Payment Gateways, Explained: What the Gateway, the Processor, and the Merchant Account Each Do

You signed up to accept credit cards in ten minutes, the money lands in your bank account two days after each sale minus about 3 percent, and when a customer disputes a charge, three different companies each insist the problem belongs to one of the others. Nothing is broken — you are just seeing three separate jobs that the signup page bundled into one button.

The payment gateway, the payment processor, and the merchant account do completely different work. Once you know which one encrypts, which one talks to the banks, and which one holds your money before it reaches you, the fee statement, the two-day delay, and the dispute runaround all start making sense.

The One Distinction That Explains Everything: Data vs. Money​

Every card payment has two halves: somebody has to move the information (is this card valid, does it have room, did the customer approve), and somebody has to move the funds (dollars traveling from the customer's bank to yours over a day or two). The three roles split along that line:

• The payment gateway moves data. It captures the card details at checkout, encrypts them, and passes them along. It never holds your money and never deposits anything into your bank account.
• The payment processor routes messages between the banks. It carries the authorization request to the card networks and the customer's bank, then carries the settlement instructions back. It is the back-end plumbing.
• The merchant account holds funds. It is a special account at an acquiring bank where your card sales wait after approval and before payout to your regular business bank account.

A useful shorthand: the gateway encrypts, the processor talks, the merchant account waits. When providers blur the three together in their marketing, come back to that sentence and ask which job each fee is paying for.

The Payment Gateway: The Encrypted Front Door​

The gateway is the software your customer touches. On a website it is the checkout page or the embedded card form; in a store it is the card reader's software; on the phone it is the virtual terminal your staff types numbers into.

What the gateway actually does​

When a customer enters a card number, the gateway does four things in about two seconds:

1. Captures the card data from the checkout form or reader.
2. Encrypts it immediately, so the raw card number never travels the open internet or sits in your systems.
3. Forwards the encrypted payload to the payment processor with the amount and merchant identification.
4. Returns the answer — approved or declined — to your checkout so the customer sees a confirmation or an error.

The gateway also handles the recurring and edge-case work that sits around the sale: tokenization (swapping the card number for a reusable token so subscriptions can rebill without storing card data), Address Verification (AVS) and CVV checks, 3-D Secure challenges like Verified by Visa, and voiding an authorization that was never captured.

Why the gateway matters for your PCI scope​

The Payment Card Industry Data Security Standard (PCI DSS) applies to every business that touches card numbers, but how much of it applies depends on how much card data reaches your systems. A gateway that hosts the card form or tokenizes at the point of entry keeps raw card numbers out of your servers entirely, which can reduce your compliance burden to the shortest self-assessment questionnaire instead of a full audit.

This is the practical reason to care which gateway you use even when the fees look identical: the gateway determines whether a breach of your website exposes card numbers or exposes only useless tokens. Ask any prospective provider where tokenization happens — at the customer's browser or on your server — before you sign.

Hosted vs. integrated gateways​

• Hosted (redirect) gateways send the customer to the provider's own payment page and back. Easiest PCI posture, least control over the checkout experience.
• Integrated (embedded) gateways keep the customer on your site with a form or component you style. Better conversion, more of your code in scope, so lean on the provider's tokenization.

Most small businesses should start hosted or embedded-with-tokenization and never handle a raw card number. The conversion gains from a fully custom card form are real but small; the compliance cost of touching card data is large.

The Payment Processor: The Messenger Between the Banks​

If the gateway is the front door, the processor is the courier running between every bank involved in the sale. The processor's customer is you, but its counterparties are the card networks (Visa, Mastercard, Amex), the issuing bank (your customer's bank, which decides whether to approve), and the acquiring bank (your bank's card division, which collects the money on your behalf).

Authorization: the two-second conversation​

When the gateway forwards a sale, the processor routes it: processor to card network, network to issuing bank. The issuer checks the account — valid card, enough available credit, no fraud flags — and sends back an approval code or a decline. That approval reserves the funds; it moves nothing. The customer sees a pending charge, and you have a promise, not money.

Authorizations expire. A typical card-present authorization lasts a few days; card-not-present authorizations often last around a week, varying by network and merchant category. If you never capture (finalize) the sale before expiry, the hold drops off and you must re-authorize. Businesses that ship days after the order — furniture, custom work, pre-orders — get bitten by this regularly: authorize at order time, capture at ship time, and track the gap.

