Payments 101: How Card Payments Actually Work
The technical, financial, and structural machinery of credit card processing, from checkout submission to final settlement.
The Journey of a Single Transaction
When a buyer types card numbers into an online checkout or taps a card against a terminal, money does not transfer instantaneously from the customer to the merchant. Instead, a series of cryptographic messages, risk verifications, and contractual obligations are executed across multiple institutions over several days.
Every card transaction consists of three distinct phases: authorization, clearing, and settlement.
1. Authorization (Seconds)
The merchant website securely collects the Primary Account Number (PAN), expiration date, CVV, and billing address. The gateway encrypts this payload and routes it through a payment processor to the acquiring bank, which sends the request across the card network (such as Visa or Mastercard) to the cardholder’s issuing bank. The issuing bank performs fraud screening, verifies available funds or credit line, places a temporary hold on the customer’s balance, and returns an authorization code (or decline code) back along the chain within one to two seconds.
2. Clearing (End of Day)
Authorization merely confirms that funds are reserved; it does not move capital. At the end of a business day, the merchant’s system closes its open batch of authorized transactions and transmits the capture file to its payment processor. The processor routes the batch to the card networks, which sort, validate, and distribute individual transaction records to their respective issuing banks globally. This reconciliation stage reconciles exact gross totals, fees, and currency conversions.
3. Settlement (1 to 3+ Days)
During final settlement, real financial transfers occur across interbank networks. The issuing bank debits the cardholder’s account and transfers funds (minus interchange) to the acquiring bank via card network settlement facilities. The acquiring bank deducts its own processing markup, assessment fees, and any contractual rolling reserve holdbacks, before crediting the net remaining proceeds to the merchant’s commercial bank account. In standard low-risk commerce, this occurs in 24 to 48 hours; in high-risk acquiring, settlement schedules frequently extend across weekly batches or delayed payout windows.
Table 1 —
Who is who in card payments
A standard card payment involves seven distinct operational roles. Understanding who pays whom clarifies why high-risk underwriting and interchange work the way they do.
| Party | What they do | Who pays them |
|---|---|---|
| Cardholder | Initiates the purchase and authorizes the payment method | Pays issuing bank via monthly statement or deposit debit |
| Issuing Bank | Issues the card to the consumer, extends credit line, and authenticates authorizations | Receives interchange fee deducted from transaction gross by acquirer |
| Card Network | Operates the messaging and clearing rail (Visa, Mastercard); establishes rules and sets interchange tables | Receives scheme assessment fees from both issuers and acquirers |
| Acquiring Bank | Licensed financial institution holding member status in networks; maintains merchant account (MID) and accepts financial liability | Receives acquiring fees and processing margins deducted from payouts |
| Payment Processor | Technical infrastructure provider connecting acquirers to card networks, managing transaction switches, routing, and batch settlement | Receives per-transaction processing fees negotiated with acquirers/merchants |
| Payment Gateway | Software application providing checkout UI, tokenization, fraud filters, and API connectivity to processors | Receives SaaS subscription fees, monthly gateway charges, or per-event transaction fees |
| Merchant | Supplies goods or services to cardholder; bears primary delivery and dispute obligations | Receives net settlement proceeds from acquiring bank after all fee deductions |
Gateway, Processor, and Acquirer: Distinguishing the Terms
In marketing copy and informal discussions, the terms gateway, processor, and acquirer are frequently used as if they were synonyms. In regulatory and operational reality, they perform fundamentally different functions in the transaction chain.
Payment Gateway: The Software Layer
The gateway is the digital equivalent of a physical point-of-sale terminal. It lives on your website, hosted payment page, or mobile app. Its sole job is to capture card numbers securely, tokenize sensitive data to meet PCI-DSS compliance standards, run initial pre-authorization fraud checks, and pass the encrypted data payload to the processor. A gateway cannot hold money, clear funds, or underwrite financial risk on its own.
Payment Processor: The Routing Engine
The processor operates the telecommunications and data switching network. It receives the encrypted payload from the gateway, routes authorization requests across card brand networks to the issuing bank, reports approval or decline codes back, and manages end-of-day batch clearing files. Processors handle technical communication protocols, network format conversions, and transaction records.
Acquiring Bank: The Regulated Financial Entity
The acquirer (or acquiring bank) is a licensed, regulated banking institution that maintains direct membership in the card networks. The acquirer underwrites the merchant, provides the unique Merchant Identification Number (MID), and settles fiat currency into commercial bank accounts. Crucially, the acquirer is legally and financially responsible for all merchant liabilities, chargebacks, and scheme fines that the merchant fails to cover. When high-risk merchants face strict underwriting scrutiny or reserve requirements, the rules originate from the acquiring bank’s credit risk committee.
