Payment processors work by shuttling transaction data between the merchant’s point of sale, the card network, and the bank that issued the customer’s card, handling the authorization, clearing, and settlement steps that move money from buyer to seller. The full cycle finishes in one to three business days. Fees usually run 1.5% to 3.5% of each sale and get split among several parties along the way.
Who’s Involved in a Card Transaction
Every card sale pulls in at least six parties, each with a specific job.
The cardholder starts the transaction by tapping, dipping, or entering card details online. The issuing bank is the bank that gave that cardholder their credit or debit card, and it ultimately decides whether to approve the purchase based on available funds or credit.
On the other side, the merchant sells the goods or services. The acquiring bank, sometimes called the merchant’s bank, holds the merchant’s account and receives settlement funds on their behalf. Between these two banks sits the card network: Visa, Mastercard, Discover, or American Express. The network sets the rules, routes the data, and determines interchange rates.
The payment processor handles the actual technical routing. It sends authorization requests, manages batch submissions at end of day, and makes sure data reaches the right network. A payment gateway is the encrypted front door that captures card data at the terminal or checkout page and passes it on to the processor. In a brick-and-mortar store the gateway lives inside the card terminal; for an online business it’s built into the checkout software.
One party most merchants encounter but rarely think about is the independent sales organization, or ISO. An ISO is a third-party company authorized to sell and manage merchant accounts on behalf of processors and acquiring banks. ISOs handle onboarding, support, and compliance rather than the technical plumbing of moving money.
The Transaction Flow From Tap to Deposit
Authorization Happens in Under Two Seconds
When a customer taps or dips a card, the terminal captures the card number (or its tokenized substitute), the expiration date, and the purchase amount. The gateway encrypts the data and sends it to the payment processor, which routes the request to the correct card network. The network identifies the issuing bank and forwards the authorization request. The issuing bank checks the account for sufficient funds, screens the transaction against fraud patterns, and sends back an approval or denial code. The entire round trip takes less than two seconds.
An approval places a hold on the cardholder’s funds equal to the transaction amount. The money hasn’t actually moved yet. The hold simply reserves it so the cardholder can’t spend it elsewhere before settlement.
Clearing and Settlement Finish the Job
At the end of the business day, the merchant’s terminal or payment software sends all approved transactions as a batch to the acquiring bank. The acquiring bank passes those records through the card networks to each issuing bank for final processing. This step is called clearing. During clearing, the issuing bank transfers the funds, minus interchange fees, to the acquiring bank, which then deposits the net amount into the merchant’s account. Settlement generally takes one to three business days, longer when bank holidays fall in the middle.
Why Voids Are Cheaper Than Refunds
The gap between authorization and settlement matters more than most merchants realize. If you need to cancel a transaction, catching it before the batch closes is a void, and voids are far cheaper than refunds. A voided transaction never settles, so no interchange fees are charged, and the hold drops off the customer’s account within hours.
A refund works differently. It runs as a separate transaction after the original has already settled. The merchant still pays the original processing fees, and the customer waits three to five business days to see the money come back.
What Each Fee Actually Pays For
Interchange Goes to the Issuing Bank
Interchange is the single largest cost component, and it goes to the issuing bank as compensation for extending credit and absorbing fraud risk. Card networks publish updated interchange schedules twice a year, with rates varying by card type, transaction method, and merchant category.
As a rough frame, regulated debit cards carry interchange as low as 0.05% plus $0.21, while non-qualified premium credit cards can reach 3.15% plus $0.10 per transaction.1Visa. Visa USA Interchange Reimbursement Fees Rewards cards consistently carry higher interchange than standard cards because the issuing bank funds those points and cash-back programs through the fee.2Mastercard. Mastercard Interchange Rates and Fees
For debit cards issued by large banks, federal law caps interchange. Under Regulation II, the Durbin Amendment, issuers with $10 billion or more in assets cannot charge more than 21 cents plus 0.05% of the transaction value.3eCFR. 12 CFR 235.3 – Reasonable and Proportional Interchange Transaction Fees On a $50 debit purchase, that works out to about 23.5 cents, a fraction of what an equivalent credit card transaction would cost. Debit cards from smaller banks and credit unions are exempt from the cap, which is why their interchange rates are often higher.
