Head of Product – Cards Business


# Building a Card-Issuing Stack: BIN Sponsorship, KYC, Risk, Disputes

Launching a card program—whether co-brand credit cards, corporate expense cards, or neobank debit cards—requires navigating a complex stack of regulatory, technical, and operational requirements. Here's what you're actually building.

## The Issuing Stack Layers

### 1. BIN Sponsorship

You can't issue cards without a **Bank Identification Number (BIN)**. The first 6-8 digits of every card number identify the issuing institution and card type.

#### Option A: Become a Bank
- **Requirements**: Banking charter, capital reserves (millions to billions), regulators
- **Timeline**: Years
- **Reality**: Not viable for most fintechs

#### Option B: BIN Sponsorship
Partner with a licensed bank that lends you their BIN. You build the product; they handle regulatory heavy-lifting.

**Sponsor bank provides**:
- BIN range allocation
- Card network membership (Visa/Mastercard licensee)
- Regulatory coverage (Fed, OCC, FDIC oversight)
- Settlement accounts

**You provide**:
- KYC/AML program
- Fraud monitoring
- Customer support
- Product experience

**Economics**: Sponsor takes 0.2%-0.5% of transaction volume plus fixed fees. Worth it to avoid regulatory maze.

### 2. Card Network Integration

Once you have a BIN, you must integrate with Visa or Mastercard.

#### Certification Requirements
- **Authorization engine**: Respond to auth requests in <3 seconds
- **Fraud scoring**: Real-time transaction risk assessment
- **Clearing and settlement**: File-based batch processing
- **Dispute management**: Chargeback handling per network rules

#### Network Fees
- **Annual licensing**: $50K-$500K depending on volume
- **Per-transaction fees**: $0.02-$0.05 for debit, higher for credit
- **Scheme fees**: Network assessments (0.13%-0.15% of volume)

#### Integration Path
Most issuers use **processor middleware** (Marqeta, Stripe Issuing, Lithic) instead of direct network integration. Processors handle:
- Network certification
- Message format translation (ISO 8583)
- Compliance with scheme mandates
- PCI DSS scope reduction

**Tradeoff**: Processors add cost (~1% of volume) but save 18 months of integration work.

### 3. KYC & Onboarding

Before issuing a card, you must verify the cardholder's identity.

#### Individual KYC
- **Identity verification**: Government ID + selfie match
- **Address proof**: Utility bill, bank statement
- **Sanctions screening**: OFAC, UN, EU lists
- **PEP checks**: Politically Exposed Persons
- **Adverse media**: Criminal records, fraud databases

**Vendors**: Jumio, Onfido, Persona, Plaid Identity

#### Business KYC (Corporate Cards)
- **Company verification**: Corporate registry lookup
- **Beneficial ownership**: Ultimate ownership structure (25%+ stake)
- **Business validation**: Tax ID, operating address
- **Authorized representatives**: Who can approve card issuance?

**Challenges**: Cross-border businesses, shell companies, frequent ownership changes

#### Continuous Monitoring
KYC isn't one-time. Regulators expect:
- **Periodic re-verification**: Annual or risk-based
- **Transaction monitoring**: AML pattern detection
- **Watchlist screening**: Real-time updates as sanctions lists change

### 4. Authorization & Processing

When a cardholder swipes, your system must decide: approve or decline?

#### Authorization Flow
1. **Network routes** auth request to your processor
2. **Processor** forwards to your authorization server
3. **You evaluate**:
   - Sufficient balance/credit limit?
   - Card active (not lost/stolen/expired)?
   - Transaction within velocity limits?
   - Passes fraud scoring?
4. **Respond**: Approve (00), Decline (51-insufficient funds, 05-generic decline)

#### Response Time Budget
- **Total SLA**: <3 seconds (network requirement)
- **Processor overhead**: ~500ms
- **Your logic**: Must execute in <2 seconds
- **Database lookups**: Pre-cached in Redis, not live DB queries

#### Fraud Scoring
Must happen in-line during auth:
- **Velocity checks**: Max 5 transactions/10min, $500/hour
- **Geography**: Does card location match cardholder home?
- **Merchant category**: Suspicious MCCs (wire transfer services, crypto exchanges)
- **Behavioral anomaly**: ML model predicting fraud probability

**Tradeoff**: False positives hurt user experience, false negatives cost money.

### 5. Ledger & Accounting

Every transaction must be recorded with double-entry accounting.

