What it takes to become a payment gateway provider
Becoming a payment gateway means building or licensing software that sits between a merchant's checkout and the banks that actually move money. You are not processing payments yourself — you are the middleman that routes transactions, checks fraud signals, handles declines, and reports what happened. To do this legally, you need a money transmitter license in most U.S. states, a relationship with at least one acquiring bank, and compliance with payment card industry rules that govern how you store and handle card data.
The barrier is not technical skill alone. It is regulatory approval, capital reserves, and the trust of banks willing to sponsor you. A bank will not work with you without proof you can handle disputes, chargebacks, and fraud losses. You will also need cyber insurance, a compliance officer, and systems that pass third-party security audits. Most people who start payment gateways either have banking experience already or partner with someone who does.
Key Takeaways
- Money transmitter licenses are required in most states and take three to six months to obtain; you must apply to each state separately, and some states have no licensing regime at all.
- You need a sponsoring bank or acquiring processor willing to underwrite your business; they will require proof of capital, compliance systems, and fraud controls before they sign.
- PCI DSS compliance is mandatory if you touch card data, and third-party audits cost thousands of dollars annually; most gateways avoid this by using tokenization or never storing raw card numbers.
- Your first customers will be small merchants or niche verticals where existing gateways are expensive or unavailable, not Stripe's market.
- Startup capital ranges from $500,000 to $2 million depending on whether you build from scratch or license existing software.
Money transmitter licensing by state
A money transmitter license is a state-level permit that says you are allowed to move money on behalf of others. Most states require one; a few do not. The process is not centralized — you apply to each state's financial regulator separately, and each has different forms, fees, and waiting periods.
States that require licensing include California, New York, Texas, Florida, Illinois, and Pennsylvania. New York's BitLicense framework also covers digital assets and is notoriously strict. States like Wyoming and South Dakota have lighter regimes or exemptions for certain types of payment activity. You will need to research each state where you plan to operate or where your merchants are located. Most regulators require proof of net worth (often $250,000 to $500,000), a detailed compliance plan, background checks on owners, and sometimes a surety bond.
The timeline is typically three to six months per state, though New York can take a year or longer. During this period, you cannot legally accept merchant funds or process transactions. Many startups begin with a single state or a handful of states with lighter requirements, then expand as they grow.
Finding a sponsoring bank or acquiring processor
You cannot process card payments without a bank or processor behind you. This entity is called your sponsor or acquirer. They hold the merchant account, manage the settlement, and absorb certain fraud losses. They also decide whether to work with you at all.
Banks and processors evaluate new gateways based on your team's experience, your compliance infrastructure, your fraud controls, and your capital. They want to know: Can you detect fraud? Can you handle chargebacks? Will you go out of business and leave them holding bad debt? If you have banking or payments experience, this conversation is easier. If you do not, you may need to hire someone who does or partner with a co-founder in the industry.
The sponsor relationship is contractual and can be terminated. They set your interchange rates, chargeback thresholds, and reserve requirements. If your chargeback rate exceeds their tolerance (often 1 percent), they can shut you down. This is why fraud prevention and customer service matter from day one — not just for your merchants, but for your sponsor's risk appetite.
PCI DSS compliance and data security
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that govern how you handle card data. If you store, process, or transmit raw card numbers, you must comply. Compliance requires annual audits by a may have access to security assessor, encryption of data in transit and at rest, network segmentation, access controls, and incident response plans. The cost is $5,000 to $20,000 per year depending on your volume and complexity.
Most new gateways avoid this by using tokenization: the merchant's system never sees the card number. Instead, the customer enters it into a hosted form or iframe that you control, you tokenize it (replace it with a unique identifier), and you store only the token. The card number goes directly to your sponsor or a third-party tokenization service. This keeps you out of scope for the strictest PCI requirements.
Even with tokenization, you must still comply with PCI's network security rules, maintain audit logs, and pass annual assessments. Cyber insurance is not optional — it covers breach costs, notification, and liability. Budget $10,000 to $30,000 per year for insurance depending on your transaction volume.
