How Online Payment Processing Actually Works
How online payment processing works, how processors, gateways and aggregators differ, and what to check before you choose.
·
12 min read
·
RocketPay Editorial
TL;DR
Online payment processing companies move money from a customer's bank to your account by handling authorisation, authentication, clearing and settlement, usually within a few business days. Gateways, processors and aggregators do different jobs, though many Indian providers combine them, and a processing engine decides routing, retries, fraud checks and reconciliation behind the scenes. Judge providers on success rates, settlement speed, pricing transparency and payment method coverage, and, if you collect subscriptions, EMIs or premiums, on mandate support (UPI AutoPay, eNACH, card standing instructions).
Online payment processing companies are the businesses that move money from a customer's account to a merchant's account when a payment is made online. They handle authorisation, security checks, routing through card or bank networks, and settlement. Choosing the right one affects your success rates, your costs, and your cash flow.
This guide explains how online payment processing works end to end, compares the top providers in India, and covers something most guides skip: recurring payments and mandates. If you bill customers every month, that is where most processors quietly fall short.
What Happens Between "Pay Now" and Money in Your Bank
A customer taps "Pay Now." Within seconds, their payment details are encrypted and sent to your payment processing service. The processor passes the request through a network to the customer's bank, which checks the balance, runs fraud checks, and approves or declines. The customer sees "Payment successful."
The money has not reached you yet. For card payments, approval only means the funds are reserved, while with UPI and netbanking the customer’s account is debited straight away. Either way, the money does not reach your account until clearing and settlement, which usually happens within a few working days. Everything in between is what payment processing services do, and the rest of this guide explains each step.
The Key Players in Every Online Payment
Every online payment involves up to six parties. Knowing who does what helps you understand fees, delays, and failures.
Player | What it does |
|---|---|
Cardholder | The customer paying with a card, UPI, or bank account |
Merchant | The business receiving the payment |
Acquirer | The bank or entity that receives funds on behalf of the merchant |
Issuer | The customer's bank, which approves or declines the payment |
Card network | Visa, Mastercard, or RuPay, which carry the message between acquirer and issuer and set the rules |
Processor | The payment network processor that connects merchants and acquirers to the networks and handles the technical work |
Cardholder and Merchant
The cardholder starts the payment, and the merchant offers the checkout. Both want it to be fast and safe.
Acquirer and Issuer
The acquirer sits on the merchant's side and the issuer on the customer's side. Most declines come from the issuer, which is why a payment can fail even when your checkout works perfectly.
Card Network and Processor
Payment processing networks such as Visa, Mastercard, and RuPay carry authorization and clearing messages. The processor is the layer that talks to these networks for you, so you do not need to integrate with each one.
The Full Payment Processing Flow, Step by Step
An online payment processing system works in four stages. Each stage can fail or add delay, so it helps to know them.
Authorisation
The processor sends the payment request to the issuing bank. The bank checks that the account is valid, funds are available, and the transaction looks legitimate. The result is approved or declined, usually within moments.
Authentication (3DS and OTP)
In India, most online card payments need additional authentication, such as an OTP or 3D Secure step, and UPI needs a PIN. This protects the customer but is also a common drop-off point. A slow OTP or a confusing screen loses sales.
Clearing
At the end of the day, approved transactions are batched and sent through the network. The network tells the issuer how much it owes and the acquirer how much it should receive.
Settlement
The money moves from the issuer to the acquirer and then to your account. Settlement typically takes a few business days after the transaction, though timelines vary by provider, payment method, and your risk profile. Delays usually come from bank holidays, risk holds, or reconciliation mismatches.
These systems are built to be fast, but they involve several independent parties. That is why choosing a processor with good retry logic and clear reporting matters.
Payment Processor vs Payment Gateway vs Payment Aggregator
These three terms are used interchangeably online, but they are different. Understanding the difference helps you evaluate online merchant processing services and online payment processing platforms properly.
