White-Label Payment Gateway in 2026: The Complete Guide
A 2026 deep dive into white-label payment gateways: branded card, APM, bank transfer and crypto acceptance, orchestration, PCI DSS Level 1, 3DS2, decline recovery, anti-fraud and PSD3 SCA updates.
What is a white-label payment gateway?
A white-label payment gateway is a fully branded payment acceptance platform that you operate under your own name while a technology vendor supplies the underlying software, infrastructure and compliance backbone. Your merchants see your logo, your checkout, your dashboard and your support. Underneath runs a production-grade engine that routes transactions to acquirers, tokenizes cards, authenticates via 3DS2, scores fraud and reconciles settlements.
In 2026 the category has matured well beyond "rebranded Stripe checkout". A modern white-label gateway is a payment orchestration platform: multi-acquirer routing, cascading retries, smart decline recovery, network tokens, APMs, open banking, stablecoin rails, KYB onboarding and subscription billing, all exposed as APIs and a merchant portal you can ship tomorrow.
Your brand, end to end
Checkout, hosted pages, merchant portal, emails and API responses carry your name. The vendor is invisible to your clients.
Orchestration built in
Route to the cheapest or best-performing acquirer, cascade on soft declines, switch on outage, all via rules you control.
PCI DSS Level 1
The platform holds the certification, tokenizes PAN data and shields you from most of the audit scope.
Target buyers are payment service providers, ISOs, acquirers launching digital channels, marketplaces that need split payouts and SaaS platforms monetising payments. For every one of them, white-labelling is faster than building and safer than reselling someone else's checkout.
Let's discuss your project and see how we can launch your digital banking product together
Request demoGateway vs processor vs orchestrator
The three terms are often used interchangeably. They are not the same thing, and the distinction matters when you price a project or pick a vendor.
| Layer | What it does | Who provides it | Typical revenue |
|---|---|---|---|
| Gateway | Captures card and APM data, tokenizes, runs 3DS2, forwards the authorisation to a processor. | Crassula, IXOPAY, Akurateco, Payneteasy, Praxis Cashier. | Per-transaction fee plus monthly platform fee. |
| Processor / acquirer | Holds the scheme license, sends the auth to Visa or Mastercard, settles funds to the merchant. | Worldline, Nuvei, Adyen, Checkout.com, Stripe. | Interchange plus scheme fees plus margin. |
| Orchestrator | Sits above gateways and acquirers, routes traffic based on rules, price, risk and performance. | Primer, Gr4vy, Spreedly, and gateways with orchestration (Crassula, IXOPAY). | Per-transaction fee, usually lower than gateway margin. |
In 2026 the lines blur. Most serious white-label gateways (Crassula included) now ship orchestration as a core feature, because running a single acquirer in 2026 leaves money on the table every minute of the day.
Core features a 2026 gateway must ship
Checklist for anyone evaluating a white-label vendor or building an internal gateway. If any of the following is missing, the product is either unfinished or built in 2019.
Multi-acquirer routing
Rules by BIN, country, currency, MCC, amount, risk score. Failover within milliseconds on acquirer outage.
Tokenization and network tokens
Vault-based tokens plus Visa and Mastercard network tokens for higher auth rates and scheme discounts.
3DS2 and SCA exemptions
Full EMV 3DS2.3 support, TRA, low-value and MIT exemptions routed automatically per PSD2 and incoming PSD3 rules.
Decline recovery
Smart retry with network token refresh, card account updater, scheme-specific retry windows and cascading to a backup acquirer.
Anti-fraud
Native rule engine plus plug-ins for Kount, Riskified, Forter, Sift, Signifyd and ThreatMetrix.
Merchant onboarding and KYB
Self-serve signup, UBO checks, sanctions and PEP screening, document collection and underwriting workflows.
Subscription billing
Recurring schedules, dunning, proration, MIT flags, ready for PSD3 and scheme credential-on-file rules.
APMs and local rails
Apple Pay, Google Pay, PayPal, iDEAL, Bancontact, Sofort, Klarna, Pix, SEPA Instant, FasterPayments, plus stablecoin settlement.
Reporting and reconciliation
Real-time dashboards, chargeback workflows, settlement files, RBI and scheme-compliant data exports for finance teams.
