What Is a Payment Gateway? Gateway, PSP, Acquirer and Aggregator (2026)

A payment gateway is the technical service that captures payment details from a checkout or a terminal, encrypts them and sends them to an acquirer or processor for authorization, then returns the answer to the merchant. It moves data, not money: a pure gateway does not hold funds or sign merchants for acquiring.

In 2026 the word is used loosely. Many PSPs call their API a gateway, acquirers bundle one with every merchant account, and orchestration platforms sit on top of several. For PSPs, PayFacs, ISOs and ISVs, knowing exactly which role a provider plays decides who is licensed, who carries risk and who owns the merchant relationship.

What is a payment gateway?

A payment gateway is the entry point of a payment into the card and banking networks. It collects the payment data, secures it, formats it for the next party and relays the response. European law gives the clearest boundary: PSD2, Directive (EU) 2015/2366, excludes from its scope technical service providers that support the provision of payment services without entering at any time into possession of the funds to be transferred. A gateway that only transmits and processes data falls on that side of the line. One that receives settlement funds does not.

The card schemes draw a similar line. In its paper on acceptance entities beyond the acquirer, dated February 2024, Visa lists the third parties that may operate between a merchant and an acquirer, and notes that ISOs may sell or resell gateway services alongside the acquirer’s merchant account. Related roles:

• Acquirer: the licensed scheme member that contracts with merchants, or with PayFacs, and settles card payments to them.
• PSP: a payment service provider that sells acceptance as a package, usually gateway plus acquiring, its own or a partner’s, and often collects funds.
• Aggregator: a provider that accepts payments for many merchants under its own acquiring relationship. The schemes call it a payment facilitator.
• ISO: an independent sales organization, registered with the schemes by an acquirer, that sells the acquirer’s services.
• Introducer: a referral partner that passes leads to an acquirer or PSP for a commission and takes no part in contracting or processing.

Gateways come in three technical shapes. A hosted gateway shows its own payment page or fields, so card data never reaches the merchant’s servers. An API gateway receives card data from the merchant’s own form, which gives more control and a wider PCI DSS scope. A terminal gateway connects in-store devices to acquirers, for card-present payments. Most providers now offer all three behind one account.

Our episode who’s who in payments maps these players in more detail.

Gateway vs PSP vs acquirer vs aggregator: what is the difference?

The four differ on three questions: who moves the data, who holds the merchant contract and who touches the money.

• Gateway: moves data. No acquiring contract with the merchant, no funds. The merchant needs a separate merchant account with an acquirer.
• Acquirer: holds the acquiring contract, receives funds from the schemes and settles the merchant. It is liable to the schemes for its merchants, and its price is the merchant discount rate.
• PSP: combines a gateway with acquiring, either as an acquirer itself or through partner acquirers, and adds payment methods, reporting and risk tools.
• Aggregator or PayFac: signs sub-merchants under its own master account, on behalf of an acquirer, and receives their settlement funds before paying them out.
• ISO: sells and services on behalf of an acquirer. The merchant’s contract is with the acquirer, and the ISO does not receive settlement funds.
• Introducer: refers merchants and steps back. It is not part of the payment flow.

One company can play several of these roles at once, and the same company can play different roles in different countries: acquirer where it holds a license, gateway to a partner acquirer elsewhere. What counts for a merchant, and for a regulator, is the role played in a given contract, not the label on the website.

The comparison between the two resale models is developed in PayFac vs ISO. A newer layer sits above all of them: payment orchestration, which connects one checkout to several gateways, PSPs and acquirers and decides where each payment goes.

How does a payment gateway work?

A gateway handles the first and last steps of every payment, in a few hundred milliseconds.

1. Capture: the shopper enters card details in hosted fields, a hosted payment page or a mobile SDK, or presents a card to a terminal connected to the gateway.
2. Protection: the gateway encrypts the data and usually replaces the card number with a token, so the merchant’s systems never store it.
3. Checks: it runs fraud screening and, where required, starts 3-D Secure authentication with the issuer.
4. Formatting and routing: it builds the authorization message in the format expected by the acquirer or processor, and sends it there. With several acquirers connected, routing rules choose one, often from the card’s BIN.
5. Acquirer to scheme to issuer: the acquirer forwards the request to the card network, which passes it to the issuer. The issuer approves or declines.
6. Response: the answer travels back through the same chain. The gateway translates the acquirer’s response code and informs the merchant’s system, by API response and by webhook.
7. Follow-up operations: captures, voids and refunds are sent through the gateway as well. Settlement and payout are done by the acquirer or the PSP, outside the gateway.

The gateway is also where a payment gets its technical identity: references, status history and the data later used for reconciliation and disputes.

