Payment Gateways vs. Payment Processors: What's the Difference and Why It Matters

A payment gateway and a payment processor are two separate tools that work together to move money from a customer's card or bank account to your business account

When a customer enters their card number on your website or in your store, the payment gateway is the technology that captures and encrypts that information. It's the digital lock box. The payment processor is the company that takes that encrypted data, contacts the customer's bank, confirms the funds exist, and moves the money into your account. It's the messenger and the accountant combined.

Many businesses think they're signing up for one service when they're actually paying for both—sometimes to the same company, sometimes to two different ones. Understanding which is which helps you know what you're paying for, why a transaction failed, and who to call when something goes wrong.

Key Takeaways

• A payment gateway encrypts and transmits card data; a payment processor contacts banks and moves money, and both are required for any online or card-present transaction.
• Some companies bundle both services under one contract, while others require you to choose a gateway and a processor separately, which can cost more but gives you flexibility.
• If a transaction is declined, the gateway tells you the customer's bank said no; the processor tells you why the bank said no.
• Monthly fees, per-transaction fees, and setup fees vary widely between providers, and bundled services are not always cheaper than paying for each separately.
• PCI compliance (the security standard for handling card data) is required by law, and your gateway and processor share responsibility for meeting it.

How the payment gateway captures and protects card information

The payment gateway is the first point of contact between your customer and the financial system. When someone enters their card number, expiration date, and CVV on your checkout page—or swipes or taps their card at a physical terminal—the gateway immediately encrypts that data so it cannot be read by anyone intercepting it, including you.

The gateway then sends that encrypted information to the payment processor. It does not store the card number on your server or your website. This is critical: if hackers break into your business's computer system, they cannot steal card data because you never held it in the first place. The gateway held it, encrypted, for a fraction of a second.

Different gateways work with different types of transactions. Some handle online payments only (Stripe, Square Online). Others handle in-person card swipes and taps (Square Terminal, Toast). Some handle all three: online, in-person, and phone orders. Your choice of gateway depends on how your customers pay you.

How the payment processor moves money from the customer's bank to your account

Once the gateway sends encrypted card data to the processor, the processor's job begins. It contacts the customer's bank (or credit card company) and asks: "Does this person have the funds? Do they want to approve this charge?" The bank responds yes or no within seconds.

If yes, the processor collects the money from the customer's bank and deposits it into your business bank account. If no, the processor sends a decline code back to the gateway, which displays an error message to your customer. Common decline codes include "insufficient funds," "card expired," "CVV mismatch," and "bank flagged as suspicious."

The processor also handles refunds. When you issue a refund, you tell the processor, and the processor sends the money back to the customer's original card or bank account. This can take one to three business days depending on the customer's bank.

Bundled services versus separate gateway and processor contracts

Many small businesses use a bundled provider—one company that acts as both gateway and processor. Square, Stripe, PayPal, and Toast are examples. You sign one contract, pay one monthly fee (or no monthly fee), and both services are included. This is simpler to set up and easier to understand.

Other businesses, especially larger ones or those with high transaction volume, hire a gateway company and a processor company separately. For example, you might use Authorize.Net as your gateway and First Data as your processor. This approach costs more in setup and monthly fees, but it gives you the ability to switch processors without changing your gateway, or vice versa. If your processor's rates become too high, you can move to a cheaper one without rebuilding your checkout page.

Bundled services are not automatically cheaper. Compare the total cost: monthly fee plus per-transaction fee plus any setup or gateway fees. A bundled provider charging 2.9% per transaction plus $0.30 per transaction might cost more than a separate gateway ($25/month) plus a processor charging 2.2% plus $0.15 per transaction, depending on your sales volume.

Fees you will encounter and where they come from

Payment gateways and processors charge in different ways. Understanding each type helps you predict your total cost and spot overcharges.

Per-transaction fees are the most visible. A processor might charge 2.2% of the transaction amount plus $0.30 per transaction. A gateway might charge $0.10 per transaction. These add up quickly if you process hundreds of transactions per month.

Monthly gateway fees range from $0 to $50 or more, depending on the provider and the features you use. Some providers waive the monthly fee if you process a minimum number of transactions per month.

Setup fees are one-time charges to activate your account, ranging from $0 to $500. Some providers charge this only if you hire them to integrate the gateway into your website.

PCI compliance fees are annual charges to maintain security certification. These range from $0 to $300 per year depending on the provider. Some include this in their monthly fee; others charge separately.

