Card Issuance

Card issuance is the business and process of giving customers payment cards linked to an account or credit line. It covers designing a card programme, joining or renting access to a card network, approving each applicant, producing and delivering the card (or creating a virtual one), and then authorising and settling every payment made with it. Banks, credit unions, credit card companies and, increasingly, fintechs and non-financial brands all issue cards.

Issuance is the opposite side of the card market from acquiring. The card issuer serves the cardholder and takes the credit and fraud risk on their spending; the acquirer serves the merchant. The two meet through the card networks in the four-party card model. Issuers are regulated as banks or e-money institutions and must follow network rules, consumer-credit and payment laws, and anti-money-laundering requirements.

Issuing a card is a bit like a club handing out membership cards. The club decides who may join, checks each applicant, prints a card with the member's name and number, and keeps the register of what each member owes or has paid in. Shops in a much bigger network agree to honour any card bearing the club's network logo.

A modern fintech that "launches a card" usually works like a restaurant brand using a shared kitchen. It owns the customer and the design, but a licensed bank, a card processor and a card factory do much of the cooking behind the scenes.

• The issuing institution. A bank or licensed e-money institution that holds the network licence and the customer funds or credit. Firms without their own licence use a BIN sponsor or sponsor bank that lends them a bank identification number (BIN) range.
• The program manager. A program manager designs and markets the card, owns the customer relationship and often handles customer service, under the sponsor's oversight.
• The issuer processor. A technology firm that keeps card accounts, authorises transactions in real time, and handles clearing files and disputes. Some offer this as card-as-a-service (CaaS), part of the wider banking-as-a-service (BaaS) model.
• The card manufacturer and personalization bureau. Certified factories that make card bodies and load each card's data and keys, covered under card personalization.
• The card network. Visa, Mastercard and others set the rules, run authorization and clearing between issuers and acquirers, and charge scheme fees.

1. Programme set-up. The issuer chooses the card type (credit card, debit card or prepaid), network, BIN range, spending limits, fees and features, and obtains network approval.
2. Customer onboarding. Applicants pass know your customer (KYC) checks and, for credit products, an affordability and credit assessment.
3. Account and card creation. The processor creates the account and a primary account number (PAN), expiry date and security codes.
4. Production or provisioning. A physical card is personalised and posted, or a virtual card is shown in the app straight away and can be pushed into a phone wallet as a token.
5. Activation and use. The customer activates the card and sets a PIN, and the issuer then authorises each payment. Later stages, from replacements to closure, fall under card lifecycle management.

Traditional issuance is central: cards are produced in batches at a secure bureau and mailed, which can take days. Instant issuance lets a bank branch print and encode a card on the spot with a desktop machine, useful for new accounts and urgent replacements. Virtual cards exist only as data; they are issued in seconds, are popular for online shopping, corporate expenses and one-off supplier payments, and remove production costs entirely. Many issuers now issue a virtual card first and post the plastic later. For physical cards, manufacturers often require a minimum order quantity, which affects the economics of small programmes.

Issuers earn mainly from interchange paid by the merchant's side on each purchase, plus interest and fees on credit cards. Interchange is capped in some places: in the US the Durbin Amendment limits it for regulated cards issued by banks with $10 billion or more in assets, while smaller issuers' cards are exempted cards; the EU caps consumer debit at 0.2% and credit at 0.3% of the transaction under the Interchange Fee Regulation. Fintech programmes often prefer exempt sponsor banks for this reason.

Consumer rules also shape issuance. In the US, Regulation Z generally forbids sending a credit card that the consumer did not request (renewals and substitutes excepted), and Regulation E sets similar conditions for unsolicited debit cards. Issuers of prepaid access products face FinCEN rules on prepaid access, and EU issuers must apply strong customer authentication (SCA) when cardholders pay online.

• CFPB: Regulation Z § 1026.12, Special credit card provisions
• PCI Security Standards Council: Card Production and Provisioning