What it takes to launch a payment gateway

Starting a payment gateway company means building software and infrastructure that lets merchants accept card payments, bank transfers, or digital wallets. You are not a bank—you are the middleman between the merchant, their customers, and the financial institutions that actually move money. That distinction matters legally and operationally.

The real barriers are not technical. You need a merchant acquiring agreement with a bank or an existing payment processor, regulatory licenses in every state where you operate, compliance with card network rules (Visa, Mastercard, American Express), and the ability to hold and move customer funds safely. Most new gateway companies do not build from zero; they build on top of an existing processor's infrastructure through what is called a white-label or reseller arrangement.

If you want to process payments directly—meaning you hold the merchant relationship and the customer funds—you will need a money transmitter license, which varies by state and takes months to obtain. If you want to stay smaller and faster, you can resell another processor's gateway under your own brand and take a cut of each transaction.

Key Takeaways

  • A payment gateway is software that connects merchants to banks and card networks, not a bank itself, and you must have a legal agreement with an actual bank to process real payments.
  • White-label and reseller models let you launch faster by using another processor's infrastructure, while direct processing requires money transmitter licenses in each state you operate.
  • You must comply with PCI DSS (Payment Card Industry Data Security Standard), which sets rules for how you handle card data, and you cannot store full card numbers yourself.
  • Your revenue comes from transaction fees (a percentage of each payment plus a per-transaction charge), monthly platform fees, or both, and you keep a margin between what you charge merchants and what you pay the processor.
  • Building trust with merchants means offering faster payouts, lower fees, better reporting, or integration with tools they already use—not just copying what Stripe or Square do.

Choosing between white-label, reseller, and direct processing

A white-label gateway means you buy the software and infrastructure from an existing processor and rebrand it as your own. The processor handles all the compliance, the bank relationships, and the actual fund movement. You own the merchant relationship and set your own pricing. This is the fastest route to market—you can launch in weeks—but your margins are thin because you are paying the processor a wholesale rate and keeping the difference.

A reseller model is similar but lighter: you sign up merchants, they use the processor's gateway directly, and you take a cut of their fees. You have almost no technical work and no compliance burden, but merchants see the processor's branding, not yours, and you have less control over the experience.

Direct processing means you hold the merchant account, you hold customer funds temporarily, and you are responsible for compliance. This requires a money transmitter license in every state where you operate. New York's BitLicense is the most expensive and restrictive; other states range from $500 to $5,000 in application fees, plus legal and compliance costs. The process takes three to nine months per state. You also need a sponsoring bank—a bank that will underwrite your business and let you process on their license. Finding one is harder than it sounds; most banks only sponsor established companies with years of processing history.

Most new gateway companies start white-label or reseller, prove the business model, and move to direct processing later if the volume justifies the cost and complexity.

The compliance and regulatory layer you cannot skip

Every payment gateway must comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules created by Visa, Mastercard, American Express, Discover, and JCB. PCI DSS covers how you store, transmit, and access card data. The core rule: you cannot store the full card number, expiration date, and CVV together. Most gateways use tokenization—you receive the card data, immediately send it to a secure vault, and store only a token (a random string) that represents that card. When you need to charge it again, you send the token, not the card number.

You must also pass a PCI DSS audit annually. If you process fewer than 20,000 transactions per year, you can do a self-assessment questionnaire (SAQ). Above that, you need a third-party auditor. Audits cost $1,500 to $5,000 depending on your complexity.

If you are processing directly (not white-label), you also need money transmitter licenses. These are state-level licenses that regulate companies that move money on behalf of others. You will need to show proof of net worth (usually $100,000 to $500,000 depending on the state), a detailed compliance plan, and sometimes a surety bond. Some states require you to hold customer funds in a segregated account and file quarterly reports on how much money you are holding.

Card networks (Visa, Mastercard) also have their own rules. They require you to have a processing agreement with a bank, they audit your security practices, and they can fine you or shut you down if you violate their rules. You do not sign directly with the networks; your sponsoring bank does, and they pass the requirements down to you.

Building the technical infrastructure

The software side is the easier part if you have engineering resources. You need an API that merchants can call to create a payment, check its status, and refund it. You need a dashboard where merchants can see their transactions, download reports, and manage their account settings. You need webhooks so merchants can be notified when a payment succeeds or fails. You need to handle 3D Secure (the extra authentication step for card payments), tokenization (storing card data safely), and reconciliation (matching what you charged to what the bank settled).

Most new gateways do not build the payment processing engine itself. Instead, they integrate with an existing processor's API (through white-label or reseller) or they use a payment processor-as-a-service like Stripe Connect or Adyen for Platforms, which handles the hard parts and lets you focus on the merchant experience and your own features.

