White-label payment infrastructure for acquiring banks
White-label payment gateway for low-risk PSPs
Built for high-risk PSPs — full control over your channels
A practitioner's guide to launching a payment service provider: choosing a model, signing an acquirer, licensing, PCI DSS, platform choice, costs, timelines and a 9-step launch plan.
To start a payment processing company, you choose a model — a technical PSP that never touches merchant funds, a payment facilitator, a licensed payment institution that collects and pays out funds, or a full acquirer — then sign an acquiring bank partner, obtain the licence that model requires and go live on a PCI DSS-compliant platform with AML/KYC and fraud controls. A technical PSP on a rented white-label gateway can be live in roughly 1–3 months: a SaaS platform is set up in weeks, and most of the time goes to acquirer onboarding and testing. Holding merchant funds in the EU requires a payment institution licence (€125,000 initial capital) or an e-money institution licence (€350,000) under PSD2 and EMD2, and authorisation usually takes 6–12 months or longer.
This guide is for founders, banks, acquirers and ISOs who want to launch an online payment service provider (PSP). It walks through the roles in a card payment, the business models, a 9-step launch plan, licensing in the EU, UK and US as of November 2026, PCI DSS, platform choice, costs and the metrics that matter after launch. If you want to resell an acquirer’s services as a sales agent instead, read our separate guide on how to start a credit card processing company as an ISO or agent.
“Payment processing company” covers several different businesses. Before you choose one, it helps to know who does what in an online card payment.
| Role | What it does |
|---|---|
| Payment gateway | Captures the payment details at checkout, encrypts them and passes them on for authorisation. |
| Payment processor | Carries the transaction messages between the merchant’s acquirer, the card scheme and the issuer. A front-end processor handles authorisation; a back-end processor handles settlement, reconciliation and reporting. |
| Payment service provider (PSP) | Bundles gateway, processing connections, payment methods, fraud tools and reporting behind one merchant integration. |
| Payment facilitator (PayFac) | Holds a master merchant account with a sponsoring acquirer and onboards smaller businesses as sub-merchants under it. |
| Acquirer (acquiring bank) | Contracts with merchants to accept card payments, provides the merchant account and receives the funds from the card scheme. |
| ISO / agent | An independent sales organisation that signs merchants up for an acquirer; it sells, the acquirer processes and settles. |
| Issuer | The cardholder’s bank. It approves or declines each payment and pays for it. |
| Card scheme | Visa, Mastercard and others set the rules and run the network between issuers and acquirers. |
Every card payment your company handles runs through the same two phases.
The shopper pays on the merchant’s checkout. The gateway sends the request through the processor and card scheme to the issuer, which approves or declines it, and the answer travels back the same way in seconds.
Approved transactions are batched and sent by the acquirer through the card scheme to the issuers.
Issuers pay the acquirer, and the acquirer pays the merchant’s account minus fees — or, in the Aggregator model, pays your company, which then pays the merchant.
The question that shapes everything else — licensing, capital, accounting and how fast you can launch — is whether money passes through your accounts. We explain this split in more detail in our four facts to check before launching a PSP.
For most newcomers the sensible path is to start as a Processor, prove the business and then apply for a licence. A regulator looks more favourably on a company with a processing track record than on a start-up with none.
Each rung adds control and margin but also capital, licensing and time. Figures are indicative industry ranges.
| Model | Holds funds? | What you need | Indicative setup cost | Time to launch |
|---|---|---|---|---|
| Agent / ISO | No | Contract with an acquirer; ISO registration for the ISO route | Agent under $1K; ISO from ~$10K | 2–4 weeks (agent); 2–3 months (ISO) |
| Technical PSP on a white-label platform | No | Acquirer partners, PCI DSS (covered by the platform vendor), merchant contracts | Setup fee plus monthly subscription | ~1–3 months; platform setup takes weeks |
| PayFac (sponsored) | Yes, via the sponsor | Acquirer sponsorship, Visa/Mastercard registration, possibly US money transmitter licences | $25K–$250K (“PayFac-in-a-box”); $250K+ registered | 3–6 months (in-a-box); 6–12 months registered |
| Licensed PSP / aggregator (EU PI or EMI) | Yes | PI or EMI licence, safeguarding, AML programme | €125K (PI) or €350K (EMI) initial capital, plus legal and operating costs | 6–12 months licensing |
| Acquirer / scheme principal member | Yes | PI, EMI or bank licence plus Visa/Mastercard principal membership | Highest: bank-level regulatory capital plus scheme membership costs | Longest route, usually several years |
Dashed segments mean the route often takes longer. Licensing, acquirer onboarding and merchant contracts run in parallel with platform setup.
