French ecommerce earned €196.4 billion in 2025 from 3.2 billion transactions – 10% more than in 2024. These purchases go through payment gateways, tools that let businesses accept online payments securely.

Payment gateways have become an entirely separate regulatory checkpoint. Beginning 12 January 2026, with a few exceptions, online payments over a few cents made by bank cards issued in France must be authenticated by 3D Secure to be accepted. Poorly configured gateways cause businesses to miss sales, while well-configured ones capture wrongfully rejected transactions and charge lower fees per sale. Both directly affect net revenue.

In this article, we explain what payment gateways are, how they work, their costs and benefits, and what to consider when choosing the right one.

Key takeaways

• Payment gateways are secure services that connect sellers' websites to customers' banks at the time of purchase. These systems collect card details, request payment authorisation, and send the response in seconds, but never hold funds.
  
• Payment gateways differ from both physical in-store payment terminals and payment service providers (PSPs), which are certified businesses regulated by the Prudential Supervision and Resolution Authority (ACPR). They execute transactions and circulate funds.
  
• Gateways serve several core functions. They secure transactions using encryption and tokenisation, help prevent fraud by assessing risk, orchestrate strong 3D Secure authentication, manage exemptions, send information to buyers, and centralise tracking of sales and failed payments.
  
• There are three ways to integrate payment gateways, each with different implications for Payment Card Industry Data Security Standard (PCI DSS) compliance. They include hosted checkout pages, hosted iframe fields, and direct application programming interface (API) integration.
  
• Businesses must consider various factors when choosing a payment gateway. These include 3D Secure orchestration quality, the local payment methods offered, total cost, integration method, platform uptime, and token reversibility.
  

What are payment gateways?

Payment gateways are secure services that transmit transaction data between seller websites and payment-service providers (PSPs) at the time of purchase to request authorisation. They collect bank card information and send responses to the seller website within seconds. They do not hold funds or make payments.

These gateways accept cards, digital wallets such as Apple Pay and Google Pay, SEPA Direct Debits, wire transfers, and Wero, as French sellers prefer. They typically earn money by charging fees on each transaction.

Note: Payment gateways cannot collect payments on their own. Businesses must also enter into an electronic payment contract with a payment provider, or work with a provider that offers both services.

What is the difference between payment gateways and payment terminals?

Payment terminals are physical devices that read cards in-store. Online payment gateways are software services that collect payment data on a website or app. Both collect card transactions, but they serve different transaction methods and environments.

In brick-and-mortar stores, certified PSPs secure and send data between the seller's electronic payment terminal and the payment network via an internet protocol (IP) or mobile connection. For distance selling – such as through ecommerce websites – an online payment gateway fills this role.

The distinction between in-person and remote payments is important for two reasons. First, they carry different fraud risks and legal liabilities. In-person payments using a chip and personal identification number (PIN) are by definition authenticated. This is not true for distance payments. Second, sellers in both channels benefit from unified reporting, rather than maintaining both a point-of-sale (POS) system and an online payment gateway with separate data.

What is the difference between payment gateways and PSPs?

Payment gateways secure and transmit transaction data. Payment processors are regulated providers that execute transactions and circulate funds. The former is a technical intermediary that falls outside the second Payment Services Directive (PSD2). The ACPR certifies and oversees the latter.

Under Article L. 521-1 of the Monetary and Financial Code, PSPs include payment institutions, e-money institutions, credit institutions, and account information service providers. They are licensed, supervised, and subject to capital and customer-fund protection requirements.

Legally, technical payment gateways are separate from PSPs, as defined in Article 3 of PSD2, because they never hold the funds being transferred. Therefore, they do not require ACPR certification.

In practical terms, most payment gateway providers in the French market offer both functions. They combine gateway and funds acquisition into a single service. This means sellers do not have to negotiate separate electronic payment contracts with their banks. Businesses need to consider this factor when choosing a provider. The service structure determines who is liable in an incident and who ultimately pays out the funds.

What are payment gateways used for?

Payment gateways serve several functions. They secure transactions with encryption and tokenisation, maximise accepted payments by managing bank-required authentication, and centralise tracking of sales, refunds, and failed payments.

Encrypting and tokenising data

Gateways encrypt customer bank card data at the time of entry and replace it with a token (tokenisation) so that they can reattempt payments without requiring the card number to be reentered.

Preventing fraud

Gateways assign a risk score to each transaction. The score is calculated using formulas defined by the seller and analysis models. In France, fraud prevention relies on three factors: 3D Secure authentication, card verification value (CVV), and real-time risk analysis.

Orchestrating strong authentication

Gateways submit transactions to 3D Secure 2.0 authentication. They can sometimes request exemptions to let customers skip an authentication step – for example, for payments under €30. If the customer's financial institution refuses the exemption with a soft decline, the gateway will reattempt the transaction using 3D Secure. In France, automatic reattempts are currently used to calculate acceptance rates.

