Acquiring
Checkout
The merchant-facing payment surface, the form, hosted page, or SDK where the customer enters payment details.
A checkout is the digital interface where the final stage of a transaction occurs, facilitating the secure collection of sensitive cardholder data. The technical architecture usually involves a merchant choosing between a fully hosted payment page (HPP), an embedded iframe, or a server-side API integration using mobile SDKs. From a regulatory perspective, the checkout design dictates the level of PCI DSS compliance required, with hosted solutions typically moving the heaviest compliance burden to the acquirer or gateway. To support Strong Customer Authentication (SCA) under European regulations, the checkout must integrate 3D Secure protocols to manage the handover between the merchant and the card issuer for biometric or passcode verification. Modern checkouts are also expected to detect the user's device to automatically surface appropriate digital wallets like Apple Pay or Google Pay, which often bypasses traditional form entry to improve conversion rates at the point of sale.
Frequently asked
How does the choice of checkout impact PCI DSS compliance scope?
Using a hosted payment page or a modern iframe-based checkout generally qualifies a merchant for SAQ A, the simplest compliance level, because card data never touches the merchant's server. If a merchant uses a custom API checkout to collect data directly on their own infrastructure, they typically fall under SAQ D, requiring a significantly more rigorous and expensive annual audit.
What role does the checkout play in SCA and 3D Secure 2.0 flows?
The checkout acts as the orchestration layer that triggers the 3DS request to the issuer when a transaction requires authentication. It must be capable of handling redirects or displaying the issuer's authentication challenge window within the UI without breaking the customer session or causing transaction timeouts.
Related terms
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.