantly to phone contacts. By 2026 it serves 25M+ active users, processes ~1B transactions annually, supervised by Banco de España under SNCE. The 2018 launch of Bizum Compras opened a checkout channel; by 2026 over 60,000 Spanish online merchants accept Bizum — El Corte Inglés, Decathlon, Carrefour, MediaMarkt, Mercadona. Surveys (Observatorio Cetelem, IAB Spain) show Bizum increases conversion by 15–25% for domestic shoppers under 45.

How Bizum Compras Works at Checkout

The shopper flow is simpler than 3DS2: pick "Bizum", type the mobile number (no card data), approve a push notification in the bank's app with biometrics (Face ID / Touch ID / PIN), and funds settle from the shopper's account to the merchant's IBAN in seconds on SNCE. The merchant receives an authorisation webhook and can release the order immediately — there is no traditional chargeback path.

Bizum Merchant Fee Structure 2026

Bizum E-commerce fees are negotiated with each acquiring bank and sit well below card-processing cost. Bank-by-bank rates are not public, but market rates cluster as follows.

Bizum Limits and Settlement

Bank-level caps: typical daily €1,500–€2,000 per shopper, monthly €5,000–€8,000, single transaction €500–€1,000. Ideal for fashion, electronics, beauty, groceries and most marketplace SKUs, but unsuitable above €1,000 — Visa/Mastercard or BNPL remain primary. Settlement is instant on weekdays, far faster than D+1 for cards.

2. Visa & Mastercard — The Universal Card Rails

The Spanish Card Landscape in 2026

Despite Bizum's rise, Visa and Mastercard still account for ~70% of Spanish e-commerce value. Cross-border is overwhelmingly card-based, high-ticket above Bizum's €1,000 cap defaults to cards, and older shoppers, B2B and business travel remain card-first. Spain has ~90M issued cards for 48M population; dominant issuers CaixaBank, Santander, BBVA, Sabadell, Bankinter and ING España. Visa is the largest network (strong in CaixaBank/Santander debit) and authorises at a slightly higher rate on Spanish issuers because its risk engine is tuned to local 3DS2 ACS implementations operated by Redsys. Mastercard overweights premium credit (BBVA, Bankinter) and cross-border, with a slightly higher Frictionless hit rate under €30.

Card Processing Fees Structure 2026

Card-acquiring fees are governed by EU IFR caps — 0.2% debit, 0.3% credit — plus acquirer mark-up and scheme fees. Practical rates cluster as follows.

Authorisation Rate — The KPI That Matters

The metric that matters most in card-based checkout is the authorisation rate. A typical Spanish merchant should target above 92% for domestic cards and above 85% cross-border. Underperformance usually comes from misconfigured 3DS2 (wrong MCC, missing exemptions, weak risk scoring). Zunapro's payment-routing module monitors auth rate per BIN and surfaces issuer-level drops in real time.

3. PayPal Spain — The Trust-Layer Wallet

From 2002 Launch to 12M Spanish Accounts

PayPal opened its Spanish operation in 2002. By 2026 PayPal Spain counts 12M+ active accounts — roughly one in four Spanish adults — and is the country's #1 wallet by online checkout share excluding Bizum. Operating entity: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg CSSF passporting. PayPal's defining value proposition is Buyer Protection — making its share of high-ticket fashion and electronics baskets roughly double its share of overall checkout.

PayPal Pay-in-3 — The Spanish BNPL Wedge

PayPal Pay in 3 (Paga en 3) launched in Spain in 2021 as PayPal's answer to Klarna and SeQura. Shoppers split baskets between €30 and €2,000 into three interest-free instalments. PayPal absorbs credit risk; the merchant is paid in full on day 1 minus the standard fee. By 2026 Pay in 3 accounts for 15–20% of PayPal volume in fashion and electronics.

PayPal Fee Structure 2026

PayPal's Spanish merchant fees are the most expensive mainstream rail but pair with embedded chargeback risk transfer and BNPL. Official schedule on paypal.com/es.

On top of the percentage fee, PayPal applies a fixed €0.35 per transaction and a 3–4% FX surcharge on non-EUR. All-in cost can exceed 4.5% for cross-border — high vs Bizum and Redsys, but trust-layer conversion lift often justifies the premium.

4. Stripe España — Developer-First PSP

From SF Garage to Madrid Branch

Stripe opened its Spanish operation via Stripe Payments Europe, Limited (Irish entity) with a Madrid-registered branch in 2018. By 2026 Stripe is dominant among Spanish startups and digital-native brands — Spotify, Glovo, Cabify, JobandTalent and Wallapop have all run on Stripe. Edge: unified REST API, exceptional docs, immediate go-live, one SDK covering cards, Bizum, Apple/Google Pay, Klarna, SEPA and Open Banking. Cost: retail-grade fees vs bank-negotiated wholesale.

