You can build a payment gateway, but you will need a processor, a bank, and licenses you probably do not have yet

A payment gateway is the software that captures card data, encrypts it, and sends it to a processor for approval. You can write that code yourself or license it from a vendor. But the gateway is only one piece. To actually move money, you need a payment processor (the company that talks to banks and card networks), a merchant account (permission from a bank to accept payments), and compliance with PCI DSS (Payment Card Industry Data Security Standard). Building the gateway is the easy part. Getting licensed to handle money is the hard part.

Most people who ask this question are actually asking: "Can I avoid Stripe or Square and keep more of the transaction fee?" The answer is yes, but only if you are willing to spend months on compliance, hire a lawyer, and maintain security infrastructure that costs more than the fees you save. For most businesses, it is cheaper to use an existing processor.

Key Takeaways

  • Building the gateway software itself is possible, but you still need a payment processor and a merchant account to actually move money.
  • You must comply with PCI DSS, which requires annual audits, encryption, firewalls, and documented security procedures — not a one-time checkbox.
  • You need a bank willing to underwrite you as a merchant, which means proving your business model, your fraud controls, and your ability to handle chargebacks.
  • The total cost of compliance, legal review, and security infrastructure usually exceeds what you would save on processing fees for the first three to five years.
  • If you do build your own gateway, you still cannot avoid using a processor like Stripe Connect, Adyen, or a direct bank connection — you are just adding a layer on top.

What you actually need to build: the three layers

A payment system has three distinct layers, and you can only control one of them yourself. The first layer is the user interface — the form where a customer enters their card number. You can build this. The second layer is the gateway — the software that takes that data, validates it, encrypts it, and routes it. You can build this too. The third layer is the processor connection — the actual link to Visa, Mastercard, and the banking system. You cannot build this from scratch.

Most people who build their own gateway do not actually build a processor. They build a gateway that sits on top of an existing processor like Stripe, Adyen, or a direct bank API. This means you are writing custom code to manage the user experience and your own business logic, but you are still paying the processor's fee and still subject to their terms. You save nothing on fees. You gain only complexity and maintenance burden.

If you want to avoid paying a processor entirely, you need a direct bank connection. This means your bank gives you API access to their payment system, and you build everything else yourself. Only large businesses (usually $10 million+ annual volume) get this option, and only after proving they have in-house security expertise and compliance staff.

PCI DSS compliance: the real cost

PCI DSS is a set of 12 requirements that govern how you store, process, and transmit card data. It is not a law; it is a standard set by Visa, Mastercard, American Express, and Discover. But your bank will require it as a condition of your merchant account, and your processor will audit you for it. If you fail, you lose your ability to accept cards.

The requirements include: encrypting all card data in transit and at rest, maintaining a firewall, running regular security scans, limiting who can access card data, logging all access, training staff on security, and having a documented incident response plan. You must also pass an annual audit by a may have access to Security Assessor (QSA), which costs $5,000 to $15,000 per year depending on your transaction volume and system complexity. If your volume is very high, you may need a full on-site audit, which costs $20,000 to $50,000.

You also cannot store the full card number after the transaction completes. You can store the last four digits and the expiration date, but the full number must be deleted or tokenized (replaced with a unique code that only the processor can decode). This means you cannot build a simple database of customer cards. You need a tokenization service, which is usually provided by your processor or a third-party vault.

Getting a merchant account and underwriting

Before you can process any payments, a bank must agree to let you. This is called underwriting, and it is not automatic. The bank will ask for proof of your business, your processing history (if any), your fraud controls, and your chargeback rate. They will also ask what you sell, who your customers are, and whether you have any history of disputes or refunds.

If you are new to payment processing, the bank will likely require you to use a third-party processor as a middleman. This is because the bank does not want to take on the risk of your fraud or chargebacks directly. The processor acts as a buffer and handles the day-to-day compliance and dispute management. This is why Stripe and Square exist: they are the processor that banks trust, so you do not have to build that trust yourself.

If you have a direct bank connection, you are the processor. This means you are responsible for everything: fraud detection, chargeback management, customer disputes, and compliance. If your chargeback rate exceeds a certain threshold (usually 1% of transactions), the bank can terminate your account and freeze your funds. This is why only large, established businesses attempt this.

