Types of payment gateways: 2026 UK ecommerce guide

TL;DR:

UK ecommerce businesses should choose a payment gateway type based on compliance needs, resources, and future growth plans.

Hosted gateways offer minimal security requirements but may reduce customer conversion, while self-hosted options demand extensive security measures and higher costs.

UK ecommerce businesses in 2026 choose primarily between four types of payment gateways: hosted, self-hosted, API-hosted, and local bank integration. The difference between them comes down to one critical question: where does card data actually go, and who is responsible for securing it? That single factor shapes your PCI DSS compliance obligations, your development costs, and the checkout experience your customers get.

Here is a quick-reference breakdown before we go deeper:

Hosted gateways redirect customers to a provider-controlled payment page (e.g. Stripe Checkout, Opayo Payment Pages, PayPal Checkout). Card data never touches your servers. Lowest compliance burden: SAQ A.
Self-hosted gateways keep the payment form on your own site, with card data passing through your environment. Full branding control, but the heaviest compliance requirement: SAQ D.
API-hosted gateways embed secure iframes or SDKs (e.g. Stripe Elements, Worldpay hosted fields) directly in your checkout. Card data bypasses your servers while customers stay on your domain. Mid-tier compliance: SAQ A-EP.
Local bank integration gateways connect directly to banking infrastructure for methods like direct debit, with providers such as GoCardless and Braintree serving the UK market.

Providers including Stripe, PayPal, Worldpay, Opayo, Adyen, Square, GoCardless, and Braintree all operate in the UK, and most support more than one integration model. Choosing between them is not just a technical decision. It affects conversion rates, ongoing costs, and how much security responsibility lands on your team.

How hosted payment gateways work

Hosted gateways are the most straightforward payment processing solution available to UK merchants. When a customer clicks “pay now,” they are redirected to a secure page controlled entirely by the gateway provider. Card details are entered there, the transaction is processed, and the customer lands back on your confirmation page. Your servers never receive, transmit, or store cardholder data.

Because of that clean separation, hosted gateways reduce PCI DSS scope to SAQ A, the lightest self-assessment questionnaire available. For most small UK merchants, that means minimal compliance overhead and no need for specialist security audits.

Common UK examples include:

Stripe Checkout — fast to deploy, well-documented, supports 135+ currencies
Opayo Payment Pages — long-standing UK presence, popular with SMEs and charities
PayPal Checkout — high consumer recognition, one-click repeat checkout for returning buyers
Worldpay Hosted Payment Page (HPP) — strong acquiring infrastructure, suits established retailers
Square — straightforward setup, popular with businesses trading both online and in person

The trade-off is UX. Redirecting customers away from your domain creates a visible break in the journey, and hosted checkouts typically see 5–15% lower conversion compared to on-page alternatives. Providers offer varying degrees of branding control, usually logo, colours, and some CSS, but the page always lives on their domain. For merchants processing under roughly £250,000 in annual online sales without an in-house development team, that trade-off is almost always worth it.

Key advantages at a glance:

Minimal development effort; can be live within hours
SAQ A compliance scope, often free to maintain with provider tools
Provider handles security updates, fraud tooling, and SCA under PSD2
Lower upfront cost, though per-transaction fees can be higher than integrated alternatives

What self-hosted payment gateways actually demand from you

Self-hosted gateways put the payment form directly on your website. Your code captures card details and transmits them to the processor via API. The customer never leaves your domain, and you control every pixel of the checkout experience. That level of control comes with a significant cost.

Hands typing code for payment gateway integration

Because cardholder data touches your own environment, self-hosted integrations require SAQ D, the most extensive PCI DSS questionnaire, covering over 300 controls. Those controls include network segmentation, encryption key management, vulnerability scanning, and annual penetration testing. For many UK businesses, the cost of achieving and maintaining that standard runs to £5,000–£20,000+ per year in security tooling, audits, and staff time.

