What you actually need to become a payment processor
Starting a payment processing company means you will be the middleman between a business and the bank that holds their money. You take a customer's card or digital payment, hold it briefly, verify the funds exist, and send the money to the business's bank account — usually within one to three business days. In exchange, you keep a small percentage of each transaction as your fee.
This is not a business you can start from your kitchen with a laptop. You will need a merchant account (a special bank account that accepts card payments), a payment gateway (software that encrypts and routes the transaction), a processor license or partnership with an existing processor, and compliance with federal banking regulations. Most new companies do not build these from scratch — they partner with an existing payment processor and resell their services under their own brand, or they build software that sits on top of an existing processor's infrastructure.
The barrier to entry is high because banks are liable for fraud. If you process a stolen card and the cardholder disputes the charge, the bank loses money. Because of that liability, banks require payment processors to carry insurance, maintain capital reserves, and pass regular audits. You cannot avoid these requirements by being small or new.
Key Takeaways
- Most new payment processing companies partner with an existing processor rather than building their own infrastructure, because the regulatory and technical barriers are too high to build alone.
- You will need a merchant account with a bank, a payment gateway, a processor license or partnership agreement, and errors and omissions insurance before you can legally process payments.
- The Federal Reserve, the Office of the Comptroller of the Currency, and state banking regulators all have rules about who can handle customer payment data and how.
- Your business model determines your regulatory burden: reselling another processor's services is simpler than building your own payment infrastructure.
- You will need to understand PCI DSS (Payment Card Industry Data Security Standard) compliance, which sets rules for how you store and handle card information.
The three main business models and what each requires
The simplest model is reselling: you sign an agreement with an existing payment processor (like Stripe, Square, or a regional processor), and you market their services to small businesses under your own brand. You do not touch the payment data yourself — the processor's software handles it. You take a cut of their fee. This requires the least regulatory burden because you are not actually processing payments; you are selling access to someone else's processor. You still need a business license, a merchant account for your own business, and a reseller agreement.
The second model is building a payment process (or "fintech app"): you create software that connects to an existing processor's API (the technical interface that lets your software talk to theirs). Your app might specialize in restaurants, salons, or nonprofits. You handle the user experience and the business logic, but the processor handles the actual payment processing and data security. This requires more technical skill and a formal partnership agreement with the processor, but still less regulatory burden than building your own processor.
The third model is becoming a payment processor yourself: you build the infrastructure that actually handles card data, routes transactions to banks, and manages the settlement. This is the most complex and most heavily regulated. You will need a money transmitter license in most states, a partnership with a bank or a bank charter of your own, errors and omissions insurance, and compliance with federal anti-money-laundering rules. Most companies that do this are either very large or very specialized (like a processor for a specific industry).
Regulatory requirements that explore to all three models
The Payment Card Industry Data Security Standard, or PCI DSS, is a set of rules written by Visa, Mastercard, American Express, and Discover. It covers how you store card numbers, how you encrypt data in transit, how you control access to systems, and how you monitor for breaches. Compliance is not optional — your bank will require it as a condition of your merchant account. The level of compliance you need depends on how many transactions you process per year, but even small processors must meet the baseline requirements.
If you are processing payments in the United States, you will also need a money transmitter license in most states. A money transmitter is anyone who moves money on behalf of someone else. Some states do not require a license; others require one. You will need to check your state's banking regulator (usually called the Department of Financial Services or Division of Banking). The license typically requires you to post a surety bond (a financial may provide), pass a background check, and submit to regular audits.
Federal law also requires you to comply with the Bank Secrecy Act and anti-money-laundering rules. This means you must report suspicious transactions, verify the identity of your customers, and maintain records of large transactions. If you are processing payments for high-risk businesses (like cannabis, gambling, or adult services), the requirements are stricter and the banks are more reluctant to work with you.
You will also need errors and omissions insurance (sometimes called professional liability insurance). This covers you if you make a mistake that costs a customer money — for example, if you accidentally process the same transaction twice, or if your system goes down and a business loses sales. Banks often require this as a condition of your merchant account.
The technical infrastructure you will need
If you are reselling or building an app on top of an existing processor, you need a payment gateway — software that encrypts the card number, validates the card, and sends the transaction to the processor. You can build this yourself (which requires significant technical skill and security informed) or you can use a gateway provider like Authorize.net, Paypal Commerce Platform, or Stripe's API. Most new companies use an existing gateway rather than building their own.
