What is the difference between a payment gateway and a payment processor?

A payment gateway is the software layer that captures and encrypts a customer's payment details at checkout, while a payment processor is the service that actually moves the money between the customer's bank and the merchant's bank. The gateway handles data capture, security, and authorization requests; the processor handles routing, settlement, and the behind-the-scenes communication with card networks and banks. In many modern setups, especially with all-in-one platforms like Stripe, Square, or PayPal, one company performs both roles, which is why the two terms are often used interchangeably even though they describe distinct functions. Understanding the split matters when you are comparing fees, negotiating rates at scale, or deciding whether to build a custom checkout on top of separate components.

The Direct Answer: Two Different Jobs in One Payment Flow

Also worth reading: What is the difference between smart routing and blended pricing in digital payments? · Stripe vs PayPal 2026 guide: Which payment processor is better for merchants and consumers? · What is the best payment processor for a small business in 2026?

When a customer enters a card number online, two things must happen before the money reaches your account. First, the payment details must be collected securely and checked for basic validity — this is the gateway's job. Second, an authorization request must travel through the card networks (Visa, Mastercard, American Express, Discover) to the issuing bank, which approves or declines the charge, and later the approved funds must be settled into your merchant account — this is the processor's job.

The gateway is essentially the digital equivalent of the physical card terminal you see at a grocery store. It encrypts sensitive data, formats the transaction request, and passes it along. The processor is the plumbing: it connects to acquiring banks, communicates with card networks, manages the flow of authorization and settlement messages, and handles the eventual movement of funds. A gateway without a processor cannot move money; a processor without a gateway has nothing to process unless the merchant collects payment data some other way.

For a typical small business using an all-in-one provider, this distinction is invisible. You sign up, embed a checkout, and the provider handles gateway and processor functions under one contract and one fee schedule. The distinction becomes practical when you outgrow flat-rate pricing, when you operate in multiple countries, or when compliance requirements push you toward separating components.

How a Transaction Actually Flows, Step by Step

Consider a $120 online purchase made with a Visa credit card. The sequence looks like this:

1. The customer submits payment details on your checkout page. The gateway tokenizes and encrypts the card data, so raw card numbers never touch your servers — a requirement under PCI DSS, the Payment Card Industry Data Security Standard.
2. The gateway forwards the encrypted transaction to the payment processor.
3. The processor routes the request to the appropriate card network (Visa, in this example).
4. The card network sends the request to the issuing bank — the bank that gave the customer their card.
5. The issuing bank runs fraud checks, verifies available credit, and returns an approval or decline. This entire round trip typically completes in 2 to 3 seconds.
6. The approval travels back through the network, processor, and gateway to your checkout, which confirms the order.
7. Settlement happens later — usually within 1 to 3 business days — when the processor batches approved transactions and moves funds from the issuing bank through the acquiring bank into your merchant account.

Notice that authorization and settlement are separate events. A customer can see an approved charge on their statement days before the money actually lands in your account. Interchange fees — the wholesale costs set by card networks, typically ranging from roughly 1.15% to 2.5% plus a fixed fee per transaction for credit cards in the United States — are deducted during settlement, along with network assessment fees and the processor's markup.

What Each Component Is Responsible For

The gateway's responsibilities center on data capture and security. It provides the checkout interface (hosted page, embedded iframe, or API-driven fields), encrypts card data in transit and at rest, performs address verification (AVS) and CVV checks, supports 3-D Secure authentication for European transactions under PSD2's Strong Customer Authentication rules, and manages tokenization so returning customers can pay without re-entering card details. Gateways also handle the user-facing side of declines, retries, and error messages.

The processor's responsibilities center on money movement and financial plumbing. It maintains connections to acquiring banks and card networks, submits authorization requests, manages settlement batches, handles chargebacks and disputes end to end, processes refunds, and reports on transaction data. Processors also manage the less visible work of currency conversion for cross-border sales and compliance with network rules that change regularly — Visa and Mastercard update their fee structures and operating rules twice a year, in April and October.

Some functions overlap. Fraud screening, for instance, may be offered by the gateway, the processor, or a third-party service layered on top. Recurring billing logic might live in the gateway's vault or in a separate subscription management tool. This overlap is why vendor boundaries can feel blurry when you compare products.

Comparison: All-in-One Platform vs. Separate Gateway and Processor

The economics deserve a concrete example. At $50,000 in monthly card volume with an average ticket of $60 (about 833 transactions), a flat 2.9% + $0.30 model costs roughly $1,700 per month. An interchange-plus arrangement at effective interchange of 1.9% plus 0.25% and $0.15 per transaction costs roughly $1,415 per month — a saving of about $285 monthly, or $3,400 per year. Below that volume, the flat rate's simplicity usually wins; above it, the savings justify the extra complexity.

Practical Steps to Choose the Right Setup

Start by calculating your monthly card volume and average transaction size, because these two numbers determine which pricing model favors you. Flat-rate pricing penalizes high-volume merchants and rewards low-volume ones; interchange-plus penalizes nobody but demands more scrutiny of statements. If your average ticket is small (under $15), the fixed per-transaction fee dominates your costs, so negotiate that component hardest.

