Payment gateway development companies build and certify the software that authorizes, secures, and settles card payments: the payments API and checkout, tokenization and the card vault, acquirer integrations, fraud controls, and settlement.
The shortlist includes the ones that have shipped a gateway and taken a client through PCI DSS and acquirer certification, because a team without certification experience stretches the launch date further than the code ever does. Companies to shortlist in 2026 include SPD Technology, EPAM, ELEKS, Andersen, Intellectsoft, Jappware, Appinventiv, and Altoros.
A payment gateway looks like infrastructure you buy once and stop thinking about. It works as a revenue system because any timeout, failed authorization, or settlement discrepancy in your online transactions immediately costs you money.
That exposure grows with transaction volume, and digital transactions are increasing at the expense of cash transactions. Global non-cash transaction volume is expected to grow to about 4,002.5 billion transactions by 2030, almost double the current amount; hence the cost to pay for your partner to undergo certification.
The usual starting point is a list of payment gateway development companies with a paragraph of marketing copy under each name. Nothing there tells you who has certified a gateway with an acquirer, and it leaves you without a benchmark for scope, timeline, or cost.
Below is the shortlist, then the numbers behind it: when to build, what a gateway contains, what has to be certified, how long it takes, and what it costs.
Top Payment Gateway Development Companies in 2026: Comparison Table
Shortlisting payment gateway development companies starts with evidence of delivery, so every company below offers payment gateway solutions or payment software development as a named service and publishes payments work that can be checked. SPD Technology appears first as the publisher of this list, and the remaining seven follow in no ranked order.
The last two columns carry most of the signal: what each company concentrates on inside payments, and the kind of buyer its delivery model suits. Teams that have shipped a platform end-to-end scope projects differently from teams that have integrated one, a gap visible in how fintech companies build payment platforms. Breadth across the surrounding stack is worth checking too, through each company’s wider fintech software development record.
Company | HQ | Team Size | Payments Focus | Best Fit |
|---|---|---|---|---|
SPD Technology | London, UK; delivery centers across Europe | 650+ | Custom gateways, PayFac platforms, orchestration, Adyen integration | Fintechs, PSPs, and platforms building or scaling payment infrastructure |
EPAM | Newtown, US | 10,000+ | Large-scale financial services engineering | Banks and enterprises with large programs |
ELEKS | Tallinn, Estonia | 1,000–9,999 | Payment solutions aligned to business architecture | Enterprises needing architecture-led delivery |
Andersen Inc. | Warszawa, Poland | 1,000–9,999 | Payment systems with long-term team support | Companies needing stable dedicated teams |
Intellectsoft | Miami, FL | 50–249 | API-driven, multi-currency solutions | International eCommerce and product companies |
Jappware | L’viv, Ukraine | 50–249 | Custom gateways for regulated environments | Fintechs needing deep system integration |
Appinventiv | Noida, India | 1,000–9,999 | Payment and wallet apps | Consumer-facing payment products |
Altoros | Pleasanton, CA | 250–999 | Enterprise and banking solutions | Banks with compliance-heavy projects |
Company
SPD Technology
EPAM
ELEKS
Andersen Inc.
Intellectsoft
Jappware
Appinventiv
Altoros
HQ
London, UK; delivery centers across Europe
Newtown, US
Tallinn, Estonia
Warszawa, Poland
Miami, FL
L’viv, Ukraine
Noida, India
Pleasanton, CA
Team Size
650+
10,000+
1,000–9,999
1,000–9,999
50–249
50–249
1,000–9,999
250–999
Payments Focus
Custom gateways, PayFac platforms, orchestration, Adyen integration
Large-scale financial services engineering
Payment solutions aligned to business architecture
Payment systems with long-term team support
API-driven, multi-currency solutions
Custom gateways for regulated environments
Payment and wallet apps
Enterprise and banking solutions
Best Fit
Fintechs, PSPs, and platforms building or scaling payment infrastructure
Banks and enterprises with large programs
Enterprises needing architecture-led delivery
Companies needing stable dedicated teams
International eCommerce and product companies
Fintechs needing deep system integration
Consumer-facing payment products
Banks with compliance-heavy projects
Company details as of October 2026.
