Payment Gateway Providers: How to Choose or Build Your Own

Do we think anyone is still cashing checks, or would they prefer to be paid automatically?

There are still 11 million checks written every day in the United States, but total volumes are declining by 8% each year as electronic payments grow. Checks reign supreme when it comes to the frequency of fraud, though, with 63% of organizations reporting check fraud in 2024.

Each transaction that moves from a paper check to card or digital wallet will run through a payment gateway. Beyond moving payment data, gateways are designed to provide a seamless and secure payment experience for customers, while offering specialized features and services like fraud prevention tools, recurring billing, and support for different payment methods.

Think of a gateway as the online version of a point-of-sale chip reader. It collects card details at checkout, verifies the CVV, runs fraud screening, and passes the transaction to the card issuer for approval, reducing the risk of fraud along the way.

The key difference between a payment processor as opposed to a payment gateway is that the processor facilitates the transaction, and a gateway is the middleman between merchant and processor, collecting transaction details, transmitting them to a processor, and communicating the outcome to the merchant.

It’s important to note that many payment processors also offer payment gateways, which allows them to bundle the services together under one platform.

Do you need a gateway, a processor, or both? 

If you accept payments online, you need both. The payment gateway securely captures card data at checkout and sends it onward. The payment processor carries the transaction through the card networks to the issuing bank for approval, then handles settlement. Many providers bundle the two into one product, so you may only sign one contract, but both jobs happen on every transaction. There is, though, a key distinction between transactions that happen in an environment where the card can be physically checked (card-present) and those where it cannot (card-not-present):

• Card-Present: The terminal and point-of-sale software do the gateway's job of capturing and encrypting card data from the chip or tap. Because of that, many in-store merchants never contract with a gateway separately, though they still need a processor to authorize and settle each transaction.
• Card-Not-Present: There's no terminal, so a gateway has to fill that role. This covers e-commerce checkouts, in-app purchases, phone orders and recurring subscription billing. The gateway collects the card details, passes them securely to the processor and sends the result back to your customer in seconds.

Return to Top

How do you choose a payment gateway? 

When choosing a payment gateway, it's important to consider many factors that will impact your needs, including:

• Features and Services: Make sure the payment gateway offers the features and services you need to run your business; do you self-administer, for instance, fraud checking, or do you need that to be run by your gateway. Regardless of the popularity of particular payment gateways, be sure to research which providers offer the services your business actually needs.
• Fees: Just as the features vary by provider, so do the fees. Be sure to review each pricing tier for every payment gateway and ensure that the fees allow your business to thrive both now and as it grows. Remember that the prices you pay at the creation of your business, when time to market is more important than a basis point or two on each transaction, may not be sustainable as you scale.
• Security Features: As with any third-party solution you’d choose, review the security posture of the gateways before making any purchasing decisions. Customers will not blame your downstream provider if their information leaks after they do business with you - they will blame you.
• Customer Support: If you will need help, or would like the option for help in the future, be sure to evaluate the potential gateway’s customer support options. Will you need a dedicated customer support specialist, or do you prefer any specific forms of assistance like chat, email, or phone?

Return to Top

Should you build your own payment gateway as a merchant? 

Businesses have payment needs that are unique to their customer strategy, and while third-party payment gateways often provide a convenient solution, there are compelling reasons why a company might choose to create their own.

1. Cost Savings: For businesses processing high volumes of transactions, the fees charged by third-party gateways can add up significantly. Building a proprietary payment gateway can reduce costs in the long term by enabling you to direct transactions to the downstream provider that charges you the least based on the profile of the purchase.
2. User Experience: Third-party payment gateways often come with a one-size-fits-all approach, which may not suit all businesses. With your own payment gateway, you can tailor the user experience to your specific requirements, offering a seamless checkout process and improved customer satisfaction.
3. Control: When you manage your own payment gateway, you control the entire transaction process. This means that you can quickly respond to issues, from new fraud vectors to customer payment trends, then implement changes quickly without relying on a third party. A good example of this is striking the right balance for different customer segments between authorizing transactions for revenue and declining transactions to prevent fraud.
4. Market Expansion: In some regions, third-party payment gateways may not support local payment methods or currencies. Building your own gateway can allow for better market penetration and expansion into these regions.

