HuchPay is a France-based “pay-by-bank / open banking” payment layer marketed to merchants as instant settlement with “no chargebacks.” R42 has observed HuchPay-branded payment pages in connection with casino cashier flows, including Starscream-linked brands recently fined by the Dutch KSA. Regulatory posture and licensed rail dependencies remain unverified.

---

R42 Risk Signal

• Traffic Light: ⚫ Under Review

• Confidence Grade: Indicated

• Rationale: HUCH SAS appears to be a real French-registered entity and markets open-banking payment services (including claims that it routes via “regulated TPPs” and “never touch[es] or hold[s]” customer money). However, R42 could not verify a payment-services licence/agent status for HUCH SAS via public sources used for this draft, and the alleged casino exposure is based on investigative observations and FinTelegram reporting rather than regulator naming of HuchPay specifically.

---

Key Data

---

5) What the Company Does

HUCH markets a pay-by-bank/open-banking checkout for merchants, positioned as a “card alternative” with lower fees, instant settlement, and “no chargebacks.” It claims funds move “through regulated Third-Party Providers (TPPs)” and that it does not “touch or hold” customer funds—suggesting a technical layer sitting in front of regulated rails.

---

Regulatory & Legal Framework

In the EU, initiating payments from a customer bank account (PIS) typically requires authorisation as a Payment Institution (or operating as an agent) and listing in the relevant regulator register (in France, ACPR/REGAFI). A “technical service provider” can be outside PSD2 scope only if it is genuinely technical and does not provide regulated payment services—this distinction is fact-specific and must be validated via: (a) register status, and/or (b) named licensed TPP partner(s) and contractual roles.

AML/CFT expectations (practically) remain material for high-risk merchant stacks even when the firm claims it never holds funds: KYB, sanctions screening, transaction monitoring rules and escalation/STR channels must exist—often via the licensed TPP/EMI partner.

---

Ownership, Founders, Executives

• President (registry signal): Quention Madelaine (LinkedIn)

Verification gaps:
To confirm ownership/control: French RCS extracts, shareholder disclosures (where applicable), cap table (if venture-backed), and any group/company relationships disclosed in filings.

---

Corporate Structure & Related Entities

Known brand/domain cluster: huch.tech (main), huchpay.fr (policy pages), and huchpay.com referenced as “Website” in privacy policy text.

---

Products, Integrations & Technical Footprint

• Checkout flow: bank selection → bank secure interface → approve payment

• Merchant proposition: API integration; “instant settlements / no chargebacks” messaging

• Claimed rail dependency: “regulated TPPs” (not named publicly in the sources reviewed)

---

Merchant / Customer Footprint

• Partner coverage indicates relevance to iGaming use-cases (deposit speed/confirmation).

• R42/FinTelegram investigative signal: appearance in casino cashier stacks, including Starscream-linked brands (unverified outside investigative artefacts).

---

Complaints, Allegations, Enforcement, Litigation

Public complaints & signals

No consolidated public complaint pattern assessed in this draft (update as new sources emerge).

Whistleblower / insider reports (UNVERIFIED)

Allegation: HuchPay acts as an open-banking gateway layer facilitating deposits for unlicensed/illegal casino operations (including Starscream-linked brands).
Evidence needed: merchant contracts, API integration records, bank transfer descriptors, TPP partner identifiers, settlement statements, or scheme/acquirer notices.

Regulatory actions / warnings

No public enforcement found against HUCH SAS / HuchPay as of 2026-01-26 in sources reviewed.
Context: Dutch KSA fined Starscream Limited €4.228m for illegal gambling offers (RantCasino/Allstarz/SugarCasino) and explicitly highlighted cooperation with PSPs/banks/third parties. HuchPay is one of the open/instant banking facilitators of the Starscream casinos (report here).

---

Risk Factors & Red Flags

Regulatory risk

• Licence/agent status for payment initiation not verified in this draft.

• If acting beyond “technical services,” PSD2 authorisation/agent requirements apply.

AML/CFT risk

• Open-banking “no chargeback” positioning can attract high-risk merchants (gambling/fraud recovery funnels).

• Reliance on unnamed “regulated TPPs” creates accountability gaps unless roles are contractually clear.

Consumer/merchant harm risk

• Dispute/chargeback removal shifts risk to consumers and may reduce remediation pathways.

Operational/continuity risk

• Dependency on third-party TPP/EMI rails (single-point partner risk).

Transparency/ownership risk

• UBO and group structure not yet evidenced (filings needed).

Reputational risk

• Any sustained association with unlicensed gambling stacks could trigger bank/TPP de-risking.

---

Merchant Due-Diligence Checklist

If you are considering onboarding HuchPay/HUCH:

1. Role clarity: Are they TSP only, or an authorised PISP/AISP or agent? Get this in writing.

2. Regulatory proof: request ACPR/REGAFI evidence or proof of agency + the licensed principal (name + register link).

3. Identify the “regulated TPPs”: names, jurisdictions, licence numbers, and which entity executes initiation/holds compliance accountability.

4. KYB/AML pack: onboarding policy, prohibited verticals, geo-restrictions, monitoring rules, escalation/STR process (who files).

5. Settlement mapping: where money settles (which bank/EMI), timings, refunds/returns process, and dispute handling.

6. High-risk controls: gambling controls, blocked jurisdictions, merchant monitoring, termination triggers.

7. Data protection: DPA, sub-processors list, incident response SLA, logs retention.

8. Walk away if: they cannot name the licensed rail provider(s), cannot document compliance responsibilities, or cannot evidence robust high-risk merchant controls.

---

Evidence Box (References)

• Dutch KSA press release: “Boete van 4 miljoen euro … Starscream Limited” (13 Jan 2026).

• KSA sanction decision PDF (Starscream; iDEAL as NL targeting signal; case 21987).

• FinTelegram: “KSA’s €4.228M Starscream Fine Exposes the Real Chokepoint!” (Jan 25, 2026).

• HUCH website (product claims; “regulated TPPs”; “never touch or hold your money”).

• HUCH “How does it work?” page (entity/address disclosure).

• HuchPay privacy policy (HUCH SAS details; huchpay.com reference).

• French registry aggregation (Pappers: HUCH SAS; address; president).

• PYMNTS partnership coverage (HUCH + Genome; iGaming relevance mention).

• ACPR register info page (REGAFI context).

• Screenshots: R42/FinTelegram internal cashier-flow captures (on file; available to regulators on request).