Clearing and settlement: the overnight batch​

At the end of the business day (or on a schedule you set), your approved authorizations are grouped into a batch and submitted for clearing. Clearing sorts every transaction to the right issuer; settlement is the actual movement of money, with the issuer sending funds to the acquirer minus interchange (the fee the issuer keeps, which is most of what you pay), and the network taking its small assessment.

This batching is why card money arrives in one daily lump rather than a stream of individual deposits. It is also why your payout never equals your sales total: every fee in the chain is deducted before the money reaches you.

Capture, refunds, and chargebacks ride the same rails​

• Capture converts an authorization into a final charge for a set amount. You can usually capture less than authorized (a partial shipment) but not more.
• A refund is a new transaction flowing backward through clearing and settlement — not the reversal of the original charge. That is why a refund takes days to reach the customer and why you typically do not get your processing fee back on refunded sales.
• A chargeback is the issuer pulling money back after settlement because the customer disputed the charge. The processor delivers the dispute notice, the acquirer debits your merchant account, and you respond with evidence or accept the loss. Dispute windows run 60 to 120 days depending on the reason code, which is why card revenue stays provisional long after it hits your bank.

The Merchant Account: Where Your Money Waits​

The merchant account is an account at the acquiring bank — identified by your merchant ID (MID) — that exists for one purpose: receiving card-sale funds and releasing them to your business bank account. Every card sale you make passes through it.

The funding timeline​

The standard rhythm is T+1 or T+2: sales captured on Monday settle overnight and reach your bank account Tuesday or Wednesday. New accounts often start slower, with the acquirer holding a rolling reserve — a percentage of each payout kept back for 60 to 180 days as a buffer against chargebacks and refunds. Reserves shrink or disappear as you build history, but read the reserve clause before you sign: it is the most common reason a new business finds its first payouts smaller than expected.

Same-day and instant payouts exist with most large providers now, usually for an extra fee around 1 percent. Treat them as a cash-flow tool for tight weeks, not the default — the fee compounds fast against money that would have arrived free two days later.

The merchant discount: where the 3 percent goes​

The total cut taken from each sale is called the merchant discount rate, and it has three layers:

1. Interchange — paid to the customer's issuing bank, roughly 1.5 to 2.5 percent plus a fixed per-transaction amount depending on card type, how the card was presented, and your merchant category. This is the largest layer and it is set by the networks, not negotiable by you.
2. Assessments — paid to the card network itself, typically around 0.13 to 0.15 percent. Also non-negotiable.
3. Markup — the acquirer and processor's margin on top. This layer is negotiable, and it is the only part worth shopping.

That structure explains the two pricing models you will be offered. Flat-rate pricing (the familiar 2.9 percent plus 30 cents) bundles all three layers into one predictable number — simple, but you overpay on cheap debit transactions. Interchange-plus pricing passes interchange and assessments through at cost and adds a fixed markup, so you pay the true cost of each card type plus a thin margin. Below roughly $10,000 to $20,000 a month in card volume, flat rate's simplicity usually wins; above that, interchange-plus almost always costs less. Any provider that refuses to quote interchange-plus to an established business is telling you something about its margins.

Underwriting: why opening one takes days​

Unlike a regular bank account, a merchant account extends you something like credit: the acquirer fronts settlement funds and absorbs the loss if you vanish with chargebacks outstanding. So the application asks for business history, processing volumes, average ticket size, refund rates, and your merchant category code — and high-risk categories (travel, supplements, digital goods, anything with delayed delivery) face higher reserves, higher markups, or rejection. A provider that approves you in minutes has not skipped this underwriting; it has just automated it, as the next section explains.

The Shortcut Most Small Businesses Take: The All-in-One Facilitator​

Stripe, Square, PayPal, and their peers operate as payment facilitators (also called payment aggregators). Instead of setting you up with your own merchant account, they board you as a sub-merchant under their master merchant account and bundle the gateway, processing, and acquiring into one product with one API and one flat rate.

The trade is straightforward:

• You gain instant onboarding with no underwriting paperwork, one integration, one statement, predictable flat-rate pricing, and tokenization plus PCI tooling out of the box.
• You give up your own merchant ID (your dispute history is pooled with thousands of other sub-merchants), negotiated pricing (flat rate is the only menu), and stability of a human underwriting relationship — risk decisions are algorithmic, so a sudden spike in volume, ticket size, or disputes can trigger an automated hold or freeze with no one to call who knows your business.

