Choosing a payments setup for UK small‑business websites (practical commissioning brief)

Why the right payments setup matters

Checkout is where sales convert — and where friction, fraud and regulatory rules can stop them. Strong Customer Authentication (SCA) remains a core requirement for many customer‑initiated online card payments in the UK, so your integration must either support SCA or rely on documented exemptions; getting this wrong increases declines and disputes and creates extra admin for refunds and chargebacks (FCA guidance). Operational choices (settlement timing, dispute handling and accounting integration) also materially affect cashflow and bookkeeping; pick a setup you can reconcile reliably (Xero guide).

Quick decision flow (practical)

• Monthly volume and average transaction value — low volume with mixed payments: a hosted PSP is usually simplest. Higher, consistent volume or many chargebacks: consider a merchant account + gateway for potentially lower fees and clearer responsibility allocation.
• Product type — high‑risk goods (age‑restricted, regulated or frequent disputes) often need specialist acquirers; general retail and services suit mainstream PSPs.
• Card vs direct bank — if you prefer bank‑to‑bank (fewer fees, different liability), ensure the provider supports Open Banking/direct debit, otherwise use card rails with SCA support.
• Recurring payments/subscriptions — require support for card‑on‑file, mandate re‑authentication rules and a way to manage failed SCA attempts.
• In‑person POS — if you sell online and face‑to‑face, prefer providers that offer both online gateway and card‑reader hardware to simplify settlement and reconciliation.

Practical checklist to ask every payments provider

• Settlement timing — how often and how are funds paid to your bank account? Are there reserve or rolling reserve arrangements?
• Dispute / chargeback process — who notifies you, what evidence is required, and typical timelines? Ask for documentation of the workflows.
• SCA support and exemptions — does the provider handle 3‑D Secure and provide an exemption strategy (low‑value, transaction risk analysis, merchant‑initiated transaction flows)? Confirm testing support in sandbox (UK Finance FAQs).
• PCI responsibility — which PCI scope model do they use (hosted checkout, tokenisation, direct capture)? Ask for their compliance level and documentation.
• Refunds and reversals — how are refunds processed and represented in settlement reports? Any limits or fees?
• Multi‑currency and FX handling — how are cross‑border cards processed and reported; who sets the exchange rate?
• Reporting and data access — availability of detailed transaction-level reports and webhook/event APIs for automated reconciliation.

Integration considerations for websites

• Hosted checkout vs integrated gateway — hosted (redirected) checkouts reduce PCI scope and shift SCA handling to the provider; integrated/gateway flows keep the customer on your site and demand more development and stronger PCI controls.
• 3‑D Secure & SCA flow — ensure your checkout framework supports the provider’s SCA challenge and graceful fallback (soft decline handling) so customer experience isn’t broken mid‑purchase (FCA).
• Webhooks for reconciliation — use reliable webhook delivery and idempotent handlers so your order system updates automatically on capture, refund and dispute events.

Operational tasks before launch

1. Run end‑to‑end sandbox tests (authorisation, SCA challenge, payment capture, partial and full refunds, dispute simulation).
2. Map gateway settlement reports to your accounting codes; automate where possible using your accounting tool’s recommended connectors (Xero).
3. Prepare customer service scripts for failed SCA or declined transactions and a fallback path (retry, alternative payment method). Train staff on chargeback evidence collection.
4. Set acceptance tests: successful authorised sale, SCA challenge flow, refund appears in statement and in accounting system within expected time, and a simulated dispute escalates to the correct inbox.

When to consider a merchant account + gateway vs an all‑in‑one PSP

• Choose an all‑in‑one PSP if you value quick setup, built‑in fraud tools and bundled reconciliation connectors — it minimises technical and compliance work for small teams.
• Choose a merchant account + gateway when you need bespoke pricing, high volume discounts, specialist risk handling or a separation of duties between acquiring bank and gateway. This option often requires more integration and clearer operational responsibilities (acquirer vs merchant) as described in industry guidance (UK Finance).

One‑page commissioning brief (studio → client) — essentials

• Scope: accepted payment methods, one‑time vs recurring, in‑person POS needs.
• Non‑functional: expected monthly volume and average basket, settlement cadence, acceptable dispute management SLA.
• Security & compliance: required PCI scope model, SCA handling (provider or merchant), testing in sandbox and production cutover plan.
• Acceptance tests: ecommerce checkout success with SCA; failed SCA fallback; refund posted and reconciled; webhook events handled idempotently.

These steps reduce surprises at launch and make reconciliation manageable. If you’d like, I can produce the one‑page commissioning brief and the launch acceptance tests as a downloadable document ready for client handover — or we can start by reviewing your current provider and integration.

Further reading and regulator guidance: FCA on SCA and consumer protections (FCA), UK Finance merchant FAQs on SCA (UK Finance), and practical accounting integration notes from Xero (Xero).

Ready to turn this into a one‑page commission brief and a technical acceptance checklist? Start a quick brief with our ecommerce studio page: /ecommerce-websites/.