How payment orchestration works
The merchant integrates once, with the orchestration layer. For each payment, a rules engine picks a provider by card type, country, currency, amount, cost or recent approval rates, and translates the request into that provider's API.
If the provider is down, or declines for a reason that allows another attempt, the layer can retry through a second provider, which is known as failover or cascading. Card details are usually held in the layer's own vault as tokens that work with every connected provider, so the merchant is not tied to one provider's tokens.
What an orchestration layer adds
- Routing rules that change without new code
- Failover and retries across providers
- A provider-neutral token vault
- One set of reports and one reconciliation feed
- One place for fraud checks and 3-D Secure
Who uses payment orchestration
Merchants with large volumes or many markets, marketplaces, and PSPs that resell several acquirers. The layer handles card data on behalf of merchants, which makes its operator a service provider in PCI DSS terms. The layer never holds the merchant's funds, so the contracts for acquiring and settlement stay between the merchant and each provider.
Orchestration, gateway or PSP?
- Payment gateway
- Connects a merchant to the acquirers that gateway supports. An orchestration layer sits above several gateways and treats each as one route among many.
- Payment service provider
- Contracts with the merchant, has the payment processed and pays the merchant out. An orchestration layer has no acquiring contract and moves no money.
- Payment routing
- The decision about where one payment goes. Routing is one function of an orchestration layer, alongside the vault, failover and reporting.
Where Payment orchestration shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Analytics & monitoringProduct analytics, attribution, engagement and crash reports, on a tracking plan you control.
Platforms that need it
Guides that go deeper
- White-label vs custom fintech platform: build, rent or buyCustom build, SaaS licence or white-label with the source code: how the three routes compare on time, cost, ownership and lock-in, and the outsourcing rules regulators apply to each.
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.