Payment gateways in numbers (2026)

Gateways are rarely measured on their own, but the rules and markets around them are well documented.

• March 31, 2025: date on which the future-dated requirements of PCI DSS v4 became mandatory. The PCI Security Standards Council confirmed that the limited revision v4.0.1, published in June 2024, did not change it. Any gateway that stores, processes or transmits card data must comply. PayFacs can start with our PCI DSS v4.0 compliance guide.
• $5,000: Visa’s initial registration and annual renewal fee for third-party agents in the ISO and PSP categories, per region, in its third-party agent registration overview.
• ₹15 crore, then ₹25 crore: minimum net worth for a payment aggregator in India at application and by the end of the third financial year after authorization, under the Reserve Bank of India’s Master Direction of September 15, 2025.
• 6 million and $3.7 trillion: merchant locations served and payment volume handled by Global Payments after it completed its acquisition of Worldpay on January 12, 2026, according to its filing with the SEC.
• 65%: share of US small businesses that use the payments built into their business software, in an embedded payments survey run in early 2026.

What are the risks and limits of a payment gateway?

A gateway is a narrow role, and most of its risks come from expecting more of it than it does.

• Single point of failure: with one gateway and one acquirer behind it, an outage stops all sales. Redundancy has to be designed in, which is the role of payment fallback.
• Lock-in: tokens stored in a gateway’s vault do not move easily. Changing provider can mean asking every customer for card details again, unless token migration is planned from the start.
• Security scope: the gateway carries card data, so it is a prime target and sits fully inside PCI DSS scope. Merchants and platforms that use hosted fields reduce their own scope, not the gateway’s.
• Role confusion: a “gateway” that starts to receive merchant funds becomes a payment institution or a payment facilitator, with licensing, safeguarding and scheme registration duties.
• Thin data: some gateways return only an approval or a decline. Without detailed response codes, fees and settlement data, operators cannot optimize or reconcile.
• Limited coverage: a gateway built around one acquirer rarely supports local payment methods or acquirers in new markets.

None of these limits is a reason to avoid gateways. They are reasons to ask, before signing, what the gateway connects to, what data it returns and what happens to stored credentials at the end of the contract.

Payment gateways: what changes for PSPs, PayFacs and platforms

For an operator, the gateway is no longer a product bought from someone else. It is the layer where its own brand, data and partners meet.

Brand and merchant relationship

A PSP, an ISO or a software platform can offer a gateway under its own name without building one. White-label infrastructure provides the API, the payment pages, the back office and the connections, and the operator keeps its merchants and its pricing. NORBr is built for this model: its Payment Platform Builder lets an operator configure a branded payment platform, which is the basis for launching a new branded PSP. The trade-offs against an in-house build are set out in build or buy a payment infrastructure. The #TheShot episode Own the checkout. Own the revenue. makes the same point from the field.

Onboarding and status

The role decides the paperwork. A referral partner needs a contract with its acquirer. An ISO needs scheme registration through its sponsor. A PayFac needs its own underwriting, monitoring and funds flow. Software platforms often climb these steps one at a time, a path described in embedded payments: from referral to PayFac and told first-hand in the #TheShot episode From partner to PayFac: the real journey. In India, the same progression is written into regulation, as the guide to payment methods in India shows.

Routing and acquirer choice

A gateway tied to one acquirer leaves no room to route. Operators that practice multi-acquiring and connect several payment methods behind one integration can route each payment to the partner best suited to it and keep selling during an outage. In NORBr, these connections come from the connector catalog, and merchants see one API whatever sits behind it.

Reconciliation and data

Because the gateway sees every request and response, it is the natural place to normalize data from different providers. Operators should expect transaction-level detail, consistent statuses and exports that match settlement files.

Responsibilities

Some operators want the merchant relationship and the revenue, but not the regulated activity. Models where licensed partners hold the acquiring and the funds, while the operator runs the platform, are the idea behind payments without the PSP burden.

For a market-level view, the Payments Library lists Merchant Acquiring Industry Dynamics. The #TheShot episode why enterprises still rely on PSPs and acquirers explains why these roles persist.

Is a standalone payment gateway still worth it in 2026?

As a product bought on its own, less and less. As a layer an operator controls, more than ever. By player:

• PSPs: the gateway is their product surface. Owning it under their brand, with several acquirers behind it, protects margins and merchants.
• PayFacs: they need gateway, onboarding and funds flow to work as one system. A separate gateway adds a seam.
• ISOs: reselling a branded gateway with the acquirer’s account turns a sales role into a technology relationship.
• ISVs and platforms: an embedded gateway is the first step toward payment revenue, before any licensing question arises.

A payment gateway carries the message and never the money, and knowing where that line sits tells an operator which licenses, risks and revenues come with the role it wants to play.