The Payment Systems Regulator describes a payment gateway, in its most basic form, as software that captures card details and translates them into a message that the systems of the business’s card acquirer can understand. Businesses can get one from an acquirer, a payment facilitator or a specialist provider.

How it works

• The customer enters their card details on a payment page hosted by the provider, on a form embedded in the business’s own web page or through a link sent by email.

• The gateway passes the payment to the acquirer, which supports authorisation, clearing and settlement through the card scheme.

• The firm providing the acquiring service, not the gateway, pays the money to the business, less its fees.

Why it matters for travel businesses

• Card data security. How the gateway is set up affects your PCI DSS work. Since 31 March 2025, a business using self-assessment questionnaire A whose page embeds a provider’s payment form must also confirm that its site is not open to script attacks. The check does not apply to full redirects or emailed payment links.

• Deposits now, balances later. Under Visa’s rules, before a business stores card details for a future payment or takes an advance payment, it must get the cardholder’s express informed consent to terms that include its cancellation and refund policy and how and when the card will be charged.

• Authentication. A balance the business takes later under that agreement, without the customer having to act, is outside Strong Customer Authentication. Setting up the agreement online needs it.

Worth knowing

The labels overlap. The PCI Security Standards Council glossary says a payment processor is sometimes called a payment gateway or a payment service provider. The FCA says providing online gateways is not, on its own, acquiring, so it is worth asking each provider which firm holds and settles your money.