Transmitting requests to acquiring banks

Gateways transmit authorisation requests to the acquirer or PSP, which forwards them to the card issuer via the appropriate network (e.g., CB, Visa, Mastercard).

Transmitting responses

Gateways return bank responses (authorisation or declined payment) to the seller's website. The site then displays the appropriate message and processes or declines the order.

Reporting and reconciling transactions

Online payment gateways gather records of transactions, refunds, failed payments, and payout reconciliations with acquiring banks in a single interface. This gives sellers an overview of all payment activity in one place, instead of consolidating details from multiple sources.

How do payment gateways work?

Customers enter their information into a form provided by the payment gateway. The gateway encrypts the data, performs 3D Secure authentication if required, and sends the authorisation request to the acquirer, which queries the issuer. The seller’s website receives the response within seconds. Payment settlement occurs separately.

Here is a step-by-step explanation of how payment gateways work in online transactions:

1. Customer enters payment information
   The customer selects the products and services they wish to buy and goes to the checkout page. They enter their payment information, including card details or digital wallet login. The gateway provides the form as a hosted payment page, iframe, or hosted field. Card details do not pass through the seller’s server. This is the entire purpose of gateways.

2. Gateway encrypts and tokenises data
   The payment gateway encrypts the card number as it is entered and replaces it with a token. The seller sees a placeholder rather than the actual card number.

3. Gateway performs strong authentication, if required
   The gateway verifies customer-initiated transactions using 3D Secure 2.0 authentication. Gateways can request exemptions – for example, for small transactions – but the customer’s bank can still require authentication.

4. Gateway sends authorisation request to the acquirer
   The online payment gateway sends the transaction to the seller’s acquiring PSP, who routes it to the appropriate card network.

5. Customer’s bank verifies and responds
   The issuing bank verifies the card’s validity, account balance, and authentication result, and grants or refuses authorisation. If it refuses authorisation due to an authentication failure, the gateway automatically retries the transaction under 3D Secure. The customer does not need to re-enter their details.

6. Seller processes the order
   The bank sends its response to the website, which displays the corresponding message to the customer and processes or declines the order. If the payment is rejected, the site can suggest a different payment method.

7. Payment settlement occurs separately
   Authorisation confirms that the card is valid and the account has sufficient funds. The money typically is not transferred by the acquirer until a few days later, depending on the period specified in the contract.

What are the benefits of payment gateways?

Payment gateways offer three main benefits to sellers. They secure data by encrypting and tokenising card information, improve conversion by enabling strong authentication and local ways to pay, and reduce management expenses by centralising payment tracking.

Here are the benefits of these systems:

Reduced fraud risk

Gateways use Strong Customer Authentication (SCA) and tokenisation. Together, they have helped reduce the rate of card payment fraud in France to €47 per €100,000 of payment, a record low.

Fewer compliance requirements

Online payment gateways handle forms and tokenise data so that sellers’ servers never see card numbers. Sellers receive the minimum PCI DSS checklist, rather than the comprehensive one. This reduces annual costs and audit expenses.

Higher acceptance rate

Exemption requests and automatic reattempts after soft declines reduce wrongful rejections. Also, beginning January 2026, 3D Secure is required for customer-initiated online payments.

Access to multiple payment methods

Because of its unique integration, payment gateways offer the payment methods French customers expect. These include bank cards, digital wallets, SEPA transfers, buy now pay later (BNPL), and Wero (by late 2026). By offering customers’ preferred ways to pay, businesses can reduce abandoned carts. In fact, offering a range of options has become a conversion strategy in itself.

Management of recurring payments

For subscription revenue models, payment gateways save bank card tokens and trigger payment on each due date. Sellers initiate payments based on an agreement that the customer authenticates once at the time of subscription using 3D Secure. Subsequent payments are made automatically, without requiring customers to re-enter their information.

Enhanced cash flow projections

Payment gateways automatically reconcile authorisations, payouts to acquirers, and failed payments. Sellers no longer have to reconcile transactions manually. They can also see incoming collections, which improves revenue projections.

Centralised management

When gateway, payment processing, and acquisition services are packaged together – most providers on the market do – sellers need to integrate one API and manage a single contract. They can oversee transactions, refunds, and payouts from a single dashboard, simplifying administrative tasks.

What are the different types of payment gateways?

There are three ways to integrate payment gateways: hosted payment pages, which redirect customers to the PSP; hosted fields, which use iframes to keep customers on the seller's website while isolating data; and API integration, which gives sellers complete control but comes with stricter PCI DSS compliance requirements.

The choice of integration method is important. It determines which PCI DSS compliance checklist applies and therefore the annual compliance fee.

Hosted payment pages

At checkout, customers leave the seller's website for a form hosted and managed by the gateway provider. Hosted payment pages are quick to establish and have minimal PCI DSS requirements, since sellers never handle card information. The redirects, though, interrupt the shopping experience and can cost sales, especially on mobile devices.

Hosted fields and iframes

The payment gateway provides text fields, but sellers embed them into their website – typically as iframes. The shopping experience is frictionless, and card information never reaches the seller's servers. This makes it the most common ecommerce payment type in France.

