A payment gateway is the technology that captures, encrypts, and transmits payment information between a customer, a merchant, and the financial institutions that authorize and settle the transaction.
Every time you tap a card, enter credit card details on a checkout page, or pay through a digital wallet, a payment gateway is processing that interaction in seconds.
The scale is enormous — Stripe processed $1.9 trillion in payment volume during 2025 (approximately 1.6% of global GDP), Adyen processed €1.29 trillion, and the overall payment gateway market was valued at $48.2 billion in 2025 — projected to reach $245.7 billion by 2033 at a 22.7% CAGR, according to Grand View Research.
- How a payment gateway processes a transaction (step by step)
- Difference between a gateway, a processor, merchant account
- Security standards (PCI DSS, tokenization, 3D Secure)
- The four main types of payment gateways
- How much do payment gateways cost
How does a payment gateway process a transaction?
A payment takes 1-3 seconds from the customer's perspective, but six distinct steps happen behind the scenes.
| Step | What happens | Who is involved |
|---|---|---|
| 1. Checkout | Customer enters payment details or taps a card/wallet | Customer, merchant website/POS |
| 2. Encryption | Gateway encrypts the data and transmits it securely | Payment gateway |
| 3. Routing | Payment processor routes the request to the appropriate card network | Payment processor, Visa/Mastercard |
| 4. Authorization | The issuing bank (customer's bank) approves or declines based on available funds and fraud checks | Issuing bank |
| 5. Response | Approval or decline is sent back through the chain to the merchant | All parties (reverse path) |
| 6. Settlement | Funds are transferred from the issuing bank to the merchant's acquiring bank (typically 1-3 business days) | Acquiring bank, issuing bank |
The gateway handles steps 2 and 5 — the secure capture and transmission of payment data. The processor handles routing and communication with card networks.
The acquiring bank handles settlement. Understanding this chain explains why the terms "gateway" and "processor" are different (even though some companies, like Stripe and Adyen, combine both functions).
How does a payment gateway differ from a processor and a merchant account?
These three terms describe different parts of the payment infrastructure.
| Component | What it does | Example |
|---|---|---|
| Payment gateway | Captures and encrypts payment data, transmits authorization requests | Stripe, PayPal, Authorize.net |
| Payment processor | Routes transactions between the gateway, card networks, and banks | Fiserv, Worldpay, Adyen |
| Merchant account | A bank account that receives settled funds from card transactions | Provided by acquiring banks |
Modern platforms like Stripe, Square, and Adyen bundle all three functions into a single service — which is why the terms are often used interchangeably (incorrectly). For businesses evaluating bank fees and payment infrastructure costs, understanding which component charges which fee prevents overpaying.
What are the four types of payment gateways?
Payment gateways come in four architectures, each with different tradeoffs.
Hosted gateways
The customer is redirected to the payment provider's page (PayPal Checkout, Shopify Payments). The merchant never touches raw card data, which simplifies PCI compliance — but the redirect can reduce conversion rates.
API-hosted gateways
The payment form is embedded in the merchant's website using the provider's API (Stripe Elements, Adyen Drop-In). The customer stays on the merchant's site, improving the checkout experience. The merchant handles more of the integration but the provider still manages sensitive data.
Self-hosted gateways
The merchant collects payment data directly on their own servers and sends it to the gateway for processing. This provides maximum design control but requires full PCI DSS compliance — a significant security and audit burden.
Local bank gateways
Regional banks offer their own gateway services, routing transactions through their internal infrastructure. Common in markets where international providers have limited coverage. Processing may be slower and API documentation may be less mature.
How much does a payment gateway cost?
Pricing varies by provider, volume, and business model.
| Fee type | Typical range | Example |
|---|---|---|
| Transaction fee | 2.4-2.9% + $0.25-0.30 per transaction | Stripe charges 2.9% + $0.30 for online payments |
| Monthly fee | $0-$79/month | Some providers charge monthly minimums |
| Setup fee | $0-$500 | Most modern providers charge nothing |
| Chargeback fee | $15-$25 per dispute | Applied when a customer disputes a charge |
| FX conversion fee | 1-2% above mid-market rate | Applied on cross-border or multi-currency transactions |
| PCI compliance fee | $0-$120/year | Some providers include this; others charge separately |
For businesses processing Interac e-Transfers, the cost comparison with card-based gateways is relevant — Interac transactions typically carry lower fees but are limited to Canadian domestic transfers.
