A third-party payment processor is a company that handles electronic payment transactions on behalf of merchants, sitting between your business, the card networks like Visa and Mastercard, and the banks on both sides of every sale. Rather than building direct connections to every bank and network yourself, you contract with a processor to move payment data and funds through the financial system. Almost every business that accepts credit cards, debit cards, or electronic bank transfers relies on one, and the processor you choose affects your transaction fees, how fast revenue reaches your bank account, and what happens when something goes wrong.
Processor, Gateway, or Payment Facilitator?
People mix these terms up constantly, and the differences matter when you’re shopping.
A processor handles the core mechanics: routing transaction data between banks and card networks, running authorization checks, and moving funds during settlement. A payment gateway is narrower. It’s the secure digital tunnel that encrypts card data from a website checkout and passes it to the processor. Many processors bundle a gateway into their service, which is why the labels blur.
A payment facilitator, sometimes called a “payfac,” goes further than a traditional processor. Instead of each merchant getting its own bank-issued merchant account, a facilitator signs businesses up as sub-merchants under its own master account. Stripe, Square, and PayPal operate this way. A traditional processor, by contrast, typically helps you apply for and maintain your own standalone merchant account at a bank. Facilitators offer faster onboarding with less paperwork; traditional processor arrangements often give you more control over rates and account terms.
How a Card Payment Actually Moves
Every card payment passes through three stages before money lands in your account.
Authorization. When a customer taps, swipes, or enters card details online, the payment data is encrypted and sent to the processor. The processor routes the request through the appropriate card network to the cardholder’s bank (the issuing bank). That bank checks whether the cardholder has enough funds or available credit and screens for fraud. If everything looks clean, an approval code comes back through the same chain to your terminal or checkout page. The round trip takes a few seconds.
Clearing. Authorization doesn’t move money. It locks in a promise. At the end of the business day, you send a batch of approved transactions to the processor, which then facilitates the exchange of transaction details between your bank (the acquiring bank) and each cardholder’s issuing bank through the card network.
Settlement. The issuing banks transfer the actual funds, minus interchange fees, to the acquiring bank, which deposits the net amount into your account. For most businesses, settlement takes one to two business days after batching. Unusually large individual transactions, a spike in chargebacks, or irregular patterns flagged for manual review can stretch that timeline.
What You Need to Open an Account
Signing up with a processor requires the same core documentation you’d provide to open a business bank account, plus a few payment-specific details:
- An Employer Identification Number, or a Social Security Number if you’re a sole proprietor.1U.S. Small Business Administration. Open a Business Bank Account
- Formation documents such as Articles of Incorporation or an LLC operating agreement.1U.S. Small Business Administration. Open a Business Bank Account
- Routing and account numbers for the bank account that will receive settlement funds.
- A Merchant Category Code, the four-digit code that classifies your business type. The processor or card network assigns it, but you’ll describe your products or services accurately because the MCC affects your interchange rates and which card network rules apply.
- Beneficial ownership information. Financial institutions still collect ownership information for legal entity customers at account opening, even after a 2025 interim rule exempted domestic companies from filing separate reports with FinCEN. You’ll likely need to identify anyone who owns 25% or more of the business.2Federal Register. Beneficial Ownership Information Reporting Requirement Revision and Deadline Extension
Underwriting review runs from near-instant on aggregated platforms for low-risk businesses to several business days for higher-volume or higher-risk merchants applying for dedicated accounts. Once approved, you receive a Merchant ID and integration instructions, either hardware for in-person payments, API credentials for a website, or both.
How Processing Fees Are Structured
Processor pricing falls into two main models, and the gap between them widens as your volume grows.
Flat-rate pricing charges the same percentage on every transaction regardless of card type. A processor might charge 2.6% plus $0.10 per in-person swipe whether the customer uses a basic debit card (where the underlying interchange cost is around 0.5%) or a premium rewards credit card (where interchange runs closer to 2.4%). The appeal is predictability. The cost is that you overpay substantially on debit and simpler card types.
Interchange-plus pricing splits the bill into two visible pieces: the interchange fee set by Visa or Mastercard (which nobody can negotiate) and the processor’s markup on top. A typical structure looks like “interchange + 0.20% + $0.10.” Your effective rate fluctuates by card type, but the processor’s cut stays constant and visible. For a business doing enough volume to care about margins, interchange-plus almost always costs less overall because you’re not subsidizing rewards-card transactions with debit-card overpayments.
Beyond per-transaction fees, watch for recurring charges that can add up quietly:
- Monthly statement fee, roughly $7 to $10, sometimes waived for e-statements.
- Payment gateway fee, around $5 to $25 per month plus a small per-transaction charge if you use a third-party gateway.
- Monthly minimum fee, typically $5 to $25, charged when your processing volume falls below a threshold.
- Chargeback fee, generally $20 to $100 per disputed transaction. Some processors charge as little as $15; high-risk accounts pay more.
