Card issuing in 1,000 words
A card isn't a payment, but a chain of promises. How do card issuing and payments work, how is the card stack evolving, and why are so many fintechs building on cards today?
This is an installment of the “Fintech in 1,000 words” series, where we break down core fintech topics, like cross-border payments, interchange, payfacs, stablecoins, and real time payments. These introduce critical but mis- or under-understood topics to people working or interested in fintech. It’s not an exhaustive guide, but the gentle introduction and overview I wish I had earlier.
“Money is not metal. It is trust inscribed.”
Niall Ferguson, The Ascent of Money
Cash is easy to trust. You walk into a grocery store, fill your cart, and hand the cashier a $100 bill. As long as the bill is real, the exchange is concluded. The trust is in the physical thing itself.
But few pay that way anymore. Most people wave a slab of plastic or their phone over a blinking machine and walk out. Same result, but the tap1 is an IOU backed by a chain of strangers. That these strangers almost always do honor it, in under a second, anywhere on Earth, is one of the most taken-for-granted marvels of modern infrastructure.
A card is a chain of promises
Five players connect billions of buyers and sellers. The networks (Visa, Mastercard) are the center, managing the chain’s rules, tech, and incentives. Networks partner with banks2 to extend their reach: issuers are banks that onboard and support cardholders, while acquirers do the same with merchants.
The chain works because each link only has to cosign its neighbors. Cardholders only need a relationship with the issuer. Issuers only need a relationship with networks. The networks don’t work with cardholders or merchants directly, only with issuers and acquirers.
The chain’s first job is moving promises, not money. The promise layer is called authorization: when you tap, the question “is this cardholder good for $100?” is routed through the chain to your bank, and your bank returns an answer to the merchant. The money follows a day or two later, in a slower process called settlement.
Different cards, different promises, different fees
Every tap is a promise made by the issuer, and the kind of card depends on what immediately backs that promise.
With debit cards, the cardholder’s money immediately backs the promise. The funds sit in their bank account, and the issuer makes them reachable at the tap.
Prepaid is backed by stored value, a pool of funds loaded ahead of the tap (payroll cards, gift cards, government benefit cards). Other prepaid programs use just-in-time (JIT) funding, which pushes balance at auth instead of pre-loading. DoorDash drops the order cost onto a dasher’s card right before they tap.
With credit cards, the issuer’s money immediately backs the promise. The issuer fronts the money on its own balance sheet, and the cardholder pays it back later. If the cardholder carries a balance (also called revolving), they pay interest on the outstanding amount, expressed as an annual percentage rate (APR).
Charge cards are a flavor of credit with revolving traditionally turned off and repayment required at the end of the statement cycle.3 The promise is backed by the issuer’s capital extended at the moment of the tap.
Same tap, but very different businesses. Debit and prepaid have little receivable to fund. Credit and charge turn the issuer into a lender, with greater risk, capital requirements, regulatory and ops burden.
Credit’s greater risk and complexity come with greater fees. Cards monetize that directly through interchange.
The “2.9% + $0.30” is the merchant’s fee, not interchange. Interchange is only the issuer’s slice. The rest goes to the network and the acquirer (see “Interchange in 1,000 words”).
On a $100 consumer credit transaction, the merchant pays roughly $3.20, split among the issuer, network, and acquirer:
Credit incurs higher interchange fees than debit4; commercial cards are higher than personal. Network, merchant type, currency, and many other factors influence pricing.
Interchange is the foundation of issuer economics, but it’s only one piece. Credit programs also earn from interest income, annual fees, and ancillary fees. Revolving-heavy portfolios (Capital One, Discover, store-card private label) are driven primarily by interest income. Net interest margin (NIM) is the spread between yield on receivables and the issuer’s cost of funds. Transactor-heavy premium portfolios (Sapphire Reserve, Amex Platinum) lean more on interchange, annual fees, and partner economics. Debit’s slimmer margins push programs toward broader product suites.
A tap is a question
How does a tap turn into a question (”is this good for $100?”) that gets answered in milliseconds? The chain runs the request in seven steps.
