Payment orchestration is a software layer that connects multiple payment providers, acquirers, and payment methods through a unified integration. Depending on the platform, it can apply routing rules, manage eligible retries (cascading), support tokenization, and consolidate payment data, reporting, and reconciliation.
When supported by the payment setup and applicable rules, eligible transactions can be routed to an alternative available provider. However, an alternative route does not guarantee authorization or successful processing.
A payment gateway securely transmits payment data for processing, while an orchestration layer coordinates transactions across multiple connected providers and routes. In practice, the distinction is not always clear-cut because some gateways already include orchestration capabilities.
A payment gateway and a payment orchestration platform serve related functions, but they are not mutually exclusive. A gateway may focus on secure payment-data transmission or include multi-provider routing, cascading, and reporting. A standalone orchestration layer coordinates transactions across connected payment providers, while the underlying acquiring relationships remain necessary.
A unified integration can reduce the need to build and maintain a separate technical connection for every provider. However, the degree of normalization across APIs, webhooks, reporting, and settlement formats depends on the platform.
Basic gateway implementations may offer limited routing and failover capabilities, while more advanced gateways can include multi-provider routing and cascading functionality. Depending on the product, gateways may also support hosted checkout, tokenization, fraud screening, and reporting.
Orchestration can add routing across approved providers, conditional retries after eligible declines, and consolidated reporting and reconciliation. These capabilities may be provided by a standalone orchestration platform or built into a payment gateway. They do not replace the underlying acquiring relationships or override issuer authorization decisions.
That routing decision is only useful if the logic behind it actually holds up – how a platform decides where to send a transaction in the first place, and what counts as “smart” about that decision.
A card issued in Brazil may have different authorization outcomes depending on whether the transaction is processed through a European or a local acquirer. Local acquiring can improve approval rates in some markets, but results depend on issuer policies, transaction characteristics, and the acquiring setup. Smart routing can direct eligible transactions through approved routes based on geography and available performance data. This can be particularly relevant for international businesses, including iGaming operators that accept payments across multiple markets.
Two providers rarely perform identically on the same card. One acquirer’s issuer relationships might clear a regional debit scheme better than another’s; a specific BIN range might authorize reliably through one processor and unreliably through a second. Depending on the platform, routing may follow static rules defined by the merchant or use performance data to adjust how transactions are distributed across approved providers.
Least-cost routing can prioritize a lower-cost processing route when multiple eligible, approved routes are available. Routing decisions may consider processor fees, card-network charges, currency conversion costs, and expected authorization performance. Actual savings depend on provider agreements, transaction mix, and the total cost of processing across routes. A lower blended transaction cost is not guaranteed.
For high-risk merchants, billing descriptors and MCCs are not freely interchangeable routing variables. MCCs must accurately reflect the merchant’s actual business activity and must be assigned and approved through the relevant acquiring relationship. Separate MIDs or MCCs are appropriate only where they represent genuinely distinct, properly underwritten business activities.
Routing a transaction under an inaccurate MCC to improve approval rates is misclassification, not optimization. Such practices may violate card-network rules and result in compliance action or penalties. Billing descriptors should also allow customers to recognize the merchant and the transaction on their statements.
Routing decides where a transaction goes on the first attempt. What happens after it comes back declined – whether it’s worth retrying at all, and through whom – runs on a separate set of rules.
Payment cascading sends an eligible failed attempt to another available route according to predefined rules. It is most useful for technical failures and selected retryable declines; it should stop when the response indicates that another attempt is unlikely to succeed or is not permitted.
Soft and hard declines help describe whether a failed payment may be recoverable, but these labels alone do not determine whether another authorization attempt is permitted. The decision depends on the issuer response, card-network rules, provider guidance, and the circumstances of the transaction.
For example, insufficient funds or velocity restrictions do not automatically justify an immediate retry through another acquirer. Technical failures may be recoverable, but the merchant must first determine whether the original transaction was processed.
The table below summarizes appropriate actions without assuming that every decline of a particular type can be retried.
Cascading should follow documented retry rules rather than treating every failed payment as an opportunity to try another provider. Each attempt should be recorded and linked to the original payment for monitoring and reconciliation.
Retry limits and timing depend on the card network, region, transaction type, and issuer response. Merchants should follow the current network rules and the retry guidance returned by their PSP or acquirer.
