The short answer
A gateway fee is what you pay the technical layer that sits between your website and the payment processor. The gateway tokenizes card data at entry, performs fraud checks, routes auth requests to the processor, handles 3DS, and stores cards on file. Gateway fees show up on your merchant statement as a separate monthly line plus per-transaction cents, and they're frequently the single most over-padded item on a processor quote.
Typical gateway-fee structures
- Monthly gateway access fee: $5-$25/mo (Authorize.net ~$25, NMI ~$10-$15, Braintree $0, Stripe $0 since it bundles).
- Per-transaction fee: $0.05-$0.10 per auth attempt (approved AND declined on some gateways).
- Fraud-module surcharge: $5-$25/mo + $0.05/txn extra for advanced fraud filtering (Kount, Sift, ClearSale integrations).
- Tokenization / CSE fee: Included at most reputable gateways; occasionally $0.02-$0.05/txn on older platforms.
- ACH / eCheck gateway fee: Often a separate $5-$15/mo plus $0.25-$0.50/txn for ACH entries.
Bundled vs. unbundled gateway
Aggregators like Stripe, Square, and PayPal bundle gateway and processing — you see one 2.9% + $0.30 number and don't separately pay a gateway fee. Independent sales organizations (ISOs) and traditional processors use independent gateways (Authorize.net, NMI, Elavon Converge, Payroc FortisPay) and the gateway charges are on top of interchange-plus.
Neither model is automatically better. Bundled is simpler but less portable — if you ever switch processors, the gateway (and your stored cards) goes with them. Unbundled is more portable but you maintain one more vendor relationship.
What operators need to know
- Gateway fees are almost always negotiable. The $25/mo Authorize.net fee is list price; most ISOs resell it at $10 or waive it entirely on larger accounts. Ask.
- "Gateway fee" can hide processor markup. Some ISOs label their own markup as "gateway fee" to keep the advertised discount rate low. Check the line items.
- Per-decline gateway fees add up. If you're paying $0.05 per transaction (approved + declined) and your card-testing mitigations aren't tight, a single card-testing attack can rack up $500+ in gateway fees overnight. See velocity check.
- Portability matters for multi-brand. A unified gateway (like the one multiflow runs) means your stored tokens move with you if you switch processors. Brand-locked tokens mean every processor change requires forced re-entry from every customer.
- Gateway outages = your outage. One gateway means one point of failure. Redundant gateway architecture (primary + failover) prevents weekend outages from killing Monday-morning revenue.