If you’re selling online (or even sending digital invoices and taking card payments), choosing between different payment gateway providers can feel like a purely technical decision.
But there’s a legal side to it too.
A payment gateway sits right in the middle of your customer relationship, your cash flow, and your data handling. If something goes wrong - a disputed transaction, a refund complaint, a security incident, or an unclear fee structure - you’ll want to know where your legal responsibilities start and end, and what your contracts actually say.
This guide walks you through the practical legal issues to think about when comparing payment gateway providers in Australia, so you can accept payments confidently and build a setup that scales with your business. This article is general information only and doesn’t constitute legal, financial or tax advice.
What Do Payment Gateway Providers Actually Do (And Why It Matters Legally)?
In simple terms, payment gateway providers help your business accept and process payments (usually card payments, and sometimes other payment methods) through your website, app, or invoicing system.
From a legal perspective, this matters because it affects:
- Who is responsible for various parts of the transaction flow (you, the gateway, your bank, or other third parties);
- What you’re promising customers about pricing, refunds, delivery, and service quality;
- How personal information is collected and shared during checkout;
- What happens if there’s a chargeback, fraud allegation, or suspected policy breach.
Many founders focus on features (like whether a gateway supports subscriptions, international currencies, or mobile wallets). Those are important - but the legal and commercial terms you agree to can be just as important to your risk profile.
Payment Gateway vs Merchant Facility (Quick Clarity)
Depending on your setup, you may have:
- A payment gateway (the “checkout tech” that routes payment details securely); and/or
- A merchant facility / acquiring arrangement (the arrangement that allows your business to accept card payments and settle funds).
Some payment gateway providers bundle these functions. Others integrate with third-party acquiring banks. This affects what paperwork you sign, who holds funds, and which party sets certain rules.
How To Choose Payment Gateway Providers: A Legal Due Diligence Checklist
When you’re comparing payment gateway providers, you’re effectively choosing a long-term supplier that will touch your revenue, customer experience, and data practices. So it’s worth doing a quick “legal due diligence” pass before you commit.
1) Read The Terms Like A Commercial Contract (Not Just A Signup Screen)
Most gateways have standard terms, but that doesn’t mean they’re “non-negotiable” in practice - and even when you can’t change the terms, you still need to understand what you’re signing up to.
Key clauses to look for include:
- Fees: transaction fees, chargeback fees, currency conversion fees, dispute administration fees, minimums, and “premium” feature fees;
- Settlement timing: how quickly you get paid and when holds may apply;
- Reserves and rolling holds: whether the provider can hold a portion of your revenue for risk management;
- Termination and suspension: when they can pause your account (and what happens to funds);
- Disputes and chargebacks: who decides outcomes, your timeframes to respond, and what evidence is required;
- Liability limits: whether they limit their liability even if their service fails;
- Data handling: what data they collect, where it’s stored, and who it’s shared with.
If your business relies heavily on uninterrupted cash flow (which is most startups), pay special attention to suspension rights and fund holds. A surprise hold can create real operational issues, even if you ultimately “win” the dispute.
2) Check Whether Your Business Model Is “High Risk” Under Their Policies
Different payment gateway providers have different risk appetites. Some industries and business models trigger additional scrutiny, such as:
- subscription-based services (especially free trials);
- pre-orders and long lead-time delivery;
- digital goods;
- events and ticketing;
- marketplaces where you collect money on behalf of sellers;
- cross-border sales or high refund rates.
This isn’t necessarily a “bad” thing - it just means you should align your customer terms, fulfilment processes, and refund practices to reduce disputes and protect your account stability.
3) Be Clear On Who The “Merchant Of Record” Is
One practical legal question is: who is the merchant of record (the party legally selling to the customer and appearing on their card statement)?
In many cases, it’s your business. But some arrangements may involve a platform or intermediary structure. This can affect:
- how refunds must be handled;
- how complaints are escalated;
- how chargebacks are assessed;
- tax invoicing and recordkeeping.
If you’re running a marketplace or platform-style startup, this is especially important to get right from day one.
