# Payment Gateway Checklist for a New Online Shop: Verify These Before Your First Sale
Launching an online shop is mostly logistics until the moment money has to move — then the payment gateway becomes the piece everything else leans on. A well-matched gateway quietly handles authorizations, settlement, refunds, disputes and reporting. A gateway chosen in a hurry surfaces later as failed payments, messy reconciliation and disputes nobody saw coming. The checklist below is written for merchants in Canada and the United States preparing to open a first store, or to add online payments to an existing counter, and it is ordered roughly by how expensive each item is to fix after launch.
## Start With Settlement, Currency and the True Cost of Acceptance
Before you compare checkout pages, map out how money will actually arrive. Confirm which currencies the gateway can authorize and settle in, and whether a Canadian merchant selling to U.S. buyers is charged in the buyer’s currency with a documented conversion process — or pushed into a single settlement currency. **Multi-currency support affects both conversion rates and bookkeeping**, so decide early whether you will price in one currency, several, or let the processor convert on your behalf. Ask where the payout lands, which bank account, and in what currency the deposit appears.
Next, ask about timing. What is the batch cut-off each day, and how do weekends and statutory holidays affect deposits? New merchants should specifically ask whether a **rolling reserve, delayed payout schedule or initial hold** applies during onboarding, because that is the single most common cash-flow surprise for a first online shop. Also request how the transaction appears on the customer’s statement — a clear, recognizable statement descriptor reduces “I don’t recognize this charge” disputes more than almost any other small detail.
Fees come next, and this is where the structure matters more than the headline number. **Interchange-plus pricing** separates the card network’s cost from the processor’s margin, which makes your effective rate auditable line by line. Bundled or tiered pricing hides that split, so a rate can drift upward quietly as your order mix changes. Ask for the complete fee schedule, not just the percentage: monthly gateway or account fees, per-transaction and batch fees, refund fees, chargeback fees, PCI non-compliance fees, minimum monthly charges and any statement or reporting charges.
Then test the awkward scenarios on paper before you sign: partial refunds, a void inside the authorization window versus a refund after settlement, a duplicate charge, an expired card on a subscription, and a customer who wants to pay a deposit now and the balance on delivery. If you accept recurring payments, confirm that the same account supports stored credentials and scheduled charges without a second contract. Finally, hand over a recent processing statement and ask for a side-by-side comparison — a provider that will do that arithmetic for you is usually the one confident in its own pricing.
## Security, Fraud Controls and Compliance That Cannot Be Skipped
Payment security is where shortcuts cost the most. Start by asking whether the provider is a **PCI DSS Level 1 service provider** in its own right rather than a reseller of somebody else’s gateway, and whether it can show independent audit reporting such as SOC 2 Type II. That combination tells you the environment holding card data has been examined by an outside assessor, not just self-declared.
Next, look at how card data is handled day to day. **Tokenization** should replace stored card numbers with tokens that are useless if leaked, and transport should be encrypted end to end. The checkout model changes your own compliance scope: a hosted checkout page or a hosted payment field keeps card entry on the provider’s infrastructure and lightens your questionnaire, while collecting raw card fields on your own site expands it considerably. Neither choice is wrong, but the scope should be a decision, not an accident.
Fraud tooling deserves a direct question rather than a brochure answer. Ask which controls you can actually switch on: address verification (AVS), CVV checks, 3-D Secure where the card issuer supports it, velocity limits on repeated attempts, blocklists, and country or IP restrictions. For phone, mail and emailed orders keyed into a **virtual terminal**, the requirements tighten — AVS and CVV checks, 3-D Secure where supported, a card vault for repeat charges, role permissions governing who can key an order, issue a refund or void a transaction, session timeouts on idle browsers, and exportable audit logs. The operational rule that matters most is simple: card numbers are keyed straight into the terminal and never written down, emailed, or pasted into a spreadsheet or CRM.
Disputes are the other half of risk. Ask whether the platform alerts you while there is still time to respond, assembles an evidence pack from transaction, authorization and delivery detail, tracks response deadlines, provides reason-code guidance and reports win rates over time. Chargeback tools work best alongside prevention — 3-D Secure, clear descriptors and documented delivery — and it is worth being realistic: **not every dispute can be won**, which is why speed and evidence quality matter more than optimism.
## Checkout Experience, Integrations and Day-Two Support
The gateway can be perfectly priced and secure and still lose sales at the last step. Review the actual checkout on a phone: how many fields, whether returning customers can use a saved card from a **customer card vault**, whether a declined card produces a clear retry message or a dead end, and whether guest checkout is available for shoppers who do not want an account. Confirm which local payment methods your customers expect and whether the gateway supports them without a second integration.
Beyond the storefront, list every place money might need to be collected. Payment links sent by SMS or email cover invoices, deposits and outstanding balances, and the good ones support expiry, single-use limits, amount locking or partial payments, custom references back to an invoice or job number, status tracking and automatic receipts. If you sell to business buyers, check whether net-term invoicing carries its own payment page and captures a purchase order number, and whether part payments stay traceable to the same invoice instead of fragmenting across transactions.
On the technical side, ask for documented **APIs, webhooks and a sandbox** you can test in before going live, and confirm how the gateway connects to your storefront platform — native support versus a community plugin is a real difference in who fixes problems. Merchants moving onto a WordPress storefront often ask a version of the same question — “What are the best payment gateways for WooCommerce?” — and the honest answer almost always comes back to the checklist items above: fee transparency, compliance depth, dispute handling and support, not brand recognition.
Finally, plan for day two. Can you add in-person payments — terminals, tap to pay on a phone, a virtual terminal for keyed orders — under the **same merchant account and dashboard**, with in-store and online sales visible in one place and reporting tied back to actual deposits? Is there dedicated account management, and who answers when a payout is short at 4pm on a Friday? Before launch, run a low-value live transaction, refund it, and confirm the statement descriptor, the payout and the receipt all look the way you expect.