The cardholder taps. The merchant’s terminal bundles up the card details (PAN, amount, merchant info)5 and sends them to the acquirer.
The acquirer validates the request, runs its own fraud checks, and forwards it to the network.
The network reads the BIN (the PAN’s first 6-8 digits that identify the issuer) and routes the request to that issuer.
The issuer checks balance, merchant category, and fraud signals. If everything passes, the issuer vouches and “Approved” flashes back through the chain to the merchant. The cashier hands over the groceries.
No money has moved yet. Clearing and settlement happen quietly over the next day or two.6
The issuer’s three jobs
What’s actually happening inside the issuer? Open it up and you find work at three levels:
Transaction-level runs at every tap: accounting (is there money to back this?) and rules (should I vouch for this one?). Accounting tracks balances across debit, credit, and prepaid. Rules cover limits, merchant categories, velocity, and fraud.
Cardholder-level covers everything tied to an individual cardholder. Marketing and onboarding get cardholders a working card (sign-ups, KYC, delivery). Underwriting (credit and charge only) decides who gets a card and at what terms. Support, disputes, and fraud ops handle what goes wrong, one cardholder at a time.7
Program-level applies across every card in the program. Capital funds the credit and charge receivables (balance sheet, warehouse, or sponsor bank). The regulatory backstop: the licensed entity accountable to regulators, holding the charter, BIN, and loss liability.
Of the three, the transaction-level runtime is the thinnest and most codified. That’s where the unbundling started.
Issuers bundle, unbundle, then repeat
For most of card history, these three processes lived inside one building. Banks like Chase and Wells Fargo owned the whole stack.
Marqeta cracked it open by giving the transaction-level runtime a modern API. An API-first processor paired with a sponsor bank let fintechs run accounting and rules programmatically while the bank held the charter. Each level of the stack moved to a different specialist:
Program manager. The cardholder-level operations. Acquisition, onboarding, underwriting, support, disputes, and the cardholder-facing brand.
Issuer processor. The transaction-level runtime. Direct network connections, accounting, and rules as an API.
Sponsor bank. The program-level backstop. Holds the charter, the BIN, the network license, and ultimate regulatory liability. For credit and charge, often also funds receivables.
The program manager (the fintech with the brand and the cardholder relationship) typically captures the largest single share of the economics. How much depends on rewards, fraud, credit losses, and sponsor terms. Enough, in most cases, to flip who owns the customer.
After Synapse,8 the stack is partially re-bundling. Tech-forward sponsor banks like Column and Newline are keeping compliance, ledgering, and money movement in-house. Processors have split: Lithic doubled down on the pure-processor layer; Highnote moved toward consolidating program-manager functions. The Marqeta-era unbundling has been narrowed by what 2024 taught about who holds the keys to the customer’s money.
Four winning models for cards
Startups are building successful products, and sometimes whole companies, on this infra. Four shapes dominate. Read the chart left to right as a spectrum: in the first column the card is the whole bet and by the last, the card is one feature inside a software product that monetizes elsewhere.
The first two columns look alike but they’re different businesses.
ICP-focused plays are credit or charge products built on one situation-specific insight. Bilt = rent volume, Aven = home equity, Atlas = scarce access. Strip the insight and the product collapses. High LTV, low-millions customer count, heavy capital.
Deposit-focused plays are commodity banking with no fees and a better app, sold into a demographic incumbents serve badly. The product is roughly the same across providers. The moat is brand, distribution, and Durbin-exempt sponsor economics that earn 4-5x the interchange of a regulated issuer. Low LTV, tens of millions of customers, capital-light.
The shapes differ underneath. What they share is harder to copy than the card.
Distribution advantage. Every winner starts with one: a pre-existing customer base (Toast, Shopify), a tight segment (Bilt, Aven, Atlas), a defined vertical (Brex, Ramp), or a demographic incumbents serve badly (Chime, Cash App). The general-purpose bank is nobody’s best option anymore.