However, it's essential to keep in mind that creating a payment gateway also involves significant costs, technical expertise, and time.

It also comes with its own set of operational challenges and regulatory obligations, especially around security and compliance. Therefore, the decision to build a proprietary payment gateway should be made only after careful analysis of these factors.

Return to Top

What does it take to build a payment gateway?

Building a payment gateway means taking on four ongoing commitments:

1. Partnerships with processors or acquiring banks,
2. Engineering to integrate and certify with each of them,
3. A security program that can protect card data at every step,
4. Full responsibility for PCI DSS compliance.

Many businesses can underestimate the last two because they don't end when the gateway launches.

A gateway is only useful if it can reach the payment networks, so the first step is partnering with a payment processor or acquiring bank. Your partner provides the technical specifications for connecting to their systems. Depending on the payment methods, currencies and regions, a merchant may need to integrate with several processors.

For most businesses, building the gateway itself isn't the hardest part. The hard part is that building one makes card data security and compliance a permanent part of your core operations. Here is when you start running into scope creep.

Is there a middle path between building and buying? 

Yes. You can own your payment data without owning a payment gateway. Instead of building gateway infrastructure or tying your stored cards to a single provider, you can tokenize and vault card data in an environment you control, then send it to whichever gateways and processors you choose. You get most of the control that drives companies to build, but without the cost, timeline, and compliance burden of running a gateway yourself.

Most businesses that consider building their own gateway aren't trying to get into the gateway business. They want control: over costs, over authorization rates, over which markets they can enter, and over what happens when a provider goes down.

The obstacle is usually the stored card data.

When a gateway tokenizes your customers' cards, those tokens typically only work with that provider. Adding a second processor or switching to a better one means migrating card data, which can take months, and depends on your current provider's cooperation. The longer you stay, the harder it is to leave.

As Maxio prepared to expand beyond North America, its payment stack was the limiting factor. Any additional processor or gateway addition would require data migrations for each one.

“Many providers hold tokens hostage in an attempt to prevent you from leaving their platform,” Jon Cochrane, GM of Partnerships and Payments at Maxio explained. “Because we had Basis Theory in place, this was a non-issue. We could simply focus on creating the best product experience for our customers. Without Basis Theory, that was a potential seven-figure problem for us.”

With a programmable payment vault like Basis Theory, card data is captured and tokenized when your customer enters it, and is stored in a vault you control rather than being trapped inside a single gateway.

This changes the economics of the build vs. buy decision:

• Processor independence. Your tokens aren't tied to any single provider, so you can add a processor, split volume across several, or switch entirely without a card migration project.
• Smaller PCI scope. Raw card data stays out of your systems, which significantly reduces the compliance work you'd take on by building and maintaining your own cardholder data environment.
• Leverage and optimization. With multiple processors connected, you can route transactions by cost, region, or approval rates, and negotiate with providers from a position of choice.
• No new single point of failure. Routing happens outside the authorization path, so the vault doesn't add another dependency to every transaction. If a processor goes down, you can send transactions to another one.

You keep using proven gateways for what they do well, and you keep the one asset that's hardest to move: your customers' payment credentials.

If you are debating on expanding your payment stack, consider the different use cases that Basis Theory and an agnostic payment vault can support.

Ramp implemented Basis Theory in less than a quarter as a backup vault that could work with customized billing models.

Anton Payments saved three years of development time and $130,000 in certification costs because of Basis Theory.

Both customers are using Basis Theory to connect with multiple payment gateways, processors, and other elements of their payment stack. Reach out to our team to discuss your potential use cases.

Return to Top