A payment gateway is the front door. It securely collects a customer’s card details at checkout and passes them on. A payment processor does the work behind that door. It routes the transaction through the card network to the customer’s bank, returns an approval or decline, and helps move the money into the merchant’s account. In short, the gateway captures and protects the data, and the processor moves the payment.
Many businesses never see the two as separate products, because one provider often bundles them. Still, the difference matters when you compare pricing, fix a failed payment or plan for security rules. This guide walks through each piece in plain terms. It is part of our money and business guides.
What a payment gateway does
A gateway is software that sits between your checkout and the rest of the payment system. Online, it is the form or embedded field where a shopper types a card number. In a store, the card terminal plays the same role.
Its main jobs are narrow but important:
- Capture. It collects the card number, expiration date and security code.
- Protect. It encrypts that data in transit, so it is not readable if intercepted.
- Hand off. It sends the request to the processor and shows the result to the shopper.
- Screen. Many gateways also run fraud checks, such as address matching or velocity limits.
A gateway does not move money by itself. It is closer to a secure courier for card data.
What a payment processor does
A processor, often called a credit card processor, connects the merchant side to the card networks. It formats the transaction, sends it to Visa, Mastercard or another network, and receives the issuing bank’s answer. Then, at the end of the day, it bundles approved transactions for settlement.
The processor usually works for, or alongside, the acquiring bank. That is the bank that holds the merchant’s account and accepts card payments on its behalf. The issuing bank is the customer’s bank, the one that gave them the card. So the processor is the link that lets those two banks talk through the network.
| Payment gateway | Payment processor | |
|---|---|---|
| Main role | Captures and encrypts card data at checkout | Routes the transaction and handles settlement |
| Where it sits | Website checkout, app or card terminal | Between the merchant’s bank and the card networks |
| Talks to | Customer, merchant site, processor | Gateway, card networks, acquiring bank |
| Moves money? | No | Yes, through the settlement process |
| Typical fees | Monthly fee and/or per-transaction fee | Markup on top of interchange and network fees |
How a card payment flows, step by step
The whole trip usually takes a couple of seconds. Here is the path for a typical online credit card purchase:
- Customer. A shopper enters card details and clicks “Pay.”
- Gateway. The gateway encrypts the data and sends an authorization request to the processor.
- Processor. The processor passes the request to the right card network.
- Card network. Visa, Mastercard or another network routes it to the issuing bank.
- Issuing bank. The issuer checks the account, available credit and fraud signals. Then it approves or declines.
- Back the same way. The answer travels back through the network, processor and gateway to the checkout page.
- Acquiring bank. Later, during settlement, the acquirer receives the funds and credits the merchant’s account.
The Federal Reserve’s payment systems pages describe how these networks and banks fit into the wider US system. In practice, a merchant only deals with one or two of these parties directly.
Authorization vs. settlement
These are two separate stages, and mixing them up causes a lot of confusion.
Authorization happens at checkout. The issuer confirms the card is valid and places a hold on the amount. No money has moved yet. For example, a hotel or gas pump may authorize a set amount, then adjust it later.
Settlement comes after. The merchant, or the processor on its behalf, sends a batch of approved sales for clearing. The issuer then pays the network, and the network pays the acquiring bank. Finally, the acquirer deposits the money in the merchant’s account, minus fees. Timing varies by provider and account type, but it often takes one to a few business days.
This gap explains a common question. A customer can see a “pending” charge for days, which means the authorization exists but settlement has not finished. If the sale is canceled before settlement, the hold usually just drops off.
Who charges what fees
Card fees come in layers. The merchant usually sees one blended rate or one monthly statement. Still, several parties take a share:
| Fee | Who receives it | Who sets it |
|---|---|---|
| Interchange | Issuing bank | Card network rate tables (and federal law for many debit cards) |
| Network or assessment fees | Card network | Card network |
| Processor markup | Processor and acquiring bank | Your contract |
| Gateway fees | Gateway provider | Your contract |
Interchange is the largest piece for most card sales. It goes to the bank that issued the card. Rates depend on the card type, how the card was accepted and the merchant’s category. Rewards and business cards often carry higher rates than basic debit cards. Visa publishes its US rate tables on its interchange and fees page for merchants, and Mastercard publishes its own schedule. The merchant does not pay interchange directly. Instead, it is folded into what the acquirer charges.
