Payment Gateway vs Merchant Account: What UK Businesses Need

The terminology is muddier than the decision underneath it. Most UK businesses that accept card payments are already using both a payment gateway and a merchant account, bundled inside a service like Stripe or Square, with no need to think about them as separate things. That arrangement holds up until your volume grows, your industry turns out to be one a payment service provider (PSP) will not serve, or an automated risk flag freezes your funds on the worst possible Tuesday.

Which UK providers bundle the two into one service, and which sell them separately, is what actually decides your costs and your exposure when something goes wrong. We compared the published pricing, settlement terms and contract structures on both sides of that line. Bundling stays the right answer for longer than most guides suggest, and the point where it stops being the right answer is narrower and more specific than simply getting bigger.

Payment Gateway vs Merchant Account at a Glance

That last row is the one we weigh most heavily. With a PSP aggregator you have no direct contract with an acquiring bank; you hold a sub-account inside the PSP’s master merchant account. The distinction does no work while payments are clearing on time. It does a great deal of work the day they are not.

What Is a Payment Gateway?

A payment gateway is the technology sitting between your checkout and the card networks. When a customer enters their card details, the gateway encrypts them and routes an authorisation request to the relevant card scheme (Visa, Mastercard, Amex), which checks with the customer’s issuing bank. Approval or decline comes back in a few hundred milliseconds.

The gateway’s job ends there. It does not hold your money. It does not set the interchange rate, which the card scheme fixes and regulation caps, and it does not decide when the funds reach your account. It authorises and routes, and that is the whole of it. We keep the two components apart deliberately, because most of the confusion in this category comes from treating the gateway as though it held the cash.

What the gateway does decide is how card data moves through your systems, and that has direct consequences under PCI DSS, the card industry’s data security standard. If you use a fully hosted gateway checkout where card data never touches your server (Stripe Checkout, PayPal Standard, SumUp’s embedded button), you fall under the shortest self-assessment questionnaire, SAQ-A: 31 questions and minimal controls. If you integrate a gateway API directly so card numbers transit your own server, that scope becomes SAQ-D: 251 questions and a much heavier compliance and audit burden. We checked this against the standard’s own questionnaires, not against provider marketing: the integration method, not the brand on the invoice, decides which applies to you.

UK domestic interchange caps apply regardless of which gateway you use: 0.2% for debit cards and 0.3% for credit cards, under rules retained from the EU Interchange Fee Regulation in UK law. That cap is the floor under everyone’s pricing, so it is not where providers differ. We compared them on the two layers that sit on top of it: the gateway fee, and the acquirer’s own cut.

What Is a Merchant Account?

A merchant account is a specialised holding account at an acquiring bank. Card payment receipts land there first; they do not go directly to your business bank account. The merchant account holds them until the settlement run, which then transfers the net amount, after interchange, scheme fees, and acquirer margin, to your nominated bank on whatever schedule your contract specifies.

The acquiring bank carries liability with the card scheme. If a customer disputes a payment and wins, the funds are clawed back from the merchant account. That liability is why acquirers underwrite merchants: they review your industry, your expected transaction patterns, and your chargeback risk before they agree to carry your payments.

With a PSP aggregator like Stripe or Square, your business has no direct acquiring relationship. Stripe is an FCA-authorised Electronic Money Institution; it acts as the acquirer and pools every merchant under one master merchant account, and you hold a sub-account inside that structure. For most UK businesses it works without incident and costs them nothing in practice. The limit shows the day Stripe’s automated risk systems flag your account: its obligations run to the card schemes, and it can hold your funds while a review proceeds. We treat that as the real difference between the two models, and it is not the one the pricing pages compete on.

A dedicated merchant account from Worldpay, Elavon, Dojo, or Adyen gives you a direct acquiring relationship: a formal contract, formal underwriting, and formal notice on both sides before termination. Setup takes longer, and there is usually a minimum volume or monthly fee. We put the recourse ahead of the rate card here, because what you buy with the longer setup is a contract you can point at rather than a support ticket queue.

