Last Updated on August 21, 2026 by Ewen Finser
Payment gateways and payment processors might sound similar, but each plays a distinct role in the payment collection process.
If you’re collecting card payments from customers, you already have both systems in place, even if you’re unaware of it. Here’s what you need to know.
Bottom Line Up Front
If you want the short version, here’s the timeline of a typical transaction, including where both payment gateways and payment processors play their roles:
- The payment gateway collects card details from the customer.
- The payment gateway encrypts or tokenizes the card details and sends them to the payment processor.
- The payment processor sends the authorization request to the issuing bank via the card network.
- The issuing bank will approve or deny the request according to factors like whether the customer has enough funds or credit to cover the transaction and whether the card details are valid.
- The issuing bank notifies the processor of the decision to approve or deny the transaction.
- The processor tells the gateway, which notifies the customer of approval or denial.
- If approved, the funds go through the settlement process, eventually landing in the business’s bank account, minus the applicable fees.
How a Payment Gateway Works
The payment gateway is at the customer-facing end of the transaction. In e-commerce, this is the online checkout page; for in-person payments, it’s the POS system.
The gateway is what collects payment information such as card details directly from the customer. It then takes this data, encrypts or tokenizes it, and transmits it onward to the payment processor. It doesn’t interact any further with the customer, other than to tell them whether the payment was approved or denied.
In short, it simply bridges the gap between the customer and the payment processor.
Types of Payment Gateways
There are several types of payment gateways, the two most notable being hosted and self-hosted.
With a hosted gateway, the customer is redirected from your business’s website to the payment gateway to complete the transaction. The advantage here is that your business doesn’t have to directly handle many of the security and compliance considerations, but this also means you have less control over the checkout experience.
Self-hosted gateways give your business that control back, but while this can help with the user experience, it also comes with more compliance work on your end. This is because the customer is inputting their payment data through your site.
One of the most common approaches today is using an API-hosted gateway. This is kind of a hybrid between hosted and self-hosted, as it provides a smooth customer experience through your business’s website, but you have fewer compliance considerations than you would with a self-hosted gateway. This is a popular implementation, mainly due to its high customizability. However, it requires quite a bit of technical know-how unless you use a low-code solution.
White-Label Payment Gateways
Another term you’ll often encounter when researching gateways is a white-label payment gateway. This is a full-fledged, third-party solution that uses entirely your branding. This means you can customize it so that the customer doesn’t know who the payment provider actually is.
Security Considerations
The payment gateway is the one collecting the customer’s card details, so it needs to transmit this information securely. The most important concept here is PCI compliance, which means it complies with the Payment Card Industry Data Security Standard (PCI DSS). While the checklist of requirements to meet this standard is long, one of the most important points lies with encryption, as gateways should encrypt or tokenize the card data to prevent it from getting into the hands of bad actors.
How a Payment Processor Works
A payment processor is responsible for facilitating the authorization of card transactions. This part of the chain operates on the back end, which means the customer doesn’t directly interact with it. Once the payment gateway sends the card details, the processor sends an authorization request to the issuing bank (the bank that issued the customer their card) by going through the card network. The issuing bank will then either approve or deny the transaction, communicating this with the processor.
The decision to approve or deny the transaction is based on several factors, including whether the customer has enough funds or credit available to cover the transaction and whether the card details are valid. The verdict is sent to the processor, which tells the gateway, which notifies the customer whether the transaction was approved or denied. Then, the transaction goes through the settlement process, where funds eventually move to the business’s bank account (minus the applicable processing fees).
Fraud Prevention
While PCI compliance is thought of more in the context of payment gateways rather than payment processors, there are still several security measures that a processor should follow. Fraud prevention is at the forefront of these standards, and many processors have strong detection tools for it.
Commonly, processors look for issues involving:
- Card details
- Device information
- Payment velocity
- Transaction amount
- Previous declines
- IP address
- Location
You can often establish your own rule-based thresholds as well, but many businesses get along just fine by using the settings and tools that are built into their processor.
That being said, it can be a good idea to incorporate additional layers. There are several separate fraud prevention and chargeback management tools that you could add to your stack, such as Riskified, Signifyd, and Wyllo (formerly NoFraud).
Deciding on a Payment Gateway and Processor
Generally, you don’t have to worry about purchasing a payment gateway and a payment processor separately, as they’re commonly bundled together as one product. However, not all payment providers are appropriate for every business.
Here are a few factors to keep in mind.
