Payment gateway source code is sold by a handful of software vendors as a license to a complete gateway, with the merchant API, the checkout, the back office and the connectors to banks and processors. The buyer gets the code and the right to change it. It doesn’t get an acquiring bank, a PCI DSS certificate or a payment license, and those decide whether the gateway can take a single payment.
The phrase covers two smaller things as well, the integration code that links a shop to an existing gateway and the open-source projects on GitHub. This guide is about owning a gateway. We read the vendors’ own pages, the PCI Security Standards Council’s notices, Visa’s compliance rules and the legal texts in Europe and the US on November 13, 2026.
Three things people mean by payment gateway source code
A search for payment gateway system source code can mean three different things, and only one of them is a product for sale.
The first is integration code. Gateways publish API references and sample requests so that a merchant’s site can create a sale or refund one. Payments company Clearly Payments, one of the pages that rank for this search, shows the requests and responses for a sale and a refund among other calls. That code only talks to the gateway that wrote it, and the gateway’s own developer documentation is the place to get it.
The second is open-source software, published under licenses that let anyone run and change it. Projects such as Hyperswitch and Kill Bill are building blocks for a gateway rather than a finished one, and they’re covered in their own section below.
The third is a licensed codebase. Vendors sell the code of their commercial gateway under a contract, mostly to payment service providers and banks that want a gateway under their own brand. That market is what this guide compares. A merchant that only wants to take USDC or USDT needs none of the three, because stablecoin processors handle those payments, as our guide on how to accept stablecoin payments explains.
Four ways to run a gateway you control
Owning the code is one of four routes, and the vendors that sell code usually sell the other three as well. eComCharge, which builds the beGateway platform, offers cloud rental, on-premises rental and a license purchase on one page. The table sets the routes side by side, with timings as the vendors state them.
| Route | What the buyer gets | Who carries PCI DSS | Time to launch, per vendors | How it is paid for |
|---|---|---|---|---|
| Open-source project | Code under a public license, no support contract | The buyer | Depends on the buyer’s team | No license fee; own engineering |
| Licensed source code | The vendor’s codebase and the right to modify it | The buyer, for its own deployment | 2 to 3 months on premises at eComCharge | License fee, not published by any vendor checked |
| On-premises rental | The vendor’s software on the buyer’s servers | The buyer, for the servers | Same as above | Rental; eComCharge alone may maintain it |
| White-label SaaS | A branded gateway the vendor hosts | The vendor, under its certificate | About one week at eComCharge | Setup, platform and per-transaction fees |
| Build in-house | Code written from scratch | The buyer | 12 months or more, per Akurateco | Engineering payroll |
The rental row is the easiest to misread. Under eComCharge’s on-premises rental the buyer runs the servers and the network to PCI DSS requirements, yet “ongoing technical support and maintenance are provided exclusively by eComCharge UAB,” the company says. The buyer hosts the software without the right to have anyone else work on it.
Who sells payment gateway source code, and on what terms
All four vendors below describe a payment gateway source code license on their own sites. We compared what each page says about the license, how a buyer sees the code first, and what support follows the sale.
| Vendor | What the license covers | Seeing the code before paying | Support after the sale | Connectors, per vendor | Price published |
|---|---|---|---|---|---|
| SDK.finance | One license per country of operation, annual or lifetime | A code audit in the vendor’s isolated environment, 45 days by default | Six months of weekly calls; critical bugs and vulnerabilities fixed for 12 months | Not given on its source-code or merchant pages | No; the offer itemizes an upfront audit fee |
| eComCharge (beGateway) | A source code license for enterprise clients | Not described | Through separate service agreements | 170+ active | No |
| United Thinkers (UniPay) | An on-premises license with full access to the source code | Not described | Technical and operations support; help with the PCI audit | 100+ bank integrations | No; licensing fees only, no transaction or subscription fees |
| Akurateco | Source code, per a company post of January 15, 2025 | Not described | Not described for code buyers | 700+ | No for code; white-label from €0.015 a transaction |
“Not described” means the vendor’s pages we read on November 13, 2026 don’t cover the point.
The contract decides. Its wording matters more than the word “buy.” SDK.finance grants a license per country, chosen as annual or lifetime, and transfers the code to the buyer’s GitLab after the final payment. Akurateco’s 2025 post on source code says the buyer becomes the gateway’s “rightful owner.” The two positions differ on resale and territory, and on what happens when the vendor stops updating.
SDK.finance publishes the most detail on the process, from a demo and a commercial offer through the contract to the audit and the code transfer. Its merchant page says the on-premises version “comes with the source code license, available for a one-time flat fee,” while the acquisition page offers annual and lifetime terms, so the payment model is agreed per deal.
