Concept
BIN (Bank Identification Number) — the first digits of a card number; issued by payment schemes (Visa, Mastercard) only to their principal members — banks or licensed issuers. BIN sponsorship is access to someone else's BIN: a licensed scheme participant issues cards "on their paper," while a fintech builds a product on top of them without being a Visa or Mastercard member itself.
This is how neobanks and embedded financial products launch debit, prepaid, and credit cards. Card issuance is always a regulated activity (e-money issuance or bank account), so the BIN sponsor both holds the license and is responsible to the scheme.
🍓 Visa/Mastercard membership and responsibility to the scheme remain with the BIN sponsor. The fintech rents access, but the rules of the game — PCI-DSS, monitoring, collateral — are dictated by the sponsor and the scheme.
Card schemes run on a four-party model — cardholder, merchant, acquirer and issuer — and only principal members hold BINs and settle directly with Visa or Mastercard. Membership is capital- and compliance-heavy, so issuing was unbundled: program managers own the product and onboarding, issuer-processors run the technical rails, and a licensed sponsor lends its membership and BIN. That division is what lets a fintech ship a card in months instead of chartering a bank.
How It Works
The chain typically looks like this: principal member (bank or issuer — holds scheme membership and BIN) → program manager (runs the program, onboarding, part of compliance) → issuer-processor (technical transaction processing, authorization, ledger) → sponsored issuer, i.e., the fintech with the product, brand, and customer. The fintech can take some roles in-house if it has the license and scale.
Roles and Providers
- Principal member — bank or licensed issuer with Visa/Mastercard membership and its own BINs.
- Program manager — program operator; sometimes the sponsor itself, sometimes a separate company.
- Issuer-processor — the technical core of issuance: authorization, transaction processing and the ledger. Names: Marqeta, Galileo, Lithic, Highnote, i2c, Thredd (ex-GPS). Full profiles are in the "Issuer-Processors: The Catalog" section below.
- Sponsored issuer / fintech — owner of the product and customer experience.
Issuer-Processors: The Catalog
An issuer-processor is the technical engine of card issuing: it authorizes, clears, and settles transactions on the issuer side, runs the card lifecycle, and keeps the program ledger, answering the network in milliseconds. The processor supplies neither the license nor the BIN — but what once took a year and a heavy integration budget now takes a few weeks against a REST or GraphQL API, billed pay-as-you-go. The layer grew out of mainframes: FIS, Fiserv, and TSYS served banks on closed systems for decades until Marqeta moved the same function into an API in the early 2010s — card provisioning in minutes, just-in-time funding, a developer sandbox.
Who's who (mid-2026):
- Marqeta (NASDAQ: MQ) — the largest independent issuer-processor; debit, credit, and prepaid, strongest in the US. Cleared US$383 billion of processing volume in 2025 and reported its first GAAP-profitable quarter in early 2026; its 2025 acquisition of neobank TransactPay added BIN sponsorship and program management in the UK and EU.
- Galileo — bought by SoFi in 2020 for US$1.2 billion and run as SoFi's technology platform (rebranding to SoFi Tech Solutions); a Visa-certified processor behind a long roster of neobanks, expanding into sponsor banking on the Cyberbank core.
- Lithic — developer-first issuing from the US, built by the team behind Privacy.com; the pitch is API simplicity and speed to the first card, now processing over US$1 billion a month. Raised a Series C led by Stripes in 2025.
- Highnote — since January 2025 the rare platform to put issuing and acquiring behind a single API and one ledger; a 2025 Series B of US$90 million (ex-Braintree team) funded a push into US merchant acquiring and instant-payment rails (ACH, RTP, FedNow, stablecoin funding).
- i2c — a long-established, highly configurable platform with global coverage across debit, credit, and prepaid.
- Thredd — formerly Global Processing Services, rebranded in 2023; British roots, processing since 2007, Visa- and Mastercard-certified (both are investors alongside Advent International), strong across Europe and APAC in 40+ countries; entered the US debit and prepaid market in 2024.
- Pismo — a cloud-native issuer-processing and core-banking platform that Visa bought outright for US$1 billion in January 2024; the networks increasingly want to own the processing rails, not only sit above them.
- Stripe Issuing and Adyen Issuing — issuing folded into a wider payments platform; convenient when you already run there, less so when you want a sponsor-agnostic processor you can re-point later.
