Main Players in Payment Processing

A single card payment looks instant to the customer, but behind the “Approved” message at least six or seven companies have each done a job in a couple of seconds, and each one takes a share of the fee. If you build checkout, manage a payments P&L, or negotiate with processors, you need a clear picture of who these parties are, what each one is responsible for, and where the money goes.

This guide walks through the main players in card payment processing, follows a real transaction through each of them, and then covers the newer parties (PayFacs, orchestration layers, token services, fraud vendors) that sit in most modern payment stacks.

The Core Parties at a Glance

In practice the lines blur. Stripe or Adyen, for example, act as gateway, processor and (through their licenses or bank partners) acquirer in one integration. Amex and Discover have historically acted as network and issuer at the same time. It still helps to separate the roles, because the fees, rules and failure points map to roles, not to company names.

What Each Party Does

Cardholder

The person who owns the debit, credit or prepaid card. The cardholder has an agreement with the issuer, not with the merchant’s bank or the network. That is why disputes (chargebacks) start with the cardholder calling their issuer. See What Is a Chargeback? for how that process runs.

Merchant

The business accepting the card. To accept cards, a merchant needs a merchant account with an acquirer (directly, or indirectly through a PayFac). The merchant is responsible for following network rules, keeping card data secure under PCI DSS, and handling refunds and disputes. The merchant pays the fees in the transaction.

Point of sale or checkout

Where the transaction starts: a card terminal in a store, a checkout page, an in-app payment sheet or a stored card used for a subscription. The checkout decides a lot about approval rates: which data it collects (address, CVV), whether it runs 3-D Secure, whether it uses wallets like Apple Pay, and how the transaction is flagged (customer-initiated vs merchant-initiated).

Payment gateway

The gateway is the secure connection between the checkout and the processing network. It encrypts or tokenizes the card data, adds merchant details, and sends the authorization request. Many gateways also offer fraud screening, stored-card vaults and reporting. For more detail, see What Is a Payment Gateway and What Does It Do?

Card vault

A secured, PCI-certified store that holds real card numbers (PANs) and returns tokens to the merchant. It can be part of the gateway, part of the processor, or an independent vault. See Tokenization vs Encryption.

Payment processor

The processor does the technical heavy lifting for the acquirer: it connects to the card networks, formats messages to network specifications (ISO 8583), sends authorizations, assembles the day’s captured transactions into clearing files, and produces the settlement and fee reports the merchant sees. People sometimes separate the front-end processor (authorization) from the back-end processor (clearing and settlement).

Acquiring bank (acquirer)

The acquirer is a member of the card networks and is financially responsible for its merchants. It underwrites the merchant, takes on the risk if the merchant goes out of business with unpaid chargebacks, receives funds from the network and pays them out to the merchant. Acquirers often work with ISOs (Independent Sales Organizations) that sell merchant accounts on their behalf. See PayFac vs ISO for how those models compare.

Card network

Visa, Mastercard and the other networks do not issue cards or hold merchant accounts in the four-party model. They run the switching infrastructure that routes messages between acquirers and issuers, calculate net settlement positions between banks, set the rules (including dispute rules and programs like VAMP), and set interchange rates. They also run services such as network tokenization and 3-D Secure directory servers.

Issuing bank (issuer)

The issuer gives the card to the cardholder, decides whether to approve each authorization, pays the network for approved purchases, and collects from the cardholder later.

Issuers run their own fraud models, so two issuers can treat the same transaction very differently. That is why approval rates should always be analyzed by issuer. See Payment Decline Codes Explained.

Following One Transaction Through the System

Here is a $100 online purchase, step by step:

1. Checkout. The customer enters a card (or uses a saved one) and clicks Pay.
2. Gateway. The gateway captures the card data securely, runs any fraud checks, and sends an authorization request to the processor.
3. Processor and acquirer. The processor, on behalf of the acquirer, formats the request and sends it to the right card network based on the card number’s BIN.
4. Network. The network routes the request to the issuer (and, for network tokens, swaps the token for the real card number first).
5. Issuer decision. The issuer checks available credit or balance, fraud signals and account status, then approves or declines with a response code. On approval it places a $100 hold.
6. Response. The answer travels back the same way to the checkout. Total time is typically one to three seconds.
7. Capture and clearing. When the order ships (or immediately, for digital goods), the merchant captures the payment. Captured transactions are batched and sent through the network in clearing files.
8. Settlement. The issuer pays the network, the network pays the acquirer, and the acquirer pays the merchant, usually one to three business days later, minus fees.