The 2026 payment gateway market
Three shifts define the 2026 market. First, orchestration has gone mainstream: the average mid-market merchant now runs two to four acquirers. Second, recovery is a product category of its own, with smart retry, network token refresh and account updater routinely lifting auth rates by 2 to 7 percentage points. Third, PSPs that do not offer a white-label option are losing deals to those that do, because ISOs and ISVs want their own brand on every pixel.
Who buys a white-label payment gateway
Five buyer archetypes dominate the 2026 pipeline. Each has different priorities and each shapes the feature set differently.
Payment service providers
Regional PSPs that want to offer a branded gateway without building one. They bring the acquiring relationships, the platform brings the tech, the merchant portal and the compliance.
ISOs and agents
Independent sales organisations that sell processing and want to own the merchant portal instead of renting it from their bank or acquirer. Margin lives in retention.
Marketplaces
Platforms with hundreds or thousands of sub-merchants that need split payouts, escrow, KYB onboarding and branded payout flows under a single contract.
SaaS and vertical ISVs
Booking systems, invoicing platforms, vertical software (beauty, healthcare, gyms) that monetise payments inside their product. Payments become a meaningful revenue line.
Acquirers and banks
Tier-2 acquirers that need a modern e-commerce gateway to pair with their in-store terminals. White-labelling beats a five-year build.
Crypto and hybrid PSPs
Platforms that need card acceptance plus stablecoin settlement, on-ramp and off-ramp. Hybrid flows are a 2026 growth segment.
The vendor landscape in 2026
The white-label and orchestration category has consolidated around a handful of credible vendors. The honest positioning map looks like this.
| Vendor | Sweet spot | Model | Notes |
|---|---|---|---|
| Crassula | PSPs, ISOs, marketplaces, SaaS | Full white-label, cloud or on-prem | Gateway plus orchestration plus KYB plus merchant portal. Ships in 6 to 12 weeks. |
| IXOPAY | High-volume merchants, PSPs | White-label gateway and orchestration | Mature routing, strong European footprint, acquired by TokenEx. |
| Akurateco | Smaller PSPs and startups | White-label cashier | Competitive pricing, solid APM library. |
| Payneteasy | PSPs, banks | White-label and on-prem | Long history, traditional PSP stack. |
| Praxis Cashier | High-risk, iGaming, forex | Cashier and orchestration | Deep APM coverage for regulated and high-risk verticals. |
| Ixaris (Nium) | B2B and travel payouts | Virtual cards and payouts | Different problem space, often used alongside a gateway. |
| Primer / Gr4vy / Spreedly | Enterprise merchants | Pure orchestration | No acquirer, no merchant portal, bring your own gateways. |
Pure orchestrators (Primer, Gr4vy, Spreedly) and white-label platforms (Crassula, IXOPAY, Akurateco) solve overlapping but distinct problems. If you want a branded product to sell, pick the latter. If you are a large merchant that already runs several gateways and needs a routing layer on top, the former.
Security, compliance and the 2026 regulatory picture
Compliance is the load-bearing column of any payment gateway. The vendor who cannot show a clean audit trail cannot sell to a serious PSP.
- PCI DSS v4.0.1 is the baseline. Full enforcement of the new 4.0 requirements kicked in at the end of March 2025. Anyone touching PAN data now needs targeted risk analyses, stronger MFA, automated log analysis and client-side script controls. A white-label gateway that holds Level 1 certification shields you from most of that scope.
- PSD3 and the Payment Services Regulation. The EU reached political agreement in 2024 and early 2025. Implementation lands in 2026 with stricter SCA rules, explicit IBAN and name matching, an expanded open banking scope and new fraud liability rules. Your gateway must support SCA exemptions cleanly and expose the data PSD3 requires.
- EMV 3DS 2.3 and SRC. 3DS 2.3 adds device binding, decoupled authentication and better SCA exemption handling. Secure Remote Commerce is the scheme-driven replacement for branded "click to pay" buttons, unifying Visa, Mastercard, Discover and Amex checkout. Your gateway should support both.
- KYB, AML and sanctions screening. Merchant onboarding is the weakest link in most gateways. Automated UBO checks, sanctions and PEP screening, periodic review and transaction monitoring are no longer optional, they are the reason acquirers stay on the platform.
The practical outcome: if you build the gateway yourself, plan for 9 to 18 months just to get PCI DSS Level 1. A white-label vendor who already holds it saves you that year and the audit budget.