Payment Gateway Development Companies: Short Profiles
Short profiles of payment gateway development companies are worth reading for two things: what the vendor builds into payments, and one indicator that can be verified by the buyer without making a sales call. Ratings and employee count say more about the business’s size and client sentiment than about their experience building gateways. It is the specialization line that matters.
SPD Technology
Clutch rating: 4.8
Specialization: custom payment gateways, PayFac platforms, payment orchestration, and Adyen integration for fintechs, PSPs, and high-volume platforms
SPD Technology has developed payment gateways and payment platforms since 2006 and holds Adyen implementation partner and AWS partner status. The company works from its London headquarters with delivery centers across Europe and a team of 650+ engineers. The payments record includes a custom payment processing platform built for Poynt and merchant systems built for Blackhawk Network, which onboarded more than 8,000 US businesses in two years.
Project scope runs from merchant payment gateway development through settlement and reconciliation, including the custom payment portals merchants log into for statements and dispute handling. Platforms adding a second processor usually start with Adyen integration services, and the same team carries the build through acquirer and PCI DSS certification.
EPAM
Clutch rating: 4.8
Specialization: enterprise financial services engineering, with payment workstreams delivered inside larger platform and modernization programs
EPAM works in large-scale financial services engineering, where payments sit inside broader platform programs for financial institutions and large enterprises. Founded in 1993 and headquartered in Newtown, US, the company has a team of over 10,000 people, which is the scale its multi-year financial services programs are built around. Engagements at that size usually run through a central program office, so EPAM settles the scope and architecture of a payments workstream well before a gateway component is built.
ELEKS
Clutch rating: 4.8
Specialization: architecture-led payment solutions, where the target system design is agreed before the build starts
ELEKS positions its payment solutions around business architecture, so engagements tend to start at the architecture layer before any build begins. The company has been operating since 1991 and now runs from Tallinn, Estonia, with a team in the 1,000 to 9,999 range. That architecture-first approach means the system and security architecture, including what stays inside the cardholder data environment, are settled before engineering starts.
Andersen Inc.
Clutch rating: 4.9
Specialization: long-running dedicated payment teams that stay with a product across release cycles
Andersen Inc. supports payment solutions with dedicated teams that work on a project for an extended period, which is useful for teams that need the same engineers across several release cycles. Andersen Inc., established in 2007 in Warszawa, Poland, has a staff of 1,000 to 9,999 people, sufficient to have several dedicated payment teams working concurrently. This approach lets those engineers work on the payment solution post-launch, as anti-fraud rules and reconciliation logic are refined.
Intellectsoft
Clutch rating: 4.9
Specialization: API-driven, multi-currency payment solutions for international eCommerce and product companies
API-driven, multi-currency solutions are the stated payments angle at Intellectsoft, aimed at international eCommerce and product companies. The company was founded in 2007 and works from Miami, FL, with a team of 50 to 249. Its API-driven work covers multi-currency support, settlement differences, and the local payment methods each new market introduces.
Jappware
Clutch rating: 5.0
Specialization: custom gateways for regulated environments, with deep integration into existing financial systems
Custom gateways for regulated environments and deep system integration define the positioning at Jappware. Founded in 2017 in L’viv, Ukraine, the company works with a team of 50 to 249 and carries a 5.0 rating on Clutch. Its regulated-environment work relies on integrating with legacy systems already in production, which requires the ability to probe during a reference call.
Appinventiv
Clutch rating: 4.6
Specialization: consumer-facing payment and wallet applications across mobile platforms
It focuses on payment apps and digital wallets, positioning Appinventiv more toward consumer goods rather than core processing. Founded in 2015 and based in Noida, India, it has a team of 1,000 to 9,999 people across mobile & product engineering. Therefore, its payment operations focus on the checkout experience inside mobile apps, Apple Pay and Google Pay support, and app store release cycles.