Providers offering self-hosted APIs in the UK include Worldpay Direct API, Braintree, Adyen, and Checkout.com. These platforms give developers the raw tools to build entirely bespoke checkout flows, advanced fraud rules, and deep integrations with in-house systems such as ERPs and CRMs.

Who genuinely benefits from self-hosted:

Large retailers and enterprise platforms with dedicated security and development teams
Businesses where checkout customisation is commercially critical (complex B2B flows, subscription billing, marketplace payouts)
Merchants with compliance and security budgets that make SAQ D a manageable ongoing cost

Who should think twice:

SMEs without in-house security expertise
Businesses where development resource is limited or shared
Merchants whose primary goal is speed to market

Pro Tip: Before committing to a self-hosted integration, get a realistic quote for annual PCI DSS compliance maintenance, not just the initial build. The ongoing audit and tooling costs frequently surprise merchants who focus only on development fees.

API-hosted gateways: the middle ground worth knowing about

API-hosted gateways, sometimes called hosted fields or embedded checkouts, sit between the two extremes. The payment form appears to live on your own checkout page, but the individual card input fields are actually rendered inside secure iframes served directly from the provider’s domain. Card data passes straight from the customer’s browser to the gateway, bypassing your servers entirely.

To the customer, it looks and feels like a single, uninterrupted page on your site. To your compliance team, it is a meaningful reduction in scope: API-hosted integrations typically qualify for SAQ A-EP, which is more demanding than SAQ A but far less onerous than SAQ D. Misunderstandings about this model are common. Modern API-hosted solutions use tokenisation and iframes to keep card data off merchant servers, which is quite different from a fully self-hosted build where your code handles raw card numbers.

UK providers offering this model include:

Stripe Elements — highly customisable, excellent developer documentation, supports Shopify SEO automation and platform integrations
Opayo hosted fields — familiar to UK SMEs, straightforward to implement
Worldpay hosted fields — suits established retailers wanting brand consistency
Adyen — preferred by larger merchants needing global reach and multi-currency support

The development effort sits at a moderate level. Front-end work is required to style the fields and handle UI states, error messages, and webhooks, but it is substantially less than a full self-hosted build. For growing UK ecommerce businesses with moderate to substantial annual turnover, this model typically represents the best balance of brand control and compliance practicality.

Key considerations:

Customers stay on your domain throughout, which supports brand trust and conversion
SAQ A-EP compliance is achievable without a dedicated security team
Customisation is extensive: full page design, styled fields, saved cards, and retry logic
More engineering time than a hosted redirect, but far less than a pure self-hosted build

Local bank integration gateways and where they fit

Local bank integration gateways connect directly to banking infrastructure rather than routing payments through a card network. In the UK, the most prominent use case is direct debit, where GoCardless facilitates direct debit payments via the Bacs network, allowing merchants to pull funds directly from customer bank accounts on a scheduled or one-off basis.

This model suits specific business types rather than general ecommerce. Subscription businesses, SaaS platforms, utilities, and B2B merchants with recurring billing find direct debit particularly useful because it typically carries lower transaction fees than card processing and has high success rates for repeat payments. Braintree also supports local payment methods alongside its card processing capabilities, giving merchants a single integration point for multiple payment types.

Practical considerations for UK merchants:

Lower per-transaction fees compared to card-based processing
Trusted by UK consumers for recurring payments (utilities, subscriptions, memberships)
Mandates and authorisations add a setup step that card payments do not require
Less suited to one-off retail purchases where immediacy matters
International sales are more complex; direct debit schemes vary significantly by country

The customer experience differs from card checkout. Customers authorise a mandate rather than entering card details, which works well for subscription sign-ups but can feel unfamiliar in a standard retail checkout context. For merchants whose model is primarily recurring or B2B, this is a genuine advantage. For general retail, card-based gateways remain the default.

How to choose the right payment gateway for your UK store

The right choice depends on three things: your current compliance appetite, your development resource, and where you expect to be in two years. Get those three factors clear, and the decision becomes much more straightforward.