How a Gateway and Merchant Account Work Together

The transaction lifecycle has six stages:

1. Checkout capture: The gateway collects and encrypts card data from the customer.
2. Authorisation request: The gateway sends the transaction to the acquirer (or directly to the card scheme, depending on the integration).
3. Card scheme routing: The scheme (Visa, Mastercard) routes the request to the customer’s issuing bank.
4. Issuer decision: The issuing bank approves or declines. If the transaction triggers 3DS2 (Strong Customer Authentication), the customer is prompted for authentication before the final approval.
5. Settlement batch: Approved transactions accumulate during the day. At batch close, the acquirer sends a settlement file to the card scheme.
6. Funds transfer: The card scheme nets interchange and scheme fees; the acquirer deducts its margin; the remainder transfers from the merchant account to your business bank account on the agreed schedule.

Stages one to four happen in real time. Stages five and six are where settlement timing differences originate, and the widest practical gaps between providers sit here rather than in the headline rates, which is why we compared published settlement terms provider by provider. Stripe UK’s default is T+3 business days; the funds clear three business days after the transaction. Worldpay and Dojo are typically T+1, and Tyl by NatWest settles same-day to a linked NatWest account. For a business running thin on working capital, the gap between T+1 and T+3 hits liquidity harder than a few decimal points on the headline transaction rate.

Bundled (PSP/Aggregator) vs Separate Accounts

For most UK businesses the choice is between two models, and we found the gap between them is about contract and control far more than it is about headline price:

Bundled PSP: one provider covers both

Stripe, PayPal, Square, SumUp, Shopify Payments, and Teya bundle the gateway and merchant account into one service. No separate underwriting, no gateway contract, and on the standard plans we compared, no monthly fee. You verify your identity and start taking payments within hours.

Stripe dominates UK e-commerce. It is FCA-authorised, handles PCI DSS compliance at its layer for hosted integrations, and supports a wide range of international payment methods. The price you pay for that simplicity: Stripe operates a pooled merchant account, and its automated risk systems can place a hold on funds with little warning. Stability, not price, is what you trade away here, and that is how we weighted it when we made our picks.

Dojo and Tyl by NatWest sit in the middle. Both give you a dedicated merchant account with your own acquiring relationship and formal contractual protections, but we found the pricing and the setup closer to the flat-rate PSP model. Tyl is faster for NatWest customers: same-day settlement to a linked NatWest business account, on the condition that you bank with NatWest.

Separate gateway + dedicated merchant account

The traditional model: pick an acquirer (Worldpay, Elavon, Adyen, Global Payments), go through underwriting for a dedicated merchant account, then connect your gateway, either the acquirer’s own or a third-party option. More moving parts, longer setup, formal contract. In return, you get a direct acquiring relationship, negotiated rates, and contractual recourse. We recommend this route only when volume, industry, settlement speed or account stability makes it necessary, never as a general upgrade.

Worldpay does not publish its pricing. Rates are bespoke and only their sales team can give you one; the tailored pricing threshold is businesses with £75,000+ in annual card turnover. We treat that opacity as a cost, not an inconvenience: you cannot compare a quote you have to ask for. Adyen uses interchange++ pricing, where you pay the card scheme’s own interchange rate plus Adyen’s markup: 0.60% and a fixed £0.13 per transaction, as the table below sets out. It also sets a minimum monthly invoice it does not publish, which rules it out at low volumes. Elavon offers plans from 0.99% and has a faster application process than most traditional acquirers.

Cost Comparison: Bundled vs Separate in 2026

We compared the published UK online rates on the same basis, for a business taking primarily UK consumer debit and credit cards. This is where 2026 pricing sits:

The volume crossover is the only calculation that matters here, and we ran it from both ends. At £5,000/month in UK card turnover, Stripe’s 1.5% + £0.20 lands at an effective rate of roughly 1.8–2.0% once the fixed fee is averaged across your typical transaction size. At £50,000/month, a dedicated merchant account on interchange++ pricing (UK debit interchange is capped at 0.2% and credit at 0.3%) plus the acquirer’s own margin of 0.3–0.5% can come out under 1% overall for a business taking mostly UK debit cards.

We put the crossover somewhere in the £10,000–£15,000/month range. That is our judgement from typical card mixes rather than a formula, and we say so plainly, because it moves with your proportion of debit against credit, domestic against international, and consumer against corporate cards. Pull your own card mix from your current PSP before you commit to switching; the headline figures will lie to you otherwise.

