Embedded payments are payment-processing capabilities built directly into the software a business already uses, so customers pay inside the app instead of getting handed off to a separate checkout page. A property management tool collects rent, a dental practice system takes the copay, a gym app charges the monthly membership — all without leaving the host software. For the platform, that closes the loop between the workflow and the money. For the merchant, it removes the friction of running a separate payments stack alongside the business software.
How Embedded Payments Actually Work
The core move is relocating the payment function from a standalone gateway into the host application. Three layers of technology make that possible. APIs let the host software send transaction requests to a payment processor and receive responses in real time. SDKs give developers pre-built code that handles the hardest parts: encrypting card data, managing authentication, and formatting messages for the card networks. Middleware routes sensitive data between the host app, the SDK, and the back-end payment rails.
When a customer clicks “Pay” inside the app, the software captures the payment credentials and immediately tokenizes them. Tokenization replaces the primary account number, which can run from 12 to 19 digits, with a non-sensitive surrogate value. That token is useless to an interceptor, because recovering the original account number from the token alone is not computationally feasible.1PCI Security Standards Council. PCI DSS Tokenization Guidelines
The tokenized request travels through the embedded provider’s infrastructure to the card network, which forwards it to the cardholder’s issuing bank. The bank runs a near-instantaneous funds and fraud check. If approved, an authorization code returns through the network to the host app, and the customer sees a confirmation. Clearing then exchanges transaction details between the issuing and acquiring banks, and settlement deposits funds into the merchant’s account, which the platform itself often manages.
Because the platform controls the entire lifecycle, reconciliation happens automatically. The transaction data lives in the same system as the invoice, appointment, or order, so there’s nothing to match up between separate tools.
The Three Ways to Embed Payments
A software platform generally picks from three integration models. They differ in how much control the platform takes, how much revenue it captures, and how much regulatory weight it has to carry.
Referral Model
The lightest option points merchants to a third-party payment provider. The platform earns a referral fee and never touches the money or the compliance obligations. It’s the easiest to launch and the least lucrative, and it caps how deeply payments can integrate into the software experience.
Payment Facilitator Model
A more involved option is registering as a payment facilitator, or PayFac. The platform contracts with a sponsor acquirer (a bank or processor holding a card-network license) and then onboards sub-merchants directly. Visa and Mastercard treat payment facilitators as third-party agents and require sponsorship and registration by an acquirer before onboarding can begin.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
The PayFac model gives the platform control over pricing, checkout design, and onboarding speed. It also puts real liability on the platform. The sponsoring acquirer is responsible for all acts and omissions of both the facilitator and its sub-merchants, so acquirers do serious due diligence before approving anyone, including background investigations on principal ownership and reviews of risk-monitoring procedures.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
Banking-as-a-Service Model
The most comprehensive path is a Banking-as-a-Service partnership with a chartered bank. The platform can offer deposit accounts, lending, corporate cards, and treasury management alongside payment processing, all inside the same app. The platform doesn’t need its own banking license because the chartered bank provides the regulatory infrastructure through APIs. This route captures the deepest share of financial revenue and requires the closest compliance relationship with the partner bank.
How Platforms Earn Revenue From Payments
The economic logic is straightforward. The platform captures a share of the processing fees on every transaction its merchants run. Credit card processing fees to merchants generally land in the 1.5% to 3.5% range plus a small flat per-transaction fee. The platform doesn’t keep all of that. Interchange goes to the issuing bank and network assessments go to Visa or Mastercard, but the platform retains a markup, often measured in basis points, on every dollar that flows through.
That’s why the PayFac and BaaS models get attention. A referral arrangement produces a one-time or recurring referral fee. A payment facilitator sets the rate it charges merchants and keeps the spread between that rate and the underlying interchange plus acquirer cost. At high transaction volumes, that spread can exceed the revenue from the platform’s core software subscription. Some vertical SaaS companies now earn more from embedded payments than from monthly software fees, and the embedded finance market has been growing at a pace north of 30% annually.
Compliance Obligations
Embedding payments means the platform is handling money, and handling money triggers federal and state obligations. The compliance load is the single biggest reason many platforms start with a referral arrangement rather than jumping to PayFac or BaaS. Getting this wrong isn’t just operational trouble; the civil penalties compound daily.