#### Core Entities
- **Card account**: Debit balance (prepaid) or credit balance (revolving)
- **Settlement account**: Pooled funds held at sponsor bank
- **Fee accounts**: Interchange revenue, network fees, processor costs

#### Transaction Posting
- **Authorization hold**: Encumber available balance
- **Clearing**: Final amount (may differ from auth)
- **Settlement**: Funds transfer T+1 or T+2

#### Reconciliation
Daily reconciliation between:
- Your ledger (what you think happened)
- Processor statements (what actually cleared)
- Network settlement files (what moved between banks)

Mismatches = money lost or compliance risk.

### 6. Dispute Management

Cardholders can dispute charges (chargebacks). You must handle them per network rules.

#### Chargeback Flow
1. **Cardholder complains** to you (not bank, you're the issuer)
2. **You investigate**: Does claim have merit?
3. **If valid, initiate chargeback** via network
4. **Merchant responds** with evidence (proof of delivery, signature)
5. **You review** merchant evidence
6. **Decide**: Accept merchant evidence (reverse chargeback) or proceed (debit merchant)

#### Timeframes
- **Cardholder has** 60-120 days post-transaction to dispute
- **You have** 30-45 days to respond to merchant evidence
- **Arbitration**: If unresolved, network decides (costs $500+ per case)

#### Chargeback Abuse
Monitor for **friendly fraud**: Cardholders claiming "didn't receive" when they did.

### 7. Regulatory Compliance

Card issuing is heavily regulated. Key requirements:

#### US (Reg E - Debit, Reg Z - Credit)
- **Error resolution**: Investigate disputes within 45 days
- **Billing statement rules**: Must send monthly if activity
- **Liability limits**: $50 max cardholder liability if reported promptly

#### AML (Anti-Money Laundering)
- **Suspicious Activity Reports (SARs)**: File within 30 days of detecting suspicious patterns
- **Transaction monitoring**: Detect structuring, layering, integration
- **Record keeping**: 5-year retention of KYC docs and transactions

#### PCI DSS
- **Cardholder data**: Encrypted in transit and at rest
- **Access controls**: Who can view full PAN?
- **Quarterly scans**: External vulnerability assessments
- **Annual audits**: Self-assessment or 3rd-party audit

#### GDPR / CCPA
- **Data rights**: Cardholders can request data export or deletion
- **Breach notification**: 72 hours to notify regulators if PII leaked

### 8. Operations

The unsexy stuff that keeps cards working:

- **Card production**: Embossing, mailing, tracking delivery
- **PIN management**: Secure PIN mailers or in-app PIN set
- **Customer support**: Lost/stolen reporting, transaction disputes, balance inquiries
- **Fraud alerts**: SMS/email notifications for suspicious activity
- **Card controls**: Spending limits, merchant blocks, geographic restrictions

## Build vs Buy

### Build In-House
**Pros**: Full control, no processor margin, custom features
**Cons**: 18-24 months to launch, $5M+ investment, regulatory burden

### Use Card Issuing Platform (Marqeta, Stripe, Lithic, Adyen)
**Pros**: Launch in weeks, turnkey compliance, managed infrastructure
**Cons**: ~1% platform fee, less customization, vendor lock-in

**Middle ground**: Use platform for v1, migrate critical components in-house as you scale.

## Economics

**Revenue**:
- **Interchange**: 0.3%-2% of transaction volume (higher for credit, lower for debit)
- **Annual fees**: $50-$500/card (premium cards)
- **FX markup**: 1%-3% on cross-border transactions

**Costs**:
- **BIN sponsor**: 0.2%-0.5% of volume
- **Processor**: 0.5%-1% of volume
- **Network fees**: 0.15%-0.25% of volume
- **KYC**: $1-$5 per verification
- **Card production**: $2-$10 per card
- **Fraud losses**: 0.1%-0.5% of volume (if controls are good)

**Margins**: Thin. You need scale (millions in volume) to be profitable.

## Key Takeaways

- **BIN sponsorship** is the entry ticket—partner with a bank unless you are one
- **KYC and compliance** are non-negotiable, build robust programs from day one
- **Authorization** must be fast (<2s) and smart (fraud prevention)
- **Disputes** are operationally heavy, budget for support team
- **Build vs buy** depends on timeline, budget, and control needs

Card issuing is complex but tractable. Most successful fintechs start with a platform (Stripe, Marqeta) and selectively bring components in-house as they scale.


