Key Takeaways
- Payment gateways handle data capture and encryption, processors manage network communication and authorization, while acquiring banks provide merchant accounts and settlement services
- Each component has distinct pricing models - gateways charge per-transaction fees, processors add markup to interchange rates, and acquirers typically charge percentage-based discount rates
- Integrated payment platforms simplify vendor management but may limit customization, while separate providers offer more flexibility at the cost of increased complexity
- PCI compliance requirements differ across components, with gateways focusing on data security, processors on network certifications, and acquiring banks on merchant underwriting
- Enterprise businesses often benefit from direct processor and acquiring relationships for better rates and specialized features, while smaller merchants typically prefer all-in-one solutions
Payment processing involves multiple parties working together to move money from customers to merchants. Three components — payment gateways, payment processors, and acquiring banks — each handle specific functions in this chain. Understanding their distinct roles helps businesses select appropriate vendors and troubleshoot transaction issues.
What is a Payment Gateway?
A payment gateway is the software interface that captures and transmits payment data from customers to processors. It handles the technical communication between a merchant's website or point-of-sale system and the broader payments network.
Payment gateways perform several core functions:
- Encrypt sensitive payment data (card numbers, CVV codes, expiration dates)
- Perform initial fraud screening using velocity checks and AVS verification
- Route transactions to appropriate payment processors
- Return authorization responses to merchant systems
- Store tokenized payment methods for recurring transactions
Common gateway providers include: Stripe, Square, Authorize.Net, PayPal, and Adyen. Enterprise gateways like CyberSource and First Data Payeezy offer additional features like advanced fraud detection and multi-processor routing.
What is a Payment Processor?
A payment processor connects merchants to card networks (Visa, Mastercard, American Express, Discover) and manages the technical aspects of transaction authorization and settlement. Processors communicate with issuing banks to verify card validity and available credit.
Payment processors handle these specific tasks:
- Submit authorization requests to card networks within 5-10 seconds
- Receive approval or decline responses from issuing banks
- Batch and settle approved transactions for deposit
- Manage chargeback processing and dispute workflows
- Provide transaction reporting and reconciliation data
Major payment processors include: Chase Paymentech, Worldpay (FIS), Global Payments, Elavon, and Heartland Payment Systems. Processors typically charge interchange rates (set by card networks) plus markup fees ranging from 0.15% to 0.50%.
What is an Acquiring Bank?
An acquiring bank (or merchant acquirer) is the financial institution that holds the merchant account and assumes liability for processing transactions. The acquirer underwrites the merchant relationship and provides settlement services.
Acquiring banks provide these services:
- Underwrite merchant applications and set processing limits
- Hold funds in merchant accounts during settlement periods
- Assume chargeback liability up to account limits
- Provide regulatory compliance oversight
- Fund merchant accounts typically within 1-3 business days
Examples of acquiring banks: JPMorgan Chase, Bank of America Merchant Services, Wells Fargo Merchant Services, and PNC Payment Solutions. Many processors partner with multiple acquiring banks to offer broader geographic coverage and risk management.
How Do These Three Components Work Together?
A typical card transaction flows through all three components in sequence:
- Customer initiates payment: Enters card details on merchant website or swipes at terminal
- Gateway captures data: Encrypts payment information and performs initial validation
- Processor routes transaction: Sends authorization request to appropriate card network
- Card network queries issuer: Verifies card status and available credit
- Authorization response returns: Approval or decline flows back through processor to gateway
- Merchant receives response: Gateway displays result to customer and merchant
- Settlement occurs: Acquiring bank receives funds from card network and deposits to merchant account
The entire authorization process typically completes in 2-5 seconds, while settlement takes 1-3 business days depending on the acquiring bank's funding schedule.
