Card Program: BIN Sponsorship, Issuer-Processor and PayFac vs ISO

Concept

BIN (Bank Identification Number) — the first digits of a card number; issued by payment schemes (Visa, Mastercard) only to their principal members — banks or licensed issuers. BIN sponsorship is access to someone else's BIN: a licensed scheme participant issues cards "on their paper," while a fintech builds a product on top of them without being a Visa or Mastercard member itself.

This is how neobanks and embedded financial products launch debit, prepaid, and credit cards. Card issuance is always a regulated activity (e-money issuance or bank account), so the BIN sponsor both holds the license and is responsible to the scheme.

🍓 Visa/Mastercard membership and responsibility to the scheme remain with the BIN sponsor. The fintech rents access, but the rules of the game — PCI-DSS, monitoring, collateral — are dictated by the sponsor and the scheme.

Card schemes run on a four-party model — cardholder, merchant, acquirer and issuer — and only principal members hold BINs and settle directly with Visa or Mastercard. Membership is capital- and compliance-heavy, so issuing was unbundled: program managers own the product and onboarding, issuer-processors run the technical rails, and a licensed sponsor lends its membership and BIN. That division is what lets a fintech ship a card in months instead of chartering a bank.

How It Works

The chain typically looks like this: principal member (bank or issuer — holds scheme membership and BIN) → program manager (runs the program, onboarding, part of compliance) → issuer-processor (technical transaction processing, authorization, ledger) → sponsored issuer, i.e., the fintech with the product, brand, and customer. The fintech can take some roles in-house if it has the license and scale.

Roles and Providers

• Principal member — bank or licensed issuer with Visa/Mastercard membership and its own BINs.
• Program manager — program operator; sometimes the sponsor itself, sometimes a separate company.
• Issuer-processor — the technical core of issuance: authorization, transaction processing and the ledger. Names: Marqeta, Galileo, Lithic, Highnote, i2c, Thredd (ex-GPS). Full profiles are in the "Issuer-Processors: The Catalog" section below.
• Sponsored issuer / fintech — owner of the product and customer experience.

Issuer-Processors: The Catalog

An issuer-processor is the technical engine of card issuing: it authorizes, clears, and settles transactions on the issuer side, runs the card lifecycle, and keeps the program ledger, answering the network in milliseconds. The processor supplies neither the license nor the BIN — but what once took a year and a heavy integration budget now takes a few weeks against a REST or GraphQL API, billed pay-as-you-go. The layer grew out of mainframes: FIS, Fiserv, and TSYS served banks on closed systems for decades until Marqeta moved the same function into an API in the early 2010s — card provisioning in minutes, just-in-time funding, a developer sandbox.

Who's who (mid-2026):

• Marqeta (NASDAQ: MQ) — the largest independent issuer-processor; debit, credit, and prepaid, strongest in the US. Cleared US$383 billion of processing volume in 2025 and reported its first GAAP-profitable quarter in early 2026; its 2025 acquisition of EMI TransactPay added BIN sponsorship and program management in the UK and EU.
• Galileo — bought by SoFi in 2020 for US$1.2 billion and run as SoFi's technology platform (rebranding to SoFi Tech Solutions); a Visa-certified processor behind a long roster of neobanks, expanding into sponsor banking on the Cyberbank core.
• Lithic — developer-first issuing from the US, built by the team behind Privacy.com; the pitch is API simplicity and speed to the first card, now processing over US$1 billion a month. Raised a Series C led by Stripes in 2025.
• Highnote — since January 2025 the rare platform to put issuing and acquiring behind a single API and one ledger; a 2025 Series B of US$90 million (ex-Braintree team) funded a push into US merchant acquiring and instant-payment rails (ACH, RTP, FedNow, stablecoin funding).
• i2c — a long-established, highly configurable platform with global coverage across debit, credit, and prepaid.
• Thredd — formerly Global Processing Services, rebranded in 2023; British roots, processing since 2007, Visa- and Mastercard-certified (both are investors alongside Advent International), strong across Europe and APAC in 40+ countries; entered the US debit and prepaid market in 2024.
• Pismo — a cloud-native issuer-processing and core-banking platform that Visa bought outright for US$1 billion in January 2024; the networks increasingly want to own the processing rails, not only sit above them.
• Stripe Issuing and Adyen Issuing — issuing folded into a wider payments platform; convenient when you already run there, less so when you want a sponsor-agnostic processor you can re-point later.

At the other pole sits the legacy infrastructure of FIS, Fiserv, and Global Payments (formerly TSYS), which still runs most of the world's banks. The market moved in 2025: FIS bought the issuer-processing business (former TSYS Issuer Solutions) from Global Payments for roughly US$13.5 billion, while Fiserv pushes toward merchants through Clover. Choosing a processor increasingly pulls in the surrounding ecosystem: billing, treasury, reconciliation.

Roles are increasingly combined by one provider — Marqeta covers BIN sponsorship and program management in Europe itself after TransactPay, Galileo is rolling out sponsor banking. That simplifies the contract but does not change the allocation of liability: the BIN and license holder answers to the network and the regulator, and the contract should fix explicitly who that is.

What to check when choosing a processor:

• Network certifications — Visa Ready / Mastercard and for the required products (debit, credit, prepaid).
• Geography — where the processor is certified: US, Europe, APAC. Thredd is strong internationally, Marqeta and Galileo in the US.
• Role combination — does the provider take on BIN sponsorship and program management, or only processing.
• Integration model and pricing — pay-as-you-go versus minimums; speed to go-live.
• Reliability — uptime, redundancy, tokenization, support for network updates.

