To build a payment gateway, you need three things:
A tokenized card-capture and API layer
PCI DSS validation as a service provider
A signed contract with an acquirer or processor that connects you to the card networks.
For most companies, integrating an existing payment service provider (PSP) is faster and cheaper.
Building your own pays off only at high volume, or when you need control a PSP won't give you.
By Moiz Lashkaria, Founder of Mind Stack Labs
TL;DR
Building a gateway makes you a PCI DSS service provider, which means a far heavier audit than a merchant's short questionnaire.
Your acquirer contract sets your launch date and cash flow more than your code does.
Public cost estimates range from low six figures to millions because they price different scopes. Use the formula in the cost section below.
Hosted fields plus tokenization keep raw card numbers off your servers and shrink your PCI scope.
Most teams should integrate first, add orchestration second, and build a full gateway last.
Could you sign an acquirer contract, pass a PCI assessment and ship a card API in the next 90 days?
Me neither. Here is why.
I have scoped 35+ payment integrations over 6 years. One lesson from those builds keeps coming back.
On our Tamara hosted-checkout build in FlutterFlow, the payment screen was the easy part.
The hard part was keeping app state in sync through webhooks and stopping duplicate transactions.
This guide covers how to build a payment gateway in the order the real blockers show up: the decision, the roles, the parts, PCI scope, the bank contract, the build and the cost.
Should You Build a Payment Gateway or Integrate One?
Integrate unless at least three of the five conditions below are true for you.
Building a gateway is a compliance and banking project with software attached.
Build only if:
You process enough card volume that saving a fraction of a percent pays for a compliance team.
You need routing across several acquirers, or local payment methods your PSP doesn't support.
You plan to process payments for other merchants, as a platform or a payment facilitator.
You have, or will hire, people who own security and compliance full time.
Your runway can absorb many months before the first live transaction.
Build, integrate, white-label or orchestrate
These time ranges are my planning estimates, not guarantees.
Path | What you own | PCI burden | Time to first live payment | Best for |
|---|---|---|---|---|
PSP integration (hosted checkout or hosted fields) | Checkout UX, order logic | Lowest, often SAQ A for the merchant | Days to weeks | Most ecommerce and SaaS |
Embedded payments or PayFac-as-a-service | Sub-merchant onboarding UX | Shared with the provider | Weeks to a few months | Platforms and marketplaces |
White-label gateway | Brand, pricing, merchant relationships | Provider carries most of it | One to three months | Agencies and resellers |
Orchestration layer over PSPs | Routing, retries, reporting | Medium | Two to four months | Multi-PSP and multi-region businesses |
Full custom gateway | Everything | Service provider Level 1 or 2 | Often a year or more | High-volume payment companies |
If you want X, go with Y
If you want to accept cards on your website, go with a PSP plugin or hosted fields. Our team sets up WooCommerce stores with Stripe, PayPal or Razorpay without the store ever touching card data.
If you meant "how to set up a payment gateway in Shopify," you don't build anything. You turn on Shopify Payments or an approved provider in your store's payment settings.
If you run a marketplace that pays out sellers, go with embedded payments before you consider becoming a PayFac.
If you sell across regions with local methods, go with orchestration over two or more PSPs.
If payments are your product, build. Read the PCI and acquirer sections twice first.
Gateway, Processor, Acquirer and PayFac: Who Does What
A payment gateway moves and protects transaction data. It doesn't move money.
Money moves through the acquirer, the card network and the issuer.
