Card Program: BIN Sponsorship, Issuer-Processor and PayFac vs ISO

Concept

BIN (Bank Identification Number) — the first digits of a card number; issued by payment schemes (Visa, Mastercard) only to their principal members — banks or licensed issuers. BIN sponsorship is access to someone else's BIN: a licensed scheme participant issues cards "on their paper," while a fintech builds a product on top of them without being a Visa or Mastercard member itself.

This is how neobanks and embedded financial products launch debit, prepaid, and credit cards. Card issuance is always a regulated activity (e-money issuance or bank account), so the BIN sponsor both holds the license and is responsible to the scheme.

Visa/Mastercard membership and responsibility to the scheme remain with the BIN sponsor. The fintech rents access, but the requirements — PCI-DSS, monitoring, collateral — are set by the sponsor and the scheme.

Card schemes run on a four-party model — cardholder, merchant, acquirer and issuer — and only principal members hold BINs and settle directly with Visa or Mastercard. Membership is capital- and compliance-heavy, so issuing was unbundled: program managers own the product and onboarding, issuer-processors provide the technical processing, and a licensed sponsor lends its membership and BIN. This division allows a fintech to launch a card in months instead of obtaining a bank charter.

How It Works

The typical structure is: principal member (bank or issuer — holds scheme membership and BIN) → program manager (runs the program, onboarding, part of compliance) → issuer-processor (technical transaction processing, authorization, ledger) → sponsored issuer, i.e., the fintech with the product, brand, and customer. The fintech can take some roles in-house if it has the license and scale.

Roles and Providers

• Principal member — bank or licensed issuer with Visa/Mastercard membership and its own BINs.
• Program manager — program operator; sometimes the sponsor itself, sometimes a separate company.
• Issuer-processor — the technical infrastructure for issuance: authorization, transaction processing and the ledger. Names: Marqeta, Galileo, Lithic, Highnote, i2c, Thredd (ex-GPS).
• Sponsored issuer / fintech — owner of the product and customer experience.

Issuer-Processing Providers

An issuer-processor is the technical platform for card issuing: it authorizes, clears, and settles transactions on the issuer side, runs the card lifecycle, and keeps the program ledger, answering the network in milliseconds. The processor supplies neither the license nor the BIN — but modern platforms have turned what used to be a long bank-grade integration into work against an API, often billed pay-as-you-go. Historically, issuer processing relied on mainframes: FIS, Fiserv, and TSYS served banks on closed systems for decades until API-first processors such as Marqeta moved the same function into an API — card provisioning in minutes, just-in-time funding, a developer sandbox.

Major providers as of mid-2026:

• Marqeta (NASDAQ: MQ) — a leading independent issuer-processor for debit, credit and prepaid, strongest in the US. Total processing volume on its platform was US$382.5 billion in 2025. The acquisition of TransactPay, closed on 31 July 2025, brought e-money institution licences and BIN sponsorship in the UK, Gibraltar and the EEA.
• Galileo — bought by SoFi in May 2020 for US$1.2 billion and part of SoFi's technology platform, processing for fintech and bank clients; since 2024 SoFi has used its Cyberbank core for a sponsor-bank program.
• Lithic — developer-first issuing from the US that grew out of Privacy, a virtual-card service founded in 2014 whose own legacy processor could not keep up; its focus is API simplicity and speed to the first card.
• Highnote — a US platform that puts issuing, acquiring, credit programs, money movement and real-time ledgering on one platform.
• i2c — a long-established, highly configurable platform with global coverage across debit, credit, and prepaid.
• Thredd — formerly Global Processing Services; its UK operating company was renamed Thredd UK Limited in April 2023. A British issuer-processor.
• Pismo — a cloud-native issuer-processing and core-banking platform that Visa acquired in January 2024 for a purchase consideration of US$929 million; the networks increasingly seek ownership of processing infrastructure alongside their network operations.
• Stripe Issuing and Adyen Issuing — issuing within a wider payments platform; convenient for existing users of the platform, but less convenient when a company seeks a sponsor-agnostic processor that can be redirected later.

Another part of the market consists of the legacy bank-processing infrastructure of FIS, Fiserv and the former TSYS issuer business. The market changed in 2025: in April FIS agreed to buy the Issuer Solutions business (the former TSYS issuer processing) from Global Payments on a US$13.5 billion enterprise valuation, and the deal closed on 9 January 2026. Choosing a processor increasingly determines the associated infrastructure: billing, treasury, reconciliation.

Roles are increasingly combined by one provider — Marqeta covers BIN sponsorship and program management in Europe itself after TransactPay, SoFi has launched a sponsor-bank program on its technology platform. That simplifies the contract but does not change the allocation of liability: the BIN and license holder answers to the network and the regulator, and the contract should fix explicitly who that is.

What to check when choosing a processor:

• Network certifications — Visa Ready / Mastercard and for the required products (debit, credit, prepaid).
• Geography — where the processor is certified and already live: US, Europe, APAC.
• Role combination — does the provider take on BIN sponsorship and program management, or only processing.
• Integration model and pricing — pay-as-you-go versus minimums; speed to go-live.
• Reliability — uptime, redundancy, tokenization, support for network updates.

Launch Requirements

• Legal entity and license. Registered company and, depending on jurisdiction and product, an e-money issuer license (neobank) or payment institution (PI) license — or operating under the sponsor's license.
• Compliance infrastructure. KYC/AML, transaction monitoring, dispute handling and chargeback processing.
• Infrastructure. Program manager + issuer-processor combination (or these functions in-house).
• Timeline. Set mostly by the sponsor's due diligence and scheme certification, not by the API integration.
• Cost. Setup fee, transaction fees, revenue share (portion of interchange), and collateral that the sponsor holds against settlement risk.