What You Need to Launch

• Legal entity and license. Registered company and, depending on jurisdiction and product, an e-money issuer license (neobank) or payment institution (PI) license — or operating under the sponsor's license.
• Compliance infrastructure. KYC/AML, transaction monitoring, dispute handling and chargeback processing.
• Infrastructure. Program manager + issuer-processor combination (or these functions in-house).
• Timeline. Around 3–6 months to launch through an established sponsor and processor.
• Cost. Setup fee, transaction fees, revenue share (portion of interchange), and collateral that the sponsor holds against settlement risk.

⚙️ The sponsor conducts due diligence and continuously supervises the sponsored partner — their license is at stake. Therefore, fintechs face capital, policy, and control requirements comparable to bank onboarding.

Compliance

PCI-DSS for card data processing; scheme rules (branding, limits, disclosures); AML and sanctions screening; settlement cycles and collateral; dispute management and fraud. Violation of scheme rules primarily impacts the sponsor — hence the strict requirements for partners.

Money movement is where sponsorship is won or lost. The sponsor settles with the scheme and holds collateral against the program's net settlement exposure, while customer funds must be safeguarded — ring-fenced under the EU and UK e-money regime, or held in for-benefit-of accounts at the sponsor bank in the US. Clean reconciliation and an accurate ledger of end-user balances are not paperwork: when Synapse's ledgers failed, partner banks could not tell whose money was whose.

Applicable Regulation

Visa and Mastercard card schemes operate under private membership rules, with the licensing regime of the specific market underneath. In the EU and UK, this is the e-money issuance and payment services regime — see agents and passporting in payments; in the US, card issuance goes through a sponsor bank — see the BaaS guide, which now also covers US sponsor banks. The general framework for embedded financial services is in embedded finance (McKinsey: embedded finance and BaaS).

Outside the EU, UK and US the pattern repeats under local licences. Singapore issues e-money and card programs under the Payment Services Act (see Singapore PSA); Hong Kong runs prepaid and wallet issuance through a stored-value facility licence (see HK SVF licence); and many programs anchor their European issuing in an EMI, the route Marqeta bought with TransactPay. The sponsor's home regime sets safeguarding, capital and reporting, and the scheme rules sit on top everywhere.

Cases

The most prominent neobanks are built exactly this way. Chime issues debit cards through The Bancorp Bank and Stride Bank — both under $10 billion in assets, both Durbin-exempt. Block's Cash App runs through Sutton Bank, with Marqeta as the issuer-processor. In the EU and UK, Revolut and Wise started on a third-party issuer-processor (GPS, now Thredd) and, as volumes grew, added their own licenses and scheme memberships. The showcase of embedded financial products is covered in embedded finance, the "Cases" section.

Economics: rent versus build

Economics drive the build-versus-rent decision. A sponsored program earns a share of interchange — capped in the EU at 0.2% on debit and 0.3% on credit, and set in the US for issuers with $10 billion or more in assets at 21 cents plus 5 basis points per debit transaction, with a further one-cent fraud-prevention adjustment, under Regulation II (12 CFR §§ 235.3–235.5) — and pays the sponsor a setup fee, per-transaction fees and a revenue share, while posting collateral against settlement risk. Renting a BIN buys months instead of the years that principal membership and direct scheme certification take; once volumes cover the membership fee, the collateral and an in-house compliance stack, issuers start bringing the BIN in-house.

Acquiring: PayFac, ISO and Merchant of Record

Issuing cards and accepting payments are separate product layers. Three models allocate the merchant contract and operating risk differently:

• PayFac uses a master MID, onboards sub-merchants and owns underwriting, monitoring, reserves and chargeback exposure.
• ISO distributes the acquirer's product; the acquirer contracts with and underwrites each merchant.
• Merchant of Record contracts with the buyer as the seller of record and therefore takes on payment acceptance together with invoicing, indirect tax, refunds and consumer claims.

Managed PayFac and PayFac-as-a-service sit between those endpoints: the platform controls more of the user journey while a licensed or registered provider supplies access and risk infrastructure. The canonical decision guide — contract chain, scheme rules, regulatory perimeter, economics and the fork for a marketplace, SaaS vertical or infrastructure platform — is PayFac, ISO and Merchant of Record: Who Carries the Risk in Acquiring.

The product decision comes first. Visa and Mastercard rules, payment-agent law, KYC/KYB, PCI DSS and tax treatment are constraints inside it. Decide who should own the merchant relationship, onboarding and losses, then choose the access model.

Recent regulatory shifts (2024–2026)

United States — after Synapse. The 2024 failure of BaaS middleware Synapse froze tens of millions in customer deposits across roughly 100 fintech programs once partner banks lost the ledgers that mapped end-user balances. The Federal Reserve hit partner bank Evolve with an enforcement action over AML and risk-management gaps, and Cross River, Blue Ridge and Lineage drew consent orders; sponsors now diligence partners far harder, because the bank's charter is the asset at risk.

European Union — PSD3 and the PSR. PSD2 and the e-money directive are being merged into one rulebook: PSD3 plus the directly-applicable Payment Services Regulation. The package is not law yet: the European Parliament's ECON committee approved the texts agreed in trilogue on 5 May 2026 (procedures 2023/0209(COD) and 2023/0210(COD)), both files are awaiting the Council's first-reading position, and the indicative plenary date is 14 December 2026 — so the application dates will only be fixed in the adopted texts. E-money issuance, safeguarding of customer funds and authorization move under a single regime.

The schemes tighten the frame. Mastercard set out new BIN-sponsorship guidelines in 2025 — clearer oversight, transparency on BIN assignments and defined roles for each party; Visa runs a formal BIN-sponsor partner track. Consolidation continues: Marqeta acquired the EMI BIN sponsor TransactPay to bundle program management across the UK and EEA.