🏦 The role of banks

Two banks, one transaction

Every card payment involves two banking functions that mirror each other but remain separate: issuing on the cardholder side and acquiring on the merchant side. A universal bank often runs both. BNP Paribas, for example, issues cards and equips merchants. Inside the bank, however, the two businesses keep separate teams, IT systems, and risk models. They serve different customers, earn different revenue, and face different primary risks.

The issuing bank: issue, authorize, protect, debit

The issuer provides the card to the cardholder and manages its entire lifecycle, from manufacturing and personalization through activation and renewal to the card block. Personalization covers the PAN tied to the issuer’s BIN, the EMV keys, and the PIN. The issuer manages spending and withdrawal limits, which cardholders can often adjust in real time from the banking app. It also configures contactless and online payments, and enrolls the card in wallets such as Apple Pay and Google Pay through tokenization.

• Authorization: on every transaction, the issuer checks that the card is valid and not blocked, confirms the available balance or credit line and the rolling limits (7 or 30 days), and validates the EMV cryptogram.
• Real-time fraud scoring: rules engines and statistical models assess every authorization (location, MCC, amount, velocity, device fingerprint for e-commerce), constantly trading off the fraud rate against the false decline rate.
• Strong customer authentication: the issuer, through its 3-D Secure ACS, decides whether to challenge an online payment (TRA exemptions, frictionless flow).
• Debiting the cardholder: once clearing arrives, the debit is immediate or deferred to month-end. The issuer carries the credit risk on deferred debit and related credit facilities.
• Dispute handling: the issuer receives cardholder disputes, refunds confirmed fraud, and raises chargebacks against the acquirer under scheme rules.

The acquiring bank: onboard, guarantee, pay out

The acquirer signs the merchant agreement with the merchant and then registers it with the schemes. Registration gives the merchant an identifier, the MID, and a merchant category code, the MCC. The acquirer then collects the merchant’s transactions, submits them for clearing, and pays out the funds. Above all, it provides the payment guarantee, which applies as long as the merchant followed the acceptance rules: authorization obtained and authentication done correctly. The merchant then gets paid even if the cardholder disputes the transaction or defaults.

• KYB and onboarding: verifying the merchant’s identity, its actual business, and its beneficial owners, with full AML/CFT obligations.
• MCC assignment: the merchant category code drives interchange, risk rules, and certain industry restrictions (gambling, crypto, and adult content fall under dedicated scheme programs).
• Payouts: usually daily, one to three business days after the transaction. Some contracts provide for a delay or a holdback (rolling reserve, typically 5% to 10% for 90 to 180 days) in high-risk industries.
• Chargeback handling: receiving chargebacks raised by issuers, passing them on to the merchant, and supporting the merchant through representment.
• Ongoing monitoring: tracking the merchant’s fraud and chargeback rates. Scheme programs (VAMP at Visa, ECP at Mastercard) set thresholds beyond which fines and termination loom.

The merchant’s bank ≠ the acquirer

The bank that holds a merchant’s deposit account and the merchant’s acquirer perform two separate functions, and they are not necessarily the same institution. In France, the two roles used to coincide: merchants signed their card acceptance contract at their local bank branch. The acquiring market has since opened up, and the two relationships are now contracted separately. A merchant can bank with Crédit Agricole and use Worldline, Adyen, or Payplug for acquiring, which will pay out the funds into that account.

Neobanks and nonbank issuers

The payment institution (PI) and the e-money institution (EMI) are two lighter licenses created by EU directives. They allow firms to issue payment instruments without a full banking license, which is why issuing a card no longer requires being a bank. Revolut operated as an EMI for years before obtaining a banking license, and Lydia, now Sumeria, is on the same path, seeking a credit institution license. Dozens of fintechs issue cards without ever becoming banks.

• The schemes have adapted their licensing: Visa and Mastercard accept PIs and EMIs as principal members, and GIE CB has opened up to nonbanks (PIs and EMIs can join).
• BIN sponsorship lets an unlicensed firm issue cards “under” a member’s BIN. It is fast but creates heavy dependence: losing the sponsor shuts down the program.
• Nonbank issuing lives mainly on interchange and subscription fees. The IFR caps (0.2%/0.3% on consumer cards) have pushed some players toward uncapped commercial cards.

The economics of the two businesses

Issuing and acquiring rely on different revenue and different cost structures. Issuing is a stock business: its value lies in the card portfolio and the recurring revenue it generates. Acquiring is a flow business: its value lies in processed volume, with thin margins and massive economies of scale.