The Aggregator Model and Why Shutdowns Occur
Most modern e-commerce businesses begin processing payments through payment aggregators—also known as Payment Facilitators (PayFacs)—such as Stripe, PayPal, or Square. Understanding why aggregators shut down merchants without warning requires understanding how the aggregator legal structure functions.
In a traditional merchant setup, a business applies for a dedicated Merchant Identification Number (MID) directly with an acquiring bank. The bank conducts rigorous upfront underwriting—reviewing financial statements, processing history, business model legality, fulfilment workflows, and identity documents—before issuing an approved MID.
In contrast, an aggregator holds a single, large master MID with an acquiring bank. When you sign up for an aggregator, you do not receive a merchant account; you receive a sub-merchant account operating beneath the aggregator’s master agreement.
The Asynchronous Risk Dilemma
To enable instant onboarding within minutes, aggregators use automated algorithms that verify basic business details but postpone deep human underwriting. They allow merchants to start processing immediately.
However, when the merchant’s volume increases, or when an automated heuristic flags a restricted Merchant Category Code (MCC), rapid velocity spike, foreign card pattern, or minor dispute, the account is routed to a human risk auditor. If the auditor discovers that the merchant operates in an industry not permitted by the aggregator’s upstream acquiring bank policy, the aggregator must terminate the sub-merchant immediately to protect its own master MID from network penalties.
Interchange Mechanics: Who Sets It and Who Gets Paid
Every time a card is processed, a fundamental cost called interchange is deducted from the gross transaction value. Merchants frequently assume interchange is a fee charged by their processor or gateway; in fact, the mechanism operates differently.
Interchange rates and qualification rules are established and published centrally by the card brand networks (Visa and Mastercard). However, the card networks do not keep the interchange fee. Instead, the acquiring bank pays the interchange fee directly to the cardholder’s issuing bank.
The fee exists to compensate the issuing bank for:
- Credit and default risk: The issuing bank guarantees funds to the merchant even if the cardholder ultimately defaults on their credit card bill.
- Fraud and loss prevention: The issuer finances 24/7 security infrastructure, zero-liability consumer protections, and unauthorized transaction remediation.
- Float and operational overhead: The cost of funding immediate settlement before collecting repayment from the consumer at month-end.
- Cardholder rewards programs: Premium cards with higher cash back or airline miles carry systematically higher interchange schedules to fund those loyalty perks.
On top of interchange, card networks charge small scheme assessments for network switching, while acquiring banks and processors add their own margin markup. Together, these three layers—interchange, assessments, and processor markup—constitute the total cost of credit card acceptance.
In this section
Foundational guides and technical reference articles detailing the architecture of card processing and payments infrastructure.
Pricing Explained: Reading High-Risk Fee Schedules
Understanding flat-rate vs interchange-plus pricing models, effective rates, and hidden account maintenance charges.
How Card-to-USDC Settlement Operates
Technical review of checkout tokenization, fiat clearing, and non-custodial digital dollar wallet delivery.
Authorization vs Settlement Timing (Reference Guide)
Deep dive into pre-authorization holds, capture windows, and interbank ACH batch cut-off schedules.
Related Guides & Next Steps
Continue exploring the mechanics of high-risk merchant processing across our dedicated topic guides:
High-Risk Gateways
Evaluating acquiring models, integration architectures, and direct card acceptance solutions.
Merchant Accounts
Dedicated MID underwriting, acquiring bank risk assessment, and approval timelines.
Chargeback Guide
Understanding the formal dispute lifecycle, representment evidence, and card network thresholds.
Frequently Asked Questions
What is the practical difference between a gateway, a processor, and an acquirer?
A gateway is the secure software interface that captures card details and transmits them. A processor is the technical back-end network that routes transactions between banks and handles batching. An acquirer is a licensed financial institution holding member status in card networks, providing the actual bank account (MID) and assuming ultimate financial liability for transactions.
Why do payment aggregators shut down high-risk accounts suddenly?
Aggregators board merchants almost instantly under a shared master merchant agreement using automated algorithms with minimal upfront diligence. When post-onboarding audits, volume spikes, or dispute triggers reveal restricted business activities or higher risk profiles, compliance teams freeze or terminate the sub-merchant account to safeguard their master acquiring facility.
Who determines interchange fees and who gets paid from them?
Interchange schedules are established and published by the card networks (Visa, Mastercard, Discover, Amex). However, the interchange fee is paid by the acquiring bank to the cardholder’s issuing bank on every transaction to cover credit exposure, processing infrastructure, and cardholder benefit programs.
Last reviewed September 2026