PayFacs vs. Traditional Merchant Accounts
Payment facilitators, or PayFacs, have several businesses together under a single master merchant account, where each individual business is a sub-merchant. This merchant account temporarily holds funds before they go to your business’s main bank account.
However, even though it involves more extensive underwriting, some businesses prefer having their own dedicated merchant account as it provides more control. This is especially true for complex businesses or those with high processing volumes.
High-Risk vs. Low-Risk Industries
The industry your business operates in is a major deciding factor when choosing a payment provider.
Some industries are considered high-risk by nature. They’re designated as such because they involve significant government regulation, and they may face higher chargebacks. These businesses typically want to work directly with a high-risk provider, as processors like Stripe or Square may shut you down. For example, Stripe publishes a lengthy list of prohibited and restricted businesses, with some being those in adult content, debt relief, gambling, cannabis, and travel.
A couple of friendlier possibilities include Luqra and Finix. While businesses in any industry can use these providers, they could be less likely to shut down accounts for those in high-risk areas. For example, Luqra states that it works with those in telemedicine, nutraceuticals, credit repair, online vape, travel, and digital courses, among others. Finix explicitly promotes solutions for businesses working in CBD, digital wallets, lending, healthcare, nutraceuticals, and gaming.
Funding Timeline
The funding timeline is an important consideration when choosing a processor, as it can directly impact your cash flow.
Standard timelines can vary, often ranging from one to three business days. However, it’s possible that you could access your funds sooner than this, as many processors offer accelerated funding, such as next-day, same-day, or instant.
Here are a few examples:
- Stripe: Instant payouts
- Square: Next business day, same-day, instant
- Elavon: Fast Track Funding (one business day), True Daily Funding (within hours), On Demand Funding (within minutes)
- Luqra: Next-day, same-day
- Finix: Next-day, same-day, instant
Note that businesses often must meet certain requirements in order to qualify for fast funding.
Processing Fees
Cost is another critical consideration when trying to find the optimal payments setup for your business, and much of it comes down to the processing fees charged.
There are a few different cost structures you’ll see:
Flat-Rate Pricing
Under this model, every transaction faces the same fee. Stripe is commonly known for this cost structure, as under their standard pricing, most online card payments are 2.9% + $0.30 per transaction.
While flat-rate pricing can make it easy to forecast processing costs, it often ends up being more expensive in the long run.
Interchange-Plus Pricing
This is another common model, where you’ll pay interchange along with a processing fee. For high-volume businesses, interchange-plus pricing tends to lead to the lowest processing costs overall, as different transactions face different fees. For example, the card network, transaction amount, and whether the payment was completed online or in-person can all affect the fee.
Tiered Pricing
Tiered pricing generally results in the highest processing costs for businesses. Under this model, transactions are grouped into one of three buckets (qualified, mid-qualified, and non-qualified) based on the transaction’s risk. In-person transactions are typically qualified, with online payments grouped as non-qualified. And as the risk increases, so does the processing fee.
Contract Terms
Whether you’re shopping around for all-in-one payment gateway and processing solutions or you’re looking at standalone options, it’s important to read the fine print and see if you’re bound to any contract terms. Some payment providers lock you into a contract with a length of anywhere from one to three years, and you may incur a termination fee if you decide to leave early.
However, there are also options that don’t bind you to a years-long contract, so it’s important to know what you’re signing up for and whether a particular solution aligns with your business’s long-term goals.
You’ll also occasionally come across payment processors that charge a monthly subscription fee. In these cases, you’ll pay a flat rate each month, along with transaction fees, which tend to follow the interchange-plus model. For businesses with high processing volumes, this could be an economical choice, but paying a monthly subscription could be too costly for a smaller business.
Getting Started with Payment Processing
The gateway handles the customer side, collecting the card details, securing them, and reporting back the approval or denial. The processor works behind the scenes, routing the authorization to the issuing bank and moving the money afterward. Nearly every provider sells them together, so the real question is which bundle fits, and that comes down to four things: whether you want a PayFac or your own merchant account, how your industry is classified, how fast you need the funds, and which pricing model works at your volume.
That last pair is where most of the money is. Flat-rate providers like Stripe (2.9% + $0.30 on most online payments) are predictable but get expensive as volume climbs; interchange-plus usually wins at scale. And if you’re in a high-risk category, funding speed matters less than whether the provider will keep your account open at all — Stripe and Square both publish long restriction lists, while Luqra and Finix are fast providers that explicitly court categories like nutraceuticals, CBD, and telemedicine.
Write down your non-negotiables before you start comparing. It’s the difference between being sold a payment stack and choosing one.