What is a payment switch and how does it work?

Payment switching explained

A payment switch is the system that receives authorisation requests from payment terminals and other acceptance devices, decides where each one should go and forwards it to the acquirer or processing centre in the protocol that side expects. Payment switching is that routing decision, made for every transaction, together with the translation of the message on the way.

Payment switches sit at several points of the payment chain. Card schemes switch messages between acquirers and issuers, and some countries run national switches for domestic cards. This guide covers the switch on the acceptance side, between the devices and the acquirers. It is the core of an in-person payment orchestration platform, and the difference from a gateway has a guide of its own.

What a switch does with an authorisation

An authorisation passes through six functions of the switch, roughly in this order.

Receiving from terminals

Terminals, SoftPOS phones, kiosks and validators keep one connection to the switch. The switch aggregates transactions from every device in the network and identifies the merchant, the location and the terminal behind each request, which is the context the routing rules work with.

Protocol translation and mapping

Terminal applications and acquirer hosts rarely use the same format. Many hosts run their own variant of ISO 8583, the international standard for card transaction messages, with their own fields and codes. The switch maps the request into the message the chosen host expects and maps the response back for the terminal.

Routing rules

Rules decide which acquirer or processor receives the transaction, based on the card type, the amount, the merchant or the terminal. Some switches chain rules into pipelines, sequential steps that each check a condition and act on it. When rules are configuration rather than code, a new route does not need a software release.

Failover to a second processor

If the chosen host does not answer within the timeout, the switch sends the transaction to a backup acquirer or processor and the device still gets an answer. The unanswered request should then be reversed with the first host, so that a late approval there leaves no hold on the card. A backup route also needs a merchant agreement with the second acquirer.

Key management

Terminals encrypt PINs and card data with keys that have to be injected, rotated and matched on the host side. DUKPT, defined in ANSI X9.24, derives a unique key for every transaction. The switch shields the terminal key management system and translates the encrypted data between terminal keys and host keys, work that normally runs in a hardware security module.

Logs for reconciliation

The switch records every executed transaction with its route and the host's response. Finance teams reconcile those logs against the acquirers' settlement reports, and support teams use them for disputes, reversals and refunds.

Payment switch architecture

Availability is designed into the whole switch rather than one component. A switch runs on several nodes, often in more than one data centre, so a failed node or site does not stop the fleet. Monitoring covers every layer, because every device in the network depends on the switch to reach any acquirer.

A typical payment switch architecture has five layers.

• Device connectors for terminal applications, SoftPOS apps and unattended readers, including the links to cash registers.
• A core with the routing engine, the rules, the pipelines and the message mapping.
• Host connectors, one per acquirer or processing centre, usually host to host.
• A security layer for keys, PIN translation and decryption of card data, normally on hardware security modules.
• A data layer with the transaction log, reporting and the portals for merchants and support teams.

In-house switch or switch as a service

Banks, large processors and some big merchants run their own switch. They license or build the software, host it in their own PCI DSS environment, build and certify each acquirer connection and staff operations around the clock. In return they control the roadmap and the data.

With a switch as a service, a provider runs the platform and the connections, holds the certifications and applies updates, while the customer configures routing, devices and reports. It comes as a shared multi-tenant setup or as a dedicated single-tenant environment for stricter compliance requirements. The table compares the two models.

What to check when choosing a payment switch

These checks cover most of the risk in a switch decision.

• PCI DSS certification for the switch environment, assessed every year.
• PCI P2PE if card data should stay encrypted from the terminal to a secure decryption point. Merchants that use a PCI-listed P2PE solution have fewer PCI DSS requirements to meet.
• PCI MPoC if you plan SoftPOS, since it is the PCI standard for contactless and PIN acceptance on phones and other off-the-shelf devices.
• An uptime commitment in the contract, with a monthly SLA, support hours and a description of how failover is tested.
• Device coverage by model and operating system, attended and unattended, plus the cash register protocols your stores use.
• Acquirer, processing centre and payment method coverage per country, with a clear line between connections that are live and those still in implementation.
• Rule changes your own team can make, and access to the transaction log through portals, reports or an API.

How Switchio does it

Switchio's switch is the Payment Gateway, also known as the Authorisation Core Module. It processes thousands of transactions per minute, routes by card type, amount, merchant or terminal, translates protocols for 40+ acquirers and reroutes automatically when an acquirer is unavailable. It shields the terminal key management system and runs in high availability with geo-redundancy. The platform is PCI DSS certified every year and also holds PCI P2PE, PCI MPoC for SoftPOS and ISO 27001, as the security page lists.

Switchio runs the switch as a service, shared or dedicated. MOL Group takes it as software as a service for its network of 1,900 service stations, and Payter, a Dutch maker of contactless payment terminals, uses the Payment Gateway as its authorisation host with DUKPT key management.

Questions people ask