Payment Gateway vs Merchant Account

Payment gateway and merchant account are two parts of taking a card payment. This guide explains how Stripe, PayPal and the PCI Security Standards Council describe them, as read on 2026-10-16. The terms are used loosely across the industry, and two of the three sources are payment providers, so treat the definitions below as how each describes its own part of the system. For the broader picture, see payment processing for small business.

Payment gateway

Stripe says the payment gateway acts as an intermediary between the customer and the business, transmitting payment information and authorizing transactions. It encrypts payment data and sends it to the business’s designated merchant account for processing. PayPal describes the gateway as the method used to process a customer’s credit or debit payment, through a physical card reader in a store or a payment page on an e-commerce site, which encrypts and securely transmits payment data between the customer, merchant and financial institution.

Stripe adds that any business with a website or online store will need a payment gateway, and that an in-person business can use one to accept contactless payments.

Merchant account

Stripe describes a merchant account as a specialized bank account that enables businesses to accept electronic payments, process transactions and settle funds. In its explanation, the merchant acquirer asks the card issuer to authorize a transaction and, if approved, captures the funds; the merchant account provider processes the transaction, deducts any fees, and deposits the remaining funds into the business’s regular bank account. Stripe says businesses use merchant accounts for processing and settling electronic payments and regular business bank accounts for general banking.

PayPal calls a merchant account a holding account for business funds, similar to a business bank account, and says payments are deposited into it and briefly held before being transferred to the main bank account. It also says merchant accounts often charge multiple fees, including monthly fees, transaction fees and chargeback fees.

How a card payment moves through them

Using PayPal’s online example, the steps run like this:

1. The customer enters card data, or chooses a wallet, to start the payment.
2. The gateway encrypts the data and sends it to the payment processor or merchant bank.
3. The processor contacts the customer’s issuing bank to see if there are funds or credit. If there are not enough funds, or if there is a risk of fraud, the payment is denied.
4. If the issuer authorizes it, funds are transferred to the processor and deposited into the business’s merchant account.
5. The gateway sends confirmation back to the point of sale or website, and the seller delivers the goods.

PayPal says all of this happens in seconds. Stripe’s version ends with the funds settled into the business’s designated bank account, typically within a few business days.

Why the words do not line up

The PCI Council’s Guide to Safe Payments defines a merchant bank as a bank or financial institution that processes credit and debit card payments on behalf of merchants, and says acquirer, acquiring bank, and card or payment processor are also terms for this entity. For e-commerce, the same guide refers to the connection to a merchant bank as also called a payment service provider or payment gateway. So one provider’s “gateway” can be another’s “processor”, and a provider that handles several of these roles may not sell them separately.

That is why quotes are hard to compare. Ask each provider:

• Which of these roles does your service cover, and which do I need to buy from someone else?
• Whose agreement do I sign, and who sets my fees?
• Is there a monthly fee, a per-transaction fee, a setup fee or a chargeback fee?
• Do I get my own merchant account, or are my payments processed under a provider account?

We explain the account side in merchant accounts explained and merchant services explained, and how fees are structured in interchange-plus vs flat rate.

Security and PCI

Both gateways and merchant banks matter for card data security. The PCI Council’s guide says online merchants that wholly outsource handling of card data to a PCI DSS validated third party are usually in the safest position. See PCI compliance for small business.

What we did not verify

We did not verify gateway pricing for any provider on this page, nor which providers hold funds for new accounts. PayPal’s and Stripe’s articles are marketing-adjacent educational pages; for a specific provider, read its agreement and pricing page.