The money can be frozen for up to 180 days.. which is exactly the same as every merchant account I've ever seen.
If PayPal decides the money isn't yours, it goes back to who sent it. It doesn't become Paypals property.
If you're holding funds "in reserve" or otherwise "on deposit" with them, however, the rules are more flexible. For example, if they aren't certain you comply with their internal AML policy, they may have the power to indefinitely hold your funds. If they aren't certain you comply with their internal antifraud policy, they may have the power to indefinitely hold your funds. They may also be able to assess various fees, charges, et cetera against your "balances", whether free or restricted. I say "may" because this varies jurisdiction to jurisdiction.
If they hold your funds after that, that's breach of contract. Time to contact state agencies and/or go to court.
Search for the word "notwithstanding". It usually comes in the form "notwithstanding anything to the contrary in the rest of this agreement..." Remember that PayPal incorporates--and reserves the unilateral right to change--several policy documents into its agreements.
These agreements are necessarily complicated. They're also drafted by counsel working for PayPal. At least in the case of AML, I'm reasonably certain PayPal has to, under federal law, hold funds when it suspects money laundering. Unlike banks, which have their AML policies and definitions reviewed, PayPal is relatively free in constructing this policy.
PayPal's agreement requires 30 days notice of any changes, and they post the changes on their website: https://www.paypal.com/us/webapps/mpp/ua/upcoming-policies-f...
Paypal's anti-money laundering rules comply with the rules set by each state that money transmitters are required to follow. The funds frozen for AML don't become paypal's -- they're seized by the government.
It is complicated. For example, New York's Department of Financial Services "interposed no objection to PayPal offering certain of its payment processing services to New York customers without being licensed as a money transmitter" in 2002 [1]. These rules are complex alone, complex in their interrelations and subject to competing regulatory interests.
I work in a regulated financial forum. I've seen, or been relayed through regulators, accounts concerning money transmitters needing to hold funds for more than 180 days to finish an investigation per their internal policy. At that point, the contract doesn't matter--statute trumps. This might be unique to New York, but I doubt we're the only state or territory with these rules (usually, our laws are the most cutting).
If it's customer versus compliance, the customer almost always has to engage regulators or sue to make progress. When using money transmitters like PayPal to not only move funds but also hold them you're giving up a lot of the regulatory protection and venue-provisioning you get with more sophisticated services. If a business relies on PayPal, its management needs to talk to a lawyer and do more research.
NY may have been ok with paypal operating that way in 2002, but that has clearly changed:
https://www.paypalobjects.com/webstatic/en_US/licenses/NY_li...
They probably won't do anything particularly nefarious as far as the law is concerned, but that doesn't prevent this situation from becoming an unmitigated disaster for the small business owner who doesn't have their own floor of lawyers.
In fact, nothing here would be out of line for any merchant account (except maybe the customer service issues).
2% chargeback rate is extremely high. It would get you shutdown pretty much everywhere. MSP agreements usually say between 0.25% to 1% for the chargeback rate limit. This is 10x what i've seen some banks specify as an acceptable chargeback rate.
And if you exceed it.. you get warnings, reserve lines and longer holding periods, and eventually the termination of your account. Exactly what happened to OP.
Each one of those actions should have been a red flag to the merchant tellling them they have a serious problem they need to address.
The number of times I've had an MSP call me to discuss fraud in the past 14 years I've had one or more merchant accounts: 0
The number of times I've had an MSP establish a reserve line for my account: 0
The chargeback rate for an ecommerce site I've run for 14 years: 0.1% (about 1 every 1000 orders)
MSPs don't normally contact their customers to discuss fraud. They don't normally require reserves.
Every time they contacted you about the chargeback rate was a warning. When they set the reserve line that was a warning. You didn't negotiate the right to the chargeback rate.. you negotiated how severely their anti-fraud control would impact your business.
These were HUGE red flags. Possibly the biggest red flags you could have gotten, short of a legal notice or the immediate closure of the account.
And while it sounds like PayPal should have been more direct with you about the consequences here... I can tell you that every MSP agreement I've ever seen specially talks about these actions as negative actions they may take to mitigate the risk of fraud.
1 in 1000 is 0.1%