Payment gateway | Payment processor | Payment aggregator | |
|---|---|---|---|
Role | Captures payment details securely at checkout and passes them on | Routes transactions to networks and banks and manages authorisation | Lets many merchants accept payments under one master merchant account |
Who holds the money | No one; it passes data | The acquirer or bank, not the processor itself | The aggregator holds funds briefly before settling to merchants |
Best for | Businesses that already have a merchant account | Large merchants with direct bank relationships | Startups and SMEs that want to start quickly |
In practice, many Indian providers are authorised payment aggregators that collect, hold and settle merchant funds, and they run the gateway and processing layers themselves. Ask a provider which of these roles it performs, whether it appears on RBI's list of authorised payment system operators (the list dated 16 October 2026 has 71 payment aggregator entries), and who is liable when a payment fails.
What a Payment Processing Engine Does Under the Hood
A payment processing engine is the software core that decides what happens to every transaction. A good one automates decisions that would otherwise need manual work, which is the idea behind automated payment processing.
Smart routing: sends each transaction through the bank or rail most likely to succeed.
Retries and failover: if one route is down, the engine tries another without the customer noticing.
Fraud scoring: assigns a risk score in milliseconds and flags suspicious payments.
Reconciliation: matches every payment with its settlement so your finance team does not do it by hand.
Ledgering: keeps a precise record of every credit, debit, refund, and fee.
Two processors can offer the same payment methods and still deliver very different success rates. The engine is usually the reason.
Role of Payment Networks: Visa, Mastercard, RuPay, and NPCI/UPI
Payment networks are the rails that connect banks. They set the rules, define the message formats, and earn fees on transactions.
Visa and Mastercard: global card networks that run authorisation and clearing between issuers and acquirers. They set interchange rules and scheme fees.
RuPay: India's domestic card network, operated by NPCI. It is widely used for debit cards and is important for domestic acceptance.
NPCI and UPI: NPCI runs UPI, which works differently from card networks. UPI moves money directly between bank accounts in real time, using a UPI ID and a PIN instead of card details.
The practical difference: card payments run through issuer, network, and acquirer, with fees shared along the chain. UPI is account to account, and its cost structure and rules are set by regulators and NPCI. Your processor needs to support both well.
Types of Online Payment Processing
The online payment processing options you offer shape your conversion rate. Indian customers expect choice.
Cards
Credit and debit cards remain essential, especially for higher-value purchases and international customers. They require tokenisation and authentication.
UPI
The most used digital payment method in India. It is fast, familiar, and works on any smartphone. It supports one-time payments and recurring payments through UPI AutoPay.
Netbanking
Customers log in to their bank to pay. It is still widely used for larger amounts and by customers who do not use cards.
Wallets
Stored-value wallets offer one-click payments and suit frequent small transactions.
BNPL
Buy now, pay later offers lift basket sizes for certain categories, though acceptance varies by provider.
Mobile Payments
Most traffic now comes from phones, so mobile payment processing solutions matter. Look for UPI intent flows, which open the customer's UPI app directly, and in-app SDKs that keep customers inside your app while paying.
Collecting repeat payments?
RocketPay creates and runs UPI AutoPay and eNACH mandates, on its own or on top of the payment provider you already use.
Recurring Payments and Mandates: The Missing Piece in Most Processors
Most guides to online payment processing companies stop at one-time checkout. But if you run a subscription, collect EMIs, or bill premiums, the question that matters is different: can the processor collect repeat payments reliably, without asking the customer to pay again each time?
What Is a Recurring Payment, and How Is It Different from a One-Time Payment?
A one-time payment needs the customer to approve every transaction. A recurring payment is set up once and then collected automatically on a schedule, such as monthly or yearly. The customer approves once, and the business collects each cycle.
What Is a Mandate?
A mandate is the customer's authorisation for a business to debit their account or card repeatedly, within agreed limits and a defined period. It is the legal and technical permission that makes recurring collection possible.
Mandate Creation
A mandate is set up once. The customer gives consent and authenticates, and the bank registers it. If any part of this process is weak, you see failed renewals and customers dropping off. For the full process, read our guide on how recurring payment mandates work, step by step.
