How to accept payment? reddit / selfhosted ---------------------------------------------------------------------- lmux · 2023-10-22 12:05 My company is currently using stripe as payment processor. As a side project, I want to explore the possibility of creating my own payment processor at home (i.e. become my own stripe). Does anyone know what's involved? I can probably develop a stripe clone by myself. But I want to focus on the legal/financial aspects. Pls don't tell me to accept bitcoin. Already got that rolling. ---------------------------------------------------------------------- thekrautboy · 2023-10-22 12:21 > Does anyone know what's involved? * Step 1: Talk to a actual lawyer about it. *Step 2: There wont be a step 2. ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-22 12:23 Working for a bank i know there many aspects that come with being a PSP. Think about fraud detection, KYC, technical as well as well as financial audits. When you work with card processing you need to abide with Mastercard policies for example(which is a few hundred page rulebook). Same goes for various other payment methods with each their own rules, fraud rate tresholds. Then there are security aspects, risk apetite, chargeback policies as well as possible liquidity requirements. My 2 cents is that this is a bit much for a side project. But I don’t know how much time and resources you have on your hands. As there is a reason people usually use larger payment providers and smaller payment providers usually attract a certain type of customers(p*rn, gambling, “research” drugs etc) If you want to do this solely for your own company, perhaps the way to go is to tie a few existing psp API’s together. But in Europe since the wirecard scandal regulators have become more strict on PSP’s. Hope this info helps you a bit and doesn’t encourage you, if you are really set on this you’ll find a way. But handling other people their money and payment infrastructure comes with great responsibility. ---------------------------------------------------------------------- string-user-equals · 2023-10-22 12:31 Lordy. That fact that you think this could be a side project is a huge red flag in and of itself. You can start out with SAQ D to get a little taste of what you’d be in for… https://listings.pcisecuritystandards.org/documents/SAQ_D_v3_Merchant. pdf ---------------------------------------------------------------------- weischin · 2023-10-22 12:36 The only easy way is to have customers transfer payment directly to your bank account. Other than that, dealing with credit cards, frauds, audits, chargebacks, etc... will be more than anyone can do as a "side project". ---------------------------------------------------------------------- candle_in_a_circle · 2023-10-22 12:47 I know a LOT about how to do it, and don’t be dissuaded by the naysayers. The act of figuring it out will teach you an awful lot. It is a very regulated, expensive, technically and (most of all) legally challenging space / project. The act of building a ‘hobby’ acquirer- processor is something you can do in a sandbox environment from modern banking-as-a-service providers without much financial cost, but moving from there to accepting an actual payment will cost you a significant amount (can’t see how you could do it for less than £100k at an absolute minimum, probably 5x that). ---------------------------------------------------------------------- springs87 · 2023-10-22 12:50 I work for a payment gateway and the amount of systems we have to run everything as well as communicate to visa and mc is insane. as well as the specialist equipment, we have to make sure everything is encrypted. Not the sort of thing you could do at home on the cheap without using another system to process the actual card data ---------------------------------------------------------------------- Disastrous_Elk_6375 · 2023-10-22 12:55 > I can probably develop a stripe clone by myself. =))))))))))))))))))) ---------------------------------------------------------------------- tyroswork · 2023-10-22 13:03 You still need it to go through a bank so you can't have it selfhosted. The truly selfhosted way to accept payments is Bitcoin/crypto, it doesn't even require "hosting" anything. ---------------------------------------------------------------------- lmux · 2023-10-22 13:22 Hey tks for the detailed answer. Care to elaborate what you mean by tie existing psp api together? Some kind of proxy existing psp? ---------------------------------------------------------------------- lmux · 2023-10-22 13:26 Is payment gateway an umbrella term? I can google payment gateway and get page after page of PSPs. Are they all doing an insane amount of communicating with visa/mc every day? ---------------------------------------------------------------------- persiusone · 2023-10-22 13:26 I built a payment processor many years ago for a large bank. Spoiler alert: you won't be self hosting something like this. The regulatory and compliance aspect alone will financially destroy you. You'd have audits, auditors in your home, and they will fail you. You won't be able to be in compliance and thus you won't be allowed to process financial transactions. You will need an intermediary, like stripe or square or similar, to accept payment. Shop around for a solution or start investing into a large education on SEC, FDIC, and PCI regulations before you even get into the technical and physical challenges of financial transaction processing. I am guessing there are quite a few additional regulations now. Good luck ---------------------------------------------------------------------- lmux · 2023-10-22 13:29 Yeah my plan is to make a sandbox version for people to play with, and see how well it scales. I have no idea how much $$ it takes to become real...what would that much money be used for? ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-22 13:43 Yes indeed, i think that’s the phrasing that does it best. For example if there are some cheaper psp’s around for 1 specific payment method but you’d like to offer more. You could proxy different psp’s for different payments all into 1 API and offer that as a service perhaps. I don’t have any concrete ideas for that but suggested it as a point to get you started somewhere and if you have a working business model you could use the profit to start building everything in-house to work towards becoming your own PSP. ---------------------------------------------------------------------- SolFlorus · 2023-10-22 14:00 “Payments Systems in the U.S.“ is a book that is a decent introduction into everything involved. Is this something you even have the power to do at your company? Often times larger companies will negotiate special contracts with stripe. If you do have the power, there are alternatives to Stripe with lower fees, but they aren’t as nice as stripe to work with. ---------------------------------------------------------------------- radakul · 2023-10-22 14:17 The PCI DSS 4.0 doc, all 400+ pages of it, should give you an idea of just how much compliance and regulatory effort there is in being a payment servicer. This is totally outside the scope of self hosted. ---------------------------------------------------------------------- thekrautboy · 2023-10-22 14:33 About treefiddy. ---------------------------------------------------------------------- IfxT16 · 2023-10-22 14:39 Are you sure you want a PCI environment in your homelab? ---------------------------------------------------------------------- springs87 · 2023-10-22 14:47 payment gateway is the term i know it by. Might be different in other countries. But stripe would fall under that banner as well. basically the company in the middle that can securely process card details depending on the setup and traffic there can be a lot of communication between them both ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-22 16:05 This should be the top comment. ---------------------------------------------------------------------- e3m88 · 2023-10-22 16:27 Why ---------------------------------------------------------------------- lucassou · 2023-10-22 17:05 As other probably said. Don't do it. Payment processing is not just setting up a server and a database. Just as implementing your own encryption protocol is a bad idea, creating your own paiement system sadly also is... ---------------------------------------------------------------------- opinionsnotmine · 2023-10-22 17:57 Fintech regulatory lawyer here (former top-20 bank, 2x fintech GC). What are you trying to accomplish? Just to accept payments for your company, or to offer payment services to third-parties and get paid for it? There are a bunch of fintechs that abstract away a lot of the work needed to roll your own payment processing, but, as many other commenters said, you'll still need to handle the PCI requirements. If you're only accepting payments for your own company, the legal requirements to authorize payments are relatively easy. If you're going to process payments for third-parties, though, you're in for a world of regulatory pain at the federal and state level - here are some of the acronyms you'll need to become an export about: OFAC, BSA, KYC/KYB, AML, EFTA, MTL, and NACHA. ---------------------------------------------------------------------- DWolfUK40 · 2023-10-22 19:04 There’s a reason stripe is a payment processor and your company is using it. Regulations and costs alone make it difficult for companies, never mind individuals. Getting approval for things. Having protections, gaining trusts etc etc. the list is endless. It’s not something that an individual should ever be considering. Stripes fees aren’t too bad and they do the heavy lifting. You would spend way more thinking about setting up yourself and researching. The time cost involved. It’s just not worth it for anybody but the biggest players. ---------------------------------------------------------------------- Murky-Sector · 2023-10-22 20:04 Wheres the cost/benefit justification? My company went through the certification process. It cost many thousands and took many months. ---------------------------------------------------------------------- tstyopin · 2023-10-22 20:08 Why merchant edition? Should