Stripe Fee Structure 2026

Stripe Radar — The Fraud Layer

Stripe's Radar ML-based fraud-scoring is included free at Standard tier and adds €0.05/screened transaction at Radar for Fraud Teams. Particularly effective at filtering coordinated card-testing attacks. Zunapro forwards Radar outcomes into its order-management dashboard so fraud holds appear alongside marketplace orders.

5. Redsys — The Spanish Card Switch

The Backbone Behind Every Spanish Card Payment

Redsys Servicios de Procesamiento, S.L. is the Spanish national card-processing switch, jointly owned by the country's largest banks. Its roots: Sermepa (1985) and Sistema 4B, merged in 2010. By 2026 Redsys clears ~10B card transactions annually — the overwhelming majority of Spanish-issuer card activity, POS and e-commerce. The e-commerce touchpoint is the SIS gateway (Sistema de Interconexión de Servicios) — the virtual POS (TPV Virtual) used by every major Spanish bank. Whatever your acquirer, the underlying gateway is Redsys-operated SIS with bank-specific branding.

Redsys vs Stripe — Cost-vs-DX Trade-off

The strategic decision Spanish merchants face is whether to integrate directly with Redsys SIS (via your acquiring bank) or to abstract over it via Stripe / Adyen / Mollie / Worldline. Direct Redsys SIS charges 0.4–0.9% for Spanish issuers but requires a virtual-POS contract with a Spanish bank, PHP/Java SIS integration and your own 3DS2 ACS routing — best at €1M+ monthly volume. Stripe / Adyen / Mollie charge 1.5–2.5% but go-live in hours via a single SDK with built-in 3DS2, Bizum, wallets, BNPL and dashboards — best for SMEs and time-to-market. Break-even sits around €500K–€800K monthly card volume: below it engineering cost dominates, above it the fee delta dominates.

Redsys SIS Technical Flow

SIS comes in two modes: Realizar Pago (form redirect) — HMAC-signed HTML form post, shopper completes on Redsys-hosted pages including 3DS2, dominant in PrestaShop/WooCommerce/Magento; and SIS REST — modern JSON API supporting SCA 2.2, frictionless, tokenisation and one-click, recommended for Next.js/Rails/Node. Both require HMAC-SHA256 signatures; Zunapro provides a Redsys SDK with battle-tested signature generation and 3DS2 v2.2 support.

6. 3DS2 SCA & PSD2 — The Authentication Backbone

What PSD2 Mandates

The Revised Payment Services Directive (PSD2) — Directive (EU) 2015/2366, transposed into Spanish law via RDL 19/2018 — requires Strong Customer Authentication (SCA) on most online card payments above €30 since September 2019, with phased Spanish enforcement completed on 1 January 2021. Supervisor: Banco de España, with CNMV oversight on adjacent investment services. SCA requires two-of-three factors: something the user knows, has and is. For online cards the implementation is 3-D Secure 2.x (3DS2), an EMVCo standard that pushes authentication to the issuer — the shopper sees a bank-branded prompt and approves with biometrics or PIN.

3DS2 Frictionless vs Challenge

Frictionless flow — the issuer reviews risk data, deems risk low, and approves silently with no shopper prompt; typical for low-ticket recurring transactions, trusted beneficiaries and TRA exemptions under €500 from low-fraud merchants. Challenge flow — the issuer demands explicit 2FA; the shopper completes a biometric or OTP prompt; typical for first-time merchant pairs, baskets above €30 without exemption, and any risk-flagged transaction. The merchant's goal is to maximise the frictionless share — higher frictionless ratios correlate directly with higher auth rates and higher conversion.

SCA Exemptions in 2026

PSD2 allows exemptions: Low-value (under €30, cumulative €100 / 5 transactions per card), TRA (Transaction Risk Analysis, up to €500 for low-fraud merchants), Trusted Beneficiary (shopper whitelists the merchant), Recurring MIT (subsequent merchant-initiated transactions on the same mandate), and MOTO (mail-order/telephone-order, out of PSD2 SCA scope).

7. Apple Pay & Google Pay — Mobile Wallet Rails

Wallet Adoption in Spain 2026

Apple Pay launched in Spain in December 2016; by 2026 every major Spanish bank supports tokenisation. Google Pay opened in September 2017. Adoption among Spanish shoppers under 35 exceeds 60% in-store NFC and 40% online. Apple Pay checkout completes 2.5× faster than card-form entry; mobile basket conversion under €100 lifts 18–28%.

