What Is a Payment Gateway?
A payment gateway is the technology that securely transmits card payment information between your business and the financial institutions that process the transaction. Think of it as the digital equivalent of a card reader, but for online, telephone, and app-based payments rather than in-person ones.
When a customer enters their card details at your checkout, the payment gateway encrypts that information and sends it to the acquiring bank for authorisation. The bank approves or declines the transaction, and the gateway communicates the result back to your checkout, all in a matter of seconds.
Without a payment gateway, you cannot accept card payments online or over the phone.
For a full explanation of how gateways work step by step, see our guide to what is a payment gateway.
Payment Gateway vs Merchant Account
These two terms are often confused. They are different things that work together:
A merchant account is the financial account that holds card payment funds between the card networks settling them and your business bank account receiving the money.
A payment gateway is the technology that processes and routes the transaction data.
Some providers bundle both together, you get a merchant account and gateway in one product. Others provide just the gateway technology and work alongside a separate merchant account. For most UK small businesses, a bundled solution from a single provider is the simplest approach.
For a full breakdown of the distinction, see our guide to payment gateway vs merchant account.
Types of Payment Gateway
Understanding which type of gateway suits your business depends on how you take payments and how much technical work you can manage.
Hosted Payment Page
The customer is redirected to the payment provider's own secure page to enter their card details. You never handle raw card data. The trade-off is that the customer briefly leaves your website.
Examples: PayPal Checkout, Opayo hosted forms, Worldpay hosted payment page.
Best for: Businesses that want simplicity and the lowest PCI compliance burden.
API-Integrated (Self-Hosted) Gateway
The payment form sits on your own website. Card data is collected on your site and transmitted to the gateway in the background via API. Gives full control over the checkout experience but requires developer work to implement and maintain.
Examples: Stripe API, Braintree, Adyen API.
Best for: Businesses that want a seamless, fully branded checkout experience and have developer resource.
Hosted Fields (iFrame)
A hybrid approach. The card input fields are technically hosted by the gateway provider and embedded in your checkout page via iFrame. The customer sees a seamless checkout on your website, but card data never actually passes through your own servers.
Examples: Stripe Elements, Braintree hosted fields, Opayo form integration.
Best for: Most ecommerce businesses, the best balance of checkout control and low PCI burden.
Payment Links
A hosted payment page generated on demand and shared by email, text, or WhatsApp. No website required. The customer clicks the link, pays on a secure hosted page, and you receive confirmation.
Best for: Tradespeople, consultants, service businesses invoicing customers remotely.
Virtual Terminal
A web-based dashboard where you manually enter card details provided by a customer over the phone or by post. Card-not-present rates apply. Requires specific PCI compliance considerations.
Best for: Businesses with telephone order operations, professional services, hospitality reservations, trade businesses.
What Does a Payment Gateway Cost?
Gateway costs vary significantly by provider and setup. The main components:
Per-transaction fee: often included in your overall merchant account rate, but sometimes charged separately. Typically 10p to 25p per transaction or a percentage on top of interchange.
Monthly gateway fee: a fixed charge for gateway access. Typically £10 to £40 per month. Some providers include this in the overall merchant account package; others charge it separately.
Setup fee: a one-off activation charge. Often waived, particularly if negotiated. Typically £0 to £200.
3D Secure / authentication fee: some providers charge separately for SCA authentication tools. Increasingly included as standard.
At low ecommerce volumes (under £5,000/month), providers like Stripe (no monthly fee, 1.5% + 20p per transaction) often work out cheapest. At higher volumes, traditional gateways with monthly fees and lower per-transaction rates typically cost less overall.
For a full cost breakdown and worked comparisons, see our guide to payment gateway costs UK.
Choosing the Right Payment Gateway
The right gateway depends on several factors that vary by business:
How you take payments. Online checkout, payment links, phone orders, or a combination. Different payment types require different gateway capabilities.
Your ecommerce platform. Shopify, WooCommerce, Magento, Wix, and others each have preferred gateway integrations. Check official compatibility before choosing.
Your technical capability. Hosted page gateways need no developer. API integrations require ongoing technical resource.
Your monthly volume. Higher volume justifies the cost of monthly gateway fees and negotiated rates. At lower volumes, no-monthly-fee options are usually cheaper.
Your customer base. If a significant proportion of customers use Apple Pay or Google Pay, choose a gateway that supports digital wallets natively.
Your sector. Subscription businesses, high-value transactions, and international sales each have specific gateway requirements.
For recommendations by business type and use case, see our best payment gateways UK guide.
Security and Compliance
Any gateway you use for UK online payments must:
- Hold PCI DSS Level 1 certification
- Support 3D Secure 2 (3DS2) for Strong Customer Authentication compliance
- Use SSL/TLS encryption for all payment data transmission
- Support tokenisation for any stored payment details
- Using a hosted page or hosted fields gateway significantly reduces your own PCI compliance burden, card data never touches your servers, meaning you qualify for the simpler SAQ A self-assessment rather than more demanding audit requirements.
For a full guide to payment security requirements, see our secure payment gateways article.