Acquiring the SDK.finance Platform source code, sdk.finance (November 2026).
None of the four vendors gives a figure for the license itself. Akurateco’s post says the price depends on “the term of development, financial investments, availability of advanced payment technologies, and other parameters.” A buyer comparing offers has to get each one in writing.
Open-source gateways and the licenses that come with them
An open source payment gateway changes who writes the code, not who answers for it. Three projects come up most often, and their licenses differ in ways that matter to a gateway operator.
Juspay’s Hyperswitch is released under the Apache License 2.0, according to the license file in its repository. Juspay describes it as open-source, modular payments infrastructure, with connectors for payment providers, fraud checks and other services.
Kill Bill is also under Apache 2.0. It calls itself a billing and payments platform, with a self-hosted open-source core deployed via Docker or AWS and community support, and it sells Aviate, a proprietary layer built on that core. Connections to processors come through its plugin framework, so a card gateway built on Kill Bill still needs those plugins written or found.
jPOS, which its site calls “the Java-centric platform behind gateways, switches, acquirers, and issuers” working with the ISO 8583 card message standard, is published under the GNU Affero General Public License version 3.
The license’s own preamble says it “requires the operator of a network server to provide the source code of the modified version running there to the users of that server.” A gateway serves merchants over a network, so a modified jPOS inside one can trigger that obligation.
Why a certified codebase doesn’t make the buyer compliant
PCI DSS applies to whoever handles card data. Visa’s compliance page says it is “required of all entities that store, process or transmit Visa cardholder data,” and that covers a company running licensed gateway code on its own servers, whatever certificate the vendor holds.
eComCharge spells out the split. Its SaaS customers operate under eComCharge’s PCI DSS Level 1 certification, and certification in the customer’s own name is available for an additional fee. Its on-premises customers provide their own servers and network, built to PCI DSS requirements.
The old shortcut is gone too. The PCI Security Standards Council retired the Payment Application Data Security Standard (PA-DSS) on October 28, 2022 and replaced it with the Secure Software Standard and the Secure Software Lifecycle Standard. Every PA-DSS application is now expired and listed as “Acceptable Only for Pre-Existing Deployments,” the council says on its PA-DSS page.
PA-DSS, pcisecuritystandards.org (November 2026).
How heavy the assessment is depends on volume. Under Visa’s program, a service provider that stores, processes or transmits more than 300,000 Visa transactions a year is Level 1, with an annual on-site assessment and an attestation of compliance signed by a Qualified Security Assessor. That threshold works out to 25,000 Visa transactions a month. Below it, a provider can submit the self-assessment questionnaire SAQ-D or an attestation with a QSA’s signature.
When running a gateway needs a payment license
The answer turns on whether the gateway ever holds the money. The EU’s second Payment Services Directive (PSD2) excludes, in Article 3(j), “technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred,” including processing and storage of data. The UK’s Payment Services Regulations 2017 carry the same exclusion in Schedule 1, Part 2.
A gateway that collects merchants’ money and pays it out is doing more than processing data. Under PSD2 that business needs authorization as a payment institution, and Article 7 sets the initial capital at €20,000 for money remittance only, €50,000 for payment initiation and €125,000 for the services that include acquiring payment transactions.
In the US, the Treasury’s anti-money-laundering rules exclude from the definition of a money transmitter a person who “acts as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller.” That federal exemption sits in 31 CFR 1010.100(ff)(5)(ii)(B), and whether a given gateway fits it depends on how the money moves and with whom the merchant contracts.
A gateway that holds crypto for merchants in the EU falls under a different law. The Markets in Crypto-Assets Regulation lists “providing custody and administration of crypto-assets on behalf of clients” and “providing transfer services for crypto-assets on behalf of clients” among crypto-asset services. Article 59 bars anyone from providing those services in the EU without authorization, and the authorized firms appear on ESMA’s register.
In a thread on Reddit started by a team planning a gateway in Morocco, one commenter put the test in practical terms. If the merchant signs its deal with the gateway, the gateway needs the license, and if the merchant signs with the acquirer and uses the gateway only for the technical connection, it probably doesn’t. That’s one person’s reading, not legal advice, and it matches the line PSD2 draws.
The diagram below sums up the split between the code a vendor can sell and the contracts and audits that stay with the buyer.
Only the top layer comes with the license. Each layer below it needs its own contract or authorization before the first payment goes through.
What building a gateway from scratch costs
Akurateco puts the cost of building a gateway in-house at $500,000 to $1 million or more, with 12 months or more of development, in its January 2025 post, and repeats the $500,000 to $1 million range for an initial product in a June 2026 guide. A vendor that sells the alternative has a reason to quote high, so we checked the figure against US wage data.