Role | Job in one line |
|---|---|
Issuer | The customer's bank. Approves or declines the charge |
Card network | Visa, Mastercard and others. Routes messages and sets the rules |
Acquirer | The merchant's bank. Settles funds and carries merchant risk |
Processor | Runs the technical link between the acquirer and the networks |
Gateway | Captures card data, encrypts or tokenizes it, sends the authorization request |
PSP | Bundles gateway, processing and merchant account into one product |
PayFac | Onboards sub-merchants under its own master merchant account |
How one card payment flows
→ Customer enters card = gateway tokenizes it
→ Gateway sends authorization = processor forwards it to the card network
→ Network asks the issuer = approve or decline returns in the same chain
→ Batch settlement later = acquirer pays the merchant, minus fees
How to build a payment processor, or a payment processing company
A processor is a different project from a gateway. To become one, you need either card network membership or a sponsor bank, plus settlement infrastructure.
What Is a Payment Gateway Made Of?
A working gateway has eight parts, and the API is the smallest of them. Every part below has a failure mode that shows up in production, not in the demo.
Component | Job | What breaks if you skip it |
|---|---|---|
Hosted fields or checkout | Capture card data in an isolated frame | Your whole web stack enters PCI scope |
API layer with idempotency keys | Accept charge, capture, refund and void requests safely | Retries create double charges |
Token vault with HSM-backed keys | Swap card numbers for tokens | Raw card numbers sit in your database |
Fraud and risk engine | Score transactions, trigger 3-D Secure | Chargebacks climb, and the acquirer notices |
Ledger | Record every money movement as an immutable entry | Nobody can explain a balance |
Reconciliation jobs | Match your ledger to acquirer settlement files | Missing money goes unnoticed for weeks |
Webhooks | Notify merchants of status changes | Merchants poll your API, or miss events |
Merchant dashboard | Refunds, disputes, payouts, reports | Support tickets replace self-service |
Supporting multiple currencies
Multi-currency means separating the currency the customer pays in from the currency the merchant gets settled in.
Store amounts in minor units (cents, paise) with a currency code, never as floats.
Decide who carries the FX risk: you, the acquirer or the merchant.
Check that your acquirer can settle in each currency you advertise.
For the API layer, our Node.js backend builds treat idempotency and auth as day-one requirements. Our API security checklist for startups covers the basics every payment endpoint needs.
PCI DSS Scope: What You Are on the Hook For
Building a gateway makes you a PCI DSS service provider.
You validate against all applicable requirements, not the short self-assessment a merchant fills in.
PCI DSS v4.0.1, published by the PCI Security Standards Council in June 2024, is the current version.
The future-dated v4.0 requirements became mandatory on 31 March 2025. Any gateway designed today has to meet both.
Service provider levels
Level | Annual card transactions | Validation |
|---|---|---|
Level 1 | More than 300,000 | Annual Report on Compliance (ROC) by a QSA |
Level 2 | Fewer than 300,000 | Annual SAQ D for service providers |
Both | All volumes | Quarterly ASV scans, penetration testing, Attestation of Compliance (AOC) |
The thresholds come from SecurityMetrics' summary of service provider levels. Card brands set the exact rules, so confirm your level with your acquirer.
How to shrink your scope
→ Hosted fields from a certified vault = card data never touches your servers
→ Tokenization at the edge = your database stores tokens, not card numbers
→ Network segmentation = fewer systems inside the cardholder data environment (CDE)
→ Short data retention = less to protect, less to audit
Pro tip: Draw your CDE boundary on the architecture diagram before anyone writes code.
Wait, you might be thinking: "Can't we use a third-party vault and skip PCI?"
No. A vault cuts your scope sharply, but if your systems transmit card data or can affect its security, you still validate as a service provider. The audit gets smaller. It doesn't go away.
Other US requirements
Card network registration: your sponsoring acquirer usually registers you with Visa and Mastercard as a third-party agent or service provider.
Money transmission: if you hold or move merchant funds, you may need state money transmitter licences and FinCEN MSB registration. A gateway that only routes data often doesn't. Ask counsel.
KYC and AML: if you onboard merchants, you verify them. Our Flutter multipart upload guide covers the document-upload side of KYC flows.
Outside the US
In the UK and EU, PSD2 strong customer authentication means building 3-D Secure 2 into the checkout flow, not adding it later.