How Wallet Checkout Works

Both Apple Pay and Google Pay are tokenised card payments, not separate rails — the funding source is a Visa, Mastercard or Amex card, with a device-specific token (DPAN) replacing the PAN. The 3DS2 SCA step is replaced by an on-device biometric prompt, satisfying PSD2 SCA without an SMS round-trip.

Wallet Fee Structure 2026

Apple Pay and Google Pay do not charge the merchant directly. The fee is identical to the underlying card transaction — typically 1.5% + €0.25 via Stripe or 0.8–1.2% via Redsys SIS. The wallet's revenue model is on the issuing side: a fraction of interchange (typically 0.15% credit, 0.05% debit) passes from the issuer to Apple or Google.

Integration Surface

Wallet enablement is essentially one-flag across providers: Stripe Payment Element auto-detects both wallets, Redsys SIS requires Apple Pay / Google Pay merchant configuration on the bank's TPV Virtual portal plus sandbox merchant-identifier validation, and Adyen / Mollie / Worldline follow similar one-flag setups with explicit Apple merchant-ID validation. PrestaShop, WooCommerce and Magento all ship official Apple Pay / Google Pay plugins backed by Stripe or Redsys.

8. BNPL — Klarna, SeQura & Aplazame

The Three Brands That Define Spanish BNPL

BNPL in Spain is dominated by three brands: Klarna (Swedish, founded 2005, EU-wide) is largest on cross-border traffic; SeQura (Spanish, founded 2013 in Barcelona) is local market leader, integrated with El Corte Inglés, MediaMarkt, Carrefour and Decathlon; Aplazame (Spanish, founded 2014, acquired by WiZink Bank in 2019) rounds out the trio with strong electronics penetration.

Klarna · SeQura · Aplazame

Klarna opened its Spanish operation in 2020 and has ~3.5M users; mix: Pay in 3, Pay in 30, Klarna Financing (6/12/24-month). Edge: seamless app + EU-wide reach. SeQura is the Spanish champion with "Divide tu pago en 3", "Compra ahora, paga después", and "Flexi" (6/12/24-month). Its risk engine is tuned to Spanish profiles via DNI/NIE, Asnef/Equifax and Open Banking checks — approval rates run 5–10 pp above Klarna locally. Aplazame (WiZink Bank) is strong in electronics and appliances — €500+ baskets needing 6–24-month financing. Checkout default on Worten, PcComponentes, Conforama and Wallapop.

BNPL Fee Structure 2026

Across all three brands the BNPL provider pays the merchant the full basket value on day 1 (minus the merchant fee) and absorbs credit risk. The economics work because Spanish Pay-in-3 conversion lift above €100 is typically 20–35% — well above the 2–3% fee.

9. Open Banking Spain — A2A Rails

From PSD2 Compliance to Real Payment Rail

Open Banking (in Spain: Banca Abierta) is the PSD2-mandated bank API ecosystem exposing AIS and PIS services to licensed TPPs. Supervisor: Banco de España with CNMV oversight for investment-linked TPPs. Every major Spanish bank exposes a Berlin Group NextGenPSD2 API. What started as a regulatory checkbox has matured into a real payment rail in 2026: A2A (account-to-account) payments are now offered at checkout by retailers from Iberdrola to small Shopify merchants.

Major Providers and Cost Advantage

Major providers: Trustly (Swedish, full Spanish bank coverage, major in iGaming), TrueLayer (UK, neobank-friendly), Tink (Visa-owned, embedded reconciliation), BBVA Open Banking (the most mature bank-direct API in Spain), and Plaid Europe (currently AIS-only). The defining characteristic of A2A in 2026 is its cost: bypassing card networks entirely (no interchange, no scheme fees), merchant fees cluster at 0.2–0.5% per transaction — well below Bizum, dramatically below cards, a fraction of PayPal. Trade-off: unfamiliar UX for shoppers who default to Bizum or cards. For high-ticket B2B, EV charging, energy bills and any vertical where the fee delta matters more than checkout familiarity, A2A is the cheapest mainstream rail in 2026.

10. B2B Verifactu 2026 — Spain's Anti-Fraud Invoicing Regime

What Verifactu Mandates

Verifactu is the regime created by Real Decreto 1007/2023 under Ley Antifraude (Ley 11/2021), requiring Spanish businesses outside the SII regime to issue invoices through certified anti-fraud software (SIF) starting in 2026. Supervisor: AEAT (Agencia Estatal de Administración Tributaria). Technical requirements on every in-scope invoice: Hash-chained sequence (SHA-256 referencing the prior invoice), QR code encoding identifiers and an optional verification URL, and a choice between VERI*FACTU mode (real-time transmission to AEAT, exempts from later audit logs) or NO VERI*FACTU mode (local storage with hash chain and QR; AEAT can request batches on audit).