Compliance

PCI-DSS for card data processing; scheme rules (branding, limits, disclosures); AML and sanctions screening; settlement cycles and collateral; dispute management and fraud. Violation of scheme rules primarily impacts the sponsor — hence the strict requirements for partners.

Money movement is a critical component of sponsorship. The sponsor settles with the scheme and holds collateral against the program's net settlement exposure, while customer funds must be safeguarded — ring-fenced under the EU and UK e-money regime, or held in for-benefit-of accounts at the sponsor bank in the US. Accurate reconciliation and an accurate ledger of end-user balances are essential: when Synapse's ledgers failed, partner banks could not tell whose money was whose.

Applicable Regulation

Visa and Mastercard card schemes operate under private membership rules, alongside the licensing regime of the specific market. In the EU and UK, this is the e-money issuance and payment services regime — see payment agents and passporting; in the US, card issuance goes through a sponsor bank — see the BaaS guide, which also covers US sponsor banks. Embedded financial services are described in the embedded finance guide.

Outside the EU, UK and US the pattern repeats under local licences. Singapore issues e-money and card programs under the Payment Services Act (see Singapore PSA); Hong Kong runs prepaid and wallet issuance through a stored-value facility licence (see HK SVF licence); and many programs anchor their European issuing in an EMI, the route Marqeta bought with TransactPay. The sponsor's home regime sets safeguarding, capital and reporting, and the scheme rules sit on top everywhere.

Cases

The most prominent neobanks use this model. Chime issues debit cards through The Bancorp Bank and Stride Bank — both under $10 billion in assets, both Durbin-exempt. The Cash App prepaid card from Block is issued by Sutton Bank, and Marqeta manages the card program. In the EU and UK, fintechs typically start on a third-party issuer-processor and a sponsor's licence and, as volumes grow, add their own licences and scheme memberships. Examples of embedded financial products are covered in embedded finance, the "Cases" section.

Economics: rent versus build

Economics drive the build-versus-rent decision. A sponsored program earns a share of interchange — capped in the EU at 0.2% on debit and 0.3% on credit, and set in the US for issuers with $10 billion or more in assets at 21 cents plus 5 basis points per debit transaction, with a further one-cent fraud-prevention adjustment, under Regulation II (12 CFR §§ 235.3–235.5) — and pays the sponsor a setup fee, per-transaction fees and a revenue share, while posting collateral against settlement risk. Renting a BIN buys months instead of the years that principal membership and direct scheme certification take; once volumes cover the membership fee, the collateral and an in-house compliance stack, issuers start bringing the BIN in-house.

Acquiring: PayFac, ISO and Merchant of Record

Issuing cards and accepting payments are separate activities. Three models allocate the merchant contract and operating risk differently:

• PayFac uses a master MID, onboards sub-merchants and owns underwriting, monitoring, reserves and chargeback exposure.
• ISO distributes the acquirer's product; the acquirer contracts with and underwrites each merchant.
• Merchant of Record contracts with the buyer as the seller of record and therefore takes on payment acceptance together with invoicing, indirect tax, refunds and consumer claims.

Managed PayFac and PayFac-as-a-service occupy an intermediate position between those models: the platform controls more of the user journey while a licensed or registered provider supplies access and risk infrastructure. The contract chain, scheme rules, regulatory perimeter, economics and model selection for a marketplace, SaaS vertical or infrastructure platform are described in PayFac, ISO and Merchant of Record: Who Carries the Risk in Acquiring.

The product decision comes first. Visa and Mastercard rules, payment-agent law, KYC/KYB, PCI DSS and tax treatment are constraints inside it. Selection of an access model follows allocation of the merchant relationship, onboarding responsibilities and losses.

Recent regulatory shifts (2024–⁠2026)

United States — after Synapse

BaaS middleware provider Synapse filed for Chapter 11 on 22 April 2024. According to the CFPB, partner banks found US$60–90 million less in customer funds than Synapse's records showed, and consumers had no access to their money for weeks or months. On 14 June 2024 the Federal Reserve issued an enforcement action against partner bank Evolve over deficiencies in its anti-money-laundering, risk-management and consumer-compliance programs. The FDIC's Recordkeeping for Custodial Accounts rule, published in the Federal Register on 2 October 2024, is still only a proposal. Sponsors now diligence partners far harder, because the bank's charter is the asset at risk.

European Union — PSD3 and the PSR

PSD2 and the e-money directive are being merged into one rulebook: PSD3 plus the directly-applicable Payment Services Regulation. The package is not law yet: the Council and Parliament have agreed the texts in interinstitutional negotiations, the European Parliament's ECON committee approved them on 5 May 2026 (procedures 2023/0209(COD) and 2023/0210(COD)), both files are awaiting the Council's first-reading position, and the indicative plenary date is 14 December 2026 — so the application dates will only be fixed in the adopted texts. Once adopted, the package would bring e-money issuance, safeguarding of customer funds and authorization under a single regime.

Tightening of Scheme Requirements

Scheme rules make the BIN sponsor answerable for every program issued on its BINs, so sponsors push network requirements down to program managers and fintechs through contracts, audits and collateral. Consolidation continues: Marqeta's purchase of TransactPay, closed in July 2025, bundled BIN sponsorship and program management across the UK, Gibraltar and the EEA.