Pricing Models
Each component has distinct pricing structures:
| Component | Typical Pricing | Fee Structure |
|---|---|---|
| Payment Gateway | $0.10-$0.30 per transaction | Flat fee + monthly gateway fee ($10-$50) |
| Payment Processor | 0.15%-0.50% markup | Percentage of transaction + interchange pass-through |
| Acquiring Bank | 0.05%-0.15% discount rate | Percentage-based with monthly fees ($10-$25) |
When Businesses Need Each Component
Payment Gateway: Required for any business accepting online payments or needing tokenization. E-commerce sites, subscription services, and mobile apps need dedicated gateway services.
Payment Processor: Necessary for all card-accepting businesses. Processors handle network connectivity that individual merchants cannot access directly.
Acquiring Bank: Mandatory for any business accepting card payments. The acquiring relationship establishes the legal framework for processing and settlement.
Integration Considerations
Businesses choosing payment infrastructure should evaluate:
- API documentation quality and developer support availability
- Supported payment methods (cards, ACH, digital wallets, buy-now-pay-later)
- Geographic coverage and multi-currency capabilities
- Fraud detection tools and machine learning capabilities
- Reporting granularity and real-time transaction monitoring
- PCI compliance support and data security certifications
Many modern providers offer integrated solutions that combine gateway, processing, and acquiring services under single contracts. Companies like Stripe, Square, and PayPal provide end-to-end payment stacks that simplify vendor management but may limit customization options.
Regulatory and Compliance Requirements
Each component faces specific regulatory obligations:
Payment Gateways must maintain PCI DSS Level 1 compliance and implement tokenization to reduce merchant PCI scope. They typically undergo annual security audits and maintain SOC 2 Type II certifications.
Payment Processors register with card networks and maintain connectivity certifications. They must implement fraud monitoring systems and report suspicious activity to appropriate authorities.
Acquiring Banks operate under banking regulations and maintain FDIC insurance. They perform merchant underwriting according to network rules and assume primary liability for transaction processing.
Selecting the Right Payment Stack
Enterprise businesses often require specialized capabilities that influence vendor selection. High-volume merchants may need direct processor relationships for better rates, while smaller businesses benefit from integrated platforms that reduce complexity.
For businesses processing over $1 million annually, direct acquiring bank relationships often provide cost advantages. Companies with complex international requirements may need processors with extensive global coverage and multi-currency settlement capabilities.
Organizations building payment strategies should evaluate how gateway, processor, and acquiring bank capabilities align with business requirements. For detailed analysis of payment infrastructure options, business architecture frameworks provide structured approaches to vendor evaluation and integration planning.
- Explore the Payments Business Architecture Toolkit — a detailed business architecture packages framework for financial services teams.
- Explore the Payments Business Information Model — a detailed business information model framework for financial services teams.
Frequently Asked Questions
Can a business use different providers for gateway, processing, and acquiring?
Yes, businesses can mix providers, though this increases complexity. For example, using Authorize.Net as a gateway with First Data processing and Chase as the acquiring bank. However, integrated solutions from single providers often reduce technical overhead and simplify troubleshooting.
What's the difference between interchange rates and processing fees?
Interchange rates are set by card networks (Visa, Mastercard) and paid to issuing banks - these are consistent across all processors. Processing fees are markups added by processors and acquirers on top of interchange, typically ranging from 0.15% to 0.50% plus fixed transaction fees.
How do payment gateways handle PCI compliance?
Payment gateways reduce merchant PCI scope by tokenizing card data and maintaining Level 1 PCI DSS certification. When merchants use hosted payment pages or secure tokens, they typically qualify for simplified PCI compliance (SAQ-A) instead of full assessments.
What happens if a payment processor goes down?
Processor outages halt transaction authorization until service restores. Some gateways offer failover routing to backup processors, though this requires pre-established relationships. Businesses processing high volumes often maintain relationships with multiple processors for redundancy.
Why do settlement times vary between acquiring banks?
Settlement timing depends on the acquiring bank's funding policies, merchant risk profile, and account history. New merchants often face 2-7 day holds, while established accounts may receive next-day funding. Some acquirers offer instant funding for additional fees.