The other two US suspects were held under separate indictments but similar charges in Florida and New Jersey.
In the UK, Scotland Yard told the BBC that it had arrested a 16-year-old boy in south London on suspicion of breaching the Computer Misuse Act 1990.
"The Metropolitan Police is liaising with the FBI and indeed with our Dutch colleagues," a Scotland Yard spokesman said.
As well as attacking PayPal, Anonymous also temporarily shut down MasterCard and Visa last December, after they froze Wikileaks accounts.
Anonymous targeted Amazon, too, after it removed Wikileaks content from one of its servers, but that attack was not successful.
The hacking group has used a technique known as a distributed denial of service (DDoS) in an attempt to take the sites offline.
DDoS attacks bombard a website with data until it cannot respond, rendering it inaccessible.
Anonymous rose to fame with a series of attacks on websites linked to the Church of Scientology and Gene Simmons, bassist with the rock group Kiss.