Programmatic integration. Modern cards are software interfaces, not just payment methods. They plug into expense workflows, enforce category limits, push just-in-time funding, and feed transaction data back to the platform. The card becomes a product surface.
Asymmetric data. Toast sees restaurant cash flow in real time, Ramp sees the corporate spend graph, Chime sees who’s actually living paycheck-to-paycheck, Bilt sees rent payment behavior. Each platform knows things a traditional issuer doesn’t. Different shapes turn the data into underwriting fuel, segment-specific UX, or software upsell, but the asymmetry is universal.
Processing is increasingly API-accessible. Charter access and capital are constrained, and getting more so. Durable differentiation for fintechs sits in distribution, proprietary data, underwriting, workflow integration, and servicing.
Cards are dead, long live cards
Cards come with real drawbacks (interchange fees, fraud, chargebacks, rigid auth flows) and they keep winning anyway. Every major wave of consumer and business technology has extended cards instead of replacing them.
Each tech wave forced cards to evolve. The internet pushed cards into card-not-present commerce. Smartphones pushed cards into wallets and tokens. SaaS pushed cards into API-accessible issuance and virtual cards. Stablecoins are pushing cards into new settlement layers. AI is pushing cards into agentic protocols. Each wave was also supposed to end cards. Cards absorbed every wave and came out bigger.
Two new waves extend the pattern. AI agents introduce a new initiator the chain wasn’t built for. The issuer now has to answer questions harder than “is Sarah good for $100?” Is this Sarah’s agent? Is it inside Sarah’s policy? Who eats the loss if it isn’t? Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay are early attempts to encode delegated authority, intent, and liability into the chain. Stablecoins are starting to handle settlement on some flows. The vouching chain stays the same. The chain is the moat. The tender is plumbing.
My name is Matt Brown. I’m a partner at Matrix, where I invest in and help early-stage fintech and vertical software startups. Matrix is an early-stage VC that leads pre-seed to Series As from an $800M fund across AI, developer tools and infra, fintech, B2B software, healthcare, and more. If you’re building something interesting in fintech or vertical software, I’d love to chat: mb@matrix.vc
Shorthand for any card initiation. Swipe, dip, and key-in all work the same way.
Visa and Mastercard are four-party networks where the issuer is a separable link. Amex and Discover are closed loops: the network is also the issuer, no slot for a sponsor bank. Every unbundled fintech stack runs on V/MC by structural necessity.
The line has blurred: Amex Green and Gold now offer Pay Over Time revolving. Brex and Ramp don’t charge APR to the cardholder but still finance receivables via warehouse lines or balance sheet. The float has to come from somewhere.
The Durbin Amendment (2010, Dodd-Frank) caps debit interchange for $10B+ asset issuers at ~21¢ + 5 bps + 1¢ fraud adjustment, far below the 1.5–2.0% credit range. Smaller “exempt” issuers are uncapped; many prepaid programs escape the cap too. This is why fintech debit programs run on sponsor banks like Pathward, Sutton, Coastal, or Lead Bank rather than JPMorgan or Wells. Picking a sub-$10B sponsor is a literal interchange-economics decision.
For Apple Pay or Google Pay, the terminal receives a network-generated token (DPAN) instead of the real PAN; the network maps it back to the PAN at authorization. Tokenization is now the default for mobile wallets.
Not literally cash. Over 1–2 business days, the auth becomes a clearing record; settlement then moves net funds between banks. Chargebacks can still shift liability for weeks or months after. “Trust like cash” captures the moment of the tap, not the eventual finality.
Reg E (debit) gives the issuer 10 business days to investigate, or 45 if it provisionally credits the cardholder. Reg Z (credit) gives the cardholder 60 days from statement. The issuer files a chargeback; the merchant representments or eats the loss. Disputes ops is the line founders most underestimate.
Synapse’s April 2024 bankruptcy, part of a broader wave of BaaS failures, froze roughly $265M of end-customer funds across Yotta, Juno, and other programs when FBO reconciliations failed.