Three entities sit between a merchant and the card networks. Each has a specific responsibility in the transaction flow.
| Entity | Responsibility | Example |
|---|---|---|
| Payment gateway | Accepts payment data from the merchant, encrypts it, routes it to a processor, and returns the response | Reefpay |
| Payment processor | Communicates with card networks and banks to authorize and settle transactions | TSYS, Vericheck |
| Acquiring bank | Holds the merchant's bank account and receives settled funds from card networks | Bank of America, Wells Fargo |
A payment gateway is the merchant-facing layer in the payment stack. It provides the API that your application calls to create transactions, store payment methods, and manage settlements.
- Data collection: Accepts card numbers, bank account details, or payment tokens from the merchant's checkout.
- Encryption: Protects sensitive data with encryption (AES-256 CBC in the case of Reefpay) before transmitting it to the processor.
- Routing: Determines which processor to send the transaction to based on the payment method type. Reefpay routes card transactions to TSYS and ACH transactions to Vericheck.
- Response normalization: Translates processor-specific response codes into a standardized format so your application handles all processors the same way.
- Tokenization: Stores payment credentials securely and returns a token that can be used in future transactions, reducing Payment Card Industry Data Security Standard (PCI-DSS) scope.
- Reporting: Provides transaction history, batch details, and settlement data through API endpoints.
A gateway does not hold funds, issue cards, or maintain bank accounts. It is a software intermediary — it moves data, not money.
A payment processor handles the communication between the gateway and the financial institutions that move money.
- Authorization: Forwards the transaction to the card network (for card payments) or ACH network (for bank transfers) and returns the approval or decline.
- Clearing: Submits finalized transaction data for settlement at the end of the business day.
- Settlement: Coordinates the actual transfer of funds from the issuing bank to the acquiring bank.
| Processor type | Description | Reefpay example |
|---|---|---|
| Card processor | Handles credit and debit card transactions through card networks | TSYS |
| ACH processor | Handles bank account debits and credits through the ACH network | Vericheck |
A single gateway can connect to multiple processors. Reefpay automatically routes to the correct processor based on the payment_method.type in the transaction request.
The acquiring bank (also called the merchant bank) is the financial institution that holds the merchant's account. After settlement, the acquiring bank receives funds from the card network and deposits them into the merchant's account.
Merchants establish a relationship with an acquiring bank when they set up their payment processing. The acquiring bank sets the terms for deposits, fees, and chargebacks.
The following sequence shows how all three entities interact during a card sale.
- Authorization happens in real time (milliseconds). The gateway sends the transaction through the processor and card network to the issuing bank, which approves or declines.
- Settlement happens in batches, typically at the end of the business day. The processor submits cleared transactions to the card network, which coordinates the movement of funds from the issuing bank to the acquiring bank.
Reefpay is a payment gateway that abstracts the processor and network layers behind a single REST API.
| Capability | How Reefpay handles it |
|---|---|
| Card payments | Routes to TSYS automatically when payment_method.type is card |
| ACH payments | Routes to Vericheck automatically when payment_method.type is bank_account |
| Encryption | AES-256 CBC encryption for sensitive payloads |
| Tokenization | Stores payment methods via /v1/payment_tokens |
| Batch settlement | Manages batches via /v1/batches |
| Reporting | Transaction queries via GET /v1/transactions |
As a developer, you interact only with theReefpay API. You do not need direct connections to TSYS, Vericheck, card networks, or banks.