Scope, Implications and Penalties

Verifactu applies to businesses and autónomos operating in Spain not already under SII real-time VAT reporting. SII is mandatory for large taxpayers (>€6M, VAT groups, monthly filers); Verifactu covers everyone else — approximately 2.5M businesses. Every B2B marketplace order in 2026 must produce a Verifactu-compliant invoice. Zunapro's Verifactu module is certified anti-fraud software per RD 1007/2023 — it auto-issues hash-chained, QR-encoded invoices on order receipt, optionally transmits in VERI*FACTU mode to AEAT, and stores the receipt identifier. Penalties: up to €50,000/year for non-certified software plus per-invoice fines for hash-chain breaches.

Merchant Fee Comparison 2026 — All Ten Rails

The single most useful artefact for choosing your Spanish payment stack is a side-by-side fee view. The table below summarises 2026 merchant fees, settlement timing and integration complexity.

Payment Rail	Domestic Fee	Settlement	Cross-Border	Integration
Bizum	0.4% – 0.9%	Instant	ES only	Bank API · medium
Visa / Mastercard (Redsys SIS direct)	0.4% – 0.9%	D+1	Yes · +0.5–1.5%	Heavy · best at scale
Visa / Mastercard (Stripe / Adyen)	1.5% + €0.25	D+2 / D+7	Yes · +1.5%	Hours · best DX
PayPal Spain	2.5% – 2.9% + €0.35	Instant in PayPal wallet · D+1 to bank	Yes · +1.5%	Days · checkout button
Stripe España	1.5% + €0.25	D+2 (default)	Yes · 2.5% + €0.25	Hours · Payment Element
Apple Pay / Google Pay	Same as underlying card	Same as card	Yes · same as card	Days · merchant ID validation
Klarna / SeQura / Aplazame	2% – 5%	D+1 to D+14	Klarna yes · others ES-only	Days · risk integration
Open Banking A2A (Trustly, Tink, TrueLayer)	0.2% – 0.5%	Same-day SEPA Instant	EU SEPA only	Days · PSD2 TPP via PSP

Reading the table: Bizum and direct Redsys are cheapest for Spanish-issuer transactions. Stripe wins on time-to-market but the fee premium widens with volume. PayPal is the most expensive but adds trust-layer conversion lift on high-ticket cross-border. BNPL fees are absorbed for conversion lift on baskets >€100. Open Banking A2A is structurally cheapest but requires shopper education and is best for high-value B2B and recurring verticals.

Spanish Legal Framework 2026 — What Changes

VAT (IVA), Banco de España & CNMV

Spain's VAT is IVA, administered by AEAT. Standard 21%; reduced 10% and 4% for specific categories. Spain has no domestic VAT threshold — every business registers from the first euro. Cross-border EU sellers can use OSS. Banco de España supervises Spanish PSPs, EMIs and the SNCE infrastructure underpinning Bizum, enforcing PSD2 SCA, AML/KYC under Ley 10/2010, and DORA operational-resilience (EU Directive 2022/2554). CNMV (Comisión Nacional del Mercado de Valores) supervises investment-services entities, crowdfunding (PCFP) and crypto-asset service providers (MiCA from 2024).

PSD2, PSD3 and the Future

PSD2 has been Spanish law since 2018 via RDL 19/2018. The European Commission proposed PSD3 in June 2023 plus a parallel Payment Services Regulation (PSR), tightening SCA exemptions, expanding Open Banking obligations, and codifying A2A interoperability. Final adoption expected during 2026, transposition 2027–2028. Strategic implication: A2A and Open Banking rails will become more central.

Consumer Protection & Sectoral Registers

• GDPR / RGPD — enforced by AEPD (Agencia Española de Protección de Datos). PSPs are joint controllers for payment data; merchants remain controllers for direct B2C data.
• 14-day right of withdrawal — distance-sales return without reason (EU Directive 2011/83/EU, Texto Refundido LGDCU).
• 3-year statutory conformity warranty — Real Decreto-ley 7/2021, extended from 2 years, on new goods sold after 1 January 2022.
• LSSI-CE — Ley 34/2002 on Information Society and E-Commerce Services (transparency, cookie consent, electronic contracts).
• RAEE / REACH / CE / SIGRE — Spanish WEEE, EU chemical, CE marking and pharmaceutical packaging registers, by SKU category.

