What is worth a few minutes before you build your business on it is the company’s conduct, because this is one of those cases where the record is specific and some of it lands directly on your cash flow. This isn’t a boycott pitch. It’s the same thing we’d do with any tool you’re about to depend on: look past the familiar logo at how the company actually behaves, and decide on purpose. If you want the general method, we have a whole guide on judging a tool by its conduct. This is that method applied to one tool.

A quick note on names, because they matter here. “Square” is the card reader and the brand. Its parent company is Block (it renamed itself from Square, Inc. in 2021), and Block also owns Cash App. A lot of the conduct record below is filed under Block and Cash App, but it’s the same company you’re handing your sales to.

The part that can hit your money directly

Start with the one that’s not abstract. Square is what’s called a payment aggregator (or PayFac), which means thousands of small sellers share one big merchant account instead of each being underwritten individually. That’s why you can sign up in five minutes. The catch is that the aggregator carries the risk, so it protects itself by being quick to hold or freeze the money flowing through you.

In practice that shows up as a rolling reserve: the processor holds back a slice of your sales, sometimes 20 to 30 percent, for months, as a cushion against refunds or fraud. Square has a long, documented history of freezing accounts and withholding funds with little warning and, by many sellers’ accounts, no real way to appeal. The frustration got concrete enough that more than 1,400 merchants signed a petition over withheld funds. If you’re a seasonal seller whose whole year runs through a few busy months, a sudden hold on your deposits isn’t an inconvenience, it’s the rent.

That risk isn’t unique to Square. It comes with any aggregator. But it’s the single most important thing to understand before you route your income through one, and Square’s track record on it is on the worse end.

The regulatory record, and it’s recent

In 2025 alone, Block paid out roughly $295 million to settle regulator findings, almost all of it tied to Cash App:

• $175 million ordered by the CFPB (the Consumer Financial Protection Bureau, the federal agency that polices banks and payment apps on behalf of customers) in January 2025, for failing to protect Cash App users from fraud and mishandling their disputes. That’s up to $120 million back to harmed customers plus a $55 million penalty. This was a finalized order, not a threat, and the refund checks started going out to affected users in mid-2026.
• $80 million to a group of 48 state regulators (coordinated through the Conference of State Bank Supervisors) over weak anti-money-laundering controls. Anti-money-laundering rules, AML for short, are the laws that require financial companies to watch for and report suspicious money movement.
• $40 million to New York’s financial regulator for related compliance failures, including inadequate customer checks and a backlog of unreviewed transaction alerts.

You don’t need to follow the alphabet soup of agencies to read the signal. Three separate sets of regulators, federal and state, looked at how this company runs its money operations in the same period and found enough wrong to extract nine-figure settlements. That’s not a stray complaint, it’s a pattern.

A data breach for good measure

On top of the financial-conduct record, there’s a privacy one. In late 2021 a former employee downloaded internal Cash App Investing reports affecting roughly 8.2 million current and former customers, which Block disclosed in 2022. Insider incidents happen to lots of companies, but combined with the money-controls findings it paints a picture of a company that grew faster than its safeguards.

And in the ordinary course of business, Square, like most of the big payment apps, shares and sells data for advertising. Its own privacy policy discloses the kind of “sale or sharing” of personal information that California’s privacy law is written around. So beyond the headline penalties, the everyday posture is that you and your customers are also a data product.

What about the politics?

People ask, so here’s the honest version, kept separate from the financial record because it’s softer. Block’s founder, Jack Dorsey, sits in the Bitcoin-libertarian, free-speech-absolutist camp. He endorsed Robert F. Kennedy Jr. in 2023 and publicly promised a roughly $5 million donation to a pro-RFK group. Worth being precise: that donation was never actually sent, he reneged on it, so there’s no completed corporate political contribution to point to. Treat this as founder cultural alignment, not company money changing hands. If a values match matters to you, it’s a data point. It’s not the reason the financial record above should give you pause.

If you take payments in person, you have options

Here’s the part that matters if, like a lot of sellers, you actually do need to take a card at a table. You don’t have to choose between “use Square” and “take cash only.” You can take cards in person through a processor with a cleaner record and a friendlier money policy.

The kind of setup worth looking at is a transparent, interchange-plus processor. Interchange-plus just means they charge you the wholesale cost of the card plus a small published markup, instead of an opaque flat rate, so you can see what you’re actually paying. A good fit for North American sellers is Helcim, which offers a handheld card terminal and tap-to-pay on a phone, charges no monthly fee, and doesn’t carry Square’s reputation for freezing funds. You get the same tap-and-go experience at the table without the aggregator risk hanging over your deposits.

If you’re just starting out, start there, on a processor whose conduct you’ve already looked at. If you’re already on Square and it’s working, you don’t need to rip it out in a panic. Just know exactly what the fund-hold risk is, sweep your payouts into your own bank promptly, and have a backup way to take payment so a surprise hold can’t strand you mid-season.

The honest summary

Square is easy, and easy is worth something. But “everyone uses it” tells you about its marketing, not about how it will treat your money. The record here is unusually concrete: a documented habit of holding and freezing seller funds, roughly $295 million in regulator settlements in a single year over fraud handling and money controls, a breach affecting millions, and the standard ad-data posture on top. You can take cards in person without signing up for all of that. Look at the conduct, decide on purpose, and keep your cash flow somewhere you can defend.