Build vs buy: the honest trade-off
Three honest paths exist. Each has a different time-to-market and a different ongoing cost.
| Path | Time to launch | Capex | Best fit |
|---|---|---|---|
| Build from scratch | 18 to 36 months | €3 to 10M plus PCI audit | Large banks and acquirers with a clear strategic IP argument. |
| Resell a branded Stripe / Adyen | 2 to 4 weeks | Minimal | Agencies that do not need their own portal, rules or pricing. |
| White-label platform (e.g. Crassula) | 6 to 12 weeks to MVP | Low six figures | PSPs, ISOs, marketplaces and SaaS that want a real product without a 2-year roadmap. |
Building in-house is rarely the right call in 2026. A competent white-label platform already ships the boring 80% (ledger, tokenization, 3DS2, retries, dunning, reporting) so your team can focus on the 20% that makes your product unique: your routing rules, your risk models, your merchant mix, your verticals.
Where Crassula fits and what comes next
Crassula ships a production-grade white-label payment gateway with orchestration built in. You get multi-acquirer routing, full tokenization and network tokens, EMV 3DS2.3, smart retry and decline recovery, anti-fraud plug-ins (Kount, Riskified, Forter, Sift, Signifyd), KYB-ready merchant onboarding, subscription billing and a branded merchant portal. The stack is modular, so you can switch on only the modules your roadmap needs and plug in your own acquirer relationships.
Three directions define where the category is going next:
- AI-native optimisation. Routing, retry timing, SCA exemption decisions and fraud scoring are already majority-model at leading vendors. Expect 2 to 5 points of auth-rate lift versus static rules.
- Stablecoin rails go mainstream. USDC, EURC and PYUSD settlement sit alongside card rails. Cross-border merchants route B2B and payouts over stablecoins for 1-day settlement at scheme-fee economics.
- Consolidation of gateway plus orchestration. The distinction between gateway and orchestrator disappears. By 2027 most white-label platforms offer both, and pure orchestrators either acquire a gateway or stay niche.
Whichever of the three you bet on, the direction of travel is the same: branded, orchestrated, compliant and AI-optimised by default. A white-label gateway is how most teams get there without a 3-year detour.
FAQ
A white-label payment gateway is a branded payment acceptance platform that you operate under your own name while a technology vendor supplies the software, infrastructure and PCI DSS Level 1 compliance. Merchants see your brand. Under the hood runs a full stack of tokenization, 3DS2, multi-acquirer routing, anti-fraud and reporting.
A gateway captures payment data, tokenizes it, runs 3DS2 and forwards authorisations to a processor. An orchestrator sits above gateways and acquirers, routing traffic by rules such as price, BIN, country and performance. In 2026 most serious white-label gateways (Crassula included) ship orchestration natively, so the categories are converging.
Payment service providers, ISOs, acquirers launching digital channels, marketplaces that need split payouts, vertical SaaS that monetise payments and hybrid crypto-plus-card PSPs. Anyone who needs their own brand on checkout and a merchant portal without building the whole stack from scratch.
With a credible white-label vendor, yes. The platform holds Level 1 certification and handles card data inside its vault, which sharply reduces your PCI scope. You still manage your own organisational controls, but you avoid the 9 to 18 months of work it takes to certify a gateway from scratch.
Three layers. First, network token refresh and card account updater keep stored credentials valid. Second, smart retry replays soft declines at scheme-compliant windows with the right reason codes. Third, cascading failover sends the authorisation to a backup acquirer within milliseconds. Together this typically lifts authorisation rates by 2 to 7 percentage points.
PSD3 and the Payment Services Regulation land in 2026 with stricter SCA, explicit IBAN-name matching, expanded open banking scope and new fraud liability rules. A modern gateway routes SCA exemptions (TRA, low-value, MIT) automatically, supports EMV 3DS 2.3 and exposes the data PSD3 requires.
Crassula ships a native rule engine and pre-built plug-ins for Kount, Riskified, Forter, Sift, Signifyd and ThreatMetrix. You can run them in parallel, combine scores, and route high-risk traffic through a stricter acquirer or step-up to 3DS2.
A branded MVP typically ships in 6 to 12 weeks. That includes the checkout, the merchant portal, acquirer integrations, 3DS2, tokenization, KYB onboarding and reporting. Complex verticals (high-risk, crypto settlement, large marketplace flows) can stretch to three to six months. Building the same stack in-house is an 18 to 36 month project.
