Regulated, resilient,
and ready.
DaoPay GmbH is a payment institution licensed and directly supervised in Austria, with governance, resilience and risk controls built for the rules ahead.
DaoPay GmbH, licensed in Austria
Compliance is not a page of certifications. It is the question a CRO, CFO or Compliance officer asks before signing a merchant agreement. The answer below is set out for that reader: who governs DaoPay, what the licence covers, how the operation stays running, how DaoPay prepares for regulatory change, how merchants are reviewed and safeguarded, and what happens when something goes wrong on the rails.
DaoPay is a payment institution licensed in Austria. The website and the licence name the same legal person; there is no separation between them.
- Legal entity
- DaoPay GmbH
- Registered office
- Vienna, Austria
- Authorisation
- held under ZaDiG 2018
- Contracting party
- for all merchant services
- Supervisory relationship
- set out later on this page
Who runs DaoPay
- Peter Krapfl
- Chief Executive Officer since 2001
- Oliver Jura
- Chief Operating Officer since 2005
Both have led the company across the full operational history this page refers to: the ZaDiG 2018 authorisation, the EU passporting footprint, the safeguarding regime, the 24/7 operating posture in Vienna, and the merchant qualification discipline described below.
Privately held, independently governed
DaoPay is privately held and independently governed. Ownership is not split across external investors, platform partners or resellers whose incentives might pull the operating model in different directions. DaoPay is advised by specialist EU payment law counsel on regulatory and licensing matters.
DaoPay carries the operational, regulatory and scheme-side exposure of the licensed payments it processes on a merchant's behalf. Risk is absorbed within the licensed payment institution, governed under the same ZaDiG 2018 authorisation that merchants contract under, and is not routed back to merchants through disclaimers, sub-processor clauses or acceptance-side terms. The same legal entity that holds the licence holds the scheme-side exposure and answers to the supervisory authority. Merchants do not accept that exposure onto themselves by signing.
Named operators and two committees decide
Merchant, scheme and counterparty decisions are taken by named operators and escalated through standing committees, not delegated to automated scoring alone.
- Onboarding Committee
- signs off on merchant fit decisions
- Risk Committee
- signs off on portfolio-level risk and scheme exposure
Both report to the management board. Cases outside standard policy add an Information Security Officer and an executive escalation path. Committee membership is not published: the structure is disclosed, the individuals are not.
Everything below rests on one licence
Everything on this page rests on the foundation just described. The licence, the regulatory outlook, the operational resilience, the merchant vetting and the dispute handling that follow all belong to one legal entity, under one licence, overseen by the decision-makers named above.
Authorised under ZaDiG 2018 (PSD2)
DaoPay GmbH is an EU-based payment institution, authorised under the Austrian Payment Services Act 2018 (ZaDiG 2018), the national transposition of PSD2.
Licence scope
The authorisation covers all six ZaDiG service categories. The list is exhaustive: requests outside it are declined during qualification, not absorbed informally.
- Payment business, execution of payment transactions
- Acquiring of payment transactions
- Issuing of payment instruments
- Money remittance
- Payment initiation services (PISP)
- Account information services (AISP)
Which licence applies inside and outside the EEA
DaoPay's licence and its commercial footprint are two different things. Inside the EEA, the payment institution licence is passportable under PSD2 cross-border rules, and DaoPay answers directly to the competent Austrian financial market authority. Beyond the EEA, commercial reach across 72+ countries runs through DaoPay's acquiring network, where each local partner holds its own authorisation in its own jurisdiction.
For a merchant with customers on both sides, this matters. On the EEA leg, the regulatory weight sits with DaoPay's own licence. On the non-EEA leg, it sits with the local acquiring partner as principal. Neither leg is presented as the other, and the contract structure keeps that separation visible.
What supervision means for your risk file
DaoPay GmbH is supervised by the competent Austrian financial market authority. For your own risk file, this confirms that the licence has an external counterparty: someone other than DaoPay has standing authority to examine the institution's safeguarding arrangements and operational resilience on an ongoing basis. Your contracting decision sits inside a supervised perimeter, not outside it. The underlying register entry stays in the legal and reference sections of the site, where the statutory detail belongs.
Ahead of the regulatory calendar
DaoPay structures its regulatory readiness around three reference points: regulation it already operates under, regulation whose high-risk obligations are approaching, and regulation it watches while it takes shape.