Second, decide how much control you need over checkout. If you want a hosted page you can launch today and never maintain, an all-in-one platform is the rational choice. If you need a fully custom checkout experience, support for unusual payment methods (ACH, SEPA, local wallets), or the ability to switch processors without rebuilding your checkout, choose a gateway that supports multiple processor connections — Authorize.Net, for example, has historically connected to a range of acquiring banks and processors.

Third, verify the compliance path. Hosted fields and redirect-based checkouts keep you in the lightest PCI DSS scope (SAQ A, a short self-assessment questionnaire). Direct API integrations where card data touches your servers push you into SAQ D, which involves hundreds of controls and, at higher volumes, quarterly network scans by an Approved Scanning Vendor. Many teams underestimate this cost when comparing a custom build against a hosted solution.

Fourth, read the contract for the unglamorous terms: early termination fees, monthly minimums, PCI non-compliance fees (often $10–$30 per month on legacy merchant accounts), statement fees, and chargeback fees (commonly $15–$25 per dispute regardless of outcome). These add-ons frequently exceed the headline rate difference between providers.

Common Mistakes Merchants Make

The most expensive mistake is choosing a provider on headline rate alone. A quoted 2.5% flat rate can be worse than a 2.9% + $0.30 rate if your average ticket is $150, because the fixed fee matters less at higher ticket sizes. Always model your actual transaction mix against each pricing structure before committing.

The second mistake is ignoring effective rate tracking. Your effective rate — total processing fees divided by total processed volume — should be reviewed monthly. If it creeps above 3.5% for a standard-risk online business, something is wrong: hidden fees, downgraded transactions (cards processed without ZIP code verification often fall into more expensive interchange categories), or an excess of manually keyed transactions, which carry higher interchange than card-present or properly authenticated card-not-present transactions.

The third mistake is conflating the gateway decision with the acquiring bank decision. Your acquiring bank — the financial institution holding your merchant account — controls your risk profile, payout timing, and ultimately whether your account survives a dispute spike. Switching gateways does not change your acquirer, and vice versa. Merchants who get shut down by an acquirer after a chargeback ratio exceeds the networks' thresholds (Visa's standard program threshold is 0.90% of transactions, with an excessive threshold at 1.80%) often discover too late that their gateway was never the constraint.

A fourth mistake is neglecting decline recovery. Industry data consistently shows that 10–15% of online transactions decline on first attempt, and a meaningful share of those are recoverable through retry logic, account updater services, and dunning emails for subscriptions. A technically superior gateway that lacks smart retry features can cost more in lost revenue than it saves in fees.

When to Act: Triggers for Re-Evaluating Your Stack

You do not need to re-engineer your payment setup annually, but certain thresholds justify a review. If monthly card volume crosses $50,000, request interchange-plus quotes from at least two processors — the arithmetic starts working in your favor. If you expand into new countries, check whether your current provider supports local payment methods; in markets like Germany and the Netherlands, bank-transfer-based methods (SEPA direct debit, iDEAL) account for a large share of online checkout volume, and a card-only gateway will suppress conversion.

If your chargeback ratio approaches 0.7%, act before networks place you in a monitoring program. That means tightening fraud filters, improving order descriptors so customers recognize charges, and responding to disputes within the required windows — typically 7 to 10 days to submit evidence, depending on the network and reason code. If your effective rate rises more than 0.2 percentage points quarter over quarter without a change in transaction mix, audit your statements for downgrades and new surcharges.

Finally, review your stack whenever your integration team changes or your platform migrates. Payment code is often the oldest, least-documented part of an e-commerce codebase, and a migration is the cheapest moment to swap providers because the integration work is already budgeted.

Cost Summary and What You Should Expect to Pay

For a small US-based online business, expect all-in-one pricing of 2.9% + $0.30 per online transaction, with in-person rates around 2.7% and no monthly fee. Interchange-plus arrangements typically run interchange (roughly 1.5%–2.5% for consumer credit cards) plus 0.15%–0.50% and $0.10–$0.25 per transaction, plus a monthly account fee of $10–$25. High-risk industries — supplements, travel, CBD, subscription boxes — pay more: 3.5%–5% or higher, with rolling reserves of 5%–10% of volume held for 90 to 180 days.

Cross-border transactions add 1%–1.5% in network fees plus currency conversion spreads of 1%–3% unless you price in local currency. Chargeback fees run $15–$25 per case on most platforms. ACH processing, where available, costs a flat $0.50–$1.00 per transaction with a 1% cap in many cases, making it dramatically cheaper than cards for large-ticket B2B invoices — a $5,000 invoice costs $5–$25 via ACH versus roughly $145 via a 2.9% card fee.

The gateway-versus-processor question, then, is less about vocabulary and more about architecture. Know which component does which job, know which parts of the fee stack you can negotiate, and match the complexity of your setup to your actual volume. A solo seller does not need a separate processor; a $2-million-a-year retailer probably should not be on flat-rate pricing. The right answer is the one your transaction data supports.