Acquirer Contracts: How a Gateway Connects to the Card Networks
Your acquirer contract decides your cash flow and launch date more than your code does. Read these terms before you sign.
Term | What it means | What to push for |
|---|---|---|
Rolling reserve | The acquirer holds a share of your settlements for a set period | A lower percentage and a review date to reduce it |
Settlement timing | How many days until funds land | Written timing per currency |
Chargeback liability | Who pays when merchants can't cover disputes | Clear limits and notice periods |
Volume minimums | Fees if you miss the committed volume | A ramp period for year one |
Exclusivity | Whether you can add a second acquirer | No exclusivity, or a short term |
Termination | Exit terms and MATCH list exposure | Cure periods before termination |
Pricing model | Interchange-plus or blended | Interchange-plus, for transparency |
Technical certification | The acquirer's spec, often ISO 8583 or a JSON API | Sandbox access and a named certification contact |
Underwriting time: the part your dev team doesn't control
In the projects I plan, underwriting and certification take weeks and sometimes months. The bank reviews your financials, your compliance plan and your merchant risk policy.
Start the bank conversation before sprint one.
Direct acquirer connection vs processor connection
Option | Upside | Downside |
|---|---|---|
Direct to acquirer | Lower fees at scale, more control | Long certification, one integration per acquirer |
Through a processor | Faster, one API, several acquirers | Extra margin, less control over routing |
How to Build a Payment Gateway, Step by Step
Seven steps, and three of them depend on people outside your team. Plan the calendar around those three.
Step 1: Scope the compliance path
Pick your path from the decision table above.
Estimate your service provider level from projected volume.
Shortlist acquirers and processors.
Step 2: Design the architecture
Draw the CDE boundary first.
Choose vault, HSM and key-management options.
Set API selection criteria: idempotency support, webhook signing, sandbox quality.
Step 3: Choose the stack and hosting
Java, Go, Kotlin or C# are common for ledgers. Node.js works well for the API and orchestration layer, as long as you use decimal-safe money handling.
AWS, Google Cloud and Azure publish PCI DSS attestations for in-scope services. You still own your side of the shared responsibility.
Step 4: Build the core flows
Authorize, capture, void, refund and partial refund.
Signed webhooks with retries.
Ledger entries for every state change.
Get the auth model right before you write payment code. Our posts on authentication vs authorization and JWT authentication mistakes cover the usual traps.
Step 5: Test security and certify
Penetration testing, ASV scans and a QSA assessment.
Acquirer certification test scripts.
Step 6: Pilot with live cards
Start with low volume and a handful of merchants.
Reconcile every day by hand until the jobs match.
Step 7: Run it
Uptime monitoring, alerting and incident runbooks.
Annual PCI revalidation and quarterly scans.
Timeline: who controls each phase
The ranges below are planning estimates. Replace them with your team's numbers.
Phase | Who controls it | Planning range |
|---|---|---|
Scoping and architecture | Your team | 1 to 2 months |
Acquirer underwriting | Third party | Weeks to months |
Core build | Your team | 4 to 8 months |
QSA assessment and certification | Third party | Several weeks |
Pilot | Shared | 1 to 2 months |
How Much Does It Cost to Build a Payment Gateway?
Public estimates disagree, from low six figures to several million. Each one prices a different scope. Use a formula instead of a headline number.
The build-cost formula
Build cost = engineers × months × blended monthly rate + compliance + infrastructure + acquirer onboarding
Here is a worked example. Every input is an assumption, so swap in your own quotes:
6 engineers × 8 months × $10,000 per engineer-month = $480,000 for engineering
Cost by scenario
Scenario | Main cost drivers | Relative cost |
|---|---|---|
PSP integration | Checkout UI, webhooks, order sync | Lowest |
White-label or embedded payments | Onboarding UX, provider fees | Low to medium |
Orchestration over PSPs | Routing logic, vault, reporting | Medium |
Full gateway on a processor | Full build, service provider PCI validation | High |
Full gateway with direct acquirer links | All of the above, plus per-acquirer certification | Highest |
What you pay after launch
Annual PCI revalidation and quarterly scans.
