Payment Gateway vs Payment Processor: What Is the Difference?

The roles, in the industry's own words

The PCI SSC glossary defines an acquirer, also called a merchant bank or acquiring bank, as an entity, typically a financial institution, that processes payment card transactions for merchants and is defined by a payment brand as an acquirer. It defines a payment processor as an entity engaged by a merchant or other entity to handle payment card transactions on its behalf. Visa's Core Rules (18 April 2026) define a VisaNet Processor as a member, or Visa-approved non-member, that is directly connected to VisaNet and provides authorization, clearing or settlement services, and a Third Party Agent as an entity that provides payment-related services to a member or its merchants. A gateway sits in front of these: it is the connection your website, app or terminal uses to send the transaction.

Why the words blur

Many providers sell the gateway, processing and acquiring relationship as one account, and call the whole package whichever name sells best. The PCI SSC glossary reflects this by treating payment gateway and payment service provider as other names sometimes used for a processor. Rather than relying on the label, ask three questions: who owns the gateway software, which acquiring bank settles your funds, and which company signs your merchant agreement. The answers tell you how many contracts you have and which parts can be replaced.

Security responsibilities

The PCI SSC glossary says a service provider is a business entity, other than a payment brand, directly involved in the processing, storage or transmission of cardholder data on behalf of another entity, and it names payment gateways, payment service providers and independent sales organizations as examples. That means your gateway has its own PCI DSS obligations, but you still have yours. How much of your checkout touches card data, and which self-assessment questionnaire applies, depends on how the gateway is integrated; our PCI guides explain the difference. On the network side, Visa's rules require a member to register its Third Party Agents with Visa before they perform contracted services.

Someone had to register your gateway

The companies between you and the acquiring bank are not anonymous to the networks. Visa defines a third party agent as an entity, not defined as a VisaNet processor or Visa scheme processor, that provides payment-related services, directly or indirectly, to a member and/or its merchants or sponsored merchants or their agents. A member must register a third party agent with Visa using the Program Request Management application and the appropriate regional forms, and registration must be completed before the performance of any contracted services or transaction activity. Visa may deny or reject a registration at any time, with or without cause. Where the agent was engaged by the merchant rather than the acquirer, the acquirer must still register it before it performs any contracted services on the merchant's behalf, and registration is specific to each acquirer, so the same gateway used under two acquirers is registered twice.

Why registration is a question worth asking

Registration is also where liability sits. If a member fails to meet its responsibilities regarding third party agents, Visa assigns liability in a stated order of precedence, beginning with the member from whose performance or nonperformance the loss arose, then any member that sponsored it, then the BIN or acquiring identifier licensees used in the transactions. Effective 24 October 2026 in the Canada and US regions, members must also disclose to Visa the numeric IDs, issuing and acquiring identifiers, BINs and applicable account ranges their third party agents use, keep that information accurate and current, and review it annually. None of this is your obligation as a merchant, but it tells you what to ask before signing: which member registered my gateway, under which acquirer, and does that registration still hold if I change processor?

Why the split matters when you switch

If your gateway is independent of your processor, you may be able to change processor and keep the same checkout, integrations and stored cards, subject to the gateway supporting the new processor. If they are bundled, changing processor usually means a new integration and a plan to move stored cards, which depends on the old provider agreeing to export them securely. Neither is automatically better. Illustrative example only, with made-up round numbers: a shop paying a $25 monthly gateway fee plus separate processing may pay more on paper than a bundled plan at low volume, but can re-shop processing later without rebuilding checkout. Compare total cost and switching cost together, and check any gateway contract for its own term and cancellation fee.

Questions to ask before you sign

Which company is the gateway, and is it a separate contract? Which acquiring bank settles my funds? Who stores card data and tokens, and can I export them to another provider? Does the gateway support other processors? What are the term, renewal and cancellation terms for each contract? Get the answers in writing. This is general information, not legal advice (September 17, 2026).