PCI DSS compliance and what it costs you

PCI DSS compliance is not optional. Every business that accepts card payments falls under its requirements, and the gateway type you choose directly determines which compliance tier applies. SAQ A (hosted gateways) is manageable for almost any team. SAQ D (self-hosted) demands rigorous controls that cost most UK SMEs thousands of pounds annually in audits, tooling, and staff time. SAQ A-EP sits in between, achievable for growing businesses with modest development resource.

Compliance callout: Transitioning from a hosted to a self-hosted gateway typically jumps your PCI DSS audit complexity from SAQ A to SAQ D, covering over 300 controls including penetration testing and encryption key management. That is not a migration to take lightly.

Strong Customer Authentication (SCA) under PSD2 also affects how gateways handle 3D Secure and exemptions. Hosted and API-hosted providers generally manage SCA on your behalf; self-hosted integrations require you to implement it correctly in your own code.

UX, conversion, and the cost of a redirect

Checkout friction costs sales. A redirect to a third-party domain creates a visible break in the customer journey, and that break has a measurable impact on conversion. API-hosted and self-hosted gateways keep customers on your domain, which removes that friction entirely. For high-volume merchants, even a modest improvement in checkout conversion can outweigh the additional development and compliance investment.

Our secure payment integration guide covers the specific steps involved in moving from a hosted redirect to an embedded checkout, including what to test before go-live.

Transaction fees and total cost of ownership

Hosted gateways are quick and cheap to launch, but per-transaction fees can be higher than integrated alternatives at scale. API-hosted and self-hosted models may offer more competitive processing rates, particularly for merchants negotiating volume-based pricing with providers like Worldpay or Adyen, but they carry higher build and maintenance costs. Map your transaction volume and growth trajectory before assuming one model is cheaper.

Key selection criteria:

Annual sales volume: under £250,000 with no dev team, start with a hosted gateway
Brand consistency: if checkout UX is commercially critical, move to API-hosted (hosted fields)
Recurring billing: direct debit via GoCardless or Braintree suits subscription and B2B models
International growth: Adyen and Stripe offer the broadest multi-currency and global payment method support
Developer resource: self-hosted integrations need dedicated engineering and ongoing security maintenance

Pro Tip: Start with a hosted gateway to launch quickly and validate your sales model. Most UK providers, including Stripe, Worldpay, and Opayo, support all three integration types on the same account, so you can migrate to hosted fields or a fully integrated setup once you have the conversion data and development resource to justify it.

How Bigeyedeers can help you get this right

Picking the wrong gateway type at launch is a common and expensive mistake. We have seen merchants commit to self-hosted integrations before they had the compliance infrastructure to support them, and others stay on hosted redirects long after their conversion data made the case for moving to hosted fields.

At Bigeyedeers, we work with UK ecommerce businesses on Magento and Shopify builds where payment gateway integration is a core part of the architecture, not an afterthought. We use Sansec for proactive security monitoring and maintain PCI compliance as a standard part of our Magento support service. Whether you are launching a new store or migrating from a hosted page to a more integrated setup, we can help you choose the right model and implement it correctly.

Get in touch with our team to talk through your payment gateway options and what makes sense for your business right now.

Key takeaways

The gateway type you choose determines your PCI DSS compliance tier, your checkout conversion rate, and your total cost of ownership, so matching the model to your current scale and resource is the most important decision you will make in your payment setup.

Point	Details
Four main gateway types	Hosted, self-hosted, API-hosted, and local bank integration each carry different compliance and UX implications.
Compliance tier by type	Hosted gateways qualify for SAQ A; API-hosted for SAQ A-EP; self-hosted requires SAQ D with 300+ controls.
Self-hosted compliance cost	Achieving and maintaining SAQ D typically costs UK businesses £5,000–£20,000+ per year in audits and tooling.
Scale-based starting point	Merchants processing under £250,000 annually without a dev team should start with a hosted gateway.
Migration is low-risk	Most UK providers, including Stripe, Worldpay, and Opayo, support all three integration types on one account.