Integration by direct API

With API integration, sellers collect the card data themselves and send it server-to-server to the gateway. The seller controls the process from end to end, but since these details pass through its servers, the business is subject to the strictest compliance requirements. These include a comprehensive PCI DSS checklist and, often, an annual audit by a Qualified Security Assessor (QSA).

Note: Businesses must also ensure that checkout pages hosted by payment gateways are secure. Beginning in 2025, the PCI DSS standard requires businesses to verify payment page scripts – including those that redirect customers – because malicious scripts placed upstream of redirects can capture data.

How much do payment gateways cost in France?

Payment gateway costs include two types of expenses: payment to the gateway itself (a few cents per transaction or a subscription) and an acceptance commission charged on each collection. In addition, depending on the contract, businesses might also pay setup fees, failed payment charges, and exchange fees for payments in foreign currencies.

Gateway services bill using one of two models. The first charges a monthly fee and a per-transaction charge. This is common among bank-backed providers. The second charges an all-inclusive percentage and a fixed rate. The gateway and acquisition charges appear as a single line item on the invoice.

The acceptance fee accounts for the largest portion of the cost. It includes the interchange fee, card network fee, and acquirer's margin.

Interchange fees

Interchange fees are amounts paid to the financial institution that issued the customer's bank card. Regulation (EU) 2015/751 caps interchange fees for individual consumer cards at 0.2% for debit cards and 0.3% for credit cards. The cap does not apply to corporate cards or cards issued outside the European Economic Area (EEA). Their interchange fees are higher, raising the cost of collections from corporate and international customers.

Card network fees

CB, Visa, and Mastercard receive network fees on each transaction that passes through their network. These charges cover the infrastructure used to transfer payments between banks. The amount varies by operator and card type.

Acquirer margin

The acquirer's margin is the portion paid to the provider that collects money on the seller's behalf. It is the negotiable portion of the fee. Regulations or the networks determine the other two.

Other fees

Here are other charges aside from the acceptance fee:

• Failed payment fee: Applies to all chargebacks, regardless of whether the seller wins the dispute.
  
• Exchange fee: Applies to transactions collected in a currency different from the payment account currency.
  
• Setup and cancellation fees: Typically one-off charges when businesses open an account with a gateway or terminate their contract.
  

How to choose a payment gateway

Businesses must consider six factors when choosing a payment gateway. These include the quality of 3D Secure orchestration, the local payment methods offered, the total cost, the integration method, the impact of PCI DSS compliance, service uptime, and card token reversibility.

Let’s take a closer look at each factor:

• Strong authentication orchestration
  

The acceptance rate of transactions authenticated by 3D Secure 2.0 and how it manages soft declines and exemption requests indicate a payment gateway’s true performance.

• Local payment methods offered
  

The local options available affect conversion rates. Good gateways accept bank cards, digital wallets, SEPA transfers, BNPL, and Wero.

• Total cost
  

Evaluate the cost of online payment gateways per transaction, rather than relying on the posted rate. Determine the cost of an average cart. Include failed payment fees and exchange fees for foreign-currency sales.

• Integration method
  

Sellers choose an integration method based on PCI DSS compliance requirements. The obligation level varies depending on whether they use hosted payment pages, hosted fields, or direct API.

• Uptime and contingency plans
  

Revenue depends on a payment gateway’s uptime. Service disruptions mean interruptions in collections. Providers must include an uptime clause in the contract. Ideally, sellers need to be able to automatically switch to a second backup gateway if the first goes down. This redundancy is key for sellers with high transaction volumes.

• Reversibility
  

Payment gateways store subscriber card information as tokens proprietary to the provider. Reversibility clauses ensure that the data can be transferred to another provider using a secure, PCI DSS–compliant procedure. Without this clause, if the seller switches to a new gateway provider, customers must re-enter their card details. Some customers might decline to do so. Each subscriber lost is one less source of recurring revenue.

How Stripe Payments can help

Stripe Payments provides a unified, global payments solution that helps any business – from scaling startups to global enterprises – accept payments online, in person and around the world.

Stripe Payments can help you:

• Optimise your checkout experience: Create a frictionless customer experience and save engineering time with prebuilt payment UIs, access to 125+ payment methods, and Link, Stripe's consumer network.
  
• Expand to new markets faster: Reach customers worldwide and reduce the complexity and cost of multicurrency management with cross-border payment options, available in 195 countries across 135+ currencies.
  
• Unify payments in person and online: Build a unified commerce experience across online and in-person channels to personalise interactions, reward loyalty and grow revenue.
  
• Improve payments performance: Increase revenue with a range of customisable, easy-to-configure payment tools, including no-code fraud protection and advanced capabilities to improve authorisation rates.
  
• Move faster with a flexible, reliable platform for growth: Build on a platform designed to scale with you, with 99.999% historical uptime and industry-leading reliability.
  

Learn more about how Stripe Payments can power your online and in-person payments or get started today.

FAQs about payment gateways in France