At the other pole sits the legacy infrastructure of FIS, Fiserv, and Global Payments (formerly TSYS), which still runs most of the world's banks. The market moved in 2025: FIS bought the issuer-processing business (former TSYS Issuer Solutions) from Global Payments for roughly US$13.5 billion, while Fiserv pushes toward merchants through Clover. Choosing a processor increasingly pulls in the surrounding ecosystem: billing, treasury, reconciliation.
Roles are increasingly combined by one provider — Marqeta covers BIN sponsorship and program management in Europe itself after TransactPay, Galileo is rolling out sponsor banking. That simplifies the contract but does not change the allocation of liability: the BIN and license holder answers to the network and the regulator, and the contract should fix explicitly who that is.
What to check when choosing a processor:
- Network certifications — Visa Ready / Mastercard and for the required products (debit, credit, prepaid).
- Geography — where the processor is certified: US, Europe, APAC. Thredd is strong internationally, Marqeta and Galileo in the US.
- Role combination — does the provider take on BIN sponsorship and program management, or only processing.
- Integration model and pricing — pay-as-you-go versus minimums; speed to go-live.
- Reliability — uptime, redundancy, tokenization, support for network updates.
What You Need to Launch
- Legal entity and license. Registered company and, depending on jurisdiction and product, an e-money issuer license (neobank) or neobank (PI) license — or operating under the sponsor's license.
- Compliance infrastructure. KYC/AML, transaction monitoring, dispute handling and chargeback processing.
- Infrastructure. Program manager + issuer-processor combination (or these functions in-house).
- Timeline. Around 3–6 months to launch through an established sponsor and processor.
- Cost. Setup fee, transaction fees, revenue share (portion of interchange), and collateral that the sponsor holds against settlement risk.
⚙️ The sponsor conducts due diligence and continuously supervises the sponsored partner — their license is at stake. Therefore, fintechs face capital, policy, and control requirements comparable to bank onboarding.
Compliance
PCI-DSS for card data processing; scheme rules (branding, limits, disclosures); AML and sanctions screening; settlement cycles and collateral; dispute management and fraud. Violation of scheme rules primarily impacts the sponsor — hence the strict requirements for partners.
Money movement is where sponsorship is won or lost. The sponsor settles with the scheme and holds collateral against the program's net settlement exposure, while customer funds must be safeguarded — ring-fenced under the EU and UK e-money regime, or held in for-benefit-of accounts at the sponsor bank in the US. Clean reconciliation and an accurate ledger of end-user balances are not paperwork: when Synapse's ledgers failed, partner banks could not tell whose money was whose.
Applicable Regulation
Visa and Mastercard card schemes operate under private membership rules, with the licensing regime of the specific market underneath. In the EU and UK, this is the e-money issuance and payment services regime — see agents and passporting in payments; in the US, card issuance goes through a sponsor bank — see the BaaS guide, which now also covers US sponsor banks. The general framework for embedded financial services is in embedded finance (McKinsey: embedded finance and BaaS).
Outside the EU, UK and US the pattern repeats under local licences. Singapore issues e-money and card programs under the Payment Services Act (see Singapore PSA); Hong Kong runs prepaid and wallet issuance through a stored-value facility licence (see HK neobank licence); and many programs anchor their European issuing in an neobank, the route Marqeta bought with TransactPay. The sponsor's home regime sets safeguarding, capital and reporting, and the scheme rules sit on top everywhere.
FAQ
Can you issue cards without your own license?
Yes, through a BIN sponsor. But the regulated infrastructure (e-money issuance or account) and responsibility remain with the sponsor, while part of the requirements fall on the fintech.
What's the difference between program manager and issuer-processor?
Program manager is responsible for the program and compliance, issuer-processor — for technical transaction processing. Sometimes these are different companies, sometimes the functions are combined.
When should you become a principal member yourself?
When volumes and margins justify the membership fee, collateral, and your own compliance — typically with large card portfolios.
How does an issuer-processor differ from a BaaS platform?
A BaaS platform (middleware) wraps accounts, payments, and orchestration around a sponsor bank; the issuer-processor is the narrow piece that processes card transactions. They usually sit side by side — see the BaaS guide.
Can you switch processors later?
Yes, but it is a BIN program migration: token transfer, re-certification with the network, and downtime. Choosing well at the start is far cheaper than re-platforming.
When to choose PayFac over ISO?
When you need fast onboarding under your own brand and control over the experience, and you're ready to bear the risk and compliance. ISO is suitable if you want to sell acquiring without transactional risk.
Who pays for chargebacks in the PayFac model?
