Embedded payments are payment processing built directly into the software a business already uses, so customers pay inside the app instead of being bounced to an outside checkout. A dental scheduling tool collects the copay at booking. A property management platform pulls rent. A gym app charges the monthly membership. For the software company, embedding payments turns processing fees into a new revenue line; for the merchant using that software, it removes the hassle of running a separate payment stack alongside the business tools.
If you run a software platform and you’re weighing whether to add payments, the real questions are which integration model to use, what you’ll earn, and what you’re taking on in liability and compliance. Those answers follow.
How Embedded Payments Work
The mechanics are straightforward. APIs let the host software send transaction requests to a payment processor and receive responses in real time. SDKs give developers pre-built code for the hard parts: encrypting card data, handling authentication, formatting messages for the card networks. Middleware routes sensitive data between the pieces.
When a customer hits “Pay,” the software captures the card credentials and tokenizes them, replacing the card number with a surrogate value that is useless to anyone who intercepts it.1PCI Security Standards Council. PCI DSS Tokenization Guidelines The tokenized request moves to the card network, the issuing bank approves or declines, and an authorization code comes back. Clearing and settlement happen behind the scenes, with funds landing in the merchant’s account — often an account the platform itself manages.
Because the platform controls the whole lifecycle, transaction data lives in the same place as the invoice, the appointment, or the order. Reconciliation stops being a separate chore.
The Three Implementation Models
Platforms have three main ways to embed payments. Each one trades simplicity for control and revenue.
Referral Model
The lightest option sends merchants to a third-party payment provider. You earn a referral fee, but you don’t touch the money and you don’t carry compliance obligations. The payment experience is only loosely integrated into your software, and the revenue upside is capped. This is where most platforms start.
Payment Facilitator (PayFac) Model
A PayFac contracts with a sponsor acquirer — a bank or processor that holds a card-network license — and onboards merchants as sub-merchants under its own master account. Visa and Mastercard treat payment facilitators as third-party agents, requiring sponsorship and registration by an acquirer before onboarding can begin.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
You get control over pricing, the checkout experience, and how fast merchants come online. You also inherit real liability. The card networks treat a sub-merchant’s transactions as belonging to the PayFac’s acquirer, and the PayFac is responsible for fraudulent or unauthenticated transactions submitted by its sub-merchants.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
Banking-as-a-Service (BaaS) Model
The deepest route pairs your platform with a chartered bank through APIs. On top of card processing, you can offer deposit accounts, lending, corporate cards, or treasury products inside the same app. You don’t need your own banking license because the chartered partner supplies the regulatory infrastructure. You do need a close compliance relationship with that bank, and you need to understand the banking rules that now apply to your product.
How Platforms Make Money
Credit card processing fees charged to merchants generally run 1.5% to 3.5% of the transaction, plus a small flat fee. The platform doesn’t keep all of it. Interchange goes to the issuing bank and assessments go to Visa or Mastercard. What the platform keeps is the markup between the rate it charges the merchant and the underlying cost.
In a referral deal, that’s a one-time or recurring referral fee. As a PayFac or BaaS platform, you set the merchant-facing rate and keep the spread on every dollar flowing through your system. For platforms with real transaction volume, that spread can outgrow the core software subscription revenue. Some vertical SaaS companies now earn more from embedded payments than from their monthly software fees, which is why the embedded finance market has been growing above 30% annually.
What You’re on the Hook For
Handling money triggers a stack of federal and state obligations, and the compliance load is the main reason most platforms begin with the referral model before stepping up.
Federal Money Transmitter Registration
Any entity that owns or controls a money transmitting business must register with FinCEN, regardless of whether it holds a state license.3GovInfo. 31 USC 5330 – Registration of Money Transmitting Businesses Registration must happen within 180 days of the business being established and renews every two years.4FinCEN.gov. Money Services Business (MSB) Registration Failure to register carries a civil penalty of $5,000 per violation, and each day the violation continues counts as a separate offense.