The order matters. Teams that build technology before they have an acquirer and a licensing plan often rebuild it later.
Decide which merchants you will serve: their industries, where they are registered and which countries they sell to. These answers determine your payment methods, pricing, risk appetite and which acquirers will work with you. “Everyone who sells online” is not a niche.
Processor or Aggregator, PayFac or licensed PSP. Draw the money flow on one page: who collects, who settles, who carries chargeback liability.
Start with Visa and Mastercard plus one or two of the most popular local methods in each target market. In some countries a local method leads: iDEAL in the Netherlands, Bancontact in Belgium, Cartes Bancaires in France, boleto in Brazil. Add wallets and bank transfers as merchants ask for them.
Incorporate where your licence, acquirers and banking partners are. If you plan to become an Aggregator, the regulator of that country will supervise you, so choose it before you incorporate.
Acquirers run their own due diligence on you. Negotiate revenue share, settlement terms and merchant onboarding rules. PayFacs also need the acquirer to sponsor their registration with the card schemes.
Prepare capital, a business plan, AML/CTF policies, safeguarding arrangements and fit-and-proper management. Hire a compliance officer early, and engage legal counsel before you file.
You need a gateway, merchant back office, acquirer and payment-method connectors, fraud tools, reporting and APIs. See the comparison in the technology section below.
PCI DSS, merchant KYC and underwriting, AML transaction monitoring, fraud screening, chargeback handling and data protection (GDPR in Europe). Write the policies and train staff before the first live transaction.
Go live with a small pilot group of merchants, fix what breaks, then scale sales through direct sales, partners and resellers. Track conversion and acquisition cost, not vanity metrics.
A technical PSP that never holds funds usually needs no payment licence. The moment you collect and pay out merchant money, you are providing a regulated payment service. For jurisdiction-by-jurisdiction detail, see our overview of payment institution and e-money licences.
PSD2 and the second E-Money Directive (EMD2) are still the law. A payment institution that executes payments, acquires or issues needs €125,000 of initial capital; an e-money institution needs €350,000. Authorisation typically takes 6–12 months.
PSD3 and the Payment Services Regulation (PSR) are close but not final. The Parliament and Council reached a provisional agreement on 27 November 2025, and the Council adopted both texts at first reading on 29 October 2026. They still need European Parliament plenary adoption and publication in the Official Journal. When they enter into force:
Final PSD3 capital requirements have not been confirmed in a published text. If you apply in 2026–2027, plan on the current PSD2/EMD2 figures and expect to re-authorise under PSD3.
Holding customer funds in the UK requires authorisation by the Financial Conduct Authority as a payment institution or e-money institution. Initial capital depends on the tier and the services you provide, so confirm your tier with the FCA rules or a UK adviser before you budget.
There is no single federal payment licence. Companies that hold and move customer funds generally need a money transmitter licence in each state where they operate, and registered PayFacs may need them too. States are converging on the CSBS Money Transmission Modernization Act (MTMA): 35 states had adopted it in full or in part by August 2026, which simplifies multi-state applications but does not remove them.
You cannot connect to Visa or Mastercard on your own. There are two ways in.
An acquirer that is a scheme member sponsors you. PayFacs cannot self-register: the acquirer registers them with Visa, and Mastercard works the same way through a principal member. Vendor-reported registration fees are around $5,000 per network per year, with some quoting up to $10,000 per network.
You become a scheme member and acquire merchants directly. It requires a licensed entity, a 6–12 month scheme review and significant annual scheme fees, so it is the last rung of the ladder, not the first.