Chargeback fees are charged when a customer disputes a transaction and their bank sides with them. These typically range from $15 to $100 per chargeback. This is separate from the refund itself—you lose the money and pay a fee on top.

What happens when a transaction fails and who to contact

When a customer's payment is declined, the error message they see comes from the gateway, but the reason comes from the processor. "Card declined" is what the gateway displays. "Card declined: insufficient funds" is what the processor knows.

If the customer says "I know I have money in my account," the processor's decline code tells you whether the bank said no or whether something else went wrong. Common reasons include: the card is expired, the CVV does not match, the bank flagged the transaction as suspicious, the card is locked for security, or the customer's address does not match the bank's records.

If the problem is on the gateway side (your checkout page is broken, the form is not submitting), the transaction never reaches the processor. The customer sees an error before they even enter their card number.

If the problem is on the processor side (the bank is not responding, the processor's system is down), the customer enters their card but the transaction hangs or times out.

When troubleshooting, start by asking: Did the customer see an error message? If yes, contact your gateway provider with the error code. If no, and the transaction just disappeared, contact your processor.

PCI compliance and security responsibility

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that any business handling card data must follow. The rules cover how you store data, who can access it, how you encrypt it, and how you test your systems for vulnerabilities.

Your gateway and processor share responsibility for PCI compliance. The gateway must encrypt data and never store full card numbers on your server. The processor must protect the data it receives and handle it according to PCI rules. You must use both a compliant gateway and a compliant processor, or you are not compliant, even if one of them is.

If you store card data yourself (which most small businesses should not do), you must undergo a PCI audit every year, which costs $1,000 to $5,000 or more. If you use a compliant gateway and processor, you avoid this cost because they store the data, not you.

Choosing between providers: what to compare

When evaluating a gateway and processor, create a spreadsheet and list these factors for each option:

• Transaction types you need: online only, in-person only, or both. Not all providers support all three.
• Total monthly cost: monthly fee plus your average per-transaction fee based on your sales volume. Multiply your average transaction amount by your monthly transaction count, multiply by the percentage fee, add the per-transaction fee, and add the monthly fee.
• Setup and integration: how long it takes to go live, whether you need a developer, and whether the provider charges for setup.
• Reporting and reconciliation: can you download transaction history, export to accounting software, and see disputes and chargebacks in real time.
• Customer support: phone, email, or chat; response time; and whether support is available during your business hours.
• Dispute and chargeback handling: does the provider help you respond to disputes, or do you handle it alone.

Do not choose based on marketing claims alone. Request a quote from at least two providers, calculate the total cost for a full year, and ask for references from businesses similar to yours.

Frequently Asked Questions

Can I use a gateway from one company and a processor from another?

Yes, but it requires more setup. Your gateway and processor must be compatible, meaning they must be able to communicate with each other. You will need a developer to integrate them, and you will pay setup fees to both companies. This approach is common for large retailers and restaurants but uncommon for small online businesses.

What is tokenization and why does it matter?

Tokenization is when the gateway replaces the customer's card number with a random code (a token) that only the processor can decode. If you store the token instead of the card number, you can charge the customer again later without asking for their card number again. This is how subscription billing and one-click checkout work. It also reduces your PCI compliance burden because you are not storing actual card numbers.

Why did a transaction go through but the customer says they were charged twice?

This usually happens when the customer clicks the submit button twice, or their browser refreshes before the transaction completes. The gateway and processor should prevent duplicate charges, but sometimes the customer's bank takes a few days to process both charges, making it look like two separate transactions. Have the customer contact their bank; the bank can usually reverse one charge within 24 hours. You can also check your processor's dashboard to confirm whether you received two payments or one.

What is the difference between a payment processor and a payment aggregator?

A payment aggregator (like PayPal or Square) is a single company that acts as both gateway and processor and holds your money in a pooled account with other businesses. A payment processor works with individual merchants and deposits money directly into your business bank account. Aggregators are simpler to set up but offer less control and transparency. Processors require more setup but give you direct access to your funds.

How long does it take for money to appear in my bank account after a customer pays?

This depends on your processor and your bank. Most processors deposit money within one to two business days. Some offer next-day deposits for an extra fee. Weekends and holidays add time. If you process a payment on Friday evening, it may not appear in your account until Tuesday morning. Check your processor's settlement schedule when you sign up.