Assessment Fees Go to the Network
Visa, Mastercard, and the other networks charge their own fees on top of interchange for access to their systems. These assessment fees are smaller, roughly 0.13% to 0.15% of total monthly processing volume, but they apply to every transaction and are completely non-negotiable. The networks set them, and neither the processor nor the merchant has any leverage to change them.
The Processor’s Markup Is Where You Have Leverage
The processor’s markup is the piece businesses can actually negotiate, and the pricing model you’re quoted determines how that markup behaves.
Interchange-plus pricing passes through the actual interchange cost and adds a fixed margin on top, such as interchange plus 0.20% and $0.10 per transaction. On a $100 sale where interchange is 2.00% plus $0.10, the total comes to $2.40. This model is the most transparent because the merchant sees exactly what the bank gets and what the processor keeps.
Flat-rate pricing is what aggregators like Square and Stripe offer. One blended rate applies regardless of card type. In-person transactions run roughly 2.6% to 2.99% plus a per-transaction fee, while online transactions range from about 2.9% to 3.49% plus a per-transaction fee. The structure is simple, but merchants with high volume overpay because the rate doesn’t drop as interchange costs decrease.
Tiered pricing groups transactions into “qualified,” “mid-qualified,” and “non-qualified” buckets at different rates. This is the least transparent model. The processor decides which transactions land in which tier, and the criteria are often vague. Most industry professionals steer clients away from tiered pricing because the non-qualified bucket quietly absorbs a large share of transactions at the highest rate.
Beyond the per-transaction cost, watch for ancillary fees that add up: monthly account fees, PCI compliance fees, batch processing fees, and statement fees. Some processors also impose monthly minimums. If your processing fees don’t reach a threshold, often $25 to $35, you pay the difference.
How Security Fits Into the Flow
When a customer inserts a chip card, the embedded EMV chip generates a one-time cryptographic code unique to that transaction. Even if someone intercepted the data mid-transit, the code can’t be reused for a second purchase. That’s fundamentally different from the old magnetic stripe, which transmitted the same static card number every time and made skimming trivially easy.
Contactless payments and mobile wallets add another layer through tokenization. Instead of transmitting the actual card number, called the primary account number, the system replaces it with a unique token that works only for that specific device, merchant, or transaction type. A stolen token is worthless anywhere else. EMVCo, the standards body behind these specifications, designed tokenization to remove the most valuable data a fraudster could capture from the transaction stream.4EMVCo. EMV Payment Tokenisation: What, Why and How
Merchants also bear responsibility for protecting stored card data under the Payment Card Industry Data Security Standard, or PCI DSS. Compliance requires completing a self-assessment questionnaire and meeting technical standards for how cardholder data is stored, transmitted, and accessed. Processors typically charge a monthly non-compliance fee, often $10 to $100, to merchants who haven’t validated their PCI status. Beyond the fees, a data breach caused by lax security can result in six-figure fines from the card networks.
Aggregator or Dedicated Merchant Account
Before processing a single transaction, every business faces one foundational choice: sign up with a payment aggregator, or open a dedicated merchant account. The decision affects fees, payout speed, and how much control you have when something goes wrong.
Aggregators such as Square, Stripe, and PayPal pool many merchants under a single master account. Setup takes minutes with minimal underwriting, just basic identity verification. You get flat-rate pricing and a fast start. The tradeoff is less control. Settlement timing, billing descriptors, fraud thresholds, and chargeback rules are all standardized. Because you share the master account with thousands of other businesses, a sudden spike in refunds or chargebacks can trigger an automatic hold on your funds with little warning.
Dedicated merchant accounts give the business its own unique merchant ID with an acquiring bank. Underwriting is deeper. The bank reviews your business model, processing history, average ticket size, and risk profile. In return, you get interchange-based pricing that’s usually cheaper at volume, customizable fraud filters, control over settlement cycles, and a direct banking relationship that’s harder to freeze arbitrarily.
For a new business processing under $10,000 a month, an aggregator’s simplicity usually wins. Once monthly volume consistently exceeds that range, the math starts favoring a dedicated account. The savings from interchange-plus pricing compound quickly, and the reduced risk of sudden holds becomes worth the slower onboarding.
Whichever path you choose, the fundamentals stay the same. Understand what each fee component actually pays for. Keep your chargeback ratio well below the levels that trigger monitoring. Maintain PCI compliance. And read the full contract before signing, especially the termination clause. The businesses that get burned by payment processing usually aren’t the ones that picked the wrong processor. They’re the ones who never understood the terms they agreed to.