A small business guide to taking card payments

If you’ve just formed a company, accepting card payments can feel like one more confusing job. It doesn’t need to be. Most founders can get started quickly with a provider that handles the technical parts for them.

Why accepting card payments matters for your business

For a new business, card acceptance is no longer a nice extra. It’s part of a basic trading infrastructure. According to a study from UK Finance, 30.6 billion payments will be made using debit cards in 2034, and cash usage will decline – only 4% of payments are expected to be in cash by 2034.

For a limited company, there’s also a practical finance angle. GOV.UK states that a company is a separate legal entity, so its finances should be kept separate from the owners’ finances. The simplest way to do that is with a business bank account, which also makes it easier to receive card payment payouts, which also makes it easier to receive card payment payouts.

So, if you’ve recently incorporated, taking card payments is really about three things: You need a way to accept the payment, a way to receive the money, and a provider you trust to process it securely.

• How to update your payment card – Rapid Formations
• Can I use a personal credit card for business expenses?
• Register a UK limited company and get a Wise Business account

How card payments work

Card payments operate on what’s called a ‘Four Party Model’. Put simply, the four parties involved in any card transaction are:

1. The Cardholder (The Payer and your customer): The individual or business holding the payment card.
2. The Merchant (you, the Payee): The business or service accepting the card payment for goods or services.
3. The Issuer: The cardholder’s bank or financial institution that provides the card, holds the cardholder’s account, and approves or declines transactions.
4. The Acquirer: The financial institution that processes card payments on the merchant’s behalf and settles the funds into a merchant account before payout. Most small businesses access acquiring through their payment service provider rather than contracting directly with an acquirer.

When a customer pays by card, a few separate jobs happen in the background. The payment details are captured by your card reader or checkout, and an authorisation request travels from the card scheme to the customer’s bank (the Issuer), which approves or declines it in seconds. The money is then collected and settled by the Acquirer, and your payment service provider pays it into your business bank account, normally within one to three working days.

Merchant accounts

A merchant account is a specialist account allocated to a Merchant by an Acquirer to accept customer card payments. It’s not the same as your ordinary business bank account. A Merchant Account temporarily holds funds before they are transferred to your main business account. The Acquirer will usually debit any fees and other deductions, such as chargebacks, from your Merchant Account prior to paying out net funds via your payment service provider, although some providers payout on a ‘gross’ basis, which means you are paid the full value of your collections, with fees and other charges being paid at a later date via invoice. Gross arrangements usually require increased collateral/deposit arrangements because of the risk to the Acquirer of any chargebacks or refunds.

Traditional card setups often require you to open a merchant account separately. Many modern providers don’t. They handle that part for you behind the scenes, which is one reason they are popular with startups.

PCI DSS

If your small business accepts credit or debit card payments, you’ll likely have run into the phrase PCI DSS. It stands for Payment Card Industry Data Security Standard.

In plain English, it’s a strict set of security rules created by the major card schemes (Visa, Mastercard, Amex) to protect your customers from identity theft and fraud.

A common myth among small business owners is: *”I use Stripe (or Square, or SumUp) to handle my payments, so PCI compliance is their problem, not mine.”*

While using these companies makes your life much easier, it does not get you completely off the hook. Here is what you need to know and what you still legally have to do.

The good news: outsource to reduce the burden

If you use a modern payment service provider like Square, SumUp, or Stripe, you are outsourcing the most dangerous part of data security.

Because these companies use encrypted card readers or secure online checkout forms, card data never actually touches your website, computer network, or servers.

This puts your business in the lowest risk tier. Instead of answering a gruelling 300+ question technical audit, you only have to fill out a short, annual self-assessment.

Your remaining obligations (the “do not do” list)

Even if SumUp or Stripe handles the technology, human error can still cause a data breach. If you outsource your payments, your PCI compliance obligations boil down to four main rules:

1. Never write down or store card numbers

Your payment service provider handles the data online, but what happens offline?