Logistics & Shipping Context in Spain

The Courier Landscape

Spain's logistics is more diverse and courier-led than Poland's locker-dominated market. Major players in 2026: SEUR / GeoPost (national champion, DPDgroup), Correos / Correos Express (state postal, widest rural reach), MRW (independent Spanish, SME-focused), DHL Express / GLS / UPS (cross-border), Punto Pack / Pickup / Mondial Relay (pickup points), Amazon Logistics (last-mile in major cities), and Glovo / Vinted Go (instant/C2C). The pragmatic stack: SEUR or MRW default for B2C under 30 kg, Correos Express for rural and Canarias/Baleares, DHL for cross-border, Punto Pack for low-cost pickup. Zunapro routes orders to the optimal carrier by weight, postcode and selected service.

Cross-Border Expansion from Spain

The LATAM Bridge & EU/UK Reach

Spain's unique advantage is the Spanish-language LATAM bridge. Spanish merchants are natural sellers into Mexico, Colombia, Chile, Argentina and Peru — but the rail landscape changes: Bizum has zero LATAM presence; local rails (OXXO/SPEI in Mexico, PIX in Brazil, PSE in Colombia) dominate. For LATAM, Zunapro orchestrates region-specific PSPs (dLocal, EBANX, Kushki) on top of the Spanish core. For EU cross-border the stack extends naturally: Visa/Mastercard via Stripe/Adyen, PayPal for trust, SEPA Instant for EUR A2A, Klarna for EU-wide BNPL.

The Cross-Border Sales Stack

• Catalog: master SKUs in Zunapro, mirrored to Amazon ES/IT/FR/DE/UK plus Spanish marketplaces
• Pricing: multi-currency (EUR, GBP, USD, MXN) with daily ECB rate sync
• Compliance: Verifactu for ES, OSS for cross-border EU VAT, country WEEE/REACH
• Payments: Bizum + Redsys for Spain · Stripe / Adyen for EU · dLocal / EBANX for LATAM
• Logistics: SEUR domestic + DHL cross-border + FBA fallback

How to Build the Spanish Payment Stack — 2026 Step-by-Step

1. Choose Your Core Rails (Decision Tree)

• Maximum domestic conversion, any vertical → Bizum + Redsys
• Cross-border EU traffic → Stripe or Adyen on Visa/Mastercard
• High-ticket cross-border, trust-driven → add PayPal
• Mobile-first checkout → Apple Pay + Google Pay
• Baskets >€100 → add Klarna + SeQura BNPL
• B2B, recurring, high-ticket low-fee → add Open Banking A2A

The typical 2026 winning configuration for a Spanish DTC merchant is Bizum + Redsys + PayPal + Apple/Google Pay + one BNPL — five rails covering 95%+ of viable shopper preferences.

2. Spanish Company or EU OSS Registration

Three legal-entity options: Spanish autónomo (~1 day via AEAT + Seguridad Social, monthly ~€80–€300 with starter discounts), Spanish S.L. (limited liability, ~€3,000 capital or €1 under Ley Crea y Crece, 1–2 weeks), or Foreign EU entity + OSS (keep your company, register for OSS VAT, no Spanish establishment).

3. Verifactu Integration (Mandatory from 2026)

Whichever entity you choose, Verifactu compliance is non-negotiable for in-scope businesses: adopt certified SIF software per RD 1007/2023, implement the SHA-256 hash chain, generate the QR code per AEAT spec, and choose VERI*FACTU (real-time transmission) or NO VERI*FACTU (local + audit-on-request) mode. Zunapro handles all four steps automatically on order receipt.

4. PSD2 SCA Configuration

Configure 3DS2 v2.2 across all card rails (Redsys, Stripe, Adyen) with maximum risk-data submission to maximise frictionless share. Wire up TRA exemptions and trusted-beneficiary opt-in if your category benefits. Banco de España requires SCA audit logs retained at least 5 years.

5. Connect via Zunapro (10–15 min per Rail)

1. Sign in and open the Spain module
2. Connect each rail — paste API keys / OAuth into the Bizum, Redsys, Stripe, PayPal, Apple/Google Pay, Klarna, SeQura, Aplazame and Open Banking tiles
3. Map your checkout — Zunapro auto-suggests rail ordering (Bizum first for ES IPs, card first for cross-border)
4. Enable Verifactu + SCA — single toggle each
5. Go live — first end-to-end test completes in ~5 min per rail

Spanish Payment Methods FAQ 2026