June 2023 Summaries

For B2B software and SaaS companies, timely payment processing can strengthen cash flow, financial stability, and growth, and the piece presents Tilled PayFac-as-a-Service as an integrated payments option built around split payments. Under Tilled’s model, a software vendor can add a platform fee to merchant transactions, with the transaction amount sent to the merchant’s account and fee revenue directed to the vendor’s Tilled revenue account; Tilled says partners receive the full fee revenue and are paid commissions monthly. The approach is positioned as a way for independent software vendors to increase payment-related margins, access revenue sooner, and fund activities such as product expansion, marketing, and technology investment. The text also highlights Basis Theory as a complementary provider of security and compliance tools, arguing that its data-protection capabilities alongside Tilled’s merchant onboarding and payment features can help companies operate secure, compliant payment processes while focusing on their core software products.

Global payments revenue was projected to reach $2.7 trillion in 2023, reflecting broad growth in digital transactions across subscription services, e-commerce, cards, mobile wallets, buy now, pay later options, bank transfers, and real-time payments. The material emphasizes that subscription businesses can reduce lost revenue and customer churn by monitoring failed payments, although many do not track them despite evidence that high-performing merchants recover a substantial share. E-commerce adoption continues to expand, with digital-payment-accepting small businesses reported to grow faster and mobile devices expected to account for a growing portion of online spending. Mobile wallets, contactless cards, debit and credit cards, BNPL, same-day ACH, and real-time payment systems are gaining traction, while cash and physical checks are becoming less central in many markets. Customer experience metrics, particularly churn and lifetime value, are presented as important but underused measures for subscription merchants, where declined payments can be a significant cause of cancellations.

Basis Theory has introduced extended CVC storage for Card Objects, allowing eligible customers on paid PCI plans to securely retain card verification codes beyond the previous one-hour limit while maintaining PCI compliance. Businesses can request access through Basis Theory support by describing their use case, and the feature uses end-to-end encryption, access controls, time-to-live limits, and the company’s unified API to protect sensitive payment data. The capability is intended to support payment workflows requiring repeated manual card entry across merchants that may not offer tokenization, including event planning, concierge services, interior design, personal shopping, business setup consulting, and travel-related work.

Electronic Benefits Transfer (EBT) replaced paper food stamps with electronic benefits cards and is now used across all 50 U.S. states to distribute programs such as SNAP. Merchants seeking to accept EBT must obtain a USDA Food and Nutrition Service permit, navigate state-specific rules, and use an approved processor capable of securely handling the PIN required for online purchases, with only a small number of providers meeting relevant PCI standards. Although these requirements can be complex, EBT acceptance may help eligible merchants reach consumers who rely on benefit funds, increase sales of essential goods, and reduce chargebacks because payments are government-backed; EBT spending was estimated at $356.3 billion in 2023. Unlike conventional card payments, EBT often requires direct relationships with approved gateways or processors, as major providers such as Stripe may not support online EBT, while Shopify uses Forage. The passage argues that tokenization can help merchants manage multiple payment providers by storing sensitive card data securely, reducing compliance exposure, supporting payment-routing decisions, and allowing merchants to change processors without disrupting customer payment details.

Secure payment processing is presented as a shared responsibility in which merchants should balance data protection, PCI-DSS compliance, and security costs according to their transaction volume. PCI-DSS assigns merchants to four tiers, with lower-volume businesses generally able to meet requirements through self-assessment questionnaires while larger organizations face more extensive controls and independent assessment. New merchants can reduce time to market and limit exposure to cardholder data by using payment aggregators such as PayPal, Stripe, or Square, but relying on only one provider may create operational risk if rates change or the account is terminated. Adding multiple aggregators provides processing redundancy, while third-party tokenization can preserve control over customer payment data without bringing sensitive card details into the merchant’s own systems. As a business scales, automated routing can direct transactions to providers based on approval rates, geography, or cost, while integrating merchant accounts and gateways may further lower processing expenses.