Mandate Rails in India
UPI AutoPay: the customer sets up a mandate in their UPI app and debits happen automatically, up to the limits allowed.
eNACH: an electronic mandate registered through the customer's bank via netbanking or debit card, widely used for EMIs and loan collections.
Card-based standing instructions: the customer registers their credit or debit card for recurring charges with their card issuer, under RBI’s e-mandate framework and tokenisation rules. This is separate from eNACH, which debits a bank account.
Each rail differs in setup time, limits, authentication, and failure rates, which is why the best processors support more than one and help you choose.
Regulatory note: The Reserve Bank of India (RBI) regulates recurring e-mandate transactions through its e-mandate framework, which includes additional factor authentication (AFA) requirements and pre-debit notifications. Read the RBI's framework for processing e-mandates for recurring online transactions.
Who Needs Recurring Payments and Mandates
SaaS and software: monthly or annual plans.
OTT and media: subscription renewals.
EdTech: course fees in instalments and monthly memberships, collected automatically.
Lending and NBFC-MFIs: EMI collection.
Utilities and memberships: regular bills and fees.
Business Benefits of Recurring Payments
Lower churn: customers do not lapse because they forgot to pay.
Predictable cash flow: you know what is coming in each cycle.
Fewer failed renewals: automated retries and notifications recover payments.
Less manual collection: your team stops chasing invoices.
This is the area where RocketPay focuses, and it is why mandate capability is one of the criteria in the scorecard below.
What Makes a Good Online Payment Processing Company
Search for the best online payment processing and you will mostly find lists of brand names. A better approach is to score providers against criteria that match your business.
Criterion | What to check |
|---|---|
Success rate | First-attempt success by payment method |
Uptime | Reliability during peak traffic and bank downtime |
Settlement speed | few business days, or instant options, and any holds |
Pricing transparency | MDR, GST, setup fees, and failed-transaction charges |
Payment method coverage | Cards, UPI, netbanking, wallets, BNPL |
Recurring and mandate support | UPI AutoPay, eNACH, card SI, retries, notifications |
APIs and SDKs | Documentation quality, sandbox, webhooks |
Support | Response times and dedicated account help |
Reconciliation | Reports that match payments to settlements |
Security and Compliance in Payment Processing
Payment processing services handle sensitive data, so compliance is not optional.
PCI DSS
The Payment Card Industry Data Security Standard sets requirements for storing, processing, and transmitting card data. A PCI DSS compliant processor reduces your own compliance burden.
RBI Guidelines and Tokenisation
RBI rules restrict merchants from storing actual card numbers. Instead, cards are replaced with tokens that are useless if stolen. RBI also sets rules for recurring payments, including authentication and pre-debit notification.
Fraud Monitoring
Look for real-time risk scoring, velocity checks, and tools to manage chargebacks.
Data Storage Rules
RBI's payment data localisation rules require payment data to be stored in India. Confirm that your provider complies.
Common Reasons a Transaction Fails
Even good payment processing systems see failures. Most come from a short list of causes:
Insufficient funds in the customer's account.
Bank downtime or issuer-side technical issues.
OTP or 3DS failure, such as a delayed or expired OTP.
Limit breaches, where the amount exceeds the card, UPI, or daily limit.
Network timeouts between the processor, network, and bank.
Mandate-Specific Failures
Recurring debits have their own failure causes: an expired mandate, a debit amount above the registered limit, a missed or invalid pre-debit notification, or insufficient balance on the due date. A processor with automated retries and customer reminders can recover many of these.
How to Choose the Right Online Payment Processing Company for Your Business
Start with how you collect money, then match the provider.
One-time e-commerce: prioritise success rates, checkout experience, and method coverage.
Subscription and SaaS: prioritise recurring support, retries, and notifications.
Marketplace: prioritise split settlements and payouts.
Lending and collections: prioritise eNACH and UPI AutoPay reliability and reporting.
Five Questions to Ask Any Vendor
What is your first-attempt success rate for the payment methods I need?
How do you handle mandate creation and failed recurring debits?
What is the full cost, including GST, setup, and failed-transaction fees?