Debit cards from large banks follow a federal cap. Under the Federal Reserve’s Regulation II, issuers with $10 billion or more in assets may receive at most 21 cents plus 0.05% of the transaction. An eligible issuer can add a 1-cent fraud-prevention adjustment. The Fed proposed lowering that cap in October 2023. As of October 2026, the 21-cent standard is still the one listed by the Fed, and the rule is also the subject of court challenges. So it is worth checking for updates.
Network or assessment fees are smaller charges the card network keeps for running the system. Processor markup is the processor’s own margin. It may be a percentage, a flat amount per transaction or both. Gateway fees are often a monthly charge, a per-transaction charge or a mix. However, many bundled providers fold everything into one flat rate.
Pricing models differ. “Interchange-plus” pricing passes through interchange and network fees and shows the markup separately. Flat-rate pricing is simpler to read but hides the split. Tiered pricing groups sales into buckets with different rates. Because providers differ, ask for a written breakdown before you sign anything.
Tokenization and PCI DSS basics
Any business that stores, processes or transmits card data must follow the Payment Card Industry Data Security Standard, or PCI DSS. The standard is maintained by the PCI Security Standards Council, and the card networks enforce it through their merchant rules. As of October 2026, the active version is PCI DSS v4.0.1. Version 4.0 was retired at the end of 2024.
Gateways help here in two ways. First, hosted payment pages and embedded fields keep raw card numbers off your own servers. That can shrink the part of your business PCI DSS covers, which often means a shorter self-assessment. Second, many gateways offer tokenization.
Tokenization swaps the real card number for a random stand-in value called a token. The token is useless to a thief outside that system. So a merchant can store tokens for repeat billing or one-click checkout without keeping actual card numbers. The real number stays in a secure vault run by the provider.
Encryption and tokenization reduce risk, but they do not remove PCI duties entirely. A merchant still has to confirm compliance each year, usually through a self-assessment questionnaire or an audit, depending on volume. Your acquiring bank or provider tells you which form applies.
Do you need both?
Yes, every card payment needs both functions. Someone has to capture the card data, and someone has to route the transaction and settle it. The real question is whether you buy them as one package or as two separate services.
One bundled provider is the common choice for small online shops. Setup is faster, there is one bill and one support line. The trade-off is less control over pricing and less freedom to switch parts later.
A separate gateway and processor can make sense for larger merchants. For example, a business with high volume may negotiate interchange-plus pricing with a processor. Then it may use a gateway that connects to several processors. That setup can lower costs and add backup if one route fails. However, it takes more technical work and more contracts.
Business-to-business payments add their own layer of invoicing and reconciliation software. Investors have funded that side for years, as with this 2018 investment in B2B payment software. Crypto payments, by contrast, run on separate rails that skip card networks. A 2018 market report on bitcoin payments covered that segment’s early growth.
To decide, list your monthly card volume, average sale size and sales channels. Then compare written quotes that separate interchange, network fees, markup and gateway charges. This article is general information, not financial or legal advice.
Frequently asked questions
What is the difference between a payment gateway and a payment processor?
The gateway captures and encrypts card data at checkout. The processor routes the transaction through the card network to the issuing bank and handles settlement into the merchant’s account.
Is a credit card processor the same as a merchant account?
No. The merchant account is held at the acquiring bank and receives the funds. The processor is the service that moves transaction data between that bank, the card networks and the issuer. Some providers bundle all three.
Who pays interchange fees?
The merchant pays them indirectly. The acquiring bank pays interchange to the card issuer and passes the cost on through the merchant’s processing rates.
Does a payment gateway make me PCI compliant?
Not on its own. A gateway with hosted fields and tokenization can reduce what you have to secure. Still, you must confirm PCI DSS compliance yearly, usually with a self-assessment questionnaire.
How long does settlement take?
It varies by provider and account. Many merchants receive funds within one to a few business days after a batch is settled.
