Card Issuer Explained: Infrastructure, Compliance, and Processing Responsibilities

Where the card issuer sits in payments

Most card payments run on what the industry calls the four-party model: cardholder, merchant, acquirer, and card issuer, with a scheme like Visa or Mastercard in the middle as the network. The Australian Payments Network describes the issuer as the financial institution that issues cards to customers and holds the underlying account, whether that account holds stored funds or extends credit.

The card issuer is the party that stands behind every transaction on the card. It approves or declines the authorization and funds the acquirer through the scheme, while its team takes the customer's call when something goes wrong. Confusion about this role is common because fintech partners sit close to the cardholder and share the same brand surface.

Getting the boundaries right matters because regulators and scheme rulebooks assign liability to specific parties. If you're building a card product, you need to know which obligations sit with you and which stay with the issuing bank or your sponsor.

Issuer vs acquirer, processor, and scheme

A single tap at a terminal touches four entities in well under a second. The merchant sends the request to its acquirer. The acquirer routes it through the scheme. The scheme passes it to the issuer's processor, which hands it to the card issuer for the final call. Each party has one job, and the money and the messages take different paths through them.

It helps to fix the roles before going further:

• Scheme: writes the rules, sets interchange, licenses members, moves no end-customer funds.

• Acquirer: contracts with merchants and pays out merchant settlement after deposits clear.

• Processor: runs the technical switch and message format, takes no financial liability.

• Issuer: owns the cardholder, the account, the funds, and the decision.

Acquirers and the merchant side

The acquirer is the bank or licensed institution that signs up merchants to accept cards. CMSPI defines the acquirer as the bank or financial institution that manages technical card acceptance for the merchant and ensures funds reach the merchant's account. Where the issuer faces the cardholder, the acquirer faces the store.

Acquirers and issuers never settle directly. They settle through the scheme, which nets positions across thousands of members each day. The acquirer collects from the issuer via the scheme and pays the merchant, minus the merchant discount rate that includes interchange and scheme fees.

Processors and message routing

A processor is the technical operator that formats and routes the ISO 8583 authorization and clearing messages between issuers and acquirers through the schemes. Processors can serve either side. Galileo and Marqeta sit on the issuing side, while Worldpay or Adyen handle a lot of acquiring traffic.

A processor takes no financial liability for the transaction. It moves the message and applies the rules its client has configured. Most card issuers rent processing as part of issuing bank infrastructure rather than build their own technical switch, because the response-time engineering and scheme certification are punishing. Qonto's payments team described getting end-to-end authorization under eight milliseconds as the bar for a competitive in-house service.

Card schemes and the rulebook

Visa and Mastercard write the rulebook, set interchange, certify members, and run the network that carries messages between acquirers and issuers. According to Visa's own dispute documentation, the scheme's role is to enforce the rules and arbitrate when members disagree while cardholder fund custody sits outside that role.

The scheme licenses each card issuer and each acquirer to operate under its brand. The bank under a card uses the Visa logo under license. That distinction lets a fintech put a recognizable network mark on a card while the legal card issuer is a different entity entirely.

Core responsibilities of a card issuer

The duties below are what you actually sign up for when you put a card in someone's hand. None of them can be fully delegated. A program manager can run the front end and a processor can run the switch, but the regulated card issuer remains accountable to the scheme and the cardholder under regulatory oversight.

Cardholder onboarding

Onboarding starts with an application and ends with a usable card. The issuer collects identity data, runs verification, approves or declines, opens the underlying account, and provisions the credential. Provisioning covers physical card production through bureaus like IDEMIA or Thales and virtual card issuance through tokenization APIs, with wallet setup for Apple Pay or Google Wallet handled through the same digital credential flow.

The issuer is also the party that puts the cardholder agreement in place. In the United States that document carries Regulation Z disclosures for credit cards and Regulation E disclosures for debit and prepaid. The cardholder and issuing bank are the parties to the contract, even when the program manager's brand is on the card.

KYC and AML compliance

Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations sit on the regulated card issuer. In the United States the Customer Identification Program rule under Section 326 of the USA PATRIOT Act requires the bank to verify identity at account opening and keep the records for five years after closure. FinCEN guidance is explicit that even when a program manager runs the application flow, the issuing bank is the responsible party.

Issuers monitor transactions throughout the account lifecycle for sanctions hits and unusual patterns, and they file Suspicious Activity Reports when something crosses the line. Ongoing customer due diligence and screening against OFAC lists run for the life of the account.

Credit and risk management

For credit products, the card issuer underwrites the customer, sets a credit limit, prices the line, and books the receivable. Scoring leans on bureau data and application information, with cash-flow signals from open banking in the model as well. Portfolio-level provisioning under CECL accounting rules sits on the issuer's balance sheet.

For debit and prepaid, repayment risk disappears because the customer's own money is funding the transaction. Risk shifts to fraud and first-party misuse, with overdraft exposure added if the program permits it. Either way the issuer is the party making the call on who gets a card and on what terms.

Transaction authorization

Authorization is the moment the card issuer says yes or no. The processor receives the request from the scheme, hands it to the issuer's decision logic, and the issuer checks the available balance or open-to-buy, runs fraud scoring, applies velocity rules, and returns an approval code or a decline reason. The final answer belongs to the issuer.

The networks impose hard response-time windows. Mastercard's network handles more than 160 million transactions per hour with an average response time of 130 milliseconds, and an issuer that times out loses the transaction by default. Visa scores every transaction through its Advanced Authorization engine in under a millisecond against 500-plus risk attributes before the issuer even sees it, but the final decision is still the issuer's.