Altoros
Clutch rating: 4.8
Specialization: enterprise and banking solutions for compliance-heavy environments
Enterprise and banking solutions shape the payments work at Altoros, aimed at banks running compliance-heavy projects. The company has operated from Pleasanton, CA since 2001, with a team of 250 to 999. Its banking engagements run in environments where audit readiness and control documentation form part of every release.
Do You Need a Custom Payment Gateway? Build vs. Integrate vs. Orchestrate
The decision depends primarily on annual processing volume and the need to control routing, the checkout process, and the data. Volume determines the base level, while the control requirement determines if the threshold is passed. The build versus buy analysis shows the three routes in relation to volume levels, and the comparison behind build vs. buy a payment gateway explains the trade-offs in each row.
Path | Annual Processing Volume | What You Get | Typical Timeline |
|---|---|---|---|
Third-party gateway (integration) | Under $20M | Fastest launch, lowest upfront cost, minimal PCI DSS scope | Weeks |
Payment orchestration layer | $20M–$100M | Custom routing across several providers, and most of the value of a custom gateway at a fraction of the cost | 3–6 months |
Custom payment gateway | Over $100M | Full control, lowest cost per transaction, complete data ownership | 12–24 months |
Path
Third-party gateway (integration)
Payment orchestration layer
Custom payment gateway
Annual Processing Volume
Under $20M
$20M–$100M
Over $100M
What You Get
Fastest launch, lowest upfront cost, minimal PCI DSS scope
Custom routing across several providers, and most of the value of a custom gateway at a fraction of the cost
Full control, lowest cost per transaction, complete data ownership
Typical Timeline
Weeks
3–6 months
12–24 months
There are four triggers for developing your payment gateway, and each becomes apparent at high transaction volumes. Processing charges that exceed 1.5% to 2% of total revenue make the cost line the budget bottleneck. If the incumbent won’t reveal a white-label checkout or routing mechanism, the product roadmap becomes the bottleneck, while direct acquirer relationships provide a place for routing. Transaction data ownership finally makes the pricing, risk model, and reconciliation your assets.
Payment gateway integration companies connect your product to an existing gateway such as Stripe or Adyen, which is the scope covered by payment gateway integration services, while a gateway development company builds the processing core itself.
Crypto payment gateway development companies solve a different problem: wallet custody and blockchain payments replace acquirer connections, so crypto payment gateway development deserves its own evaluation.
What a Payment Gateway Development Company Must Be Able to Build
A payment gateway is eight or nine systems working together, and a payment gateway development company worth shortlisting has built each of them. Payment gateway software development gets sold as a single line item, so the table below splits it into the parts that have to exist, with the question that exposes real experience in each one.
Component | What It Does | What to Ask the Company |
|---|---|---|
Payments API and checkout | Accepts payment requests from web, mobile, and POS; hosted or embedded checkout | How do you prevent duplicate charges on retries? |
Tokenization and card vault | Replaces card numbers with tokens; stores card data encrypted | How do you keep most of our systems out of PCI DSS scope? |
Processing engine and routing | Authorization, capture, refunds; routes each transaction to the best acquirer | How does failover work when an acquirer is down? |
Acquirer and processor integrations | Connections to acquiring banks, processors, and card schemes | Which acquirers have you certified with? |
Payment methods | Cards, Apple Pay, Google Pay, ACH, SEPA, and local methods | Which local methods have you integrated, and where? |
3-D Secure and authentication | EMV 3-D Secure and Strong Customer Authentication | How do you balance fraud checks against approval rates? |
Fraud and risk controls | Rules, risk scoring, velocity checks, chargeback handling | How are fraud rules tuned after launch? |
Settlement and reconciliation | Matches transactions to payouts; calculates fees and splits | How do you handle late chargebacks and refunds in reconciliation? |
Merchant onboarding and reporting
| KYC checks, merchant accounts, dashboards, and statements | How long does onboarding one merchant take in a system you built? |
Component
Payments API and checkout
Tokenization and card vault
Processing engine and routing
Acquirer and processor integrations
Payment methods
3-D Secure and authentication
Fraud and risk controls
Settlement and reconciliation
Merchant onboarding and reporting
What It Does
Accepts payment requests from web, mobile, and POS; hosted or embedded checkout
Replaces card numbers with tokens; stores card data encrypted
Authorization, capture, refunds; routes each transaction to the best acquirer
Connections to acquiring banks, processors, and card schemes
Cards, Apple Pay, Google Pay, ACH, SEPA, and local methods
EMV 3-D Secure and Strong Customer Authentication
Rules, risk scoring, velocity checks, chargeback handling
Matches transactions to payouts; calculates fees and splits
KYC checks, merchant accounts, dashboards, and statements
What to Ask the Company
How do you prevent duplicate charges on retries?