The Bureau of Labor Statistics puts the median annual wage for software developers at $135,980 in May 2025, according to its Occupational Outlook Handbook. Wages and salaries made up 68.5% of employer costs for full-time private-industry workers in June 2026, the bureau’s employer cost survey shows, so one median developer costs an employer about $198,511 a year.
| Team for 12 months, our assumption | Wages at the median | Employer cost |
|---|---|---|
| 4 engineers | $543,920 | $794,044 |
| 6 engineers | $815,880 | $1,191,066 |
| 2 engineers maintaining it, per year after launch | $271,960 | $397,022 |
The table covers payroll alone. It leaves out hosting and the annual PCI assessment, as well as legal work and the months spent signing acquirers, and the median covers all software developers rather than payments specialists. Even so, a four-to-six person team for a year lands between $794,044 and $1,191,066, which puts Akurateco’s estimate within the range the wage data supports.
License or white-label at 1 million transactions a month
White-label pricing is easier to compare because some of it is public. Akurateco’s pricing calculator, at its default of 1 million transactions a month, showed an indicative €18,000 to €25,000 a month on November 13, 2026, a rate of €0.018 to €0.025 a transaction. Over a year that comes to €216,000 to €300,000.
The calculator marks the figure as “Indicative only, not a final offer,” and it excludes acquiring and processing fees. Setup and platform fees are “tailored, can be waived,” and each new connector costs €0 to €2,500 once.
A licensed deployment replaces the per-transaction fee with the license and the people to run it. Fees grow with volume. Payroll mostly doesn’t.
UniPay says its on-premises model has “licensing fees only, eliminating any transaction or subscription fees.” At the median wage, the two-engineer maintenance team in the table above costs about $397,022 a year, which is the same order of size as the white-label fees at 1 million transactions, though in a different currency.
A license starts to pay when volume runs well above that level, because the fees keep rising and the team doesn’t. It also pays when the business needs changes to the code that a white-label vendor won’t make. At 1 million transactions a month, neither route is clearly cheaper on these numbers.
How to check a source code license before you sign
A license is a long contract with a codebase attached, and most of the risk sits in the clauses on support and updates. Anyone planning to buy payment gateway source code can run these checks on every offer. The checks below come from the terms the vendors publish and the gaps between them.
- Ask for a code audit before the final payment, with your own engineers reading the code; SDK.finance offers 45 days by default.
- Read which countries the license covers, for how long, and whether you may sublicense the gateway to others.
- Find out who may maintain the code, since eComCharge’s rental reserves support and maintenance to eComCharge.
- Get security fixes in writing with a period attached, as SDK.finance does for critical bugs and vulnerabilities in the first 12 months.
- Ask for the live list of connectors and check the banks and processors you need, not the headline count.
- Ask what PCI evidence the vendor will hand over for your own assessment, and treat any PA-DSS certificate as expired.
- Check the license of every open-source library inside the codebase, because AGPL components carry network-use terms.
- Agree how updates reach you after the support period ends, and what they cost.
- Put the cost of the team and the hosting, plus the annual assessment, next to the license fee before comparing offers.
Start with the last check. The license fee is a single line in a budget that the wage table above shows can run to seven figures over two or three years.
Vendors don’t publish license prices, so the comparison starts with written offers from at least two of them. Ask each for the audit period, the license scope and the support terms in the same format, and settle the payment-license question before the first contract, since it decides whether the business needs an acquirer partner, a payment institution license or neither.
Frequently asked questions
Can I download payment gateway source code for free?
Yes, as an open source payment gateway project. Hyperswitch and Kill Bill are published under the Apache License 2.0, and jPOS under the AGPL version 3. None of them is a finished gateway with acquirers attached, and whoever runs them carries PCI DSS and any payment license.
How much does payment gateway source code cost?
None of the four vendors we checked on November 13, 2026 publishes a license price. Akurateco estimates $500,000 to $1 million or more to build a gateway in-house, and at the median US developer wage four engineers for a year cost about $794,044.
Is purchased payment gateway source code PCI DSS compliant?
The code can be built to PCI requirements, but compliance belongs to whoever stores, processes or transmits card data. A buyer running the code on its own servers needs its own assessment, and PA-DSS validations, retired on October 28, 2022, no longer count for new deployments.
Do I need a license to run my own payment gateway?
It depends on whether the gateway holds the money. In the EU and UK, a technical provider that never takes possession of the funds is excluded, while one that collects and settles payments needs authorization, and PSD2 sets its initial capital at €20,000 to €125,000 depending on the service.
Where do I find payment gateway integration source code in Java or PHP?
In the developer documentation of the gateway you are integrating with. Integration samples work only with the gateway that published them, so code copied from a third-party script site should be checked against the gateway’s current API reference before it touches card data.