Any company that stores, processes or transmits card data must comply with PCI DSS; the current version is 4.0.1. Under Visa’s rules, a service provider that handles more than 300,000 transactions a year is Level 1 and needs an annual onsite assessment by a Qualified Security Assessor (QSA). Do not confuse this with the merchant Level 1 threshold of 6 million transactions. The output is a Report on Compliance (ROC) and an Attestation of Compliance (AOC), not a “certificate”. Vendor surveys put a Level 1 audit at $15,000–$250,000, most often $40,000–$100,000, before remediation and tooling.
Running on a PCI DSS Level 1 white-label platform moves card data storage and most of the assessment scope to the vendor. You still own your policies, access controls and the parts of the flow you operate.
Your platform has to cover the gateway and hosted payment page, a transaction engine, acquirer and payment-method connectors, a merchant back office, fraud tools, reconciliation, reporting and merchant APIs. Changing platforms later is expensive, so choose carefully.
| Criteria | Build in-house | Buy a licence | Rent a white-label platform |
|---|---|---|---|
| Time to launch | 6+ months for basic card processing; 6–12 months for a gateway | Faster than building, plus deployment | About 1 month of setup |
| Upfront cost | Highest: development team and infrastructure | Often six figures | Setup fee and monthly subscription |
| PCI DSS | Your own Level 1 assessment every year | Your own assessment; vendor helps prepare | Vendor-managed for the platform |
| Control | Full | High, but changes are billed by the vendor | Configurable; roadmap shared with the vendor |
| Ongoing team | Permanent engineering team | Engineers and DevOps | Integration and support staff |
Building gives the most control and the highest bill; our analysis of build vs buy total cost of ownership breaks it down. For most new PSPs, renting is the fastest route to the first merchant: you get a branded gateway and back office, hosting and PCI DSS scope handled by the vendor. Read more about what a white-label payment gateway includes, how a white-label solution for PSPs is set up, and which modules to look for in payment service provider software. If you plan to work with several acquirers, make sure the platform supports payment routing and cascading from day one.
Your model sets the cost floor. The table below lists the items most founders underestimate.
| Cost item | Who pays it | Indicative figure |
|---|---|---|
| Initial capital (EU) | Licensed PIs and EMIs | €125,000 (PI) / €350,000 (EMI) under PSD2/EMD2 |
| Licence application and legal support | Aggregators | Varies by jurisdiction; budget for specialist counsel |
| Card scheme registration | PayFacs | About $5,000–$10,000 per network per year (vendor-reported) |
| PCI DSS Level 1 assessment | Anyone running their own card environment | $15,000–$250,000, typically $40,000–$100,000 (vendor surveys) |
| Platform | Everyone | From a monthly white-label subscription to a multi-month in-house build |
| Team | Everyone | Compliance/MLRO, risk and underwriting, payment operations, sales, support, integration engineers |
Plan for 12–18 months of runway. Acquirer onboarding, licensing and the first merchants’ ramp-up all take longer than expected, and transaction revenue builds slowly.
Costs also scale with scope: every extra country, currency and payment method adds integration, compliance and tax work. Launching in one region with a focused set of methods keeps the first year affordable.
A PSP charges merchants a flat fee per transaction, a percentage of the amount, or both, so revenue grows with the number and value of payments processed. On top of that come setup and monthly fees, currency conversion, chargeback fees and paid services such as fraud screening.
One rate for the merchant covers everything. Simple to sell, but you carry the risk when interchange varies.
Interchange and scheme fees pass through at cost; you earn a fixed markup. Transparent and preferred by larger merchants.
Setup, monthly platform, FX, dispute and value-added service fees smooth revenue between volume peaks.
Margins are thin because most of what the merchant pays goes to issuers and card schemes. In the EU, interchange on consumer cards is capped at 0.2% for debit and 0.3% for credit, so a PSP earns only its markup on top of these pass-through costs. For the full fee breakdown, pricing models and a worked example, see our guide to the payment gateway business model.
Measure what drives revenue and risk, not page views or sign-ups:
If you plan to serve card merchants under your own brand, our guide to white-label credit card processing explains how the brand, acquirer and platform fit together. When you are ready to compare platforms, see how eComCharge supports payment service providers or explore our white-label payment gateway platform.
