Payment Gateway vs Payment Service Provider: What Is the Difference

What a Payment Gateway Actually Does

A payment gateway is the secure channel that connects your checkout, whether that is a website, a point-of-sale terminal, or an in-app purchase flow, to the rest of the payment infrastructure. When a customer enters card details, the gateway encrypts that data and forwards an authorisation request to the acquiring bank or processor. Once the issuing bank responds, the gateway relays that approval or decline back to you and your customer, typically in one to three seconds.

The gateway does not move money. It moves data. Settlement, the actual transfer of funds into your bank account, happens separately through the acquiring and card-scheme infrastructure. Because the gateway sits at the point where raw card data is first captured, it is also the main lever for reducing your PCI DSS scope. When a gateway uses tokenisation or hosted payment pages, raw card numbers never touch your servers, which can reduce your compliance burden significantly under PCI DSS v4.0.1.

Examples of standalone gateway providers include Opayo (formerly Sage Pay) and Judopay. These products integrate with a separate merchant account that you hold directly with an acquirer such as Barclaycard, Lloyds Cardnet, or Worldpay.

What a Payment Service Provider Covers

A payment service provider is a broader term for a company that enables merchants to accept payments. In practice, the term covers a spectrum. At one end you have providers that are essentially gateways with a thin layer of reporting on top. At the other end you have full-stack providers, such as Stripe, Adyen, or Mollie, that bundle the gateway, the acquiring relationship, a merchant account (or sub-merchant account), fraud tooling, recurring billing, and multi-currency settlement into a single contract.

Full-stack PSPs are sometimes called payment facilitators or PayFacs. Instead of you holding your own direct relationship with an acquiring bank, the PayFac holds the master merchant account and onboards you as a sub-merchant beneath it. This is how Stripe, Square, and PayPal operate. It means you can start accepting payments within hours rather than the days or weeks that a traditional acquirer underwriting process can take.

The trade-off is that the PayFac, not you, controls risk decisions. Account holds, reserves, and sudden terminations are more common under the aggregated model, especially for businesses in higher-risk categories. Merchant Savvy's research suggests that PayFacs are used by roughly 25 percent of the smallest UK merchants (those with annual card turnover up to approximately £380,000) but only about 2 percent of larger businesses, who tend to secure their own acquiring relationships for better rates.

The Card Transaction Flow: Step by Step

Understanding the flow of a card transaction makes the roles of each party concrete. The journey from a customer tapping their card to funds appearing in your account involves five distinct actors and two separate phases.

The authorisation phase happens in seconds. Settlement, the actual movement of funds, follows separately, usually within one to two business days for most card schemes, though settlement timing varies by acquirer and PSP.

Gateway-Only vs Full-Stack PSP: A Direct Comparison

The comparison below captures the main practical differences between using a standalone payment gateway with your own merchant account versus using a full-stack PSP or PayFac. Neither model is universally better: the right choice depends on your transaction volume, your technical resources, and how much you want to own the acquiring relationship.

UK Regulation: FCA Authorisation and Safeguarding

Any company that provides payment services in the UK must be either authorised or registered with the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017, or the Electronic Money Regulations 2011 if it issues e-money. There are two tiers of authorisation: Authorised Payment Institution (API) for firms processing above a certain threshold, and Small Payment Institution (SPI) for smaller-volume operators. You can check a provider's status on the FCA Financial Services Register.

From 7 May 2026, significantly strengthened safeguarding rules came into force for payment institutions and e-money institutions. Safeguarding is the requirement to protect customer funds that are held by a PSP pending execution of a payment. Under the new rules, firms must place those funds in a designated trust account or cover them with an appropriate insurance policy; they cannot commingle them with the firm's own operating funds. Firms also face new obligations around daily reconciliation, monthly FCA reporting, annual independent safeguarding audits (for firms holding over £100,000), and governance requirements including a named senior manager accountable for compliance.

For merchants, the relevance is twofold. First, if your PSP holds your settlement funds before paying out, you want confidence that those funds are properly safeguarded and would be protected in the event of the PSP's insolvency. Second, if your own product involves holding or moving client money, you may need your own FCA authorisation rather than relying solely on a PSP's permissions.

What to Look For When Choosing

Pricing is the most visible factor but rarely the most important one at early stage. Flat-rate fees from a PayFac are easy to model but can become expensive relative to interchange-plus pricing once your monthly card volume exceeds roughly £25,000 to £50,000. At that point, the effort of a direct acquirer relationship usually pays off.

Settlement speed matters for cash flow. Find out exactly when funds hit your bank account and whether the PSP imposes rolling reserves or holds on new accounts. Some providers hold a percentage of settlement for 90 days or more until they build a fraud and chargeback history for your account.

Supported payment methods are increasingly important. UK consumers now use open banking payments, Apple Pay, Google Pay, and buy-now-pay-later products alongside cards. A gateway that only handles card payments may require separate integrations for each method; a full-stack PSP typically aggregates them.

PCI DSS scope affects how much compliance work falls on your team. A gateway that provides a hosted payment page or JavaScript-based card fields means card numbers are entered directly into the PSP's environment, not yours, which can substantially reduce your scope under PCI DSS v4.0.1.

FCA authorisation status should always be verified. Confirm the provider appears on the FCA Financial Services Register as an Authorised Payment Institution or an Authorised Electronic Money Institution before contracting. Do not accept a claim of authorisation at face value.

Conclusion

The distinction between a payment gateway and a payment service provider is not just semantic. It determines who holds your merchant account, who underwrites your risk, how quickly you receive funds, what you pay per transaction, and how much compliance responsibility sits with you versus the provider. A gateway is the technology layer; a PSP is the commercial and operational layer that may or may not include a gateway.

For most UK startups and growing businesses, a full-stack PSP offers the fastest path to accepting payments with the least operational overhead. As transaction volume grows, the economics of a direct acquiring relationship become more attractive. Either way, verify your provider's FCA authorisation status, understand exactly how your settlement funds are safeguarded, and read the terms on reserves and holds before you sign.

Frequently asked questions