The actual cost of building versus using an existing processor

Let's say you process $1 million in transactions per year. Stripe charges 2.9% + $0.30 per transaction, which comes to roughly $29,300 per year. If you build your own gateway and use Stripe Connect (Stripe's API for custom interfaces), you still pay 2.9% + $0.30, so you save nothing on fees. You have only added engineering time and maintenance burden.

If you get a direct bank connection, you might negotiate a rate of 1.5% to 2%, which saves you $10,000 to $15,000 per year. But you have now added: a QSA audit ($5,000 to $15,000 per year), a security engineer to maintain your system ($80,000 to $150,000 per year), legal review of your terms and compliance procedures ($5,000 to $20,000 upfront), and the cost of building and maintaining the gateway software itself ($50,000 to $200,000 upfront, depending on complexity). Your break-even point is five to ten years, and only if nothing goes wrong.

If something does go wrong — a data breach, a spike in chargebacks, a regulatory audit — your costs spike immediately. A data breach can cost $100,000 to $1 million in forensics, notification, credit monitoring, and legal fees. A chargeback spike can result in account termination and frozen funds. A regulatory audit can result in fines or loss of your merchant account.

When building your own gateway actually makes sense

Building your own gateway makes sense only if one of these is true: you process more than $10 million per year and can negotiate a rate that saves you more than your compliance costs; you operate in a country or industry where existing processors do not operate or charge prohibitive rates; or you need a user experience that no existing processor offers and you are willing to pay for that customization.

Even then, you are usually not building a processor. You are building a gateway that sits on top of an existing processor or a direct bank connection. You are writing custom code for your specific business logic, not reimplementing the entire payment system.

If you are a SaaS company that needs to let your customers accept payments from their own customers, you might build a custom gateway using Stripe Connect or Adyen for Platforms. This lets you white-label the payment experience and take a cut of each transaction. But you are still using their processor; you are just customizing the interface.

The regulatory and legal layer you cannot skip

Beyond PCI DSS, you may also need to comply with other regulations depending on where you operate and what you sell. In the United States, you may need to register as a Money Services Business (MSB) in certain states if you are holding customer funds or acting as a payment processor. This requires state-by-state licensing, which can cost $1,000 to $10,000 per state and take several months.

You will also need terms of service that cover chargebacks, refunds, data privacy, and liability. You will need a privacy policy that explains how you handle card data. You will need to document your fraud detection and chargeback procedures. All of this requires a lawyer who understands payment law, which costs $5,000 to $20,000 for initial setup and $2,000 to $5,000 per year for ongoing review.

If you operate internationally, you may also need to comply with PSD2 (Payment Services Directive 2) in Europe, which has additional requirements around strong customer authentication and open banking. These regulations are constantly changing, and staying compliant requires ongoing legal review.

Frequently Asked Questions

Can I build a payment gateway without a processor?

No. A processor is the connection to the banking system and card networks. You can build the software that sits on top of a processor, but you cannot replace the processor itself unless you are a bank or have a direct bank connection, which requires $10 million+ annual volume and regulatory approval.

What if I just want to accept payments on my website without using Stripe?

You still need a processor. Your options are: use a different processor like Square, PayPal, or Adyen; get a direct bank connection (only available to large businesses); or use an open-source payment gateway like Magento or WooCommerce, which still connects to a processor behind the scenes. You cannot avoid the processor layer.

How much does PCI DSS compliance actually cost?

The annual audit costs $5,000 to $50,000 depending on your volume and system complexity. Add staff time to implement and maintain the security controls, which can be $20,000 to $100,000 per year depending on your team size. If you have a data breach, costs can reach $100,000 to $1 million.

Can I use an open-source payment gateway like OpenCart or Magento?

Yes, but they still require a processor. These platforms let you customize the user interface and business logic, but they still connect to Stripe, PayPal, or another processor to actually move money. You are not avoiding the processor; you are just choosing a different interface on top of it.

What happens if I process payments without a merchant account?

Your processor will eventually discover it and terminate your account. Your funds may be frozen for 180 days while they investigate. You may also face fines from your bank or the card networks. If you knowingly process payments without proper licensing, you may face criminal charges for operating as an unlicensed money transmitter.