Chargebacks, Holds, and the MATCH List
p>Chargebacks are the single biggest operational headache for processors and the merchants they serve. When a cardholder disputes a charge, the issuing bank pulls funds back from you through the processor. Under the Fair Credit Billing Act, consumers have 60 days from the billing statement date to dispute a billing error with their card issuer. The issuer must acknowledge the dispute within 30 days and resolve it within two billing cycles, no more than 90 days.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors You get a chance to fight back with evidence, a process called representment, but even winning is expensive because the chargeback fee is typically non-refundable.
Account Holds and Rolling Reserves
Processors can freeze some or all of your funds when they detect elevated risk. Common triggers include an unusual spike in transaction volume, a sudden jump in average ticket size, a surge in chargebacks, or patterns inconsistent with your stated business model. For merchants classified as high-risk (industries like travel, digital services, supplements, or subscription businesses), the processor may require a rolling reserve from day one. A rolling reserve holds back a percentage of each day’s sales, often 5% to 10%, and releases the funds after a set period, usually 90 to 180 days. Particularly risky accounts can see holdbacks of 15% or more.
The MATCH List
The most severe consequence a processor can impose is terminating your account and adding your business to the MATCH system (Mastercard Alert to Control High-risk Merchants). This is essentially an industry-wide blacklist. Once listed, getting approved by another processor becomes extremely difficult. You can land on MATCH for exceeding chargeback thresholds (more than 1% of transactions in a single month totaling $5,000 or more), data security breaches, fraud, PCI non-compliance, or violations of card network rules. Records stay on MATCH for five years. This is where most small businesses discover, too late, that chargeback management isn’t optional.
PCI DSS Is Your Responsibility, Not the Processor’s
Any business that accepts, transmits, or stores cardholder data must comply with the Payment Card Industry Data Security Standard. Your processor doesn’t handle this for you. Requirements scale with transaction volume across four levels:
- Level 1: Over 6 million card transactions per year. Requires an annual on-site audit by a Qualified Security Assessor and quarterly network vulnerability scans.
- Level 2: 1 million to 6 million transactions per year. Requires an annual Self-Assessment Questionnaire, a Report on Compliance based on internal evaluation, and quarterly network scans.
- Level 3: 20,000 to 1 million transactions per year. Requires an annual Self-Assessment Questionnaire and quarterly network scans.
- Level 4: Fewer than 20,000 e-commerce transactions or up to 1 million total transactions per year. Requires an annual Self-Assessment Questionnaire and quarterly scans, but no formal Report on Compliance.
Most small businesses fall into Level 4 and need only complete the annual self-assessment. The problem is that many merchants never bother, and their processor starts adding a monthly PCI non-compliance fee, typically $20 to $30, sometimes considerably more. The questionnaire usually takes under an hour for a simple business, eliminates the fee, and forces you to think about whether you’re actually securing card data.
Contract Terms Worth Reading Before You Sign
The sign-up process is deliberately frictionless, which is why most merchants never read the service agreement. Two provisions cause the most surprise later.
Early termination fees. Some processors lock you into contracts of a year or longer and charge a flat fee, commonly around $300, for canceling early. Others calculate the penalty as a percentage of your projected annual processing volume, which can be substantially more expensive. Aggregated platforms like Square and Stripe generally operate month-to-month with no termination penalty, but traditional merchant account providers frequently include these clauses.
Auto-renewal clauses. Many processing contracts renew automatically for additional terms of one to three years unless you send a cancellation notice within a narrow window before the renewal date. Missing that window by a few days can lock you in for another full term. Before signing, check the contract length, the renewal terms, and the exact notice period required to opt out. These details matter more than the headline per-transaction rate for a business that might outgrow its processor or want to switch to better pricing.
Where Processors Sit in the Regulatory Framework
Processors are not typically classified as financial institutions or money services businesses under federal law. The Bank Secrecy Act’s definition of “money transmitter” explicitly excludes a person that acts as a payment processor to facilitate purchases through a clearance and settlement system by agreement with the seller.4eCFR. 31 CFR 1010.100 – General Definitions Processors therefore don’t directly bear the anti-money-laundering registration obligations that banks do.
In practice, they still perform substantial compliance work. The acquiring banks that sponsor them are fully subject to BSA requirements, and those banks contractually require their processors to conduct merchant due diligence, screen transactions, and keep records. Processors handling ACH transactions, meaning direct bank-to-bank transfers like payroll deposits and recurring bill payments, must also follow NACHA operating rules governing how electronic payments are initiated, formatted, and settled.5Nacha. 2026 Nacha Operating Rules and Guidelines One boundary worth noting: the Electronic Fund Transfer Act’s Regulation E primarily governs financial institutions that hold consumer accounts, so a processor that doesn’t hold consumer accounts and works through an acquiring bank generally isn’t subject to Regulation E’s full requirements when serving your business.6eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)