4 min read
Embedded payments are the growth story of the year. We covered that in our mid-year review, and the market is on track to hit nearly $193 billion globally by 2032. In essence, money is moving into places it never used to live: inside of SaaS platforms, marketplaces, and apps that were never built to be payment processors. But growth stories have a way of skipping the boring middle chapter, and the boring middle chapter here is security. Let’s talk about it.
Refresher: What Are Embedded Payments?
Embedded payments are what happens when the ability to pay gets built directly into a platform or app, instead of routing you out to a separate checkout page or a third-party processor. Think booking a service and paying on the same screen, or a piece of software that lets you pay invoices without ever leaving the dashboard. The payment infrastructure is baked into the product itself.
We broke this down in more detail if you want the full picture, but for this piece, the short version is enough: payments have moved inside the products businesses already use every day, and that shift is exactly what's creating the security gap we're digging into below.
Speed Built the Channel, But Not the Safeguards
Embedded payments gained popularity because they're invisible. The customer never leaves their app, never gets redirected to a third-party checkout, and never thinks about who's moving the money behind the scenes. While that's the point, it also has potential to be the problem.
When payments live inside a platform that was designed for things like scheduling, inventory, or property management, security is often an afterthought versus a built-in essential. The platform might assume the payment processor has security covered, and the processor may assume the platform has controls in place. Meanwhile, the merchant assumes both of them do. As one recent industry analysis put it, sensitive payment data now travels through fragmented environments with no consistent model governing how it's protected, and many organizations aren't yet equipped to manage that risk.
That gap shows up in a few specific places.
1. Tokenization Inconsistency
Not every system in an embedded payment chain tokenizes data the same way, or at all. A processor might tokenize on their end while a middleware layer or a connected POS device still touches raw card data. Every point where that happens is a point where a breach gets more expensive and harder to contain.
2. Unclear Compliance Ownership
Who's accountable when something goes wrong: the platform, the processor, or the merchant? In a lot of embedded arrangements, nobody has written that down clearly. That ambiguity is fine right up until there's an incident, at which point it becomes a very expensive question to answer under pressure.
3. Expanding Physical Touchpoints
Embedded payments aren't just a digital phenomenon anymore. As they move into card-present environments through semi-integrated POS systems and connected devices, the number of places where sensitive data is captured, processed, and transmitted keeps growing. For a simple example, think of the last time you went to your hair salon. Maybe they had their booking software running on a tablet, paired with a Bluetooth card reader at the front desk. While this is a simplified example, each new touchpoint is a new place for something to go wrong.
Why This Is a Canadian Compliance Problem Now
We wrote about the Retail Payment Activities Act back in the spring. If you missed it, the short version is that PSPs operating in Canada are now formally on the hook for operational risk and for safeguarding end-user funds. It’s a regulatory requirement with real consequences attached.
Layer that onto the embedded payments gap, and suddenly the stakes change. Inconsistencies that used to be a to-do-list item are now a compliance exposure. An unclear ownership handoff between platform and processor is now a question a regulator can ask you to answer. Security that's been treated as a "we'll get to it" is now something businesses have to actively demonstrate control of.
And the risk isn't limited to payments infrastructure alone. Fraud is increasingly a cross-system problem too. Financial institutions are seeing attacks that don't stay in one lane, moving across onboarding, credit, and customer channels in ways that only show up if different teams are comparing notes. Embedded payments have the same structural weakness: the risk lives in the seams between systems, not necessarily inside any one of them. And if nobody owns the seams, nobody catches what's moving through them.
What "Security by Design" Looks Like for Embedded Flows
To be clear, we aren’t suggesting you slow down or rip out embedded payments. The fix is simply to stop treating security as the layer you bolt on after the fact.
Here are a few principles worth building around.
1. Protect Data at the Point of Capture
Whether that's a checkout embedded in a SaaS dashboard or a card-present terminal at a physical location, the data should be encrypted the moment it enters the system, not somewhere downstream after it's already travelled through a few hands.
2. Reduce How Many Systems Ever See Raw Payment Data
Tokenization should mean tokenization everywhere in the chain, not just at the processor level. The fewer systems that ever touch a live card number, the smaller your exposure if any one of them is compromised.
3. Get A Single View of Where Accountability Exists
Someone (the platform, the processor, or the merchant) needs to own the full picture of how payment data moves and who's responsible for each stage. That doesn't mean one party does all the work, but that the handoffs are documented and nobody's assuming someone else has it covered.
Start Scaling with the Right Security
Embedded payments aren't going anywhere, and neither is the regulatory attention on how PSPs handle risk. As a business dealing in payments, it’s your responsibility to build security into your embedded flows now, rather than retrofitting it after an incident.
If you're building or expanding an embedded payments offering and want a second set of eyes on where the gaps might be sitting in your current setup, that's a conversation we're always up for. Reach out to talk with a payments expert.