How a payment gateway works
The gateway receives the payment details through a hosted page, embedded fields, an API or a terminal connection. It encrypts or tokenises the card number, runs 3-D Secure where authentication is needed, and builds the authorisation request in the format the acquirer or processor expects.
The answer comes back within seconds: approved, declined or failed, with a code. Later steps go through the same gateway: capture, void, refund, and the webhooks and reports a merchant reconciles from.
What rules apply to a payment gateway
A gateway that handles card numbers for merchants is a service provider in PCI DSS terms: the PCI Security Standards Council's glossary names payment gateways among them. In the EU, PSD2 leaves outside its scope technical service providers that support payment services without entering at any time into possession of the funds (Article 3(j)). A gateway that also contracts with merchants to accept payments and pays them out is acquiring, which is a payment service (Article 4(44)).
Why the gateway matters to a payments business
The gateway is the part of the stack a merchant integrates with, so it sets the checkout experience, the payment methods on offer and the data available for fraud checks and reporting. A company that runs its own gateway can connect several acquirers behind it and add routing, which is where a gateway grows into orchestration.
Gateway, processor, PSP or orchestration?
- Payment processor
- Carries the authorisation and clearing messages between the acquirer, the card scheme and the issuer. The gateway is the merchant-facing entry point that feeds the processor.
- Payment service provider
- Sells acceptance as one service: a gateway, an acquiring arrangement and payouts under one contract. A gateway on its own leaves the merchant to contract with an acquirer.
- Payment orchestration
- A layer above several gateways, PSPs and acquirers that decides where each payment goes. A gateway connects to its own acquirers, and an orchestration layer is provider-neutral.
Where a payment gateway shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Merchant onboardingBusiness sign-up, verification and underwriting, from application to first payment.
Platforms that need it
Guides that go deeper
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
- How to become a PSP or a payment facilitatorGateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, Articles 3(j) and 4(44) (EUR-Lex)
- PCI SSC, Glossary: Service Provider and Payment Processor
General information, not legal advice: what applies to you depends on your services and your market.