How do you keep most of our systems out of PCI DSS scope?
How does failover work when an acquirer is down?
Which acquirers have you certified with?
Which local methods have you integrated, and where?
How do you balance fraud checks against approval rates?
How are fraud rules tuned after launch?
How do you handle late chargebacks and refunds in reconciliation?
How long does onboarding one merchant take in a system you built?
Ask each candidate to walk you through one of their own transaction flows, from checkout to settlement, in a system they built.
Checkout is the surface the whole gateway gets judged on, and it extends beyond the browser because it is also the first place payment data enters the system. Anyone taking payments in store inherits terminal behavior, EMV kernels, and offline handling, which is why POS software development sits next to gateway work for omnichannel merchants.
Fraud protection works much better as an owned component, since policies in a purchased add-on wouldn’t have visibility into authorization, capture, and chargeback data in one place. Integrating fraud prevention software into the payment transaction flow keeps these factors flexible for later optimization.
The last row of that table covers merchant onboarding and the payment portals merchants work in afterward, and it is the one a buyer can verify from the outside, since merchant onboarding time is visible without access to any code. One of our own onboarding builds gives a sense of the range. More than 8,000 US businesses were onboarded in two years after Blackhawk Network replaced a manual merchant process that took about a week per business. The self-service registration portal built for that gift card distributor runs automated OFAC, EIN, and SSN checks, backed by Salesforce lead automation, and onboarding time dropped from 7 days to under 24 hours, as the aggregated merchant portal build sets out.
Compliance and Certification: What the Company Must Take You Through
Certification timelines tend to slip more than code; compliance is the most underestimated part of payment gateway development. Almost all builds include six requirement groups, stemming from card scheme specifications and financial regulations for handling financial information. Each requires dedicated time on the calendar, running in parallel with engineering.
Requirement | What It Covers | What It Takes |
|---|---|---|
PCI DSS | Security of cardholder data: storage, transmission, access, logging | Assessment by a qualified assessor; typically 6–9 months for Level 1 or 2 |
EMV 3-D Secure / SCA | Cardholder authentication; required under PSD2 in Europe | Integration and testing with schemes and issuers |
Card scheme and acquirer certification | Proof that the gateway handles messages and edge cases correctly | Test cycles in each acquirer’s sandbox before go-live |
KYC / AML | Verifying merchants and screening against sanctions lists | Automated checks built into merchant onboarding |
SOC 2 Type II | Operational security controls over time | 6–12 months of evidence collection |
GDPR and data residency | Personal data handling, storage location, erasure | Tokenization, pseudonymization, regional hosting |
Requirement
PCI DSS
EMV 3-D Secure / SCA
Card scheme and acquirer certification
KYC / AML
SOC 2 Type II
GDPR and data residency
What It Covers
Security of cardholder data: storage, transmission, access, logging
Cardholder authentication; required under PSD2 in Europe
Proof that the gateway handles messages and edge cases correctly
Verifying merchants and screening against sanctions lists
Operational security controls over time
Personal data handling, storage location, erasure
What It Takes
Assessment by a qualified assessor; typically 6–9 months for Level 1 or 2
Integration and testing with schemes and issuers
Test cycles in each acquirer’s sandbox before go-live
Automated checks built into merchant onboarding
6–12 months of evidence collection
Tokenization, pseudonymization, regional hosting
The requirements above are described in general engineering terms, and this article is not legal or compliance advice.