be service provider :) ---------------------------------------------------------------------- string-user-equals · 2023-10-22 20:09 Because op wasn’t clear on if he was doing for him/her self or for others 😀 ---------------------------------------------------------------------- tstyopin · 2023-10-22 20:09 There is not a huge problem ---------------------------------------------------------------------- captnmr · 2023-10-22 21:26 Sure you can build a stripe clone, sure bud. I have Eng friends who work at Stripe. I don’t think you can even begin to understand what’s involved with a business like this. They ARE the gateway so have fun implementing “verified by visa” with 200 banks. ---------------------------------------------------------------------- Petersurda · 2023-10-23 02:27 Btcpayserver. Credit cards etc just forget about self hosting, I worked for a credit card processor in the past, you won’t be able to get through the PCI audit. ---------------------------------------------------------------------- mattindustries · 2023-10-23 02:41 Funny enough that would still only be like 10% of the problem. They would also need to become an actuary to determine risk, and a data engineer to have up to date infrormation to model the transactions on. This post actually made me laugh, because I have also picked up projects I was overconfident in only to fail, but this is one project I would never. Authorize net merchant accounts are hella expensive, NMI works but kinda sucks. Stripe is cheap and works well. ---------------------------------------------------------------------- FactoryOfShit · 2023-10-23 07:57 Question - why do you think payment processors even exist? Why don't huge companies with tons of workforce just process payments themselves and save millions of $ on paying the processor fees? The answer is all the legal trouble and complications. So many regulations, so many liabilities, so many issues with security that companies decide that it's worth spending a percentage of their multimillion-dollar revenue to not have to deal with. And you are trying to do all that by yourself. This project is impossible. ---------------------------------------------------------------------- lmux · 2023-10-23 11:09 I notice most airlines do their own payment processing, so I guess it's not all that crazy. Maybe I can start with that? Any idea what kind of regulatory hurdle that would entail? As any other homelabber, it's all about learning. ---------------------------------------------------------------------- johanpupin · 2023-10-23 11:56 Forget stripe and use your bank e-commerce api? ---------------------------------------------------------------------- lukewilson86 · 2023-10-23 22:18 It can go sour so quickly, even though airlines take payments, they still use a merchant to process the payment. You could use PayPal to process the payment and be your merchant... With regards to regulation. It's the storing of card details where the regulators become unhappy. PCI DSS is the regulation you need to look into. It covers everything from securing the payment input, data in flight and data at rest. If you want something technical and practical to understand, look into CISSP certification. If you want to know how bad it can get. Read up about the British Airways online booking security breach. ---------------------------------------------------------------------- tyroswork · 2023-10-23 22:20 > I notice most airlines do their own payment processing No they aren't, unless they're also banks. When you're ordering on an airline website, your payment request goes through a payment processor in the background. You can't do peer-to-peer financial transactions in USD, there's always a bank involved. The only way to do peer-to-peer transactions is crypto. ---------------------------------------------------------------------- aosroyal2 · 2023-10-24 16:50 I think hard cash is the only open source self hosted payment platform ---------------------------------------------------------------------- opinionsnotmine · 2023-10-24 18:06 Different payment types are subject to different regulations, so you need to specify what type of payments you want to process, to know what regulations apply. And I was serious about the acronyms - if you've learned those, you'll be ready to proceed. Here are some relevant links, in no particular order: [https://fincen.gov/](https://fincen.gov/) [https://www.nacha.org/](https://www.nacha.org/) (note that the NACHA rules are not required by law, they are required by the ACH to be included in every contract that allows access to the ACH network). [https://www.ecfr.gov/current/title-12/chapter-X/part- 1005?toc=1](https://www.ecfr.gov/current/title-12/chapter-X/part- 1005?toc=1) [https://www.csbs.org/csbs-model-money-transmission-modernization- act](https://www.csbs.org/csbs-model-money-transmission-modernization- act) [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandar ds.org/) (note that PCI requirements are not required by law, they are required by the card associations to be included in all contracts that allow access to their payment rails).