The contract is the other half of the cost, and we count the exit fee as part of the price, because it is the part you cannot renegotiate later. Worldpay contracts are typically 12–36 months and carry exit fees. A dedicated account that saves 0.5% per transaction on £20,000/month works out to £100/month. If the exit fee is £500 and you are locked in for 24 months, the saving is real but the room to change your mind is gone.

Our Picks

Each pick is tied to an operating profile rather than ranked against the others. We recommend the provider named for the situation its heading describes, and not beyond it.

Best for most UK e-commerce under £15,000/month: Stripe

Setup in hours, no contract, hosted Checkout that keeps you on SAQ-A, and the broadest range of international payment methods available in the UK without bespoke development. The trade-off is account-stability risk and T+3 settlement. We rate that as the right trade for most online retailers under £15,000/month, and the wrong one above it.

Best for in-person retail and hospitality: Square

Flat 1.75% in-person, 1.4% + £0.25 online, no monthly fee, T+1 to your existing bank account, and hardware that works out of the box. We weighed the included point-of-sale software more heavily than the headline rate here, because for hospitality and retail it is the part that changes the working day rather than the monthly statement.

Best low-volume / market-trader option: SumUp

1.69% flat in-person, no monthly fee, no contract, and a £39 reader that pays for itself in two days of trading for most operators. For a business taking under £3,000/month in person (market stalls, mobile traders, independent therapists, small cafés), SumUp removes every excuse not to take card payments. Above £5,000/month, the pay-as-you-go flat rate stops being competitive. We compared SumUp’s own two published plans against each other: Payments Plus (£19/month, 0.99% on domestic debit and credit cards) narrows that gap once you process enough to cover the monthly fee, but at that scale we recommend pricing a dedicated account alongside it before you settle.

Best dedicated account for SMEs scaling past £10,000/month: Dojo

Dedicated merchant account with a direct acquiring relationship, T+1 settlement to your existing UK business bank account, no NatWest dependency, and a modern integration that does not feel like a 2008 acquirer agreement. We recommend Dojo for businesses that have outgrown a PSP aggregator on cost or on stability grounds, but do not want to negotiate a 36-month Worldpay contract to fix it.

Best for NatWest customers: Tyl by NatWest

Same-day settlement to a linked NatWest business account is the differentiator. If you bank with NatWest and your operating profile is hospitality, retail, or any cash-flow-sensitive sector that values money in the account by close of business, Tyl is the only provider here that delivers it. The condition is binding: you must bank with NatWest, and we do not treat same-day settlement as sufficient reason to move your business banking.

Best high-volume / multi-currency / enterprise: Adyen

Interchange++ pricing with a £0.13 fixed fee per transaction, a direct acquirer relationship, and the lowest effective rate at scale for businesses taking predominantly European consumer cards. Adyen does not publish its minimum invoice; it says only that the figure depends on your industry and is settled with its sales team during onboarding. We could not find a published figure anywhere on its site, and we are not going to guess at one. That, and an integration built for engineering teams rather than for a checkout plug-in, rules Adyen out below significant processing volumes.

Best for regulated or high-risk industries: a specialist UK acquirer

Mainstream PSP aggregators will not serve gambling, adult content, cryptocurrency, pharmaceuticals, vaping, certain financial services, or high-chargeback subscription categories. Specialist UK acquirers (Worldpay for some categories, plus dedicated high-risk providers) are the only stable route. Expect a rolling reserve, a slice of every payment held back against chargebacks that have not happened yet: typically 5–15% held for 90–180 days, plus formal underwriting and per-transaction rates well above mainstream pricing. We name no single provider here: the acquirers that write gambling are not the ones that write vaping, and your category narrows the shortlist long before price does. Those terms are the price of an account in a high-risk sector that an algorithm will not terminate.

When Does a UK Business Need a Dedicated Merchant Account?

