What Is a Payment Gateway? A Complete Guide to Fiat and Crypto Payments

Payment Gateway in 30 Seconds

A payment gateway is the software layer that sits between your checkout page and the financial networks that move money. It captures payment details from the buyer, encrypts them, authorizes the transaction with the issuing bank (for cards) or the blockchain (for crypto), and returns an approved or declined response, usually in under three seconds.

If you run an online store, a SaaS product, a marketplace, a forex broker, an iGaming platform, or any business that gets paid over the internet, a payment gateway is mandatory infrastructure. Without it you cannot legally and securely accept card, wallet, bank-transfer, or cryptocurrency payments at scale.

This guide is written for operators, founders, and product or finance leads who need to understand:

• What a payment gateway actually is, and what it is not.
• How a gateway works step-by-step for both card payments and crypto payments.
• The difference between a gateway, a payment processor, a merchant acquirer, and a merchant account.
• The economics: fees, settlement cycles, interchange, chargebacks, and how crypto changes all of them.
• How to choose the right gateway, and when a crypto gateway outperforms a fiat one.

By the end, you will be able to talk to any payments provider on equal footing and pick infrastructure that fits your business model rather than somebody else's.

What Is a Payment Gateway, Precisely

A payment gateway is a PCI-compliant service that performs four jobs on every transaction:

A useful analogy: a payment gateway is the point-of-sale terminal of the internet. A card reader in a retail store captures a tap, encrypts the chip data, and talks to the acquirer. A payment gateway does the same job for an e-commerce checkout, a mobile app, an in-app purchase, or a blockchain invoice.

A crypto payment gateway does the same four jobs, but the "network" it talks to is a public blockchain (Bitcoin, Ethereum, Tron, Solana, and others) instead of Visa or Mastercard. Instead of authorization and deferred settlement, it watches the mempool for the customer's transaction and confirms payment when the network mines the required number of blocks. The job is the same; the rails underneath are completely different.

Common synonyms and related terms

• Online payment gateway - emphasizing e-commerce use.
• Payment service provider (PSP) - an all-in-one provider that bundles gateway, processor, and acquiring into one contract.
• Payment orchestration layer - a newer term for systems that route each transaction to the best-performing gateway of several.
• Merchant gateway or gateway payment services - marketing terms; same thing.
• Crypto processor, on-chain payment processor, Web3 checkout - crypto-specific variants of the same concept.

The Fiat Payment Flow, from Tap to Settlement

A card transaction looks instant, but under the hood it is a choreographed sequence of messages between five or six parties: the buyer, the merchant, the gateway, the acquiring bank, the card network, and the issuing bank.

The total picture: eight steps, five parties, roughly 1 to 3 seconds of customer-facing latency, and up to five months of back-office uncertainty per transaction.

The Crypto Payment Flow, from Invoice to Confirmation

A crypto payment gateway compresses the eight-step fiat choreography into a much shorter sequence, but the tradeoffs are different. Here is what happens when a customer pays with Bitcoin, USDT, USDC, Ethereum, or any other supported asset.

The total picture: six steps, two parties (buyer and gateway), typical end-to-end time of 5 seconds (stablecoin on a fast chain) to 30 minutes (Bitcoin with 3 confirmations), and zero back-office chargeback risk.

Gateway vs Processor vs Acquirer vs Merchant Account

These terms are used interchangeably in marketing copy. They are not interchangeable in contracts.

• Payment gateway - the software capturing payment data at the front end and transmitting it to the processor. Think of it as the checkout's translator and security officer.
• Payment processor - the back-end service that moves the transaction from the acquirer to the card network and back. Some gateways are also processors; many are not.
• Acquirer (acquiring bank) - the bank that holds the merchant account and is licensed by Visa/Mastercard to accept card transactions on your behalf.
• Merchant account - a specialized bank account where card funds land after clearing, before being swept to your operating account. High-risk businesses often struggle to get one.
• Card networks - Visa, Mastercard, American Express, Discover, UnionPay, JCB - the rails that route authorization and clearing messages.
• Issuing bank - the cardholder's bank; the one that actually funds the transaction.

For crypto payment gateways, the stack collapses:

• Crypto gateway = capture + authorize + settle + (optional) off-ramp, all in one provider.
• Blockchain node / indexer = the analogue of both processor and network.
• Miners / validators = the analogue of the issuing bank, but decentralized.
• Merchant account is optional - you can be paid directly into a self-custodial wallet.

This collapse is why crypto checkouts usually have fewer moving parts and fewer fee layers than card checkouts.

Fiat Payment Gateway vs Crypto Payment Gateway

This is the comparison most guides skip. Both gateway types solve the same business problem, "let customers pay me on the internet", but they trade off different things.

The headline takeaway: fiat gateways optimize for buyer protection at the cost of merchant risk and fees. Crypto gateways optimize for finality and cost at the cost of consumer familiarity. A modern stack often runs both.

Payment Gateway Use Cases by Industry

Not every business needs the same gateway. Concrete patterns we see in the field:

Fees, Settlement, and Chargeback Economics

For a card transaction, the merchant's total cost-of-payments breaks down into four layers:

1. Interchange (paid to the issuing bank). Set by Visa/Mastercard; a typical US e-commerce rate is 1.5% to 2.1% + $0.10. In the EU, regulation caps it at 0.3% for consumer credit and 0.2% for debit.
2. Scheme fees (paid to Visa, Mastercard, etc.). Around 0.10 to 0.15%.
3. Acquirer / processor markup. Typically 0.3 to 1.0% on Interchange++ pricing, or baked into a flat rate like 2.9% + $0.30.
4. Gateway fee. Either bundled into the processor's rate or charged separately ($0.05 to $0.20 per transaction).