Responses marked as non-retryable should not trigger another authorization attempt. For potentially recoverable failures, the timing and route of any retry should depend on the specific response and the status of the original transaction. Excessive or prohibited retries can result in additional fees and compliance risks.
Duplicate charges can occur when an initial payment attempt times out without a confirmed result, a second provider authorizes the same purchase, and the first attempt is later confirmed as successful.
A unique payment reference helps link multiple attempts for monitoring and reconciliation, but it does not, by itself, prevent duplicate authorizations or captures across different providers. Effective safeguards include checking the original transaction status before retrying, using idempotency controls where supported, coordinating attempts across payment routes, and reconciling delayed responses and webhooks.
If duplicate authorizations occur, the redundant authorization may need to be voided. If a duplicate payment has already been captured, a refund or another corrective action may be required, depending on the provider’s procedures.
A merchant checking whether cascading is actually working needs more than a single approval-rate number. At minimum, the reporting view should show:
There is no universal benchmark for the approval-rate impact of routing and cascading. Results depend on the merchant’s starting setup, markets, issuers, transaction mix, and the quality of the additional acquiring routes.
For subscription and recurring billing, outdated payment credentials can contribute to failed renewals. Visa states that, on average, 30% of accounts in an issuer’s Visa Account Updater portfolio experience a change to the account number or expiration date, or are closed, each year.
Three changes show up at the operational level rather than on a single transaction: how reporting gets reconciled across providers, how much of the business sits inside PCI scope, and how fast a new market can go live.
Merchants working with several acquirers may need to reconcile separate transaction records, settlement files, fees, and dispute reports. An orchestration platform with suitable reporting integrations can consolidate some of this information into a shared view. However, the level of normalization and reconciliation depends on the platform, connected providers, and available data.
Fill out the form, and we will contact you
Tokenization through an orchestration platform may help reduce PCI DSS scope by keeping primary account numbers (PANs) out of certain merchant systems. However, using tokens does not automatically place those systems outside the scope of PCI DSS. The assessment depends on the actual payment-data flow, whether systems can access or retrieve PAN, their connections to the cardholder data environment, and their ability to affect its security.
Systems that perform tokenization, store PAN, or support the retrieval of cardholder data remain subject to applicable PCI DSS requirements. The merchant must assess its own environment and confirm the scope with a qualified PCI DSS adviser or acquirer.
Direct integrations can require separate commercial, compliance, technical, and reconciliation work for each market. If an orchestration platform already supports suitable local providers and payment methods, it may reduce the technical integration work required for a new market. However, commercial agreements, underwriting, regulatory requirements, and testing may still be necessary before transactions can be processed.
None of this comes free, and the trade-offs behind it are usually the part a vendor pitch leaves out.
Every benefit above assumes the orchestration layer itself behaves the way it’s supposed to, and that a merchant can walk away from it later if it doesn’t. Neither assumption holds automatically.
An orchestration layer can become a single point of failure if all payment transactions depend on it and no independent fallback is available. Merchants should evaluate the platform’s availability, recovery procedures, failover design, and handling of in-flight transactions before relying on it.
Token portability can complicate migration between payment providers when stored credentials depend on a provider-controlled vault. Before signing, merchants should clarify whether tokens can be exported or migrated, what technical and contractual restrictions apply, and what happens to recurring payments if the relationship ends.
For regulated or high-risk verticals, resilience depends on having more than one suitable and fully approved acquiring relationship in place. Orchestration can distribute eligible traffic between those approved routes, but it cannot replace underwriting or make an unapproved provider accept the merchant’s category.
There is no universal payment-volume threshold at which orchestration becomes necessary. The business case depends on the merchant’s payment architecture, markets, existing acquiring relationships, transaction performance, operational risks, and the cost of implementing and maintaining the solution.
Before introducing an orchestration layer, merchants should evaluate:
Payment volume can influence the economic case, but it should not be the deciding factor on its own. A merchant may benefit from orchestration because of operational complexity or dependence on a single provider, while another business with higher transaction volume may have little need for additional routing infrastructure.
Once the business case is clear, the next decision is whether to use a standalone orchestration platform or a payment provider with routing and cascading capabilities built in.