Clearing and settlement

Authorization places a hold. Settlement moves the money. Once the merchant submits its batch, the acquirer presents the transactions through the scheme, and the card issuer is obligated to fund the position on the scheme's settlement cycle. Marqeta's reference material defines clearing as the exchange of transaction details between acquirer and issuer, and settlement as the network-facilitated movement of funds.

For the cardholder, this is when a pending transaction posts. For the issuer's operations team, this is daily reconciliation against scheme files, dispute postings, fee accruals, and chargeback reversals. Timing differences between auth and settlement create the holds that confuse customers and the reconciliation breaks that keep finance teams busy.

Disputes and chargebacks

When a cardholder calls to dispute a charge, the card issuer is their advocate. The issuer files the chargeback under the scheme's reason codes and pushes the case through pre-arbitration and arbitration if needed, with evidence collected along the way. Cardholders have 120 days to file a Visa dispute, with select reason codes stretching to 540 days for future-delivery transactions.

Visa's resolution framework gives each party 30 days per phase and 10 days to escalate to arbitration. The issuer carries the operational and systems cost of running disputes, plus reputational damage when a customer feels poorly defended. Mishandled disputes also trigger scheme fines and excessive chargeback monitoring programs.

Fraud liability

Fraud loss does not always land on the same party. The 2015 EMV liability shift in the United States moved counterfeit card-present losses to whichever party uses the less secure technology. When both sides are EMV-compliant and the chip is processed correctly, the issuer keeps the loss.

For card-not-present, 3-D Secure shifts liability. Checkout.com's liability matrix shows that an authenticated 3DS transaction puts fraud liability on the issuer, while an unauthenticated CNP transaction puts it on the merchant. Gross card fraud losses worldwide reached $33.41 billion in 2024 according to the Nilson Report, and a meaningful share of that lands on issuers even when they do everything the rulebook asks.

Infrastructure behind a card program

The duties above run on a stack. A working card program needs a card management system that holds the account and rules, an authorization switch that responds in milliseconds, a ledger that posts the money, a tokenization service for digital wallets, and certified connectivity into each scheme. Around that core sit fraud engines, dispute case management, statementing, and reporting.

Three paths exist for assembling that stack. The first is to build issuing bank infrastructure in-house, which a handful of large banks still do. The second is to rent issuing bank infrastructure from an issuer-processor like Marqeta or Galileo. The third is to access issuing bank infrastructure through a BIN sponsor that bundles regulated access with processor and program management services.

That choice shapes card program ownership and economics. Building in-house gives full card program ownership but eats years and tens of millions before first card. Renting from a processor preserves most card program ownership while shortening the launch to months. Going through a sponsor surrenders some card program ownership in exchange for speed and a smaller compliance perimeter.

Regulatory and compliance obligations

Every card issuer operates under a license. In the United States that's a state or national bank charter. In the EU and the UK it's an e-money license under the Electronic Money Regulations 2011 or the equivalent EU directive. On top of the license, the issuer holds principal membership with each scheme it operates under, which imposes its own capital and reporting requirements.

Layered onto that are technical and consumer rules. The headline ones include:

• PCI DSS for the protection of cardholder data, which applies to issuers as well as acquirers under Visa Rule 0002228.

• Data protection regimes like GDPR in Europe and state privacy laws in the United States.

• Consumer protection rules such as Reg Z and the CARD Act for credit programs.

• Anti-money-laundering reporting through SAR and CTR filings.

Compliance is continuous and audited. Internal audit, external auditors, scheme reviews, and regulator examinations all run on overlapping cycles, and findings carry remediation deadlines with real teeth. Treating compliance as a launch milestone instead of an operating function is how programs get suspended.

Choosing or becoming a card issuer

Most fintechs want to ship a card through a structure that avoids becoming a bank. The build-partner-sponsor decision comes down to how much regulatory weight you're willing to carry against how much card program ownership and margin you want to keep.

Becoming a directly licensed card issuer means applying for a banking or e-money license and joining the schemes as a principal member, with a compliance function that can survive an examination. The reward is full card program ownership and direct interchange economics, with less sponsor concentration risk. Working with a BIN sponsor compresses that timeline to months and removes the licensing burden. Addleshaw Goddard's breakdown of sponsorship arrangements explains that the BIN sponsor holds the issuing license and ultimate compliance responsibility while the program manager runs the customer-facing side.

The third path is a modern issuer-processor platform that pairs BIN sponsorship with API-driven issuing. It's the fastest route to a live card. The tradeoff is thinner interchange margins and less control over product behavior, with a real switching cost if you outgrow the partner. Galileo's own guide for fintechs notes that many fintechs eventually become their own program manager once scale justifies it.

Key takeaways and next steps

A card issuer is the licensed entity that gives someone a card, holds the account behind it, decides every authorization, funds settlement to the acquirer, and stands behind the cardholder when something breaks. Around the issuer, schemes set the rules for acquirers and processors that serve merchants and move messages; the issuer owns the customer and the money.

If you're evaluating a card program, the next decisions are concrete. Decide whether your business case justifies pursuing a license or whether a sponsor model fits better. Pick a processor whose product roadmap matches yours. Map every duty in this article to a named party in your contracts before you sign anything.

EGS builds resilient fintech infrastructure and issuing bank infrastructure for teams that launch card programs, with sponsor connectivity and the compliance tooling a card issuer needs to operate at scale. If you're sizing the build-versus-partner decision or stress-testing an existing program, reach out to our team for a working session.