You will also need a merchant account with a bank. This is a special bank account that accepts card payments and deposits the funds. It is different from a regular business checking account. The bank will charge you a fee for the account (usually a monthly fee plus a percentage of each transaction) and will require you to meet PCI compliance before they open it.
If you are building your own processor, you will need to connect to the card networks (Visa, Mastercard, American Express, Discover) and to the Federal Reserve's ACH network (which handles bank-to-bank transfers). These connections are not available to just anyone — you must be approved by the networks and by the Federal Reserve, and you must meet their technical and financial requirements. This is why most new companies do not attempt to build their own processor.
How to actually get your free guide
Start by deciding which business model makes sense for your situation. If you want to resell, research payment processors that offer reseller programs and contact their sales team. If you want to build an app, choose a processor with a good API and developer documentation (Stripe and Square are popular choices for this), and sign up for a developer account. If you want to build your own processor, you should hire a lawyer who specializes in payment processing and fintech, because the regulatory path is complex and varies by state.
Next, form a business entity (an LLC or corporation) in your state. This protects your personal assets if something goes wrong. Register for an Employer Identification Number (EIN) with the IRS, even if you have no employees — you will need it to open a merchant account.
Then, research your state's money transmitter license requirements. Contact your state's banking regulator and ask what you need to do. Some states have a straightforward process process; others require extensive documentation. Budget several months and several thousand dollars for this step.
Once you have your business entity and understand your state's requirements, contact banks about opening a merchant account. You will need to provide your business plan, your financial statements (if you have them), proof of your identity, and documentation of your compliance plan. Be prepared to be rejected by several banks — many banks are cautious about payment processing companies because of the regulatory risk.
Finally, get errors and omissions insurance. Contact an insurance broker who works with fintech companies and ask for a quote. The cost varies based on your business model and the volume of transactions you expect to process, but budget at least a few hundred dollars per year.
Common obstacles and how to handle them
Banks are reluctant to work with payment processors because they are liable for fraud. If you are starting out, you may find that banks reject your process or require you to maintain a large cash reserve (called a "reserve requirement"). This is normal. Some banks specialize in working with fintech companies and are more willing to take on the risk. Look for banks that advertise fintech partnerships or that have a dedicated fintech lending team.
If you want to process payments for high-risk businesses (like cannabis, gambling, or adult services), the barriers are much higher. Many banks will not work with these industries at all, and the ones that do charge much higher fees and require more extensive compliance. If this is your target market, research which banks work in that space before you start, because you may not be able to use a mainstream processor.
Compliance is expensive and time-consuming. If you are building your own processor, budget for a compliance officer or consultant who understands PCI DSS, money transmitter licensing, and anti-money-laundering rules. If you are reselling or building an app, your compliance burden is lower, but you still need to understand the rules well enough to explain them to your customers.
Frequently Asked Questions
Can I start a payment processing company without a money transmitter license?
It depends on your state and your business model. If you are reselling another processor's services and not touching the payment data yourself, you may not need a license in some states. But if you are handling customer funds or processing payments yourself, you almost certainly need a license. Contact your state's banking regulator to find out what applies to you.
How much does it cost to start a payment processing company?
The cost varies widely depending on your business model. If you are reselling, you might start with just a business license and a reseller agreement — a few hundred dollars. If you are building an app, add development costs (which could be thousands to tens of thousands depending on complexity). If you are building your own processor, budget tens of thousands of dollars for legal, compliance, and technical infrastructure, plus ongoing costs for insurance and audits.
How long does it take to get a money transmitter license?
It varies by state. Some states process applications in a few weeks; others take several months. You will need to submit an process, pass a background check, and sometimes undergo an audit. Budget at least two to three months, and longer if your state requires extensive documentation or if there are questions about your process.
What is PCI DSS compliance and do I really need it?
PCI DSS is a set of security standards for handling card data. Yes, you really need it — your bank will require it as a condition of your merchant account, and the card networks enforce it. The specific requirements depend on how many transactions you process, but even small processors must meet the baseline standards for data encryption, access control, and monitoring.
Can I process payments without a bank merchant account?
No. A merchant account is where the money from customer payments actually lands. You cannot legally process card payments without one, and you cannot open a merchant account without meeting PCI compliance and your bank's other requirements. This is one of the non-negotiable parts of the business.