Stand-In Processing

Stand-in processing (STIP) is a backup authorisation service in which a card network, or a processor acting for the issuer, decides whether to approve or decline a card transaction when the card issuer cannot respond itself. This happens when the issuer's systems or its issuer processor are offline, overloaded, under maintenance or too slow to answer within the network's time limit. Instead of declining every transaction, the network applies rules the issuer has set in advance and answers on its behalf, so cardholders can keep paying.

Stand-in processing is offered by the major networks, including Visa and Mastercard, and by some processors and switches. It is a resilience tool for the authorisation step of a card payment, distinct from offline authorisation, in which a chip card and terminal approve a transaction without contacting anyone, and from simple timeouts, where the network declines a transaction because no answer arrived.

When a cardholder pays, the acquirer sends an authorisation request through the card network to the issuer. If the issuer does not respond within the allowed time, or the network knows the issuer is unavailable, the network routes the request to its stand-in system. That system checks the transaction against the issuer's stand-in parameters and returns an approval or decline to the acquirer. Afterwards, the network sends the issuer an advice message for each stand-in decision, so the issuer can update account balances and records once its systems are back.

Some issuers use stand-in only as a fallback; others ask the network to stand in routinely for certain transaction types or during planned maintenance. Issuers can usually monitor stand-in activity in real time and see how much volume the network has handled for them.

Because the network does not have live access to the issuer's account data, it relies on limits and checks the issuer supplies, such as:

• Amount limits. Maximum approval values per transaction and per day, often varying by card product, merchant type and channel.
• Card status files. Lists of blocked, lost, stolen or closed cards, which the network uses to decline those cards.
• Security checks. Verification of card security codes, chip cryptograms and PINs, which the network can perform if it holds the relevant keys.
• Risk rules. Restrictions on certain merchant categories, countries or transaction types, sometimes supported by the network's own fraud scoring.

Well-tuned parameters allow ordinary purchases to continue while limiting exposure to fraud and to cardholders spending more than they have.

Transactions approved under stand-in processing are generally treated as approved by the issuer, which remains liable for them under card network rules. Since the network cannot see real-time balances, stand-in can approve transactions that exceed available funds on debit and prepaid cards, creating overdrafts or losses for the issuer. Fraudsters sometimes try to exploit stand-in periods, especially when outages become public, by using compromised cards that would otherwise be blocked.

Issuers manage these risks by keeping stand-in limits conservative, updating card status files promptly, and reconciling advice messages quickly after an outage. Strong fraud rules at the network level, applied during stand-in, reduce exposure further.

Authorisation outages at a single issuer or processor can stop millions of cardholders from paying, so regulators and card networks expect issuers to have tested resilience arrangements. Stand-in processing is a central part of these plans, alongside redundant data centres and failover between processors. For prepaid and fintech card programmes that run on third-party processors, the choice of stand-in settings is an important design decision, balancing customer experience against credit and fraud risk. Supervisors reviewing operational resilience increasingly ask how such arrangements perform during real incidents.

The right settings differ by product. A credit card issuer can tolerate generous stand-in limits because occasional overspending becomes part of the credit balance, while a prepaid card issuer may prefer tight limits, since every amount approved beyond the balance is a loss. Debit card issuers usually sit between the two.

Stand-in processing is one of several ways card systems keep working when parts fail. Merchants can use fallback transactions when a chip cannot be read, terminals can approve some small payments offline, and acquirers may queue transactions for later submission when connections drop. Each method shifts some risk between parties, and card network rules define who bears losses in each case, as with any payment authorisation.