An assessment today measures the environment against a single active standard, since PCI DSS v4.0 was retired on 31 December 2024 and v4.0.1 has been the only active version supported by the PCI Security Standards Council since. Authentication carries its own version question, because EMV 3-D Secure supports PSD2 Strong Customer Authentication through two-factor authentication, and EMVCo recommends version 2.2 or higher for optimum functionality.
The development company should ensure that as much of the system as possible is not in contact with card data, since the smaller the scope of the system that touches card data, the lower the extent of data breach risks and audit costs, and the scope is defined in our guide to PCI DSS compliance levels. Payment processing compliance will cover broader reporting and licensing requirements. KYC and AML processes work best as onboarding logic within the platform and merchant onboarding solutions.
Designing those obligations in from the first architecture session costs less than retrofitting them around a live system, and the difference is easiest to see in a platform that carried the full set from day one. The embedded lending platform behind more than 4,000 funded businesses and over $350 million in facilitated financing carried PCI DSS, GDPR, and KYC/KYB obligations in its architecture from the first design review. Built from scratch in 18 months for a US- and Israel-based fintech lender, that SMB funding platform shows what compliance-by-design costs up front and returns later.
Oleksandr Boiko
Delivery Director at SPD Technology
“Scope decisions made in the first three weeks determine what the PCI DSS assessment costs for the next five years. If the checkout posts card data to your own servers before it is tokenized, every service behind that endpoint sits inside the cardholder data environment, and you will be paying an assessor to look at all of it, every year.”
How Long Does Payment Gateway Development Take?
It takes 12 to 24 months to build a fully custom payment gateway and 3 to 6 months to build an orchestration layer on top of existing providers, based on the delivery estimates we provide from our own gateway and orchestration implementations. The variation within those periods reflects certification running in parallel with engineering from the architectural stage onward. The timeline has six stages, and each ends with something the client can evaluate.
- Architecture and discovery, typically the first 3 weeks, end with a documented view of volumes, PCI DSS scope, and acquirer relationships, which is the ground covered by payment system architecture consulting.
- Security and compliance architecture delivers the card data scope decision, the token vault design, and a key management plan built around an HSM.
- Core engine development follows the sequence set out in how to build a payment gateway and ends with working processing, routing, fraud, and settlement services.
- Integration and certification testing closes out acquirer sandbox cycles, scheme certification, and load testing to 10 times peak.
- Compliance certification support delivers the PCI DSS assessment itself, along with SOC 2 readiness evidence.
- Go-live and hypercare cover phased rollout, monitoring, and an incident response rotation with named owners.
Every addition of an acquirer and every certification adds to the test cycles, which is the reason why projects tend to approach a two-year span.
How Much Does Payment Gateway Development Cost?
A production-grade custom payment gateway costs $500,000 to $2 million to build and $350,000 to $800,000 a year to run and keep compliant. Those figures come from our build-versus-buy and cost analysis, where the breakdown of the cost to build a payment gateway separates one-time engineering from the recurring compliance line. Payment gateway development cost reads more usefully as four items, which is how the table below splits it.
Cost Item | Typical Range | Notes |
|---|---|---|
Initial build | $500K–$2M | Production-grade gateway with core components |
Engineering and maintenance | $300K–$600K per year | 2–4 dedicated payments engineers |
PCI DSS compliance | $50K–$200K per year | Depends on level and scope |
Break-even | 12–24 months | At $100M+ annual processing volume |
Cost Item
Initial build
Engineering and maintenance
PCI DSS compliance
Break-even
Typical Range
$500K–$2M
$300K–$600K per year
$50K–$200K per year
12–24 months
Notes
Production-grade gateway with core components
2–4 dedicated payments engineers
Depends on level and scope
At $100M+ annual processing volume
Buyers tend to compare rate cards first, and the difference within the market segment is quite broad. According to GoodFirms, the median hourly rate for software development companies listed as of October 2026 is around $37, while published rates range from below $25 to above $200. Such a difference doesn’t mean much for the bill in this case, because the experience of getting certified determines the hours required.