Five regulatory tracks,
under one licence.
DaoPay monitors each track against its own applicability date and folds it into the existing ZaDiG 2018 licence, instead of running it as a separate compliance project.
- Already binding
DORA
DORA, Regulation (EU) 2022/2554, has applied to DaoPay since 17 January 2025 as a mid-sized payment service provider. ICT risk management and third-party oversight are embedded in the operating model.
DaoPay's third-party stack is overseen by the same supervisor that oversees its payments licence. An outage at a downstream technology provider can no longer be siloed as that provider's problem alone; it lands on DaoPay's operating model and in the supervisor's view.
- Approaching
AI Act
The EU AI Act's high-risk obligations apply from 2 August 2026. DaoPay frames its use of AI within the licensed payment institution as decision support for human operators, not as a replacement for human underwriting.
Any AI system DaoPay deploys is used in the deployer role, mapped onto the existing ZaDiG 2018 governance and risk-committee oversight instead of a separate compliance track.
- Watching
FIDA and Open Finance
DaoPay tracks the Financial Data Access negotiations and aligns its approach to data access with emerging Open Finance standards.
DaoPay markets no merchant-facing capability on the basis of FIDA while the regulation's final shape is still under negotiation. This is a deliberate readiness stance, not a gap: the contractual position a merchant signs today will not need to be reopened once FIDA's final form lands.
- Not applicable
Crypto and MiCA
DaoPay does not currently provide crypto-asset services under MiCA, Regulation (EU) 2023/1114. Any future scope change would be made transparent.
For a merchant, this keeps settlement statements free of crypto-related exposure. It also keeps the supervisory perimeter established under ZaDiG 2018 from being widened by a service your own compliance function would then have to assess separately.
- Ongoing by design
Staying current
DaoPay tracks EU-level regulatory change early and integrates it under its existing ZaDiG 2018 licence, so new regulation does not open a new governance track.
New regulation is brought under the same licence, the same supervisor and the same oversight committee structure named earlier on this page, and merchants are kept informed as it happens.
Monitored from Vienna, 24/7
A dedicated Network Operations Centre (NOC), staffed from Vienna 24/7, runs 17,000+ automated checks, backed by a dedicated NOC team and an Information Security Officer.
What the 17,000+ automated checks cover
The checks run continuously across DaoPay's servers, containers and supporting infrastructure. They verify system-level parameters and technical health; they do not sample individual transactions. Their job is to surface infrastructure anomalies before they reach the transaction layer merchants see.
Business continuity and disaster recovery
DaoPay maintains a Business Continuity and Disaster Recovery framework aligned with ZaDiG 2018 and EBA outsourcing guidelines, anchored to the same licence, the same supervisor and the same oversight structure named earlier on this page. A mandatory scheme release follows the scheme's own clock, not an internal release window, and its rollout goes through the same dual sign-off described further down this page.
Each infrastructure partner carries its own exposure
DaoPay works with scheme-certified acquiring, tokenisation and alternative payment method partners across the EU. Each partner carries its own exposure:
- Acquiring
- sits with the acquiring partner as a scheme-certified principal
- Tokenisation
- sits with a purpose-built counterparty in its own regulatory perimeter
- Alternative payment methods
- sit with the local-method partner in its own jurisdiction
Nothing is routed back through the DaoPay licence as a grey-area extension.
Dual sign-off on changes that materially affect production resilience
The operating philosophy behind these statements is conservative and documented, not novel and advertised. No change that materially affects production resilience happens without dual sign-off across operations and risk. Any single-point-of-failure risk the NOC finds becomes a structural work item, not a monitoring promise. The cadence and depth of internal drills are not disclosed publicly: the framework posture is what DaoPay can publish, the drill cadence is what it enforces in operation.
Out of hours, the same oversight that signed off your onboarding
The NOC, the framework, the partner stack and the operating philosophy above are part of a merchant's day-to-day, not a separate workstream. When a payment event, a scheme update or an infrastructure incident lands outside business hours, the response runs through the same committee-based oversight that signed off the merchant's onboarding decision. The same institution, under the same licence and the same supervisor, answers out of hours for what it qualified the merchant on months earlier.