Federal Money Transmitter Registration
Any entity that owns or controls a money transmitting business must register with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), regardless of whether it also holds a state license.3GovInfo. 31 USC 5330 – Registration of Money Transmitting Businesses Registration must happen within 180 days of the business being established and must be renewed every two years.4FinCEN.gov. Money Services Business (MSB) Registration Failure to register carries a civil penalty of $5,000 per violation, with each day the violation continues counted as a separate offense.
Not every platform is a money transmitter. Federal regulations carve out an exception for entities acting as payment processors facilitating purchases or bill payments through a clearance and settlement system by agreement with the seller.5eCFR. 31 CFR 1010.100 Whether the exemption applies depends on the specifics: how the platform holds funds, who it contracts with, and how long it controls the money before settlement.
State Money Transmitter Licensing
Federal registration is only the starting point. Nearly every state requires its own money transmitter license. Montana is a notable exception, requiring only a registration. State requirements typically include a surety bond, FBI background checks with fingerprints, audited financial statements, and minimum net worth thresholds. A platform operating nationally may need licenses in 49 states plus Washington, D.C., a process that can take over a year and cost significant legal and compliance fees before a single transaction is processed.
Anti-Money Laundering Programs
The Bank Secrecy Act requires money services businesses to maintain AML programs with four minimum components: internal policies and controls, a designated compliance officer, an ongoing employee training program, and an independent audit function.6FinCEN.gov. FinCEN Fact Sheet – AML/CFT Program Requirements Payment facilitators face an additional card-network layer. Visa requires platforms to collect and validate prospective sub-merchant information consistent with Know Your Customer (KYC) processes and applicable AML laws, and to screen applicants through the Visa Merchant Screening Service to check for prior terminations.2Visa. Visa Payment Facilitator and Marketplace Risk Guide
PCI DSS Compliance
Any entity that stores, processes, or transmits cardholder data must comply with the Payment Card Industry Data Security Standard. Tokenization helps reduce the scope of that obligation by replacing card numbers with tokens useless outside the tokenization system, but it does not eliminate PCI DSS requirements entirely.1PCI Security Standards Council. PCI DSS Tokenization Guidelines The validation level depends on volume. Payment facilitators processing more than 300,000 transactions annually must complete a full annual assessment and produce a Report on Compliance, while smaller facilitators can use a Self-Assessment Questionnaire.7Mastercard. Mastercard Site Data Protection (SDP) Program and PCI
1099-K Reporting for Embedded Payment Platforms
Platforms that function as third-party settlement organizations (TPSOs) have a federal obligation to report merchant payment volumes to the IRS. Under IRC Section 6050W, a TPSO must file Form 1099-K for any participating payee whose gross reportable transactions exceed $20,000 and whose total number of transactions exceeds 200 in a calendar year.8Office of the Law Revision Counsel. 26 USC 6050W – Returns Relating to Payments Made in Settlement of Payment Card and Third Party Network Transactions The One, Big, Beautiful Bill retroactively reinstated this threshold after a period of uncertainty following the American Rescue Plan Act’s attempt to lower it.9Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill
Whether the platform or the sponsor bank files the 1099-K depends on which entity qualifies as the TPSO. The test looks at which entity maintains accounts with the merchants, guarantees payment, and controls settlement standards. Internal accounts-payable departments and automated clearinghouses don’t qualify as TPSOs, so payments routed through those channels aren’t subject to this reporting.10Internal Revenue Service. Form 1099-K FAQs – Should My Organization Be Preparing, Filing and Furnishing Form 1099-K Platforms embedding payments and managing merchant payouts should work through this question with tax counsel early, before onboarding drives up the volumes.
Where Embedded Payments Fit
Vertical SaaS platforms are the natural home, because they already own the workflow that generates the transaction. A dental-practice management system that handles scheduling, records, and billing can collect the copay at checkout without pushing the patient to a separate terminal. Property management software collects rent. Gym platforms charge memberships. Salon tools process appointment payments. In each case, the service is booked, delivered, and paid for in the same interface.
Marketplaces lean on embedded payments to handle multi-party transactions, splitting a single customer payment across several sellers, calculating commissions, and holding funds where needed. ERP systems use them to close the loop between invoicing and cash flow: the customer pays directly from the invoice, and the payment posts to the general ledger automatically. In every case, the point is the same. When the payment lives inside the software, the software becomes the system of record for the money, not just the work.