Key concepts

A card has at least three legal identities behind it, and embedded issuing adds a fourth. The network member is the bank, the issuer of record. The program manager is the bank's registered agent; Visa calls it a Third Party Agent and needs a separate registration for each bank relationship. Then there's the cardholder, and on a platform, the business customer whose workers or users get the cards.

With the platform's logo on the front, the bank is still the issuer, named in the cardholder agreement and liable to Visa. Adding another sponsor bank means another agent registration, another contract, another set of audits and probably another design approval.

Prepaid adds a role. FinCEN's prepaid access rule has each program name one "provider of prepaid access" by contract, which registers as a money services business. A bank can't be that provider, but where a bank has "primary oversight and control" of the program, nobody has to register, and most banking-as-a-service contracts are written that way.

The card itself has two identities: the card number, in an account range inside the bank's BIN, and the network tokens that wallets and merchants store in its place. Visa assigns responsibility for a token to the bank behind the BIN, so tokens follow the bank.

A check I'd run early on: is the same legal entity named as issuer on the card, in the cardholder agreement and in any FinCEN registration? It usually is; when it isn't, I'd find out why before launch.

Card states get all the attention: ordered, personalized, shipped, unactivated, active, suspended, terminated or expired, reissued. Program states matter as much, and few systems model them: contracted, go-live, launched, under order, winding down.

A program can be "launched" and frozen at the same time. When the Fed put Evolve under a cease-and-desist in June 2024, the bank couldn't take a new fintech partner, product or program manager without its regulators' prior approval. Programs on it stayed live but couldn't change, and their roadmaps waited on someone else's examiner.

The bank has a state too. Its Durbin status is measured on assets at the end of each calendar year, and a bank that crosses $10 billion must apply the cap by July 1 of the next year. That gives a program about six months to reprice or move once the year-end numbers are in.

Network rules move card states too: Visa's longer maximum expiry for prepaid cards, from July 25, 2026, changes reissue planning on long-lived payroll cards.

A reissue during a migration changes the card number, and cards stored at merchants break unless tokens or the network's account updater carry the new number over.

A cardholder's balance lives in four places, and they have to tie every day:

• The bank's core: the total in the pooled (FBO, "for the benefit of") account.
• The processor: the authorization balance, or open-to-buy, used to approve the next purchase.
• The program's ledger: the per-person sub-ledger that says who owns what.
• The network's settlement reports: what was actually cleared and owed.

The daily check is simple to say: the sum of every user's balance, plus pending items, equals the pooled account balance, give or take items in transit.

Synapse is the case to know. In May 2024 its partner banks froze about $219 million "due to financial ledger reconciliation issues", and the bankruptcy trustee later reported that a gap between what the banks held and what Synapse's ledger said existed before the bankruptcy; estimates ran from $65 million to $95 million. The ledger sat on MongoDB and AWS, and the trustee lost access to systems when the staff who held the credentials were let go. The CFPB later paid $46.2 million from its penalty fund to the people affected.

Pass-through deposit insurance didn't help, because it covers the bank failing and Synapse wasn't a bank. Money held in an agent's name is insured as if each owner held it, provided the bank's records disclose the arrangement and each owner's share can be worked out from the bank's or the agent's records. If the ledger is wrong or unreachable, the money sits frozen at a solvent bank.

In September 2024 the FDIC proposed a rule for these custodial accounts: per-owner records in a standard file, daily reconciliation, direct access to records an outside company keeps even if it goes bankrupt, and a yearly certification by a senior officer, at about $250 million across 600 to 1,100 banks in the first year. It has no date on the regulatory agenda, and I found no final rule as of October 6, 2026. Banks ask for most of it by contract anyway; a law firm's August 2026 summary lists real-time, auditable ledger reconciliation among sponsor banks' standard demands.

My test for any program: if the ledger vendor went dark tonight, could the bank pay every cardholder tomorrow from data it already holds?

Rules reach a program in three layers: network rules, then the bank's policy, then your own. The bank's is usually the one you work to day to day, and it often repeats the network's rules with stricter numbers.

What Visa writes onto the bank, which the bank passes to you:

• The bank must control approval of cardholder applications, and can't approve an agent just because the contract limits the bank's liability.
• For prepaid, the bank needs Visa's approval before launch, must hold all card funds and agent reserves in an account it controls, and keeps reserves for program losses. It completes a prepaid risk self-assessment at entry and every year, and Visa can review the program at the bank's cost.
• An agent's contract must give Visa audit rights, and the agent must hand cardholder data to Visa or regulators within seven business days when asked.
• Visa can block a BIN used for a purpose it didn't approve, and can refuse an agent registration "with or without cause".