How fast is settlement, and under what conditions can it be held?
What reconciliation reports and support will I get?
The answers show quickly whether a provider fits an online payment processing solution built for your model or only for simple checkout.
Where RocketPay Fits: Mandate-Based Recurring Collections
RocketPay is collections infrastructure for businesses that collect repeat payments, from NBFCs and MFIs to SaaS and subscription businesses. It is not a payment gateway. It creates and runs UPI AutoPay and eNACH mandates, and it can also work on top of the payment provider you already use, so that relationship stays as it is. With RocketPay you can:
Create mandates through UPI AutoPay, eNACH, and cards in one flow.
Reduce failed debits with notifications and retries.
Go live in 48 hours, with a dedicated account manager and 24x7 support.
Track collections and reconcile in one dashboard.
For regulated lenders, RocketPay also offers Account Aggregator-based partial recovery, which fetches the available balance when a debit fails and collects what is there.
Conclusion
Online payment processing is more than a checkout button. Understanding the players, the flow, and the engine behind it helps you pick a partner on more than price. And if you collect repeat payments, mandate support should be near the top of your list.
Key Takeaways
Approval is not payment: an approved transaction only reserves the funds, and money reaches your account after clearing and settlement.
Know who does what: a gateway captures payment details, a processor routes to banks and networks, and an aggregator lets many merchants accept payments under one account. Many Indian providers combine all three.
The engine decides your success rate: smart routing, retries, failover and fraud scoring explain why two processors with the same payment methods perform differently, and most failures start at the issuer.
Recurring payments need more than a checkout button: for subscriptions, EMIs and premiums, look for UPI AutoPay, eNACH, card standing instructions, pre-debit notifications and automated retries.
Choose by business model and check compliance: strong success rates for one-time payments, reliable mandate support for repeat payments, and a PCI DSS compliant provider with RBI-compliant tokenisation and data stored in India.
Run mandate-based collections without changing your payment provider.
RocketPay creates and runs UPI AutoPay and eNACH mandates, with retries and one dashboard to track and reconcile collections.
Book a Demo →
Frequently asked questions
Who are all the parties involved in a single online payment?
Up to six parties are involved: the cardholder (the customer), the merchant (your business), the acquirer (the bank that receives funds for the merchant), the issuer (the customer's bank), the card network (Visa, Mastercard, RuPay, or NPCI for UPI), and the payment processor, which connects merchants and acquirers to the networks.
What is the difference between a payment processor and a payment gateway?
A payment gateway captures payment details securely at checkout and passes them on. A payment processor routes the transaction to card networks and banks and manages authorisation. Many Indian providers offer both, so the better question is which functions a provider performs and who is responsible when something fails.
How long does it take for money to actually settle in a merchant's account in India?
Settlement typically takes a few business days after the transaction. The exact timeline depends on the provider, the payment method, and your risk profile. Bank holidays, risk holds, and reconciliation mismatches can add delays.
What is a payment processing engine?
A payment processing engine is the software core that decides what happens to every transaction. It handles smart routing, retries and failover, fraud scoring, reconciliation, and ledgering. It is the main reason two processors with the same payment methods can deliver very different success rates.
Do online payment processing companies also handle international payments?
Many do, but not all. Providers that support international cards let you accept payments in foreign currencies, usually with extra compliance checks, higher fees, and different settlement timelines. Always confirm which currencies, cards, and countries a provider supports, and what documents are needed to enable it.
What fees do payment processors typically charge in India?
Most charge a merchant discount rate (MDR), a percentage of each transaction that varies by payment method, plus GST on that fee. Some also charge setup fees, annual fees, or fees on failed transactions, refunds, and chargebacks. Ask for the full cost breakdown before you sign up.
Why does a payment sometimes get authorised but not settled?
Authorisation only means the issuing bank has approved the payment and reserved the funds. Settlement happens later, after clearing. A payment can fail to settle because of a risk hold, a reconciliation mismatch, a chargeback or dispute, a bank holiday, or a technical error between the processor, network, and bank. In most cases the reserved amount is released back to the customer if settlement does not complete.
