Best Payment Gateway for E-commerce: How to Select the Right Solution
Your business model decides most of a gateway choice before you open a single price list. A subscription business and a marketplace should reach opposite conclusions from identical rate cards, because the capability that drives the decision on one branch is the one you can safely ignore on the other.
Find your branch below, apply the test, then ask the six questions before you sign.
Which branch are you on?
Six business models cover almost every online merchant, and each has a different variable carrying the decision. Identify yours first, because the table states both what decides it and what to stop comparing.
| Business model | What actually decides it | What to ignore |
|---|---|---|
| Small store, low volume, no developer | Time to first live transaction, a maintained plugin, hosted checkout, MADA acceptance | Rate decimals, API depth, custom fraud rules, multi-acquirer routing |
| Subscription or recurring revenue | Tokenisation, card updater coverage, configurable retries, dunning, token portability | First-payment checkout tuning, wallet breadth, conversion claims |
| Marketplace or multi-vendor | Split payouts, sub-merchant KYC, who is contractually the merchant, cross-vendor refunds | Whether the provider calls itself a payment facilitator, checkout design |
| Cross-border or multi-currency | Local settlement against repatriation, which rail domestic volume routes over, the FX cost stack | The advertised FX rate alone, DCC revenue-share pitches |
| High-ticket or considered purchase | Authorization validity window, partial and incremental capture, dispute evidence, false declines | Fixed per-transaction fees, small percentage-rate differences |
| Physical store plus online | Which channel carries most volume, and whether one settlement report covers both | The single-provider argument as a principle rather than a tested claim |
Small store, no developer
Two things decide it at this size: how fast you can take a real payment, and whether card data ever touches your server. The rest of a long shortlist is noise at your volume. Choose a provider with a maintained plugin for your platform, a hosted checkout that keeps you out of PCI scope, and MADA acceptance.
Rate matters less than merchants think here. On SAR 20,000 of monthly volume, the gap between 2.60% and 2.75% on credit cards is about SAR 30 a month, and a two-week delay costs more than that.
Your mix matters more. Across providers publishing rates in Saudi Arabia, mada sits at roughly 1% against 2.25% to 3% for international credit cards, and four of eight major providers publish nothing at all. Calculate a blended rate on your own traffic, and ignore multi-acquirer routing, custom risk rules, and negotiated tiers: you have no bargaining weight yet.
Subscriptions: what breaks first
Involuntary churn breaks first. Cards expire, get reissued after fraud, or decline for reasons unconnected to your customer’s intent to stay. A subscription business that picks a provider on checkout conversion has optimised the one payment that was never at risk, while the losses come from every renewal after it.
Three capabilities carry the decision. Network tokenisation and card updater coverage: which schemes are covered, how updates reach you, and what applies to MADA. Retry logic: how many attempts, on what schedule, whether soft and hard declines are treated differently, and whether you can configure any of it. And dunning: pre-expiry notices, a hosted card-update page, and a grace period you set.
Saudi merchants have one more thing to check. SAMA’s own mada page describes mada e-commerce as operating over the 3-D Secure protocol, and processor documentation tells merchants not to disable it for mada. The specification goes to banks and PSPs and is not published, so you cannot look up how unattended recurring charges behave after the first authenticated payment. Ask, and get it in writing.
If some recurring revenue is invoiced rather than card-billed, extend the question to invoicing. HyperBill covers that side for merchants billing some customers on invoice and others on a card.
Marketplaces: who is the merchant?
Three mechanics decide it: whether one buyer payment can be split across several vendors, who is contractually the merchant on each order, and how fast a new vendor can be onboarded and verified. Get the payout model wrong, and you rebuild the business.
Be careful with vocabulary. “Merchant of record” and “payment facilitator” are commercial and legal terms, not definitions issued by a standards body. The PCI Security Standards Council glossary defines acquirer, payment processor, service provider, and merchant, and notes that “processor” is itself sometimes called a payment gateway or PSP. It defines neither of the other two.
So do not ask whether a provider is a payment facilitator. Ask three questions with factual answers. Whose name appears on the cardholder’s statement for a vendor’s order? Who is liable for a chargeback on it? Who owns the vendor’s KYC, and what happens to funds already collected if a vendor fails checks mid-cycle?
The regulatory point bites hardest here, because you create merchants continuously. Under SAMA Circular 46004436, merchant contracting, KYC and AML checks, and final settlement into merchant accounts must be performed by a SAMA-licensed PSP or a bank. A technical-only integration layer cannot legally do that for your vendors. Payout APIs built for this pattern, such as HyperSplit, exist because splitting a payment and settling it are different problems.
Cross-border: what actually costs you
The decision is whether you settle locally or repatriate funds, and whether you show prices in the shopper’s currency at all. Three mechanisms get sold under one “multi-currency” label: dynamic currency conversion, multi-currency pricing, and local settlement. They carry different costs and obligations.
DCC is the one to watch, because it is often pitched as a revenue share. Visa’s own rules require the cardholder to see both currencies, both symbols, the rate used, and any markup, and to actively choose, with no pre-selected default and no steering through font or colour. That is an obligation at your checkout, not free margin.
On a co-badged mada card, processor documentation from Checkout.com and Cybersource describes domestic SAR transactions routing over mada and foreign-currency transactions routing over Visa or Mastercard. Pricing Saudi customers in USD can therefore move domestic volume onto the rail costing two to three times more. Test that before changing presentment currency, and read the multi-currency guide for the full cost stack.
High-ticket sales: what changes
At high order values, two things change: the timing of the money, and the cost of one wrong decision. Authorization, capture and settlement are three separate stages, and a business shipping six weeks after the order needs them separated deliberately. One declined SAR 40,000 order costs more than a month of fee optimisation.
