Why this matters
Every payment gateway vendor will tell you they're "PCI compliant" and "highly reliable" in a sales call. Neither claim means much until you've verified the certification level, read the actual SLA, and run a settlement-time test with real transaction volume. This scorecard gives fintech and product teams a consistent way to compare gateway vendors on the criteria that actually determine whether checkout stays up and money moves when it's supposed to.
Use it during vendor selection, and re-run it annually against your incumbent gateway — PCI requirements and uptime expectations both tightened materially heading into 2026.
Before you start
- [ ] Define your transaction volume and geographic coverage needs (domestic only, multi-currency, cross-border settlement)
- [ ] Decide whether you need a hosted checkout page, an embedded iframe, or full API-level control over the payment form
- [ ] Identify your current PCI scope (SAQ A, SAQ A-EP, SAQ D) and how each vendor's integration model affects it
- [ ] List required payment methods beyond cards — wallets, BNPL, bank transfers, local payment methods for target markets
Compliance and security requirements
| Requirement | What to verify | Red flag |
|---|---|---|
| PCI DSS level | Ask for the vendor's Attestation of Compliance (AOC) document directly, not a marketing badge | Vendor can't produce a current AOC on request |
| Certification level | PCI DSS Level 1 (highest, for large processors) vs. lower levels | Level 1 claimed but AOC shows a lower tier |
| Card data exposure | Hosted fields, iframes, or tokenization that keep raw card data off your servers | Card data touches your infrastructure at any point unnecessarily |
| Vulnerability scanning | External ASV scans quarterly, penetration testing at least annually | No documented scan or pen-test cadence |
| MFA enforcement | Multi-factor authentication required for all access to the cardholder data environment | Single-factor admin access to payment dashboards |
| Audit logging | Automated log review for the CDE (mandatory under current PCI DSS requirements) | Manual or absent log review process |
Vendor evaluation criteria
- [ ] Uptime SLA — What's the actual guaranteed percentage, and what's the credit structure if it's missed?
- [ ] Settlement speed — How long from transaction to funds in your account, and is it consistent across payment methods?
- [ ] Integration effort — SDKs available for your stack? Sandbox environment with realistic test data?
- [ ] Dispute and chargeback handling — Built-in tooling, or a manual process you have to build yourself?
- [ ] Fee transparency — Interchange-plus vs. flat-rate pricing, and any hidden fees (rolling reserves, chargeback fees, currency conversion markups)?
- [ ] Failover and redundancy — Does the vendor support smart routing to a backup processor if theirs goes down?
Red flags to watch for
- [ ] Vendor is vague about which PCI SAQ level applies to your specific integration
- [ ] No sandbox environment, or a sandbox that behaves meaningfully differently from production
- [ ] Settlement timelines that vary widely without explanation
- [ ] Contract terms that lock in a rolling reserve with no clear release schedule
How to use this
Score each vendor against every row, and treat the PCI compliance section as pass/fail rather than weighted — a vendor that can't produce a current AOC or is vague about certification level should be disqualified regardless of how well it scores elsewhere. For the remaining criteria, weight settlement speed and uptime highest if you're processing time-sensitive transactions (marketplaces, lending disbursements), and weight integration effort highest if your engineering team is small.
How Syslabs helps
Payment gateway selection is only half the work — the API integration layer that connects your checkout, ledger, and reconciliation systems to the gateway is where most fintech engineering time actually goes. Syslabs helps fintech teams run this evaluation, then builds the compliance-ready integration and reconciliation tooling around whichever gateway comes out on top.