Since we are talking about payment systems that interact with other banking systems, they will not be actually air gapped. By the nature and purpose of the systems in question, they must have access to the physical Internet (even if it is entirely abstracted away under layers of VPNs and encryption).

Assuming them compromised is prudent. Physical access is total access.