Five factors push the number. Each additional payment method, and the work of acquiring it, adds integration and testing. Multicurrency settlements add reconciliation on top of that. The PCI DSS compliance level determines what percentage of the system the assessor must analyze, while fraud rules and scoring are payment software development factors and appear directly in the build. Transaction volume drives payment infrastructure costs, uptime targets drive redundancy, and recurring payments and subscription management are part of billing software development.
Why Choose SPD Technology
Payments has been a core line at SPD Technology since 2006, and the work has been in production long enough to measure, with one payments partnership running for more than five years and a merchant portal that onboarded more than 8,000 businesses in two years. Our 650+ engineers hold Adyen implementation partner and AWS partner status, and the work spans custom payment gateway solutions, PayFac platforms, payment orchestration, merchant onboarding, settlement, and automated reconciliation. Platforms moving toward a sponsorship model usually enter through PayFac platform development.
Custom Payment Processing Platform
Business Challenge
Poynt is a B2B fintech with smart payment terminals and an app marketplace, and it needed to add a second payment processor while moving to a PayFac model. Two things stood in the way: the new processor’s event-driven architecture did not fit the existing settlement system, and the PayFac model required hierarchical merchant relationships the system was never designed to hold.
Our Solution
We, at SPD Technology, built the custom payment processing platform for Poynt, bringing the Payments API, the payment gateway, the settlement service, and billing into one system, with a virtual payment terminal, a product catalog, and a payment processor integration framework around them. From there, we redesigned the settlement architecture for PayFac transactions and rebuilt billing to handle subscription, usage-based, and tiered pricing, while an embeddable checkout interface shipped alongside. A team of 10 delivered the work on Java, React, and AWS.
Delivered Outcomes
The initial omnicommerce payment system went live in 5 months, and the move to the PayFac model brought faster merchant onboarding. Adyen came in as the second payment processor soon after. The partnership has since run for more than 5 years, and the client was later acquired by a global company.
Payment System Integration and Bot Protection
Business Challenge
An online legal services platform serving customers in the UK and the US came under bot attacks, with stolen card numbers being tested against its payment forms. The immediate need was to stop the abuse, and we also had to add payment options and give the team visibility into transactions as they happened.
Our Solution
Our payment system integration work made Stripe the primary payment system and added ACH and IBAN payment methods that debit bank accounts directly. Alongside that, bot-traffic filtering now scores each session from 0 to 100 based on user behavior and IP address, so suspicious sessions are held back before they reach a payment form. Two back-end engineers delivered the build over 10 months using Java, Spring, and React, with monitoring and alerting in Prometheus and Grafana.
Delivered Outcomes
Bot traffic is filtered before it reaches the payment forms, and the new payment system went live with two additional payment methods behind it. Real-time transaction monitoring now covers a 20-million-customer base through dashboards and alerts.
Merchant Onboarding Automation
Business Challenge
A commerce and payments company needed to automate merchant onboarding from an external payment processing partner. The work came with three constraints, since data models had to be mapped between two systems, webhooks had to be handled reliably, and the partner’s documentation was incomplete.
Our Solution
Our team delivered the merchant onboarding automation as a serverless back end on AWS, with an API gateway, three Lambda functions, and two SQS queues carrying merchant and POS terminal operations. A Java Spring Boot service handles change requests, and a mock service covers webhook testing, so integration work could continue while the partner’s documentation caught up. Two back-end developers carried out the build.
Delivered Outcomes
Automation saves 30 man-hours daily. About 10 retailers join daily, and around 100 updates occur at the same time. The process is running successfully in production and can scale.