It depends on the model. A sales agent or referral partner can start for under $1,000, an ISO from about $10,000, and a registered payment facilitator from about $250,000, according to Swipesum. A licensed EU payment institution needs €125,000 of initial capital (€350,000 for an e-money institution) before legal, compliance and staff costs. A technical PSP on a rented white-label platform avoids most build and certification costs and pays a setup fee plus a monthly subscription instead.
Yes, if you never hold merchant funds. A technical PSP (the Processor model) provides the gateway, integrations and fraud tools while the acquiring bank settles money directly to merchants, so it generally needs PCI DSS compliance and contracts, not a payment licence. Once you collect funds on merchants' behalf and pay them out (the Aggregator model), you need a licence such as an EU payment institution licence or, in the US, state money transmitter licences.
A payment processor moves the authorisation and settlement messages between the merchant's acquirer, the card scheme and the issuer. A payment service provider (PSP) packages processing, payment methods, fraud tools and reporting into one merchant integration. A payment facilitator (PayFac) holds a master merchant account with a sponsoring acquirer and onboards smaller businesses as sub-merchants under it.
A technical PSP on a rented white-label platform can usually go live in 1 to 3 months, because a SaaS platform is set up in weeks and most of the time goes to acquirer onboarding and testing. EU payment institution authorisation typically takes 6 to 12 months, a registered PayFac 6 to 12 months or more, and becoming a card scheme principal member with your own acquiring is the longest route, usually several years.
No. Most payment companies operate without a banking licence. A technical PSP needs no payment licence at all, and a company that holds merchant funds in the EU usually needs a payment institution or e-money institution licence, which has much lower capital requirements than a bank. A banking licence only becomes relevant if you want to take deposits or lend.
Under PSD2, a payment institution offering payment execution, acquiring or issuing needs €125,000 of initial capital, and under EMD2 an e-money institution needs €350,000. These figures still apply in November 2026. PSD3 will fold e-money institutions into the payment institution regime, but its final capital amounts should be checked in the text published in the Official Journal.
The Council adopted PSD3 and the Payment Services Regulation at first reading on 29 October 2026; the texts still need European Parliament adoption and publication in the Official Journal. Core provisions are expected to apply after a 21-month implementation period, e-money institutions will become a sub-category of payment institution, and existing licence holders will have to submit re-authorisation information. Until then, PSD2 and EMD2 remain the law.
Any company that stores, processes or transmits card data must comply with PCI DSS. Under Visa's rules, a service provider handling more than 300,000 transactions a year is Level 1 and needs an onsite assessment by a Qualified Security Assessor. Vendor surveys quote $15,000 to $250,000 for a Level 1 audit, most often $40,000 to $100,000. Running on a PCI DSS Level 1 white-label platform moves most of that scope to the vendor.
Use a white-label platform unless payment technology is your core product and you have the budget for a long build. Basic card processing takes at least six months to build, plus a permanent engineering team and annual PCI DSS assessment. A rented white-label gateway is typically set up within weeks, with hosting and PCI DSS handled by the vendor, so you can spend your runway on acquirers, licensing and merchants.
They charge merchants a percentage of each payment, a fixed fee per transaction, or both, on top of pass-through costs such as interchange and card scheme fees. Extra revenue comes from setup and monthly fees, currency conversion, chargeback handling and value-added services like fraud screening. After pass-through costs, the margin a PSP keeps is thin.
eComCharge develops and delivers the PCI DSS Level 1 certified white-label payment platform for Payment Service Providers and Payment Orchestration.
Learn the best practices to automate high-risk onboarding, reduce security risks, and ensure a smooth, compliant onboarding experience.
Discover how a multi-acquirer-protection-strategy enhances payment security, reduces fraud, and ensures seamless transactions for merchants.
Recover declined transactions cascading with expert tips to reduce payment failures and optimize your payment processing workflow
Unlock business growth with custom payment solutions tailored to your needs. Discover secure, flexible options for seamless transactions today.
Discover leading payment tokenization service providers. Compare features, benefits, and find the best solution for your business needs.
Discover the best all in one payment gateway to streamline your business payments, manage transactions, and integrate multiple solutions easily.