How secure are payment gateways?
Security is the primary reason payment gateways exist — separating sensitive card data from merchant systems.
PCI DSS compliance
The Payment Card Industry Data Security Standard (PCI DSS) sets the rules for handling cardholder data.
A 2025 study by Park and Hastings found that only 32.4% of organizations were fully PCI DSS compliant, and a separate study (Rahaman, Wang, and Yao) found that 86% of e-commerce websites had at least one PCI violation severe enough to invalidate compliance.
Tokenization
Payment gateways replace actual card numbers with randomly generated tokens. If a merchant's database is breached, attackers find tokens — not usable card numbers. The original card data is stored securely in the gateway's token vault.
3D Secure
An additional authentication layer (like Verified by Visa or Mastercard SecureCode) that requires the cardholder to verify their identity during checkout. 3D Secure reduces card-not-present fraud and shifts chargeback liability from the merchant to the card issuer.
AI fraud detection
A 2025 study by Luo et al. demonstrated that combining large language models with graph neural networks achieved 98% fraud detection accuracy on a dataset of 2.84 million real payment transactions — representing the frontier of AI-driven payment security.
Send and receive payments with RemitBee
RemitBee offers the best-in-class money transfer with transparent pricing and FINTRAC-regulated compliance.
- Zero fees on transfers over $500 CAD
- 100% money-back guarantee on all transactions
- Competitive exchange rates with no hidden FX markups
- Fully regulated and compliant with Canadian AML requirements
Frequently asked questions
Here are some commonly asked questions about this topic:
What is the difference between a payment gateway and a payment processor?
A payment gateway captures and encrypts payment data at the point of sale (online or in-store) and transmits authorization requests. A payment processor routes those requests between the gateway, card networks (Visa, Mastercard), and banks for approval and settlement. The gateway is the front door; the processor is the communication backbone. Many modern platforms (Stripe, Adyen, Square) combine both functions into a single service, which is why the terms are often confused. When evaluating providers, the distinction determines which fees you are paying and to whom.
Is PayPal a payment gateway?
PayPal functions as a payment gateway, payment processor, and digital wallet combined. When a customer pays through PayPal Checkout, PayPal captures the payment data (gateway function), processes the authorization (processor function), and can hold funds in a PayPal balance (wallet function). PayPal also offers Braintree as a dedicated gateway product for developers who want API-level integration without the PayPal checkout experience.
How long does payment settlement take?
Settlement typically takes 1-3 business days after authorization, depending on the provider, the payment method, and the acquiring bank's processing schedule. Stripe's standard settlement is 2 business days. Adyen and Square offer similar timelines. Some providers offer instant or next-day settlement for an additional fee. International transactions may take longer due to cross-border settlement processes and currency conversion.
Do small businesses need a payment gateway?
Any business accepting online card payments needs a payment gateway — there is no alternative mechanism for securely processing card-not-present transactions. For in-person businesses, a POS terminal handles the gateway function. The good news is that modern providers like Stripe and Square have eliminated setup fees and monthly minimums, making gateway access affordable even for sole proprietors and micro-businesses. The real question is which gateway fits the business model (subscription, marketplace, one-time sales, international), not whether one is needed.
What is PCI DSS and why does it apply to payment gateways?
PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements that any organization handling cardholder data must meet. It covers encryption, access controls, network security, monitoring, and vulnerability management. Using a hosted or API-hosted gateway (like Stripe or PayPal) reduces the merchant's PCI scope because the gateway — not the merchant — stores and processes raw card data. Self-hosted gateways require the merchant to maintain full PCI compliance, which involves significant cost and ongoing audit requirements.
