Online Payment Processor: How to Choose One Without Regretting It

Payment processors get compared on headline rate, which is the smallest number in the decision — here is what actually separates them for a digital seller.

The short answer: An online payment processor moves money between your customer’s bank and your account. Nearly all of them do that competently, so the decision turns on four things instead: which payment methods you get, what your authorisation rate looks like, who owns the tax and dispute burden, and how much PCI scope you inherit. Rate is the fifth.

What a Processor Actually Does

The processor is the layer your customer never sees and the one that decides whether you get paid.

It routes the authorisation request through the card network to the customer’s issuing bank, returns the approve or decline, settles the funds days later, deducts fees, and pulls money back when a dispute lands.

Worth separating from two adjacent layers that vendors blur deliberately.

• The gateway captures the card at your checkout and transmits it.
• The merchant account holds the funds before payout.
• The processor is the part in the middle that actually moves money, and most providers now sell all three as one product.

For choosing one, the useful framing is simpler. Almost every provider now sells gateway, processing, and an aggregated merchant account as a single product. What differs is everything around the transaction.

The Four Things That Actually Differ

Choosing a processor on headline rate is optimising the smallest number in the decision.

1. Which Payment Methods You Get

Cards are not how everyone pays, and in several of your best markets they aren’t the default.

Bank transfer methods dominate parts of Europe. Wallets dominate parts of Asia. Buy-now-pay-later shifts conversion on higher-priced digital products. A processor that offers cards and PayPal in a market where half of buyers use something else is losing you sales that never appear in any report, because a customer who can’t pay the way they expect simply leaves.

2. Your Authorisation Rate

This is the number nobody quotes, and it moves more revenue than pricing does.

Authorisation rate is the percentage of legitimate charges approved on the first attempt. It’s affected by how the provider flags card-on-file transactions, whether it uses network tokenisation, how it routes, and how aggressively its fraud rules reject borderline transactions.

A provider one or two points better on authorisation beats one that’s cheaper by a tenth of a percent, and it isn’t close. Ask for their authorisation rate on comparable merchants, and ask whether their fraud thresholds are configurable.

3. Who Owns Tax and Disputes

This is the largest difference between providers, and it’s rarely on the comparison page.

A conventional processor moves money and leaves you as the seller of record. You register for VAT and sales tax wherever you have customers, you remit it, and you fight your own chargebacks.

A merchant of record becomes the seller legally. Tax registration, remittance, and dispute handling sit with the platform. You lose direct control of the payment relationship and gain back an entire function you’d otherwise have to build.

For a digital seller with international customers, this single choice usually outweighs every other item on the list. The merchant of record comparison sets out the trade-off honestly, including what you give up.

4. What PCI Scope You Inherit

Compliance obligation follows architecture, not branding, and the standard moved recently enough that a lot of advice is stale.

PCI DSS requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025 after three years as best practice. According to the PCI Security Standards Council, they exist because “scripts running in a consumer’s browser are now a significant target for attackers seeking to steal payment card data.”

In practice, they require you to inventory and authorise every script on your payment page, verify script integrity, and detect unauthorised changes. That is ongoing operational work, not a one-time assessment.

The architectural consequence is direct. A hosted or iframed payment page keeps your scope narrow. Custom fields you render yourself, however convenient, pull payment page script management into your responsibility. Ask which model a provider uses and what it means for your obligations, in writing.

Declines Are a Revenue Line

Most sellers treat a failed payment as a customer problem. A meaningful share of them are configuration problems.

1. Soft declines — insufficient funds, velocity limits, an issuer risk flag — can succeed on a later attempt, which makes retry timing worth setting deliberately rather than accepting a default.
2. Hard declines are permanent, and retrying them repeatedly can count against you with the networks.
3. Gateway-side failures aren’t declines at all: a timeout, a validation error, a malformed request. The customer sees a failure and blames you, and nothing about your rate fixes it.

A provider that surfaces response codes clearly lets you tell these apart. One that reports “payment failed” and nothing more is hiding the information you’d need to recover the revenue.

The Pricing Models, Briefly

Three structures, and knowing which you’re being quoted prevents most comparison errors.

• Blended or flat rate. One percentage regardless of card type. Simple, slightly more expensive on average, right for most smaller sellers.
• Interchange-plus. True cost shown separately from the provider’s margin. Transparent, cheaper at volume, more work to reconcile.
• Subscription or interchange-plus-zero. A monthly fee plus interchange at cost. Only worth it at substantial volume.

Two things to check regardless of model: whether the original processing fee is returned to you when you refund a customer — often it isn’t — and what international and currency conversion add, which is frequently 1–2% and easy to overlook until you sell abroad.

Payout Speed Is a Growth Constraint

Two providers with identical rates can have very different effects on your business depending on when they pay you.

Standard settlement is commonly two to three business days after capture, but weekly or bi-weekly payout cycles are normal on aggregated platforms, and risk assessment can extend them without much notice.

If you spend on advertising, payout timing is your cash conversion cycle. Paying for traffic today against revenue that lands in fourteen days means financing your own growth, and the faster you scale, the more capital that consumes.

What to Check Before Committing

• Payout schedule, and whether it changes based on risk assessment.
• Reserve policy in writing, including what triggers a change to it.
• Chargeback fee, and whether it’s refunded when you win.
• Refund fee handling.
• Prohibited and restricted categories, read properly against your actual roadmap.
• Payment data portability if you leave. Nobody asks until they want to leave, at which point it’s the only thing that matters.
• Support response times for payment failures, not general enquiries.
• Uptime incident history, not the SLA figure.

Multi-currency deserves specific attention if you sell internationally, because pricing in the customer’s own currency measurably improves conversion — multi-currency support that doesn’t require configuring conversion yourself removes a project rather than a setting.

The Mistake Almost Everyone Makes

Sellers compare processors and ignore the page in front of them.

The checkout page determines whether a visitor who intended to buy actually does. Form length, mobile behaviour, redirect versus embedded flow, how declines are handled, whether the expected payment method is present — those choices move revenue by percentage points.

Processing rates move it by fractions. If you spend a week on this decision, spend four days on conversion and payment method coverage, and one on rate.

Start Selling Without Assembling the Stack

Processing, gateway, tax handling, disputes, and multi-currency payouts are managed as one system rather than integrated by you.