Key Takeaways
- The return on investment for building and complying with a custom payment gateway is achieved within 12 to 24 months once annual processing exceeds $100 million.
- Between $20 million and $100 million, a payment orchestration layer delivers most of the routing and cost benefits in 3 to 6 months, at a fraction of the cost of a full gateway.
- PCI DSS certification is the most underestimated part of a gateway project, typically taking 6 to 9 months, so a company without certification experience puts the launch date at risk.
- Tokenization reduces the number of systems that touch card data, lowering both security risk and the cost of future audits.
- Each additional acquirer adds a certification test cycle, so the number of integrations drives the timeline more than the amount of code does.
- An integration company connects a product to an existing gateway while a gateway development company builds the gateway itself, and hiring the wrong type leads to the wrong scope and budget.
In short: assess your payment gateway partners based on what they’ve delivered and certified, and let your processing volume determine which of the three tracks you are on before the first vendor meeting.
FAQ
What does a payment gateway development company do?
A payment gateway development company designs and builds the software that accepts, authorizes, and settles electronic payments: the payments API and checkout, tokenization, the processing engine, acquirer integrations, fraud controls, and settlement. The same company also supports PCI DSS and acquirer certification, and usually operates and maintains the gateway after launch. The practical separation from an integrator shows up in certification, since a builder has worked inside an acquirer sandbox and knows which message edge cases fail, while an integrator works above an interface someone else already certified.
How much does it cost to build a payment gateway?
A production-grade custom payment gateway typically costs $500,000 to $2 million to build. Running it costs a further $300,000 to $600,000 a year for a dedicated payments engineering team, plus $50,000 to $200,000 a year for PCI DSS compliance.
Most teams break even in 12 to 24 months at $100 million or more in annual processing volume. The number moves with the count of acquirers and payment methods, PCI DSS level and scope, fraud tooling, transaction volume, and uptime targets.
How long does payment gateway development take?
A full custom payment gateway takes 12 to 24 months, including acquirer integration and certification. A payment orchestration layer built on top of existing providers such as Stripe or Adyen takes 3 to 6 months. PCI DSS certification alone typically takes 6 to 9 months, so compliance work should start during the architecture phase. Schedules extend when acquirers are added, since each brings its own sandbox and test cycle, and when early scope decisions leave more services inside the cardholder data environment.
Should we build a custom payment gateway or use Stripe or Adyen?
Use a third-party gateway such as Stripe or Adyen for annual volumes under $20 million, as it will be faster to launch and will have a limited PCI DSS scope. Consider a payment orchestration layer for annual volumes of $20 million to $100 million, where smart routing through several providers will deliver most of the value within 3 to 6 months. You can use a custom gateway for volumes above $100 million or when you need custom routing or a white-label checkout.
What is the difference between payment gateway development and payment gateway integration?
Payment gateway integration connects a website, app, or platform to an existing gateway such as Stripe or Adyen, and takes weeks. Payment gateway development builds the gateway itself, including processing, tokenization, acquirer connections, and settlement, and takes a year or more. Integration suits most merchants, and development suits PSPs, PayFacs, and high-volume platforms. The step past development is becoming a processor, covered in our guide on how to start a payment processing company.
What is a white-label payment gateway, and when does it make sense?
A white-label payment gateway is a pre-existing gateway sold under your own brand, with your own checkout and merchant dashboards layered over someone else’s core. It works for platforms that need payments and merchant economics without a 12-to-24 month development period. The moment a white label becomes too complex, needing custom routing or acquiring relationships, the economics begin to look like payment facilitation.
What compliance does a payment gateway need?
A payment gateway needs PCI DSS certification for handling card data, EMV 3-D Secure for cardholder authentication (required under PSD2 in Europe), KYC and AML checks for merchant onboarding, and certification with each acquirer and card scheme. Many gateway operators also pursue SOC 2 Type II and must meet GDPR or other data protection rules. The architectural choices behind those obligations are set out in payment gateway compliance and security. Encryption, key handling, and monitoring practices fall under payment gateway security.