What to compare in a high-risk payment gateway

What the term means, and what it does not

High-risk payment gateway is a term used by sellers of payment services, not by the card networks. Visa’s rules, in the edition of 24 October 2026, define neither a payment gateway nor a high-risk one. The words payment gateway appear in a single rule, section 5.9.2.1, on what a cardholder’s receipt may show.

What Visa’s rules do classify is the merchant. Section 10.4.5.1 says Visa classifies as a high-integrity risk merchant one that is required to use certain merchant category codes, as specified in its Integrity Risk Program Guide. Nothing in those rules makes a gateway a different kind of service because of what the merchant sells: it carries checkout payments towards the processor and the acquiring bank.

The same rules define a merchant agreement as a direct contract between a merchant and an acquirer, or between a sponsored merchant and a payment facilitator. A gateway company is not a party named in that definition. So a gateway described as high-risk tells you one thing only: that it is offered together with an acquirer or payment facilitator said to accept your kind of business. Whether you are accepted is decided by that provider when it reviews your application.

Who stands behind the gateway

Visa’s rules define a third party agent as an entity, other than a VisaNet processor, that provides payment-related services, directly or indirectly, to a member, its merchants or sponsored merchants, or their agents. Section 1.9.8.5 requires a third party agent to have a direct written contract with a member to perform services on the member’s behalf.

Two registration rules follow. Under section 1.9.8.6 a member must register a third party agent with Visa before any contracted services or transaction activity, and Visa may deny or reject a registration at any time. Under section 1.9.8.7 an acquirer must register with Visa a third party agent engaged by any of its merchants, before the agent performs any contracted services for the merchant. That registration is specific to each acquirer.

Whether a particular gateway company is a third party agent for your set-up, and whether your acquirer has registered it, is a question for the provider making the offer. It matters most when you bring your own gateway to a new acquirer, or when an offer names a gateway without naming the bank behind it.

If a member fails to meet its responsibilities for third party agents, section 1.9.8.8 says Visa assigns liability to members in a stated order, starting with the member whose performance or non-performance, including that of its agents, caused the loss. The rule assigns liability between members; what you can claim from a gateway or provider depends on your own contracts.

Card data: why the connection method matters

Section 1.9.4.1 of Visa’s rules requires members to ensure that all agents and merchants with access to account or transaction information comply with the Payment Card Industry Data Security Standard (PCI DSS), and that they do not store the Card Verification Value 2 after authorization. The same section requires agreements with agents and merchants to establish clearly their responsibilities to meet Visa’s standards.

The PCI Security Standards Council, which publishes the standard, describes PCI DSS as baseline technical and operational requirements intended for all entities that store, process or transmit cardholder data, or could affect its security. It states that the standard is intended for all entities involved in payment processing, including merchants, regardless of their size or transaction volume, and that whether a small merchant is required to validate compliance is determined by the individual payment brands. Its advice on validation questions is to contact your acquirer or the payment brand.

The Council also says there are several different self-assessment questionnaires, developed for specific types of environments. That is why the connection method belongs in the comparison. A hosted checkout, a plugin and a direct API can put different parts of your own systems in contact with card details, so the work you must do, and document, can differ between two offers that name the same gateway. Ask the provider which validation its acquirer will expect from you for the connection it proposes.

What to compare, item by item

Scroll the table to see all columns.

Two further questions have no rule behind them but decide how tied you are to one gateway: whether stored customer card details can be moved if you change gateway or acquirer, and whether the gateway can be kept if the acquirer behind it changes. Ask for both answers in writing.

Questions to ask before you accept an offer

• Which bank or payment facilitator signs my agreement, and in which country?
• Which gateway is proposed, and is it included in the offer or contracted separately?
• Which connection method is included for my shop platform, and who builds and tests it?
• Which PCI DSS validation will be expected from me, how often, and is there a fee linked to it?
• Are any authentication or security measures required for my business category?
• What does the gateway cost to set up and to run each month and per transaction?
• What happens to my stored customer payment details if I change gateway or acquirer?

Describe your business and what you sell accurately when you ask. A gateway does not change how an acquirer or a card network classifies your business.

Where Zolution shows it

Every offer on Zolution records the payment gateway and the connection method as two separate fields, beside the provider type, the contracting company and its country, the fees, the reserve and the payout terms. You compare complete set-ups, not gateway names.

These fields are provider-declared: Zolution does not verify them, does not process payments or hold funds, and the provider decides whether to offer you an account. Zolution Standard membership costs nothing.

Questions, answered