Payment aggregators let businesses accept payments quickly by operating as sub-merchants under the aggregator’s merchant account, removing the need to establish direct acquiring-bank and payment-gateway relationships. They simplify a complex payment flow involving merchants, processors, gateways, card networks, issuing banks, and acquiring banks, often requiring little more than adding a payment link or integration. In exchange for this convenience, aggregators commonly charge predictable flat-plus-percentage fees that can become costly at higher volumes compared with interchange-plus pricing, while refunds, chargebacks, currency conversion, and other less transparent charges may further increase expenses. Merchants also face concentration risk because an aggregator can restrict or terminate access to payment services, sometimes with limited explanation. Alternatives include building an independent payment infrastructure with merchant accounts and multiple gateways, which is generally practical only for high-volume businesses, or using multiple payment service providers to diversify risk and optimize transaction routing. Tokenization services can support the latter approach by securely storing payment data and allowing merchants to send it to different processors according to cost, approval rates, or available payment methods.

Payment risks often arise less from dramatic cyberattacks than from cumulative operational issues such as chargebacks, processing fees, and declining transaction completion rates. Reducing these risks requires protecting stored payment data with tokenization layered over encryption, which replaces sensitive information with non-reversible tokens held in secure vaults. For data moving through online systems, merchants can limit exposure by using third-party payment forms and vaulting services rather than directly collecting customer information. Businesses can also avoid payment outages by automating transaction routing across multiple payment service providers, since any single processor may alter or end service. Finally, optimization tools can select the most cost-effective provider for each transaction, improving approval rates while reducing fees across different customer segments and markets.

A payment gateway is software that securely transmits customer payment information between a merchant’s website, acquiring bank, and payment processors, supporting functions such as fraud prevention, recurring billing, and multiple payment methods. Unlike a payment processor, which manages fund transfers, transaction routing, and chargebacks, a gateway focuses on securely communicating transaction data. Businesses may build proprietary gateways to reduce high-volume processing fees, tailor checkout experiences, gain direct control over authorization and fraud decisions, and support underserved regional payment methods or currencies. Development requires partnerships with processors or acquiring banks, potentially multiple integrations, and substantial resources, with an MVP estimated to take up to six months and cost roughly $200,000 to $250,000. Security and compliance are central requirements, including PCI DSS adherence, encryption, SSL/TLS, EMV, 3-D Secure, tokenization, and peer-to-peer encryption, while maintaining a secure cardholder data environment can be especially demanding. Tokenization providers can reduce a business’s PCI scope by securely handling sensitive card data, but creating a gateway remains a complex long-term undertaking that requires careful assessment of costs, risks, technical expertise, and regulatory responsibilities.

Payment analytics turns transaction data into operational insights that can help merchants reduce costs, improve approval rates, and support revenue growth. Businesses can compare payment processors’ fees and performance to route transactions more effectively, while monitoring chargebacks to balance fraud controls against the risk of rejecting legitimate customers. Analytics can also reveal customers’ preferred payment methods, identify declining options and emerging alternatives, and guide decisions about adding processors or payment types. By identifying geographic and time-based transaction patterns, merchants can align customer support, staffing, and payment-routing strategies with periods of greatest demand and profitability. Payment data may further support targeted upsell and cross-sell offers that increase order values without harming conversion rates. Achieving these benefits depends on payment flexibility, including access to multiple processing partners and secure, PCI-compliant control of customer payment information through tokenization.

Basis Theory’s spring updates focus on increasing control, flexibility, and security for sensitive-data management through new proxy, storage, and validation capabilities. White Label Proxies let organizations tokenize data before it reaches a branded API endpoint, potentially reducing PCI scope while allowing custom proxy domains. Extended CVC storage supports businesses with delayed or manual payment workflows, including hospitality and concierge services, while Regex validation in web, iOS, and Android Elements enables frontend checks that prevent invalid data from being tokenized. Proxy enhancements also allow Elements values to be sent directly to proxies and return non-sensitive plain-text responses without unnecessary tokenization, references, or Reveal. Additional improvements include support for public applications without permissions, Android Compose compatibility, better browser behavior and Shadow DOM support for Elements, array tokenization on Android, API and NodeJS bug fixes, and more flexible proxy configuration updates.