On-call engineering and security staff.
HSM and infrastructure costs.
Fraud tooling and chargeback operations.
Break-even math
Years to break even = build cost ÷ (annual card volume × fee saving − annual run cost)
Worked example, with assumptions only:
$100M annual volume × 0.3% saving = $300,000 a year
Minus $200,000 a year in run costs = $100,000 a year net
$480,000 ÷ $100,000 = 4.8 years
Run that math before the architecture diagram.
Is Payment Orchestration the Smarter Middle Path?
For many growing businesses, yes. An orchestration layer sits above two or more PSPs and gives you routing, failover and one reporting view, without your own acquirer contracts.
→ PSP outage = traffic fails over to the second provider
→ Regional pricing gap = route by card country
→ Lower PCI load = the PSPs keep handling raw card data
It is the step I'd take before a full build, and it shows you whether the build math ever works.
Mistakes Teams Make When Building a Payment Gateway
Most failures come from sequencing, not code.
Scoping PCI after the architecture is set. → Rework = months
Calling the bank after the build. → Finished code with nowhere to send it
Storing raw card numbers "just for now." That's the payments version of temporary code: it lives forever, until an auditor finds it.
Skipping idempotency. → Network retry = double charge
Treating fraud as a phase-two feature. → Chargeback ratio rises = acquirer review
Pro tip: Add a reconciliation report to sprint one. It surfaces ledger bugs months earlier.
How Mind Stack Labs Approaches Payment Builds
We build the product layer around payments, and we scope before we build. We don't hold card network registrations or PCI service provider status, and we say so upfront.
What we build:
PSP integrations: Stripe, PayPal, Razorpay, Apple Pay and local gateways for ecommerce websites and WooCommerce stores.
Hosted checkout with webhooks: our Tamara integration in FlutterFlow used sandbox and production environments, webhook status sync and duplicate-transaction protection.
Billing and invoicing products, such as Invoice Factory and SutraPlus.
Merchant dashboards and admin panels, through our business dashboards work.
How we work on payment projects:
We design to PCI DSS scope-reduction patterns: hosted fields, tokenization and no raw card storage.
We map the build-vs-integrate decision before quoting.
We integrate with your chosen PSP, processor or orchestration provider through our API integration services.
Payment Gateway FAQs
1. Can you build your own payment gateway without being a bank?
Yes. You partner with an acquirer or processor that connects you to the card networks. You still need PCI DSS validation as a service provider, and possibly money transmitter licences if you hold funds.
2. Payment gateway vs payment processor: which one do I need to build?
Most companies only need a gateway, or just a PSP integration. A processor needs network membership or a sponsor bank and settlement infrastructure, which is a much larger project.
3. How long does it take to build a payment gateway?
A PSP integration takes days to weeks. A full gateway often takes a year or more, mostly because acquirer underwriting and PCI assessment run on other people's calendars.
4. Do I need PCI DSS certification to build a payment gateway?
Yes. As a service provider, you validate through a QSA-led ROC at Level 1, or SAQ D at Level 2. Hosted fields and tokenization shrink the scope but don't remove it.
5. Is there a free payment gateway?
Some providers charge no setup or monthly fee, but every one charges per transaction. "Free" usually means free to start, not free to run.
My Recommendation
Start with a PSP integration using hosted fields. Add an orchestration layer when you need multi-provider routing.
Build a full gateway only when two things are true: the break-even math clears your payback target, and a sponsor acquirer has said yes in writing.
Your next step:
Run the break-even formula with your real volume.
List the PCI scope of your current checkout.
Read our guide to choosing an ecommerce development company, or book a scoping call and we'll pressure-test the numbers with you.
Building payments already? Tell us in the comments which of these steps took longest for you.