Customer-Facing Legal Compliance: ACL, Pricing, Refunds, And Chargebacks
Even if your payment flow is managed by one of your chosen payment gateway providers, your business is usually still responsible for what you promise customers and how you handle consumer issues.
Australian Consumer Law (ACL): Your Refund Process Needs To Match Your Legal Obligations
If you sell to consumers in Australia, the Australian Consumer Law (ACL) will typically apply.
That means you need to be careful about:
- making sure your product or service descriptions match what’s delivered;
- not overstating “no refunds” policies;
- handling faulty goods, service issues, delays, and cancellations fairly;
- avoiding misleading statements in ads and on your checkout page.
A lot of payment-related disputes start as customer frustration: unclear delivery timeframes, unexpected fees, confusing subscription renewals, or a customer not understanding what they purchased. Getting your wording right reduces chargebacks and customer complaints.
It’s also worth understanding how misleading or deceptive conduct works under the ACL, because checkout and payment claims are a common risk area. For example, if your pricing or key terms aren’t clear before a customer pays, that can create legal exposure. The principles in section 18 often come up in these scenarios.
Pricing Displays: Don’t Let Your Checkout Create Legal Risk
Make sure the customer can see (clearly and upfront):
- the total price (including any compulsory fees);
- whether prices include GST (where relevant) (this is a tax issue, so consider getting tax advice if you’re unsure);
- any delivery fees and when they apply;
- ongoing charges for subscriptions (including renewal frequency and how to cancel).
Your payment gateway provider won’t usually police this for you - but your customers (and regulators) might.
Chargebacks: Treat Them As A Process Problem, Not Just A Payment Problem
A chargeback is often framed as a banking/payment issue, but it’s closely tied to your:
- customer service process;
- refund policy and evidence trail;
- delivery records;
- contract terms and how clearly they’re presented at checkout.
In practice, you want a paper trail: order confirmation emails, receipts, delivery confirmations, clear cancellation steps, and support correspondence. If a dispute happens, those records can be decisive.
One of the biggest legal benefits of using reputable payment gateway providers is that you can reduce the chance of your business directly handling sensitive payment card details.
But you still need to think carefully about privacy and data security in your overall system.
Do You Store Credit Card Details? Be Very Careful
Some businesses want to store card details for subscriptions, recurring billing, or “one-click checkout”. Even if it’s technically possible, storing card information can create major security and compliance obligations.
If you’re considering storing card details (or you’re not sure if your tools do it automatically), it’s worth reading through the obligations around storing credit card details so you can structure your checkout in a safer way.
In many cases, a safer approach is to use tokenisation or vaulting options offered by payment providers, so your business doesn’t directly store raw card numbers.
Privacy Policies: Your Checkout Is A Data Collection Point
Even if you never touch card numbers, you’ll likely collect personal information such as names, email addresses, phone numbers, delivery addresses, and device identifiers.
If you’re collecting personal information online, you may need a properly drafted Privacy Policy depending on your business size, what information you collect, and whether the Privacy Act applies to you (and in practice, many online businesses choose to have one to set clear expectations with customers).
Your privacy documents and your actual practices need to align. For example, if your payment gateway uses overseas infrastructure or discloses information to certain subcontractors, your privacy wording should reflect that in plain English.
Security Responsibilities: Know What You’re Still Accountable For
Even when you outsource payment processing, you’re still responsible for your own security settings and staff behaviour. Practical steps often include:
- using strong access controls (especially for finance and admin accounts);
- setting up multi-factor authentication (MFA);
- restricting admin access to trusted team members;
- training staff on suspicious refund requests and phishing;
- keeping your website plugins and checkout integrations updated.
This is less about “perfect” security and more about demonstrating you took reasonable steps - which matters if you ever need to respond to a complaint or incident.
What Legal Documents Should You Have When Using Payment Gateway Providers?
When a customer pays you, that payment should sit within a clear legal framework. This is where your contracts and website terms do a lot of heavy lifting - they help set expectations and reduce misunderstandings that lead to disputes.