A dedicated merchant account stops being optional in four situations, and we treat each one as decisive on its own rather than as a point on a scorecard:

1. Transaction volume

Below roughly £10,000/month in card turnover, a PSP aggregator is almost always the cheaper and easier option. Above £10,000–£15,000/month, the case for negotiated rates on a dedicated account starts to build, particularly for businesses with a high UK debit mix. We checked the thresholds the acquirers themselves publish, and they sit above that: Worldpay’s tailored pricing threshold is £75,000+ annual card turnover, and Tyl by NatWest offers custom rates from £50,000 annual card turnover. Adyen does not publish its minimum invoice at all, so it only pays at considerably higher volumes: below the threshold your industry is quoted, your transaction fees alone are not covering the invoice, and you pay the shortfall.

2. Restricted or high-risk industry

This is a hard wall, not a gradient. Businesses in gambling, adult content, certain financial services, cryptocurrency, pharmaceuticals, tobacco, vaping, or high-chargeback categories like subscriptions and travel will find that mainstream PSP aggregators (Stripe, PayPal, Square, SumUp) either reject the application or terminate the account once the business category is flagged. We checked the restricted business lists those providers publish, and the categories above appear on them.

A dedicated high-risk merchant account from a specialist UK acquirer is not a premium choice in these sectors; it is the only route to operating legally and stably. These accounts carry rolling reserves: typically 5–15% of your monthly processing volume held back for 90–180 days against potential chargebacks. A business processing £50,000/month could have between £7,500 and £45,000 held in reserve at any given time. We work that into the cost of the account rather than treating it as a deposit you get back, because it is money you cannot spend for as long as it is held. That is a working capital commitment, not a contractual footnote.

3. Settlement speed and cash flow

Stripe UK settles at T+3 business days by default, three business days after the transaction, as set out in Stripe’s documentation. New accounts face a 7-calendar-day hold on the first payout. For most online retailers, T+3 is workable. For hospitality operators, market traders, or any business with thin working capital that runs on daily cash flow, the difference between T+1 (Worldpay, Dojo) and T+3 will matter more than the per-transaction rate, and that is how we ordered the picks for those businesses.

4. Account stability and contractual protection

Automated risk filtering flags accounts with unusual transaction patterns (high average order values, sudden volume spikes, or any proximity to restricted categories) and can freeze funds pending a manual review that takes days. A dedicated merchant account from Worldpay, Elavon, or Dojo is governed by a formal contract: the acquirer must give notice and demonstrate cause before termination. That does not guarantee a smooth life, but it gives you a defined process and recourse, and in our reading of these contracts that is what the monthly fee is really buying.

PCI, SCA, and Settlement Differences

PCI DSS compliance: what your integration choice costs you

Your PCI DSS Self-Assessment Questionnaire (SAQ) level is determined by how card data flows through your systems, not by which provider’s logo is on the invoice.

• SAQ-A (31 questions): Applies if card data never enters your environment; you use a fully hosted checkout page (Stripe Checkout, PayPal Standard). Under PCI DSS v4.0.1 (effective March 2025), you must also confirm your website is not susceptible to script injection attacks that could compromise the payment flow.
• SAQ-A-EP (intermediate): Applies to e-commerce merchants whose payment page loads a hosted form via redirect or iframe, but where your server participates in the payment flow. Common for custom checkout designs that embed a hosted payment field. If you are unsure whether your iframe integration qualifies for SAQ-A or SAQ-A-EP, check the PCI SAQ selection guidance from IT Governance UK.
• SAQ-D (251 questions): Required if your server stores, processes, or transmits cardholder data, including direct API integrations where card numbers transit your own environment. A significant compliance undertaking requiring formal controls, logging, testing, and in many cases an audit by an external Qualified Security Assessor at higher transaction volumes.

Moving from Stripe Checkout to a direct server-side API integration can shift your PCI scope from 31 questions to 251, on the same provider. That is the change we flag hardest to a developer-led team, because it is not a technical footnote: it moves your developer resource, your insurance obligations, and potentially your contractual commitments to enterprise customers or platforms.

Strong Customer Authentication (SCA)

SCA is required on most online card payments in the UK under the Payment Services Regulations 2017. The technical standard is EMV 3DS2 (3D Secure version 2). The practical consequence: if your gateway applies 3DS2 and the customer’s issuing bank authenticates them, fraud chargeback liability shifts from your merchant account to the issuer. Without SCA on a transaction where it is required, that liability stays with your acquirer, and ultimately with you. We read that as the practical reason to stay on a hosted integration unless you have a specific need not to.