• The rule: Never write a customer’s card number, expiry date, or 3-digit CVV code on a sticky note, in an email, or in a spreadsheet.
• The risk: If a customer reads their card over the phone, type it directly into your virtual terminal. Do not write it down “to type in later.”

2. Protect your hardware and Wi-Fi

If someone tampers with your physical card reader or hacks your internet connection, your third-party processor cannot protect you.

• The rule: Secure your business Wi-Fi with a strong password (never leave it on the factory default). Inspect your physical SumUp or Square card readers regularly to make sure no one has attached a “skimmer” to them.

3. Control employee access

Not every employee needs access to your financial data.

• The rule: Give every staff member their own unique login for your Square or Stripe dashboard. Never use a shared “admin” password. This ensures you always know who processed a refund or changed account settings.

4. Fill out your annual paperwork (the SAQ)

Your payment service provider will ask you to declare your compliance once a year.

• The rule: You must log into your payment service provider’s dashboard and complete a short Self-Assessment Questionnaire (usually called SAQ A or SAQ B). It takes about 15 minutes. It’s a simple checklist confirming that you follow the rules above.

Three ways to accept card payments

Most new businesses accept card payments from one or more of these routes: in person, online, or by phone. The right mix depends on how you sell, not just the cheapest option.

In-person payments

This is the standard card reader route. You take payment in person using a portable reader, a countertop terminal, or Tap to Pay on iPhone or Android. It suits retail, hospitality, events, and service businesses that visit customers.

You do not always need to buy hardware first. SumUp offers Tap to Pay on your phone at £0 hardware cost, Square supports Tap to Pay on iPhone and Android, and PayPal Point of Sale says you can start taking contactless payments on your phone as soon as you sign up and download the app. Stripe also supports Tap to Pay on compatible iPhone and Android devices.

Online payments

If you sell through a website, booking page, online store, or remotely, you need an online checkout route. That could be a full payment gateway technology solution, a hosted checkout, or a simple payment link.

Using a payment link is often the best choice if you trade remotely, sell digital services, or want to invoice customers without chasing bank transfers. It’s also a good way to launch fast if you don’t have a full website yet. With SumUp, payment links can be created without a website, and with PayPal, Payment Links can be shared by email, text, social, or QR code.

If you sell online to customers, distance selling rules apply. You must give customers key information before they place an order, and the order button must make clear that they are committing to a payment. GOV.UK’s online and distance selling guidance provides more information.

Phone payments

Phone payments are usually taken through a virtual terminal, which is a secure page provided by your payment service provider that turns any internet-connected technology into a payment terminal.

This route is useful for deposits, bookings, or one-off remote orders. It’s usually less attractive for regular trading because keyed-in payments often cost more than card-present payments. Square, for example, charges 2.5% for Virtual Terminal and other manually keyed transactions, compared with 1.75% for in-person UK card transactions.

How to take card payments as a small business

If you want the shortest route from incorporation to first sale, follow these steps.

1. Decide where you’ll sell first.
Start with your trading model. If you sell face-to-face, choose an in-person setup. If you sell remotely, start with payment links or online checkout. If you take deposits by phone, add a virtual terminal.

2. Set up a business bank account.
A limited company should keep its money separate from the owners’ money to avoid accounting issues and tax complications.

3. Choose a payment service provider and plan.
If you sell face-to-face, SumUp is the easy starting point, with pay-as-you-go readers and no monthly fees. If you’re online-first and want a customisable checkout with subscription functionality, consider Stripe.

4. Complete business verification.
Providers will ask for business details, bank details, and identity documents before they’ll activate your account.

5. Activate the right payment tool.
That might mean pairing a card reader with your app, turning on Tap to Pay, publishing payment links, or installing a checkout on your website.

6. Run a live test payment before launch.
Make one small transaction, confirm the receipt flow, check the payout settings, and test your refund process. That catches most setup errors before a real customer sees them.

Need a business bank account before you start taking payments? See our guide on the easy way to get your business bank account. Once you have a business bank account set up, then you can consider taking payments from a payment provider.