Authorization moves information; clearing and settlement move money. Many operational problems, such as settlement mismatches, missing captures and expired authorizations, happen in the gap between the two.

Where the Money Goes

On that $100 purchase the merchant might receive about $97 to $98. The difference, the merchant discount rate, is split roughly like this:

• Interchange goes to the issuer. It is the largest part and depends on card type, merchant category and how the transaction was processed.
• Network (scheme) fees go to Visa, Mastercard and the other networks.
• Acquirer and processor markup covers the acquirer, processor, gateway and any ISO or PayFac in the chain.

The full breakdown, with typical ranges, is in Payment Processing Fees: Who Makes Money and How Much.

Newer Players in a Modern Payment Stack

• Payment facilitators (PayFacs). Companies like Stripe, Square and Shopify Payments hold one master merchant account and onboard many sub-merchants under it, which makes signup fast. See What Is a Payment Facilitator?
• Payment orchestration platforms. A layer above several processors that routes each transaction to the best one and handles failover. See What Is Payment Orchestration?
• Token service providers. The networks’ own token services issue network tokens that keep card credentials current and raise approval rates. See Network Tokenization vs Vendor Tokenization.
• Fraud and risk vendors. Machine-learning fraud screening, device fingerprinting and chargeback management services that sit between checkout and the gateway.
• 3-D Secure providers. 3DS servers and access control servers (run for issuers) that handle strong customer authentication.
• Alternative payment methods. Wallets, BNPL providers and account-to-account payments add their own parties and flows. See What Is BNPL? and A2A Payments.

Why This Matters for Merchants and Product Teams

• Declines have an owner. A decline can come from your own fraud rules, the gateway, the processor, the network or the issuer. Knowing which party declined is the first step to fixing it.
• Fees have an owner. Interchange is set by the networks and paid to issuers, so it is mostly not negotiable. The acquirer and processor markup is.
• Risk has an owner. The acquirer carries the merchant’s risk, which is why it sets reserves, monitors chargeback ratios and can close accounts.
• Data flows through every party. Richer data in the authorization (address, device, 3DS results, correct transaction flags) helps the issuer approve more good transactions.

Payment Processing: Key Takeaways

• Payment processing involves at least six parties: cardholder, merchant, gateway, processor or acquirer, card network and issuer.
• Every card payment passes through authorization, then clearing and settlement, and each party in payment processing takes a fee.
• On a $100 purchase, most of the payment processing cost goes to the issuer as interchange.
• Knowing who does what in payment processing tells you who owns a decline and where to negotiate.

FAQ

What is the difference between the four-party and three-party models?

In the four-party model (Visa, Mastercard) the cardholder, merchant, issuer and acquirer are separate, and the network connects the banks. In the three-party model (historically American Express and Discover) the network is also the issuer and often the acquirer, so it deals directly with both cardholder and merchant.

Is a payment processor the same as an acquirer?

Not always. The acquirer is the licensed bank that is a network member and takes on merchant risk. The processor is the technology provider that runs transactions for the acquirer. Some companies are both.

Who approves or declines a card payment?

The issuer makes the final decision, but the merchant’s own fraud rules, the gateway and the network can also block a transaction before it reaches the issuer.

Who pays when a customer disputes a charge?

The issuer credits the cardholder and takes the money back from the acquirer through the network. The acquirer then debits the merchant. If the merchant cannot pay, the acquirer is liable.

Related Reading

• How to Make a Business out of Payments Processing
• Payment Processing Fees: Who Makes Money and How Much
• How to Choose a Payment Processor
• Authorization Rate Optimization: A Payments PM’s Complete Guide