For hosted integrations (Stripe Checkout, PayPal Standard, Adyen Drop-in), the PSP handles 3DS2 and exemption logic automatically. For direct API integrations, you may need to pass the correct exemption flags in your requests; for example, to flag a merchant-initiated transaction (subscription renewal) or request a transaction risk analysis (TRA) exemption. The main UK SCA exemptions are: low-value transactions under £30, low-risk TRA exemptions where fraud rates are within threshold, and merchant-initiated transactions. The flags themselves are integration-specific, and your PSP’s developer documentation names them.

Settlement timing: the factual picture

Which Does Your Business Need?

For most UK businesses the answer is a bundled PSP, and we do not offer that as a compromise. It is the right tool. A dedicated merchant account only becomes the right choice when volume, industry, settlement speed or account stability forces the issue, so the four profiles below are the ones worth reading against your own trading.

Under £10,000/month, mainstream industry, no cash flow pressure: Use a bundled PSP. Stripe for e-commerce, Square or SumUp for in-person and hospitality, Shopify Payments if you are already on Shopify. The flat-rate pricing is slightly expensive per transaction at high volumes, but the setup is hours rather than weeks, there is no minimum monthly fee, and the compliance burden is minimal under SAQ-A. We count operational simplicity as a real saving, and it is the one founders underestimate until they have spent a fortnight chasing a separate gateway vendor over a settlement file format.

£10,000–£100,000/month, stable industry, growing volume: Pull your card mix and run the numbers against a dedicated account quote. Above £15,000–£20,000/month with a high proportion of UK debit card payments, interchange++ pricing typically wins on transaction cost. At this scale we start with Dojo or Elavon: both onboard faster than Worldpay, and Dojo in particular suits businesses that want a modern integration without carrying a PSP aggregator’s account-stability risk.

Restricted or high-risk industry: A specialist dedicated high-risk merchant account. There is no PSP aggregator shortcut, and we do not recommend looking for one. Operating in gambling, adult, pharmaceutical, or cryptocurrency categories on a Stripe or PayPal account is operating on borrowed time; the account will be flagged eventually. Budget for rolling reserves (5–15% of monthly volume held for 90–180 days) and higher per-transaction fees. These are the cost of operating in a regulated or high-risk sector with a stable account.

High volume, multi-currency, tight margins: We treat Adyen’s interchange++ model as the reference point for mid-market and enterprise rather than as a default: published rate structure, direct acquirer relationships, and the lowest effective rate at scale for businesses taking predominantly European consumer cards. Its unpublished minimum invoice, agreed with sales by industry, and its integration requirements rule it out below significant processing volumes.

When a bundled PSP is the better answer even at higher volumes: If your business has sharp seasonal spikes and you do not want to over-provision an acquiring contract to cover three peak weeks a year, a PSP aggregator’s flexible no-contract model is the better instrument. Equally, if you need a wide range of international payment methods (Klarna, iDEAL, Alipay, SEPA Direct Debit) bolted on with minimal development effort, Stripe’s payment method range is something traditional acquirers cannot match without considerable integration work. A dedicated account is not the more sophisticated choice by default. The sophisticated choice is the one that fits how your business actually trades, and that is the test we applied to every pick above.

Frequently Asked Questions

Do I need both a payment gateway and a merchant account?

To accept card payments, you need the function of both, but not necessarily as separate products. With a bundled PSP like Stripe, Square, or SumUp, both are included in one service at no extra cost and with no separate application. You only need to source them separately if you are working with a traditional acquirer (Worldpay, Elavon, Adyen) and want to connect a third-party gateway, or if your volume and card mix make the two-contract model worth the complexity. For most UK small businesses the bundled model handles both requirements from day one, and that is the arrangement we recommend until one of the four conditions above applies.

Can Stripe freeze my account?