The PayFac covers sub-merchant chargebacks from their proceeds, then from the rolling reserve; if a sub-merchant disappears, the PayFac closes the gap and answers to the acquiring bank for the entire master MID.
Economics: rent versus build
Economics drive the build-versus-rent decision. A sponsored program earns a share of interchange — capped in the EU at 0.2% on debit and 0.3% on credit, and set in the US for large issuers at about $0.21 plus 0.05% per debit transaction under Regulation II — and pays the sponsor a setup fee, per-transaction fees and a revenue share, while posting collateral against settlement risk. Renting a BIN buys months instead of the years that principal membership and direct scheme certification take; once volumes cover the membership fee, the collateral and an in-house compliance stack, issuers start bringing the BIN in-house.
Acquiring: PayFac vs ISO
A card program is not only issuance: card acceptance follows the same rent-the-access logic. Both PayFac (payment facilitator) and ISO (independent sales organization) let a platform accept cards without becoming an acquirer itself. The difference is who holds the merchant account and who bears the risk. A PayFac obtains one master merchant account (master MID) from an acquiring bank and onboards multiple sub-merchants under it, underwriting them itself and carrying the risk; an ISO brings merchants to the acquirer and steps aside — each merchant gets its own MID, and the transactional risk stays with the bank.
The model grew out of aggregators: PayPal in the early 2000s and Square in 2009 put thousands of micro-sellers under one shared account and took on their vetting; in the early 2010s Visa and Mastercard formalized the payment facilitator role — with program registration, rules, thresholds, and reporting (see Visa Payment Facilitator Model).
The difference in short:
- Merchant account — PayFac: one master MID with sub-merchants under it. ISO: a separate MID for each merchant.
- Onboarding — PayFac: fast, within the platform. ISO: through bank underwriting.
- Underwriting and risk — PayFac: on itself (chargebacks, fraud, merchant default). ISO: on the acquiring bank; the ISO only sells.
- Margin and control — PayFac: higher margin and control over the experience, but requires compliance and reserves. ISO: simpler and lighter, but less margin and control.
Becoming a PayFac takes an agreement with an acquiring bank and a master MID, registration in the Visa and Mastercard Payment Facilitator programs, and your own sub-merchant underwriting: KYC/KYB, transaction monitoring, chargeback and reserve management. The middle path is managed PayFac / PayFac-as-a-service (Stripe Connect, Adyen for Platforms, Finix, Payrix, Infinicept): the provider's master MID and risk infrastructure, your brand and onboarding. Classic PayFacs — Square, Stripe, PayPal, Adyen — hide all underwriting inside the platform; vertical services work the same way (Shopify Payments in e-commerce, Toast in restaurants, Mindbody in fitness). High-risk verticals — gambling, travel, adult — stand apart: more chargebacks, and not every PayFac or acquiring bank takes that traffic.
In the EU and UK the labels change but the risk does not: payment facilitation is a card-network program, not a European authorisation — you acquire as a neobank or as the agent of one under PSD2 (from roughly mid-2027, under PSD3 and the PSR), see payment agents in EU/UK. Payment facilitators are projected to clear more than USD 4 trillion in card volume by 2025, and for most platforms the real question has shifted from PayFac versus ISO to build versus managed PayFac versus reseller.
Recent regulatory shifts (2024–2026)
United States — after Synapse. The 2024 failure of BaaS middleware Synapse froze tens of millions in customer deposits across roughly 100 fintech programs once partner banks lost the ledgers that mapped end-user balances. The Federal Reserve hit partner bank Evolve with an enforcement action over AML and risk-management gaps, and Cross River, Blue Ridge and Lineage drew consent orders; sponsors now diligence partners far harder, because the bank's charter is the asset at risk.
European Union — PSD3 and the PSR. PSD2 and the e-money directive are being merged into one rulebook: PSD3 plus the directly-applicable Payment Services Regulation. EU legislators reached provisional agreement in November 2025, with publication expected around mid-2026 and application roughly 21 months later (to be verified). E-money issuance, safeguarding of customer funds and authorization move under a single regime.
The schemes tighten the frame. Mastercard set out new BIN-sponsorship guidelines in 2025 — clearer oversight, transparency on BIN assignments and defined roles for each party; Visa runs a formal BIN-sponsor partner track. Consolidation continues: Marqeta acquired the neobank BIN sponsor TransactPay to bundle program management across the UK and EEA.
This material is prepared as an expert overview and does not constitute individual legal advice.