Here are the legal documents many Australian businesses need when working with payment gateway providers (particularly if you’re selling online).
- Customer contract: If you sell services (or complex deliverables), a tailored Customer Contract can clearly cover payment terms, scope changes, cancellation rights, delays, and dispute handling.
- Website terms: If customers use your site or app, having Website Terms and Conditions helps set rules around account access, acceptable use, limitations of liability, and how your platform can be used.
- E-commerce terms: If you sell products online, E-commerce Terms and Conditions help cover order acceptance, shipping, returns, subscription terms (if any), and how payment disputes are handled.
- Privacy policy: Your Privacy Policy should reflect the data collected at checkout and what third parties you share it with.
Not every business needs every document listed above - it depends on what you sell, how you sell it, and the level of risk in your transactions.
But if you’re scaling, accepting recurring payments, or selling at higher volumes, having clear and consistent terms can materially reduce disputes and chargebacks (and make it easier to defend them).
What If You Use Direct Debit Instead Of Card Payments?
Some businesses use bank debits (for example, memberships, retainers, or ongoing B2B services). If that’s part of your setup, you’ll want to ensure your customer payment authorisations and cancellation processes are compliant and clear.
Direct debit arrangements come with their own rules and common pitfalls. In Australia, direct debits are commonly processed through the Bulk Electronic Clearing System (BECS) and the relevant APCA rules and procedures (as well as your bank or provider’s terms). It’s worth getting familiar with direct debit laws and making sure your customer-facing authorisations are documented properly.
Common Legal Pitfalls With Payment Gateway Providers (And How To Avoid Them)
Most issues we see aren’t caused by a “bad” payment gateway. They happen when a fast-moving business scales, changes its offer, or introduces subscriptions without updating its customer terms and internal processes.
1) Relying On “Default” Checkout Wording That Doesn’t Match Your Business
If your checkout page, invoice wording, or email templates don’t clearly explain what the customer is buying (and the key conditions), you’re more likely to see disputes.
Aim for consistent wording across:
- your website product/service pages;
- your checkout flow;
- confirmation emails and receipts;
- refund/cancellation instructions;
- customer support responses.
2) Not Planning For Account Holds Or Sudden Suspensions
Many businesses only discover the importance of gateway “reserves” and suspension rights when cash flow is suddenly interrupted.
Practical steps include:
- keeping a cash buffer (especially if you are seasonal or running pre-orders);
- ensuring your business documents and identity verification are up to date;
- keeping fulfilment timelines realistic and clearly communicated;
- reducing refund delays that can trigger complaints.
3) Subscription Confusion
Subscriptions can be great for predictable revenue, but they’re a common source of chargebacks if customers feel surprised by a renewal.
To reduce risk, make sure:
- renewal frequency and pricing are disclosed before payment;
- cancellation is straightforward;
- receipts and renewal notices are clear;
- your terms cover what happens if a payment fails (pause vs cancellation vs debt recovery).
4) Expanding Overseas Without Updating Your Terms
If you start selling internationally, you may need to revisit:
- tax and customs messaging (consider getting tax advice for international sales);
- currency conversion disclosures;
- delivery and returns expectations;
- privacy disclosures (especially if data is transferred overseas).
Even if the payment gateway makes international selling easy, your legal documents and customer communications need to keep up.
Key Takeaways
- Choosing between payment gateway providers isn’t just a technical decision - it affects your contracts, cash flow risk, customer disputes, and privacy compliance.
- Before committing to a gateway, review the key commercial terms: fees, settlement timing, reserves/holds, suspension rights, chargebacks, and liability limits.
- Make sure your checkout flow and customer messaging comply with the Australian Consumer Law (ACL), especially around pricing transparency and refunds.
- Even if you don’t store card numbers, checkout usually involves personal information - so your Privacy Policy and data handling practices need to be aligned.
- Strong customer-facing legal documents (like website terms, e-commerce terms, and customer contracts) can reduce misunderstandings and help you respond to disputes.
If you’d like help setting up your payment terms and online legal documents for your business, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