Yes. Stripe and other PSP aggregators can hold funds or restrict your account, without warning, if their automated risk systems flag unusual activity. It happens when transaction patterns change suddenly, when average order values shift, or when a business touches categories adjacent to Stripe’s restricted list. If your business has high average order values, trades in a sector with elevated chargeback risk, or runs an inconsistent transaction volume, the risk is real. We rate this as the strongest argument for a dedicated account, and it has nothing to do with price: a formal contract gives the acquirer less unilateral discretion, because termination requires defined notice and cause.

What is a rolling reserve, and how much will it cost me?

A rolling reserve is a percentage of your processing volume that the acquirer withholds and holds for a set period, typically 5–15% held for 90–180 days, against potential chargebacks. It applies primarily to high-risk merchant accounts and sometimes to new accounts. The working capital impact is concrete: a business processing £50,000/month at a 10% reserve rate has £15,000 tied up at 90 days, which is three months of reserves cycling through. At 15% held for 180 days, the figure climbs to £45,000. Rolling reserves are released after the holdback period, but your business needs the liquidity to absorb that commitment from day one of trading. We treat it as working capital lent to the acquirer, interest-free, for the length of the hold.

What PCI DSS level applies to my business?

SAQ-A applies to most UK small businesses using a fully hosted checkout such as Stripe Checkout or PayPal Standard: 31 questions and an annual self-assessment, on the current questionnaires we checked. Under PCI DSS v4.0.1 (effective March 2025), you must also confirm your website is not susceptible to script injection attacks targeting the payment flow. If you use an embedded iframe or redirect integration where your server is involved in the payment flow, you are likely in SAQ-A-EP rather than SAQ-A; check the PCI SSC SAQ selection guidance. If card data transits your own server via a direct API, SAQ-D (251 questions) applies. If you are uncertain, a Qualified Security Assessor (QSA) can confirm your scope. Getting it wrong in either direction is a compliance risk.

Is interchange++ pricing always cheaper than a flat rate?

Not always, and your card mix is what decides it. Interchange++ charges the actual interchange rate for each card type, plus the acquirer’s own margin on top. UK domestic debit cards carry a 0.2% interchange cap under current UK regulations, which makes interchange++ hard to beat for a debit-heavy business. Premium credit cards, corporate cards and international cards carry higher interchange rates, and on an interchange++ contract you pay those in full, so a business taking a high proportion of European or American corporate cards can find a flat-rate PSP costs less than the interchange++ effective rate implies. We do not treat interchange++ as automatically cheaper on any card mix. Run the numbers on your own, not on the domestic debit headline.

Do UK businesses need SCA on all online card payments?

Not all, but most. SCA applies to most online card transactions in the UK under the Payment Services Regulations 2017. The main exemptions are: low-value transactions under £30; low-risk transactions where the acquirer or issuer applies a transaction risk analysis (TRA) exemption based on fraud rate thresholds; and merchant-initiated transactions (MITs) such as subscription renewals where the customer has previously authorised the payment series. For hosted PSP integrations, exemptions are applied automatically. For direct API integrations, you may need to pass the correct flags in your request; your PSP’s developer documentation covers this. The liability consequence is the part we put in front of a developer first: a fraudulent transaction without SCA typically means the chargeback lands with your acquirer, not the issuer.

How long does it take to set up a dedicated merchant account vs a PSP?

A bundled PSP (Stripe, Square, SumUp) can be set up in hours. Identity verification is handled online, there is no formal underwriting call, and you can be taking live payments the same day. A dedicated merchant account from Worldpay, Elavon, or Adyen typically involves an application, underwriting review (5–15 business days is common), a formal contract negotiation, and a technical integration that can take days to weeks depending on the complexity of your setup. If you are switching, account for the transition time. We recommend running both accounts in parallel through the migration; it is the only way to avoid a gap in payment acceptance.

Related Guides

• Card Processing Fees Explained: the full fee stack behind every card transaction, broken down layer by layer.
• Interchange, Blended, and Flat-Rate Pricing: how the three common pricing models actually compare on your own transaction mix.
• PCI DSS and SCA Compliance for UK Businesses: what your integration choice costs you in compliance scope, in more detail than the summary above.
• Virtual Terminal vs Payment Link: for businesses taking card-not-present payments without a full e-commerce checkout.