Everything you need to know about launching a card program, from BIN sponsorship to compliance and dispute management.

Building a Card-Issuing Stack: BIN Sponsorship, KYC, Risk, Disputes


# Wallet-as-a-Service vs In-House: Cost, Control, Compliance

Every fintech eventually faces the build-vs-buy decision for core infrastructure. Digital wallets—storing balances, facilitating transfers, managing payment methods—are no exception. Should you build from scratch or use a Wallet-as-a-Service (WaaS) platform?

## What is a Digital Wallet?

At its core, a digital wallet is:
- **Ledger system**: Track balances per user
- **Payment method store**: Securely store card/bank account credentials
- **Transaction engine**: Execute transfers, payments, top-ups
- **Compliance layer**: KYC, AML, fraud monitoring

Think of it as a **bank account abstraction** that sits on top of existing financial rails (cards, ACH, wire transfer).

## Wallet-as-a-Service Platforms

WaaS providers offer turnkey wallet infrastructure:

### Leading Providers
- **Stripe**: Stripe Issuing + Connect for marketplaces
- **Adyen**: Wallet, balance accounts, payouts
- **Checkout.com**: Issuing + embedded wallets
- **Rapyd**: Global wallet with local payment method support
- **Modulr**: Embedded finance for Europe
- **Unit**: Banking-as-a-service with wallet functionality

### What They Provide
- **Pre-built ledger**: Double-entry accounting system
- **Regulatory licenses**: E-money or banking charter
- **Compliance infrastructure**: KYC, AML monitoring, SAR filing
- **Payment method linking**: Card tokenization, bank account verification
- **API**: RESTful endpoints for balance checks, transfers, payouts
- **Dashboard**: Operations tools for support teams

### Pricing Model
Typically:
- **Setup fee**: $0-$50K (enterprise)
- **Per-transaction**: 0.5%-1.5% of value + fixed fee ($0.25-$0.50)
- **Monthly platform fee**: $500-$5K depending on volume
- **Additional services**: KYC ($1-$5/check), card issuing, FX markup

## In-House Wallet: What You're Building

Building a wallet from scratch means:

### 1. Ledger System
- **Database schema**: Users, accounts, transactions, balances
- **Double-entry accounting**: Every debit has a matching credit
- **Idempotency**: Retries don't duplicate transactions
- **Concurrency control**: Prevent race conditions on balance updates
- **Audit trail**: Immutable transaction log

**Tech stack**: PostgreSQL with row-level locking, event sourcing, or purpose-built ledger DB (TigerBeetle).

### 2. Payment Method Integration
- **Card tokenization**: Integrate Visa/Mastercard token vaults
- **Bank account verification**: Plaid, Stripe, or micro-deposit verification
- **Payment processing**: Connect to acquirers or processors

**Complexity**: Each payment method (cards, ACH, wire, crypto) requires separate integration.

### 3. Regulatory Compliance
- **E-money license**: Required in EU, some Asian markets
- **State Money Transmitter Licenses (MTL)**: US requirement (50 states = 50 licenses)
- **KYC/AML program**: Identity verification, sanctions screening, transaction monitoring
- **Reporting**: SAR filings, regulatory audits

**Cost**: Legal, compliance staff, audit fees = $500K-$2M/year minimum.

### 4. Fraud & Risk Management
- **Transaction limits**: Daily/monthly caps per user
- **Velocity checks**: Max transfers/hour
- **Behavioral monitoring**: Anomaly detection for account takeover
- **Chargeback handling**: Dispute workflow

**Team**: Fraud analysts, risk modelers, ML engineers.

### 5. Settlement & Reconciliation
- **Pooled accounts**: Where user funds are held (partner bank)
- **Daily reconciliation**: Your ledger vs actual bank balance
- **Reserve requirements**: Maintain 100%+ coverage of user balances

**Risk**: Ledger bugs = money loss. Reconciliation failures = regulatory penalties.

## Cost Comparison

### Wallet-as-a-Service
**Year 1**:
- Platform fees: $50K
- Transaction fees: $200K (on $20M volume at 1%)
- KYC: $10K (10K users at $1/check)
- **Total**: ~$260K