The bank adds prohibited program types, how deep identity checks go, approved vendors, reserves, minimums, and approval of every product change. Chime's filing puts the balance plainly: the banks approve each program, and Chime designs it, negotiates terms and picks vendors, "subject to the requirements of the banks and applicable card networks".

Some policy choices are yours, and they're product decisions. Reg E lets an issuer withhold error resolution and limited liability on a prepaid account until it has finished verifying the customer's identity, so when you run identity checks decides which protections a cardholder has on day one. The checks themselves are in Identity and trust.

When a requirement lands on your desk, I'd ask whether it's a law, a network rule or the bank's risk appetite. That tells you who can change it, and usually only the last is open to negotiation.

Most of the money in a card program depends on dates someone else sets. These are the ones I'd keep on a calendar as of October 2026:

Contract dates matter as much: notice windows (180 or 365 days), minimum-fee step-ups, exclusivity periods and the right to terminate if the bank loses its Durbin exemption, which The Bancorp's filing says some of its agreements allow.

A neobank whose bank sits at $9.6 billion in assets in September should be modelling two scenarios for the following July. If the bank ends the year above $10 billion, debit interchange drops to the cap within about six months, and the contract decides whether the program can move first.

A program touches more standards than it builds against directly.

• Messages. Networks and processors talk ISO 8583; the program usually sees the processor's own webhooks and API, covered in the later guide on authorization.
• Chip and contactless. EMVCo's specifications, which the card maker and processor implement.
• Card data security. PCI DSS v4.0.1 applies to anyone who stores, processes or could touch a full card number. Card-issuing platforms show the number inside their own hosted frames, so the program's servers never see it; support tools, logs and push-provisioning payloads can still pull you into scope.
• Card production. PCI's Card Production and Provisioning standard, physical and logical. Visa requires manufacturers, personalizers and fulfilment vendors to be Visa-approved and listed on its registry of service providers.
• Tokens. EMV Payment Tokenisation, run by Visa Token Service and Mastercard MDES. In the US, Visa requires its token service for card-absent use on consumer BINs, and an "Active" issuer must keep a monthly token provisioning approval rate of at least 90% per BIN.

Interchange depends on interfaces too. The rate a transaction qualifies for depends on data in the authorization and clearing messages, such as whether the card was present or tokenized, so a processor that drops a field can cost the program interchange.

Most of a program's counterparties can stop it.

Concentration runs in both directions. Chime runs on two banks. Marqeta said 64% of its 2025 volume settled through one bank, Sutton, and Block was 45% of its revenue. CompoSecure got 63% of its 2024 sales from two issuers, and The Bancorp's top three partners brought it 59% of its fintech fees. When one side leaves, the other side's numbers move: Galileo's segment revenue fell by about a quarter year on year after its large client left.

Early on I'd write down which single vendor failure stops new card issuance, and which stops cardholders spending; the second list is shorter and scarier.

Separate the layers, because each binds a different party and has a different enforcer.

For most US programs, the bank's policy is what binds day to day, and it carries the other layers down to you. A program manager acting as the bank's agent usually stays out of state money transmitter licensing, but holding customer money outside the bank pulls it back in; I'd check each state with counsel.

Abroad the layers sit differently. In the UK and EU a fintech can be an e-money institution and a principal network member, so the safeguarding duty lands on it directly. In Canada, payment service providers register with the Bank of Canada under the RPAA; about 300 made its opening batch, KOHO among them.

The test I'd apply to any obligation: would it survive if we changed banks? Law and network rules would; most of the bank's policy wouldn't, and the next bank brings its own.

The exceptions that cost the most in card issuing are program-level ones, and they run on long clocks.

Two smaller reversals hit the profit and loss of every program. A refund on a debit card returns no interchange to the issuer, so the program loses its interchange on that sale. And an ATM withdrawal runs the other way: the issuer pays the ATM's bank $0.30-0.60 in interchange, plus network fees, so a "free ATMs" promise costs money on every withdrawal.

I'd want both banks' contracts to say who handles a chargeback on an old-BIN card three months after the migration.

The network makes the bank liable, the bank pushes the liability to the program by contract, and when the program can't pay, the bank or the cardholder ends up holding it.

Coastal Community Bank showed how the backstop works in 2026. One credit partner's guarantee fell short, and Coastal booked $68.8 million in the April-June quarter, mostly a write-down of the partner's credit-enhancement asset, on a consumer portfolio of about $500 million. The contract put the loss on the partner; the partner couldn't pay, so the bank took it.

On debit fraud, the Fed's 2023 data has issuers bearing about 28% of losses, and for a program that share arrives as a contract line. Every relaxed setting (instant approval, instant loads, skipped checks) is also a decision about who absorbs the next loss.