Not every platform is a money transmitter. Federal regulations carve out an exception for entities acting as payment processors that facilitate purchases or bill payments through a clearance and settlement system by agreement with the seller.5eCFR. 31 CFR 1010.100 Whether the exemption fits depends on how you hold funds, who you contract with, and how long you control the money before settlement. Get a legal read on this before you build.
State Money Transmitter Licensing
Federal registration is only the start. Nearly every state requires its own money transmitter license. Montana is a notable exception that requires only a registration. States commonly ask for a surety bond, FBI fingerprint background checks, audited financials, and a minimum net worth. A platform going national may need licenses in 49 states plus Washington, D.C., a process that can take well over a year and run up substantial legal and compliance costs before you process a single transaction.
Anti-Money Laundering Programs
The Bank Secrecy Act requires money services businesses to maintain AML programs with four minimum components: internal policies and controls, a designated compliance officer, ongoing employee training, and an independent audit function.6FinCEN.gov. FinCEN Fact Sheet – AML/CFT Program Requirements Payment facilitators carry an added layer from the card networks. Visa requires PayFacs to collect and validate prospective sub-merchant information under KYC processes and applicable AML laws, and to screen applicants through the Visa Merchant Screening Service to catch prior terminations.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
PCI DSS Compliance
Any entity that stores, processes, or transmits cardholder data must comply with the Payment Card Industry Data Security Standard. Tokenization reduces the scope of that obligation but does not eliminate it.1PCI Security Standards Council. PCI DSS Tokenization Guidelines Validation depth tracks transaction volume. Payment facilitators processing more than 300,000 transactions annually must complete a full annual assessment and produce a Report on Compliance; smaller facilitators can use a Self-Assessment Questionnaire.7Mastercard. Mastercard Site Data Protection (SDP) Program and PCI
Chargebacks
Disputes follow the same card-network rules as any other transaction, with an extra link in the chain. The merchant of record is the liable party and the primary contact for resolving disputes.8Visa. Dispute Management Guidelines for Visa Merchants If a sub-merchant can’t cover a disputed amount because it lacks funds or has closed, the PayFac has to fund the resolution. If the PayFac can’t cover it, the acquirer absorbs the loss. Every step in the dispute cycle has a deadline, and missing one can trigger an automatic loss. Excessive dispute rates can bring network penalties or termination of processing privileges, so chargeback monitoring isn’t optional.
The 1099-K Question
Platforms that function as third-party settlement organizations (TPSOs) owe the IRS a report on merchant payment volumes. Under IRC Section 6050W, a TPSO must file Form 1099-K for any participating payee whose gross reportable transactions exceed $20,000 and whose total number of transactions exceeds 200 in a calendar year.9Office of the Law Revision Counsel. 26 USC 6050W – Returns Relating to Payments Made in Settlement of Payment Card and Third Party Network Transactions The One, Big, Beautiful Bill retroactively reinstated this threshold after a period of uncertainty following the American Rescue Plan Act’s attempt to lower it.10Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill
Whether the platform or the sponsor bank files depends on which entity qualifies as the TPSO: which one maintains accounts with the merchants, guarantees payment, and controls settlement standards. Internal accounts-payable departments and automated clearinghouses don’t qualify, so payments routed through those channels aren’t subject to this reporting.11Internal Revenue Service. Form 1099-K FAQs – Should My Organization Be Preparing, Filing and Furnishing Form 1099-K Sort this out with tax counsel early. It’s not a question you want to answer in January.
Where Embedded Payments Fit Best
Vertical SaaS platforms are the natural fit because they already own the workflow that produces the transaction. Dental practice management, property management, gym and salon software, invoicing tools in ERP systems — anywhere the software knows what’s owed and when, bringing payment inside closes the loop between the bill and the deposit.
Marketplaces lean on embedded payments to handle multi-party orders: splitting one customer payment across several sellers, calculating commissions, holding escrow where needed, and paying each seller on schedule. A generic payment gateway bolted to that workflow creates reconciliation problems that embedded processing is built to avoid.