Setup can be quick, but you should consider payout timing, which isn’t always instant. Square says standard payouts are the next business day. SumUp says payouts arrive the next day, including weekends and bank holidays, for eligible transactions. Stripe says initial payouts typically arrive 7 to 14 days after your first successful payment, depending on risk and country.

For each provider, ensure that it fits with your business and your personal cash flow needs.

How much does it cost to take card payments

For most small businesses, card costs fall into three buckets. You pay transaction fees, possible monthly fees, and optional hardware costs.

Transaction fees

For low-volume, in-person trading, pay-as-you-go pricing is common. SumUp’s pay-as-you-go, in-person fee is 1.69%. Square charges 1.75% for in-person UK card transactions. PayPal Point of Sale charges 1.75% for card transactions. Stripe Terminal starts at 1.4% + 10p per successful in-person charge for EEA cards, with higher fees for non-EEA cards.

Online and remote payments often cost more. SumUp charges 2.50% for online payments and payment links. Square charges 1.4% + 25p for UK online card payments, while its Virtual Terminal and other keyed-in payments cost 2.5%. PayPal Point of Sale’s payment links are 2.5%. Stripe’s standard UK online card pricing is 1.5% + 20p for standard UK cards.

Monthly fees and contracts

The cheapest way to take card payments as a small business in the UK is usually the route with the fewest fixed costs, at least at the start. That is why many founders begin with a no-monthly-fee plan. Square, SumUp pay-as-you-go, and PayPal Point of Sale all offer startup-friendly entry routes without an ongoing monthly rental for the basic card setup.

Once your volume rises, a monthly plan can become cheaper overall. SumUp’s Payments Plus plan costs £19 a month and cuts the in-person fee to 0.99%. Simple maths puts the break-even point at about £2,714 in monthly card sales, which lines up with SumUp’s own guidance that the plan suits businesses taking around £3,000 or more each month.

So, the answer depends on your volume. If you take a few hundred pounds a month on a card, fixed monthly fees can be minimal. If you take several thousand pounds, a lower percentage rate may save you more than the monthly charge costs.

Hardware costs

Entry hardware isn’t usually expensive now. Square Reader starts from £19 + VAT. PayPal Reader for PayPal Point of Sale is available from £29 excluding VAT for eligible new business users. SumUp’s Solo Lite is listed at about £30 including VAT on its UK product page, with lower promotional pricing sometimes shown elsewhere on the site. Stripe’s WisePad 3 Reader is £49 excluding VAT, while its Stripe Reader S710 is £229 excluding VAT.

You may be able to avoid hardware completely. SumUp, Square, PayPal Point of Sale, and Stripe all offer Tap to Pay routes for iPhone and Android phones, which can make that the cheapest way to get started.

In practice, the lowest-cost starting point for most new offline businesses is a no-monthly-fee provider plus Tap to Pay or a low-cost card reader. For online-only businesses, the cheapest route is often a payment link or hosted checkout, because you do not need to buy hardware at all.

What to look for when choosing a payment service provider

Start with total cost, not just the headline fee. Check the transaction rate, any fixed pence fee, dispute fees, instant payout fees, and whether keyed-in payments cost more.

Payout timing matters more than many founders expect. If cash flow is tight, compare standard payout speeds and the cost of getting paid faster.

Look closely at setup friction. SumUp and PayPal Point of Sale sign-up can take minutes, but Square requires full verification before activation, and Stripe requires live-account verification before processing. Fast sign-up does not always mean instant trading.

Don’t ignore compliance and security. Strict standards (such as PCI-DSS) apply to payment data, and as we’ve seen, using a reputable provider reduces your workload because the provider handles much of the secure infrastructure. You should also check the FCA Register when using a non-bank payment firm to ensure they are authorised to collect card payments and handle your money.

Finally, check the contract and support model. Square promotes no long-term contracts for Virtual Terminal, and Stripe’s standard pricing has no setup or monthly fees. This kind of flexibility is often valuable in your first year.

Ready to start trading?

Register your limited company with Rapid Formations from £2.99 plus the £100 Companies House fee. Many online registrations are completed within just 24 hours, helping you move on swiftly to banking and payment setup.