A typical US e-commerce merchant pays around 2.9% + $0.30 on a blended basis, and more for cross-border, premium cards, or high-risk categories.

Layer in chargeback cost: each dispute costs $15 to $100 in fees regardless of outcome, plus the disputed amount if you lose. Card networks put merchants with chargeback ratios above 0.9% to 1.5% into monitoring programs, which add another 1 to 2% in scheme fines.

Crypto gateway fees

• Network fee - paid by the buyer to the blockchain (Bitcoin miners, Ethereum validators). On Tron and L2s often under $0.10.
• Gateway fee - typically 0.4% to 1.0% flat, sometimes 0 for stablecoin-only flows.
• Off-ramp fee - a 0.5 to 1.5% conversion spread at the banking partner if you want funds in fiat.
• Chargeback cost - zero.

On a $100 transaction, a typical card stack nets you about $96.80 after all fees (and less after chargebacks). A crypto stack with stablecoin-to-EUR off-ramp nets you roughly $98.50 to $99.20. The gap widens as transaction size grows.

Settlement timing

For cash-flow-sensitive businesses, especially startups and high-growth e-commerce, the difference between T+7 and T+0 is a meaningful working-capital win.

Security, PCI DSS, and Compliance

A payment gateway is a security product more than a financial product. The core controls for fiat:

• TLS 1.2/1.3 encryption on every request.
• Tokenization - replacing the PAN with a token that is useless outside the gateway. Network tokenization (Visa Token Service, Mastercard MDES) further reduces issuer-side decline rates by 3 to 7%.
• PCI DSS compliance - by using hosted fields or a drop-in SDK, most merchants qualify for SAQ-A (the lightest PCI scope) instead of the full SAQ-D audit.
• 3D Secure 2 - the authentication layer that shifts fraud liability to the issuer when properly invoked, and is mandatory in the EU under PSD2 SCA.
• AVS and CVV verification - basic fraud filters.
• Fraud scoring - machine-learning models that score each transaction on device fingerprint, velocity, BIN country, and dozens of other signals.

Crypto gateway security

• No PAN, no PCI DSS. You never handle sensitive card data, so PCI scope drops to near zero for crypto-only flows.
• Key management - the real security question. Does the gateway use MPC (multi-party computation), HSMs (hardware security modules), or multisig? Are hot-wallet balances capped? Is there a cold-storage threshold?
• Custody model - custodial gateways hold your funds (convenient, but a counterparty risk); non-custodial gateways route funds directly to your wallet.
• AML/KYC and travel rule - apply at the off-ramp, not at the point of acceptance. Take crypto and keep it in crypto, and your regulatory footprint is minimal.
• Chain-analytics screening - high-quality gateways screen incoming addresses against OFAC and sanctioned-wallet lists before crediting the payment.

Both models are secure in practice. They put the perimeter in different places.

How to Choose the Right Payment Gateway

A decision framework that actually works, in order of importance:

1. Does it accept the payment methods your customers use? Not the ones you like - the ones they already have. If 40% of your traffic comes from Turkey, you need Troy; from the Netherlands, iDEAL; Brazil, PIX; India, UPI. If you serve tech-forward or international buyers, stablecoins are usually in that list.
2. Is your vertical accepted? iGaming, forex, CBD, nutraceuticals, adult, and "high-risk" categories face declines or punitive reserves from many fiat acquirers. Crypto gateways have no such restrictions.
3. What is your true blended cost? Get a quote on Interchange++ pricing, not just a blended flat rate. Include chargeback cost at your historical ratio.
4. Settlement speed and working-capital fit. T+7 versus T+0 can be the difference between growing and running out of cash.
5. Developer experience. Modern REST API, webhooks, idempotent retries, good SDKs, sandbox parity with production, and clear error codes. A bad API costs more than a bad rate.
6. Global coverage. Multi-currency pricing, automatic FX, local acquiring, and for crypto: all the chains your buyers use (at minimum Bitcoin, Ethereum, Tron, Solana, plus major L2s).
7. Fraud and dispute tooling. Chargeback alerts, representment automation, 3DS control, blocklists, velocity rules.
8. Reliability. Ask for the last 90 days of uptime and declined-transaction data. Anything below 99.95% authorization uptime costs you real revenue.
9. Compliance fit. PCI DSS scope reduction, PSD2 SCA support, data-residency options for the EU, KYC/AML package for crypto off-ramps.
10. Roadmap alignment. Network tokenization, open banking rails, pay-by-bank, stablecoin settlement - the winners five years from now are the providers already shipping these today.

When a crypto payment gateway is the right choice

• Your margins cannot sustain 3%+ card fees (digital goods, high-AOV electronics, gaming).
• You serve a global audience where card penetration is low or volatile.
• You operate in a high-risk vertical that card acquirers reject.
• You prefer final, irreversible settlement over chargeback-driven reversals.
• Your customers already hold crypto and prefer to pay with it.
• You want instant cross-border settlement without SWIFT fees.

For most modern businesses, the answer is not fiat or crypto, it is fiat and crypto, side by side at checkout, with the buyer choosing. The right gateway makes both feel like one product.