The Complete Guide to Merchant Services

Setting up card payments or changing providers requires understanding exactly what you are paying for. This guide explains how merchant services operate, breaks down the associated fees, and highlights where businesses typically lose margin to unnecessary charges.

Gala Technology provides independent advice to help you secure the right setup, reduce transaction costs, and maintain PCI DSS compliance.

What is a Merchant Account and How Do They Work?

Accepting credit and debit card payments is a basic requirement for most businesses. To provide some context, UK-issued debit and credit cards were used to make over 31.4 billion transactions in 2024, reflecting a total spend of just over £1 trillion.

To process these payments—whether face-to-face, over the telephone (MOTO), or online—you require a merchant account.

If you are new to card payments, a merchant account functions as a holding account for customer funds before they clear into your standard business bank account.

You typically source these accounts from a Merchant Acquirer or an Independent Sales Organisation (ISO). Once approved, you are issued a Merchant ID (MID)—a unique identification number for your business. Most setups require a separate MID for each payment channel you operate (e.g., one for face-to-face, one for e-commerce, and one for telephone payments).

After a transaction is authorised and funds are verified, the money moves to your merchant account. It is then transferred automatically to your business bank account, minus any transaction fees. This settlement usually takes 3 to 7 days, though some providers now offer same-day settlement.

Who is Involved in the Payment Cycle?

Every card transaction relies on five primary stakeholders to ensure the funds clear securely:

The Cardholder: The customer using a debit or credit card to buy goods or services.

The Merchant: Your business. You initiate the transaction by capturing the card details via a terminal, payment gateway, or secure payment link.

The Acquirer: The financial institution that acquires the funds from the customer's bank and settles them into your merchant account. They charge a Merchant Service Charge for providing this facility.

The Issuer: The bank or financial organisation that provides the payment card to the customer. They authorise the transaction and debit the funds from the cardholder's account.

The Card Scheme: Organisations such as Visa, Mastercard, and American Express. They manage the rules, operation, and clearing of transactions, acting as the bridge between the Acquirer and the Issuer.

Merchant Service Charges and Fees Explained

The cheapest advertised percentage rate is rarely the most cost-effective deal for a business. It is important to understand the specific fees attached to your account to protect your margins.

1. Merchant Service Charges (MSC)

The MSC is the percentage fee applied to every card transaction. Rates vary based on:

Card Type: Debit versus credit, or Visa versus American Express.
Card Origin: Personal, commercial/business, or international cards.
Payment Channel: Face-to-face (Cardholder Present) transactions are generally cheaper than online or telephone payments (Cardholder Not Present / CNP) due to the higher risk of fraud.

Note on Blended Pricing: Some providers charge a single "blended rate" regardless of the card type or channel.

While easier to read on a statement, it frequently results in merchants overpaying heavily on standard domestic debit transactions.

2. Minimum Monthly Service Charge (MMSC)

The MMSC ensures the provider receives a baseline fee if your transaction volume drops. If your agreed MMSC is £20, and your processing fees for the month only total £10, you will be billed the £20 minimum. If your fees total £30, the MMSC does not apply.

3. Hardware and Virtual Terminal Costs

Card Machine Rental: Physical terminals (desktop, mobile, or GPRS) require a monthly rental fee. Check the contract terms carefully for early termination penalties.
Virtual Terminals: These web portals allow staff to manually type in mail order or telephone (MOTO) payments. They carry a monthly fee and a fixed cost per transaction. Transactions processed this way are usually charged at a higher 'non-secure' rate, and the merchant retains full liability for fraud-related chargebacks.

4. Compliance and Security Fees

PCI DSS Compliance: The Payment Card Industry Data Security Standard is a mandatory requirement for any business processing card data. Failing to evidence your compliance annually will result in monthly non-compliance penalty fees applied by your acquirer.
Chargebacks: If a customer successfully disputes a transaction (frequently due to fraud), the funds are reversed. The merchant loses the goods and the revenue, and the acquirer applies an administrative chargeback fee.

Frequently Asked Questions

What is the difference between a payment gateway and a merchant account?

A payment gateway is the technology that securely captures and transmits card data from your website or virtual terminal to the acquirer. The merchant account is the financial holding facility where the funds sit while the transaction clears, before being deposited into your business bank account. You generally need both to process online payments.

Can I use my standard business bank account to process card payments?

No. You cannot accept card payments directly into a standard business bank account. You must have an approved merchant account to act as a secure intermediary holding facility for the funds.

Do I need a different merchant account for online and face-to-face payments?

You can usually use the same merchant account provider, but you will need a separate Merchant ID (MID) for each payment channel. For example, you will be issued one MID for your physical card terminals and a separate MID for your e-commerce website.

Why do telephone (MOTO) payments cost more to process than face-to-face transactions?

Telephone payments are classed as Cardholder Not Present (CNP) transactions. Because the customer is not physically present to use Chip and PIN or biometrics to verify their identity, the risk of fraud is significantly higher. Acquirers offset this risk by charging a higher Merchant Service Charge (MSC) for these transactions.

What happens if my business is not PCI DSS compliant?

If you fail to submit evidence of your PCI DSS compliance, your acquiring bank will apply monthly non-compliance penalty fees to your statement. More importantly, if you process payments non-compliantly and suffer a data breach, your business will be held financially liable for the fraud and subject to severe fines.