Merchant fit, reviewed by people
Every merchant application is reviewed against three outcomes: Go, Review or No-Fit, each with its reasoning. Review is a dialogue, not a rejection. A No-Fit decision comes with a written reason, so the merchant knows which part of the fit assessment they would need to evidence differently if they come back.
The Acceptance Policy, published in advance
DaoPay reviews merchant fit case by case under its published Acceptance Policy. It is the document of record the Onboarding Committee refers to when signing off fit decisions, and the document a merchant can read in advance. The full list of restricted and prohibited industries is in the Acceptance Policy PDF, not on this page.
Due diligence in-house, from qualification onwards
DaoPay runs continuous transaction monitoring and customer due diligence as part of its regulatory obligations under ZaDiG 2018. These checks are not only a post-go-live concern; they are part of the qualification itself. Customer due diligence stays inside the licensed payment institution and is not outsourced.
Scheme queries reach the licensed entity directly
DaoPay is a direct member of the international card schemes that matter for the markets it serves. Authorisation, clearing, settlement and scheme-level dispute routing therefore run on DaoPay's own licence, not through an aggregator intermediary. When a scheme query arrives, it arrives at the licensed entity directly.
Pre-dispute interception to reduce chargeback exposure
DaoPay runs scheme-aligned pre-dispute interception, reducing chargeback exposure before disputes mature. The interception comes from the licensed counterparty relationship described above; it is not a third-party service added on top.
Customer funds in segregated accounts
Customer funds are safeguarded in segregated accounts at credit institutions, in line with § 17 ZaDiG 2018. The account structure keeps customer funds from being commingled with operating funds, whatever happens elsewhere in the business.
Reach that scales with
your merchant footprint.
DaoPay processes payments in multiple major currencies through its acquiring network and supports 100+ payment methods across cards, wallets, account-to-account transfers and local schemes. Specific method and scheme names are covered on the Solutions and Integration Hub pages.
A merchant who reaches a Go outcome enters an operating relationship in which the governance, committees, supervisory relationship, NOC and safeguarding described earlier keep applying for the life of the contract.
Risk defence is built from everything above
Risk defence at DaoPay is not a separate module added on top of the regulatory authorisation. It is every earlier statement on this page playing out in a real merchant scenario.
- The legal entity
- holds the licence
- Regulatory readiness
- keeps that licence forward-looking
- Operational resilience
- keeps the underlying processing available
- Scheme membership plus § 17 ZaDiG 2018 safeguarding
- keeps the funds and rail-level dispute access structurally sound
When a dispute or chargeback arrives
A scheme dispute that reaches DaoPay is handled on the licensed counterparty's rails. It does not pass through an aggregator that would reroute or retranslate it, and the merchant does not deal with a different legal entity for the dispute than the one they signed the merchant agreement with. Where the case meets the conditions for scheme-aligned pre-dispute interception, the chargeback is addressed before it fully matures. Where interception is not available, the dispute goes through the standard scheme process, with DaoPay as the licensed counterparty providing the evidence and reasoning the scheme rules require.
The escalation path inside DaoPay follows the committee structure described earlier. The Onboarding Committee and the Risk Committee are both in scope for dispute-relevant decisions, and executive sign-off applies to any case outside standard policy.
The real test of this chain is whether, at three in the morning on a Saturday, a scheme query arrives at the same licensed entity that holds the merchant's segregated funds, is answered by the same NOC that keeps DaoPay's systems running around the clock, is escalated through the same committee that signed off the original onboarding decision, and produces a documented outcome the merchant's own CRO can take back to their board.
When a regulatory question arises
If a regulator, a supervisory authority or a merchant's own compliance function asks about DaoPay's position, the answer rests on the same ZaDiG 2018 framework that runs through this page. The supervisory relationship, the regulatory readiness, the safeguarding arrangements and the operational resilience framework are each a separate anchor in the merchant's risk file, all pointing to the same licensed entity and the same supervisor.
Where risk sits, resolved
Earlier on this page, DaoPay named the liability it carries: operational, regulatory and scheme-side exposure. In practice, the exposure is carried on the licensed entity's rails, with the committee oversight already disclosed, the safeguarding already in segregated accounts and the supervisor already in the picture. The contract between DaoPay and the merchant does not hand that exposure back. It stays with the licensed institution.
If your CRO, CFO or Compliance team needs to verify any item on this page directly, the standard pre-qualification contact route is the next step.