**Year 3**:
- Transaction fees scale with volume: $1M (on $100M volume)
- Platform + KYC: ~$100K
- **Total**: ~$1.1M

### In-House Build
**Year 1**:
- Engineering (4 FTEs): $800K
- Compliance (2 FTEs + legal): $500K
- Licenses: $200K (MTL applications)
- Infrastructure: $100K
- **Total**: ~$1.6M

**Year 3**:
- Engineering (6 FTEs): $1.2M
- Compliance (3 FTEs): $600K
- License renewals: $100K
- Infrastructure: $200K
- **Total**: ~$2.1M

**Break-even**: Around $150M-$200M annual volume, assuming WaaS fees are 1%.

## Control & Customization

### WaaS Advantages
- **Faster time-to-market**: Weeks vs 12-18 months
- **No regulatory burden**: Platform handles licenses
- **Managed compliance**: KYC, AML monitoring included

### WaaS Limitations
- **Feature constraints**: Limited to provider's roadmap
- **Pricing lock-in**: Hard to negotiate once dependent
- **Data ownership**: User data lives in vendor's system
- **Regional restrictions**: Not all platforms operate globally

### In-House Advantages
- **Full control**: Build exactly what you need
- **Cost efficiency at scale**: No per-transaction margin after break-even
- **Data sovereignty**: All user data in your systems
- **Competitive moat**: Unique features competitors can't replicate

### In-House Challenges
- **Regulatory expertise**: Hire compliance team or consultants
- **Slow iteration**: Can't "move fast and break things" with money
- **Operational burden**: 24/7 monitoring, reconciliation, support

## Compliance Considerations

### WaaS Compliance
- **Regulator of record**: Platform's e-money license covers you
- **Shared responsibility**: You still do KYC, but platform monitors transactions
- **Audit exposure**: If platform fails audit, you're exposed

### In-House Compliance
- **You are the regulated entity**: Direct relationship with regulators
- **Full liability**: Compliance failures = fines, license revocation
- **Flexibility**: Customize KYC/AML policies for your risk appetite

**Key risk**: WaaS platforms can change terms, raise prices, or exit markets. In-house = control but full burden.

## Hybrid Approach

Many fintechs start WaaS, then selectively bring components in-house:

### Phase 1: Full WaaS (Year 1-2)
- Launch fast with Stripe or Adyen
- Validate product-market fit
- Scale to $50M-$100M volume

### Phase 2: Selective In-Sourcing (Year 3-4)
- Build custom ledger for core flows
- Keep WaaS for edge cases (international, crypto)
- Negotiate volume discounts with remaining WaaS usage

### Phase 3: Full In-House (Year 5+)
- Obtain own licenses
- Migrate all flows to proprietary stack
- WaaS as backup or secondary provider

**Example**: Robinhood started with Apex Clearing, then built in-house clearing. Revolut used Banking Circle, then got own banking license.

## Decision Framework

### Choose WaaS if:
- **Early stage**: Pre-product-market fit, <$20M volume
- **Non-core differentiator**: Wallet is table stakes, not your moat
- **Resource-constrained**: Engineering/compliance headcount limited
- **Geographic expansion**: Need multi-country support quickly

### Build In-House if:
- **Scale**: $200M+ annual volume, WaaS fees unsustainable
- **Unique features**: Core product requires wallet customization
- **Data control**: User data sovereignty is critical (B2B, enterprise)
- **Long-term vision**: Wallet is strategic asset, not vendor dependency

### Hybrid Makes Sense if:
- **Selective control**: Own core flows, outsource edge cases
- **Risk mitigation**: Diversify across in-house + WaaS providers
- **Gradual transition**: De-risk migration over years, not big-bang

## Key Takeaways

- **WaaS** is faster, lower upfront cost, but expensive at scale
- **In-house** is slow, high upfront cost, but cheaper long-term
- **Break-even** is around $150M-$200M volume
- **Compliance** is the hidden cost—licenses, audits, staffing
- **Hybrid** is the pragmatic path for most fintechs

There's no universal answer. The right choice depends on stage, volume, team capabilities, and strategic importance of the wallet to your product.

Start with WaaS. Build in-house when the vendor bill exceeds the cost of hiring a team.


A comprehensive comparison of building your own wallet infrastructure versus using third-party wallet-as-a-service platforms.

Fintech

Building a Card-Issuing Stack: BIN Sponsorship, KYC, Risk, Disputes

Wallet-as-a-Service vs In-House: Cost, Control, Compliance