How Payment Processing Works

📖 The Payment Processing Ecosystem

Payment processing involves multiple parties working together to move money from a customer's bank account to a merchant's bank account whenever a card is used for payment. Understanding this ecosystem is essential for merchants — especially those in high-risk industries — because each party has its own rules, fees, and risk tolerances that affect approval, pricing, and ongoing account management.

The five key players in a card transaction are: the cardholder (customer), the issuing bank (customer's bank), the card network (Visa, Mastercard, Amex), the acquiring bank (merchant's bank), and the merchant (you). In practice, most merchants also interact with a payment gateway (software that transmits transaction data) and a payment processor (the technical intermediary between the gateway and acquiring bank).

🔄 The Transaction Lifecycle

Every card transaction follows a standard lifecycle with four main phases:

1. Authorization — The customer enters card details at checkout and clicks "pay." The payment gateway encrypts this data and sends it to the processor, which routes it through the card network to the issuing bank. The issuer checks whether the card is valid, has sufficient funds or credit available, and whether the transaction appears legitimate based on their fraud models. The issuer returns an approval code (or decline reason) back through the same chain to the merchant. This entire process takes 1–3 seconds.

2. Authentication — For card-not-present transactions, many processors now require additional authentication through 3D Secure (3DS). The cardholder is redirected to their bank's authentication page to enter a password, biometric, or one-time code. 3DS shifts fraud liability from the merchant to the issuing bank for verified transactions, significantly reducing chargeback risk.

3. Batching & Clearing — At the end of each business day, the merchant batches all authorized transactions and submits them to the processor for settlement. The processor forwards the batch through the card network to the clearing system, which reconciles transactions between issuing and acquiring banks. During clearing, interchange fees are calculated and deducted.

4. Settlement & Funding — The acquiring bank receives funds from the issuing bank (net of interchange and network fees), deducts its own processing fees, and deposits the remaining amount into the merchant's designated bank account. Settlement timelines vary from T+1 (next business day) for low-risk merchants to T+3 or longer for high-risk businesses.

💰 Fee Structures Explained

Merchant processing fees comprise several components that merchants should understand to evaluate pricing accurately:

• Interchange Fees — The largest component (1.5–3.5% of transaction value), set by card networks and paid to issuing banks. These are non-negotiable and vary by card type, transaction type, and industry.
• Assessment Fees — Network fees (0.1–0.2%) paid to Visa and Mastercard for use of their infrastructure. Also non-negotiable and passed through to merchants.
• Processor Markup — The processor's profit margin, typically 0.2–1.0% plus $0.05–$0.25 per transaction. This is negotiable and varies significantly between providers.
• Monthly Fees — Gateway access fees ($10–$100/month), statement fees ($5–$15/month), PCI compliance fees ($0–$20/month), and minimum processing fees.
• Incidental Fees — Chargeback fees ($15–$100 each), retrieval fees ($5–$25 each), ACH return fees ($2–$5 each), and annual account fees.

High-risk merchants typically pay an effective discount rate of 3.5–8% depending on industry, volume, and processing history. This is significantly higher than the 1.5–3% rate for standard-risk merchants, reflecting the elevated chargeback and fraud risk that acquirers assume.

⚡ Settlement Timelines

When will funds actually arrive in your bank account? Settlement timelines depend on several factors:

• Standard (Low Risk): T+1 — Funds settle the next business day after batch submission
• Moderate Risk: T+2 — Funds settle after two business days
• High Risk: T+2 to T+3 — Funds settle after 2–3 business days, sometimes longer
• Startups / No History: T+3 to T+5 — Extended holds until processing history is established
• Aggregators (Stripe, PayPal): T+1 to T+2 for most, but funds may be held up to 21 days for new accounts or high-risk activity

For high-risk merchants, understanding settlement timelines is critical for cash flow planning. Rolling reserves further complicate this picture — if a 10% rolling reserve with a 180-day holding period is in place, 10% of each transaction's funds are effectively unavailable for six months.

🔒 Security & Compliance

Payment processing is governed by strict security standards designed to protect cardholder data. The primary framework is PCI DSS (Payment Card Industry Data Security Standard), which applies to any business that stores, processes, or transmits cardholder data.

PCI compliance is not optional — it is mandated by the card networks, and non-compliance can result in significant fines ($5,000–$100,000 per month), increased transaction fees, or loss of processing ability. The compliance level depends on transaction volume:

• Level 1: Over 6 million transactions per year — requires annual on-site audit by a Qualified Security Assessor (QSA)
• Level 2: 1–6 million transactions — requires annual self-assessment questionnaire (SAQ) and quarterly network scan
• Level 3: 20,000–1 million e-commerce transactions — requires annual SAQ and quarterly scan
• Level 4: Under 20,000 e-commerce transactions annually — requires annual SAQ and quarterly scan

Most high-risk merchants fall into Levels 2–4 and can complete compliance through a self-assessment questionnaire and quarterly ASV (Approved Scanning Vendor) vulnerability scan. Using a payment gateway with hosted checkout pages can significantly simplify compliance by reducing the scope of cardholder data exposure.

⚙️ High-Risk Processing Differences

How does payment processing differ for high-risk merchants compared to standard businesses? The fundamental transaction flow is the same, but several practical differences affect day-to-day operations:

• Underwriting: High-risk merchants face more stringent underwriting, requiring detailed business documentation, processing history (if available), owner background checks, and sometimes personal guarantees.
• Reserves: Most high-risk merchants are required to maintain rolling reserves (5–15% of each transaction held for 90–180 days) and sometimes upfront fixed reserves ($10,000–$50,000+).
• Chargeback Monitoring: High-risk accounts are monitored more frequently — weekly or daily — rather than monthly. Internal chargeback thresholds may be set lower than card network limits.
• Pricing: Higher discount rates, higher per-transaction fees, and stricter monthly minimums reflect the elevated risk. However, pricing is still negotiable for higher-volume merchants.
• Processor Relationships: High-risk merchants typically work with specialized processors who understand their industry, rather than mainstream providers like Stripe or Square that restrict certain verticals.