Building or licensing the software
You have two paths: build your own gateway software or license an existing platform and white-label it. Building from scratch takes 12 to 24 months and costs $500,000 to $1.5 million. You need engineers who understand payment flows, fraud detection, reconciliation, and API design. You also need to integrate with your sponsor's systems, card networks, and third-party services like fraud tools and settlement platforms.
Licensing an existing platform is faster and cheaper. Companies like Spreedly, Adyen, or Worldpay offer APIs and white-label solutions that let you rebrand their gateway and sell it to merchants. You pay a per-transaction fee or monthly license fee, and they handle the core processing. This route costs $100,000 to $500,000 upfront and lets you launch in 3 to 6 months. The tradeoff is that you cannot differentiate on technology — you are competing on customer service, pricing, and vertical expertise.
Either way, your software must integrate with your sponsor's systems, handle real-time authorization, manage declines and retries, produce settlement reports, and provide merchants with a dashboard. You also need webhooks and APIs so merchants can build on top of you.
Finding your first merchants and market niche
You will not compete with Stripe or Square on price or features. Instead, you target merchants that existing gateways ignore or overcharge: high-risk verticals like cannabis, adult content, or gambling; international merchants with limited options; or niche industries like fitness studios or SaaS platforms that need specific integrations.
Your first customers will come from your network, industry events, or partnerships with software platforms that serve your niche. A fitness studio management system, for example, might integrate your gateway as a payment option for their users. You offer them a better rate or custom features, and they bring you hundreds of merchants at once.
Pricing matters, but so does support. Stripe's support is notoriously slow for small merchants. If you answer the phone and solve problems in hours instead of days, merchants will switch. Build your reputation on reliability and responsiveness, not on undercutting Stripe's rates by 0.1 percent.
Capital, reserves, and ongoing costs
You need capital for licensing, compliance, insurance, and operations before you process your first dollar. Most regulators require proof of net worth or liquid reserves. Your sponsor will also require you to hold a reserve — money set aside to cover chargebacks and fraud losses. This reserve is typically 1 to 5 percent of your monthly transaction volume, held in a dedicated account you cannot touch.
Ongoing costs include your sponsor's fees (usually 0.1 to 0.3 percent of volume plus per-transaction fees), PCI audits, cyber insurance, compliance staff, fraud tools, and customer support. If you process $1 million per month, you might pay $2,000 to $5,000 in sponsor fees alone, plus another $3,000 to $8,000 in compliance and insurance. You need enough merchant volume to cover these costs before you break even.
Most payment gateways take 18 to 36 months to reach profitability. Plan for losses in years one and two, and do not launch unless you have 24 months of runway.
Frequently Asked Questions
Do I need a money transmitter license if I only process payments for my own business?
No. A money transmitter license is required only if you move money on behalf of others — that is, if you accept funds from customers and pass them to merchants. If you process payments only for your own company, you do not need one. However, if you ever plan to offer payment processing to other businesses, you must obtain the license before you do.
Can I start a payment gateway without a sponsoring bank?
No. You must have a bank or acquiring processor behind you to access the card networks and settlement systems. Without a sponsor, you cannot legally move money or process transactions. The sponsor relationship is non-negotiable and is often the hardest part of launching a gateway.
What happens if my chargeback rate gets too high?
Your sponsor will issue warnings and may require you to increase your reserve or implement stricter fraud controls. If your chargeback rate exceeds their threshold (often 1 to 2 percent), they can terminate your agreement and shut down your gateway. This is why fraud prevention and customer service are critical from day one.
How much does PCI compliance cost?
Annual PCI audits and assessments cost $5,000 to $20,000 depending on your transaction volume and complexity. Cyber insurance adds $10,000 to $30,000 per year. If you use tokenization and avoid storing raw card data, you can reduce these costs, but you still must comply with network security rules.
Can I white-label an existing payment gateway instead of building my own?
Yes. Licensing an existing platform is faster and cheaper than building from scratch. You pay a per-transaction fee or monthly license, rebrand the gateway, and sell it to merchants. This route costs $100,000 to $500,000 upfront and takes 3 to 6 months to launch, versus 12 to 24 months and $500,000 to $1.5 million to build your own.