You will also need to handle disputes and chargebacks. When a customer disputes a charge with their bank, the bank asks you for proof that the transaction was legitimate (an order confirmation, a shipping receipt, etc.). If you cannot prove it, you lose the money and pay a chargeback fee. You need a system to collect and store this evidence from merchants automatically.

How you make money and what margins look like

Payment gateways make money in three ways: transaction fees (a percentage of each payment plus a fixed amount per transaction), monthly platform fees, or both. A typical white-label gateway might charge merchants 2.9% + $0.30 per card transaction. You then pay your processor 2.5% + $0.25, keeping 0.4% + $0.05 per transaction as your margin. On a $100 payment, that is $0.45 in your pocket.

At scale, that adds up. If you process $1 million in payments per month, your margin is roughly $4,500. But you also have costs: customer support, payment for the white-label platform, payment processing infrastructure, compliance and legal, and sales. Most new gateways operate at a loss for the first year or two while they build merchant volume.

Some gateways also charge monthly fees ($29 to $299 depending on features) or per-API-call fees for high-volume merchants. This creates more predictable revenue than transaction fees alone.

Your competitive advantage is not lower fees—you cannot undercut Stripe or Square on price. It is faster payouts (same-day instead of next-day), better integration with specific software (accounting tools, e-commerce platforms, invoicing systems), lower fees for a specific merchant type (nonprofits, high-risk industries), or a better user experience for a specific use case (subscription billing, marketplace payments, international transfers).

Finding a sponsoring bank and processor partnership

If you are going white-label, you need to sign an agreement with an existing payment processor. The processor will ask about your business model, your target merchants, your compliance plan, and your technical capabilities. They want to know you will not expose them to fraud or regulatory risk. This conversation usually takes weeks and involves legal review on both sides.

If you are going direct, you need a sponsoring bank. This is a bank that will let you process payments under their license and their regulatory umbrella. The bank takes on the regulatory risk and charges you a fee for it. Banks are cautious about sponsoring new payment companies; they usually want to see at least $1 million in annual processing volume, a clean compliance record, and proof that you have a real merchant base (not just a business plan).

Finding a sponsoring bank is often the hardest part of starting a direct gateway. Most banks only sponsor companies they already know or that come through a referral. You can start by talking to banks in your region, but expect to be turned down multiple times. Some payment consultants specialize in connecting new processors with sponsoring banks, and they charge a fee (usually a percentage of your first-year processing volume).

The timeline and cost to launch

A white-label gateway can launch in three to six months if you have the engineering resources. You need time to negotiate the processor agreement (four to eight weeks), build the merchant dashboard and API (eight to twelve weeks), pass PCI DSS audit (four to eight weeks), and recruit your first merchants (ongoing). Total cost: $50,000 to $150,000 in development, legal, and compliance, plus ongoing fees to the processor.

A direct gateway takes much longer. You need money transmitter licenses in the states where you operate (three to nine months per state, $5,000 to $50,000 in legal and application fees), a sponsoring bank agreement (three to six months), PCI DSS audit (four to eight weeks), and the same technical build. Total cost: $200,000 to $500,000 or more, depending on how many states you target and how much legal help you need.

A reseller model is the fastest and cheapest: you can start in weeks with almost no cost beyond your own time. But your margins are thin and you have no control over the product.

Frequently Asked Questions

Do I need to be a bank to run a payment gateway?

No. A payment gateway is software and infrastructure that connects merchants to banks and card networks. You do not hold a banking license. If you process payments directly (not white-label), you need a money transmitter license, which is different from a banking license and much cheaper to obtain.

Can I start a payment gateway without a sponsoring bank?

Not if you want to process payments directly. You need a sponsoring bank to underwrite your business and let you process under their license. If you go white-label or reseller, you do not need your own sponsoring bank because the processor you partner with already has one.

What is the difference between a payment gateway and a payment processor?

A payment gateway is the software that accepts the payment and sends it to the processor. A payment processor is the company that actually moves the money from the customer's bank to the merchant's bank. Most companies that call themselves "gateways" also handle processing, or they partner with a processor that does.

How much do merchants typically pay in fees?

Card payments usually cost merchants 2.5% to 3.5% plus $0.20 to $0.30 per transaction. Bank transfers (ACH) cost less, usually 0.5% to 1% or a flat fee. Digital wallets (Apple Pay, Google Pay) cost the same as cards. You set your own fees, but you must stay competitive with Stripe, Square, and other established gateways.

What happens if a merchant gets defrauded or a customer disputes a charge?

You must help the merchant fight the dispute by collecting evidence (order confirmation, shipping receipt, customer communication) and submitting it to the card network. If the merchant loses, you refund the customer and charge the merchant a chargeback fee (usually $15 to $100). If chargebacks exceed a certain percentage of your volume, the card networks can fine you or shut you down.