Ask four questions about capture. How long does an authorization stay valid before it expires with your acquirer? Can you capture less than the authorized amount when part of the order ships? Can you capture more than once against one authorization? Can you increment it? Providers differ on all four, and the answers sit in API documentation rather than sales material.
Then understand void against refund. A void before settlement releases the hold and never appears as a completed charge. A refund after settlement is a separate reverse transaction with its own timeline. Cancelling on day one and cancelling on day four are not the same operation.
False declines are the quiet cost. Rules calibrated for a SAR 200 basket behave badly on a SAR 40,000 one. Baymard Institute’s US benchmark lists a declined card as the reason for 10% of abandoned carts and insufficient payment methods for another 9%. US figures, not Saudi ones, but the mechanism transfers. Ask who tunes your rules and whether you can see decline reason codes.
Shop plus online: is one provider better?
Sometimes, and less often than the pitch implies. Consolidating buys one settlement file, one reconciliation, one support relationship, and the ability to refund an in-store purchase against an online order. It costs you strength in the weaker half of the provider’s offering, and every provider has a weaker half.
Online-first providers usually have thinner terminal estates and slower field support. Terminal-first providers usually have thinner APIs and stale documentation. Neither describes itself that way.
Use this test: write down which channel carries more than 70% of your volume and choose the provider strongest there, treating the other channel’s requirements as a shortlist filter rather than a tiebreak. Then ask for a sample settlement report covering both channels before you sign, because that is the benefit most often promised and least often delivered. The 2025 Global Digital Shopping Index, Saudi Arabia Edition, found 34% of Saudi shoppers shop cross-channel against 27.5% globally.
Six questions to ask before you sign
These change the shape of the contract rather than the demo, and they are the ones providers least enjoy. Ask them in writing, ask for the answers to appear in the agreement, and treat a vague reply as an answer in itself.
Start with approval rate: what is it for a merchant with my card mix, over the last ninety days, and how do you define it? Get the definition before the number, because approvals over attempts is not the same figure as approvals over attempts with 3-D Secure abandonment excluded, and a mada-heavy mix behaves differently from a credit-heavy one.
Then ask whether you get the fee back when you refund a customer. Three answers hide in that question: the percentage fee, the fixed per-transaction fee, and whether a separate refund fee applies. Many contracts return none of the three, and in a returns-heavy category that raises your effective rate by more than a negotiation will lower it.
Third, who settles the funds into your account, and under which licence? Under SAMA Circular 46004436, dated 24 July 2024, a provider offering only technical linkage needs no SAMA licence, but merchant contracting, KYC and AML checks, and final settlement into merchant accounts must be performed by a SAMA-licensed institution or a bank. Ask for the legal entity name as it appears on SAMA’s register, not the brand name.
Then three that get skipped. What is the SLA, and what is the remedy when you miss it, since an uptime figure with no consequence attached is marketing. What does migrating off you look like, including export formats and how long reporting access continues after termination. And who owns the stored card tokens if you leave, which carries the highest switching cost on the list and is asked least often: if the provider will not take part in a PCI-compliant token migration, leaving means a re-acquisition campaign rather than a migration.
Two more at significant volume: what triggers a rolling reserve and how it is released, and on what notice the provider may change your pricing.
Why HyperPay
The licensing answer is one you can verify rather than take on trust. SAMA publishes a public register of licensed payment service providers. HyperPay appears there as Hyperpay Inc Saudi Information Systems Technology Company, activity type Electronic Money Institution, unified number 7016872546, licensed to 29 December 2029. We are the entity that contracts with you and settles your funds, not a layer over someone else.
Behind that sit eleven payment methods on one integration, PCI DSS v4.0.1 Level 1 certification with ISO/IEC 27001:2022 and ISO 22301, and products built for the branches above rather than one shape imposed on all of them: HyperSplit for marketplaces, HyperBill for invoicing, HyperTap for in-store acceptance, and HyperHospitality for hotels.
Check every shortlisted provider the same way, then work through your branch with our team.
Top asked questions about Payment Gateway for Ecommerce
What is the best payment gateway for a new online store in Saudi Arabia?
The one you can go live on fastest with Mada acceptance and a maintained plugin for your platform. At low volume, integration time and onboarding speed outweigh rate differences by a wide margin. For named providers and licence categories, see the Saudi market survey.
Should I choose a payment gateway on price?
Only after calculating a blended rate against your own card mix. In Saudi Arabia, mada is priced at roughly 1% by providers that publish rates, while international credit cards run 2.25% to 3%. A mada-heavy business therefore pays far less than the headline credit rate implies.
Can any payment gateway settle money into my bank account?
No. SAMA Circular 46004436 of 24 July 2024 allows purely technical linkage providers to operate without a SAMA licence, but requires that merchant contracting, KYC and AML checks, and final settlement into merchant accounts be performed by a SAMA-licensed institution or a bank. Ask which entity settles.
Do subscription businesses need a different provider?
Not necessarily a different company, but a different feature set. Check network tokenisation, card updater coverage, configurable retry schedules and dunning tools first. A provider that is excellent for one-off retail can still leak revenue every month through expired cards it never refreshes.
What happens to my saved cards if I switch providers?
It depends entirely on your contract. Stored cards are usually held as provider-specific tokens, and moving them requires the outgoing provider to take part in a PCI-compliant token migration. If the agreement is silent, assume you will have to ask every customer to re-enter their details.
Is using one provider for in-store and online cheaper?
Not automatically. Consolidation buys one settlement file, one reconciliation, and one support relationship, and costs you strength in whichever channel the provider handles less well. Choose based on the channel carrying most of your volume, and ask to see a combined settlement report first.