For most businesses under roughly $1 million a year in card volume, that trade favors the facilitator. The flat-rate premium over interchange-plus on $500,000 of volume is on the order of a few thousand dollars a year — real money, but usually less than one week of frozen payouts costs a business that outgrew pooled risk scoring.

When you need the three pieces separately​

Consider graduating to a dedicated merchant account (with a gateway and processor you choose independently) when one of these is true:

• Your monthly volume makes the flat-rate premium exceed the hassle of separate contracts — generally above $80,000 to $100,000 a month.
• Your dispute rate, refund rate, or ticket size keeps tripping automated holds.
• Your business category is high-risk and facilitators keep declining or terminating you.
• You want to route transactions across multiple processors for redundancy or to optimize approval rates by card type and region.
• You need settlement directly to your own MID for cleaner reconciliation or multi-entity accounting.

A dedicated setup also unbundles the gateway choice, which matters if you need features your facilitator's checkout lacks — multi-currency presentment, network tokenization with automatic card-updater services, or level II and level III corporate-card data that lowers interchange on B2B sales.

How This Shows Up in Your Books​

Here is where the three roles stop being trivia and start affecting your month-end close. Because the merchant account sits between the sale and your bank, card revenue arrives in your records three times in three different forms: the sale, the batch, and the net payout. Booking all three against the same accounts is the classic double-counting trap.

The clean pattern is a clearing account: record each day's gross sales against the clearing account when captured, then record the payout as a transfer from clearing to checking with the fees split out as an expense. The clearing balance at any moment is simply money the merchant account is still holding — your in-transit card revenue:

2026-10-29 * "Card sales batch 4821 captured"
  Assets:Clearing:Card-Payouts    1000.00 USD
  Income:Sales                   -1000.00 USD
 
2026-10-31 * "Payout for batch 4821, net of fees"
  Assets:Checking                   968.50 USD
  Expenses:Payment-Processing-Fees   31.50 USD
  Assets:Clearing:Card-Payouts     -1000.00 USD

Three details make this work:

• Book gross sales, never net payouts, as revenue. Your tax return and your sales reports should show the $1,000 the customer paid, with the $31.50 as its own expense line. Booking the $968.50 payout as revenue understates both sales and expenses.
• Reconcile by batch, not by day. Match each payout to its settlement batch report from the processor, not to the calendar day's sales. Weekends and holidays shift the funding rhythm, so same-day matching breaks every long weekend.
• Track the reserve separately. If your acquirer holds a rolling reserve, that is your money held by someone else — an asset, not a fee. Book it to an account like Assets:Merchant-Reserve when withheld and clear it when released, or your cash position will read low every month the reserve grows.

If you keep your books in plain text, the introduction to Beancount covers the account structure this pattern builds on, and the Fava dashboard is a convenient way to watch the clearing balance clear to zero as each batch lands. Either way, the monthly test is one line: the clearing account should hold only batches captured but not yet paid out. Anything older than a week is a missing payout to chase, not a rounding error to ignore.

Questions Worth Asking Before You Sign​

You now know enough to read a processing agreement the way its author hoped you would not. Before you commit to any provider — facilitator or dedicated stack — get answers in writing to these:

• Which role is this fee paying for? Separate the gateway fee, the processing markup, and the acquirer's charges. A "2.9 percent plus 30 cents" quote with a $25 monthly gateway fee and a $99 annual PCI fee is not a 2.9 percent quote.
• What is the funding timeline, and what moves it? T+1 versus T+2, the batch cutoff time, weekend behavior, and the reserve schedule for the first 90 days.
• What triggers a hold, and who reviews it? Ask specifically about volume spikes and average-ticket changes — the two triggers that freeze growing businesses most often.
• How do refunds and chargebacks price? Refund transaction fees, chargeback fees ($15 to $25 each is typical), and whether the original processing fee is returned on refunds.
• Who owns the tokens? If you leave, can you take your stored customer card tokens to the next provider, or do you have to ask every subscriber to re-enter their card? Portable network tokens are the right answer.

The gateway, the processor, and the merchant account were separate businesses before the all-in-ones bundled them, and they still do separate jobs inside the bundle. Knowing which is which will not make card acceptance free — interchange sees to that — but it turns a confusing statement into an itemized one, and an itemized statement is something you can negotiate, reconcile, and plan around. Start with your last payout report: find the batch, split the gross from the fees, and confirm the net matches your bank. Everything else in this article is elaboration on that one habit.