Machine Learning pathway increased my salary by 40%
Advanced Fintech & PaymentsTransaction Reliability, Cards & Card InfrastructureTopic 22
Card Issuing APIs and Modern Card-Issuing Platforms
Architecture for modern card-issuing platforms enabling API-first card creation and management
Quick Answer
Modern card-issuing platforms (Marqeta, Stripe Issuing, Lithic) enable any company to issue virtual and physical cards via APIs without being a bank. Key features: instant virtual card issuance, programmable card controls (spending limits, MCC restrictions, geography), just-in-time (JIT) funding, real-time authorization hooks, and card lifecycle management. The platform connects to card networks (Visa, Mastercard) and handles compliance, while the customer builds the card program and user experience.
Learning Objectives
1Understand modern card-issuing platform architecture
2Design card-issuing APIs for virtual and physical cards
3Implement programmable card controls and limits
4Design JIT (just-in-time) funding models
5Build card lifecycle management including activation, renewal, and closure
Executive Summary
Modern card-issuing platforms have democratized card creation by enabling any company to issue cards via APIs without being a bank or obtaining a card network license directly. Platforms like Marqeta, Stripe Issuing, and Lithic handle the bank partnership, network connectivity, and compliance.
Key features include instant virtual card issuance, programmable card controls (spending limits, MCC restrictions, geography blocks, merchant blocks), JIT funding (funds loaded at authorization time), and real-time authorization hooks for custom logic.
This topic covers card-issuing platform architecture, API design, card controls, and lifecycle management.
What Is Card Issuing APIs and Modern Card-Issuing Platforms?
A modern card-issuing platform is an API-first platform that enables companies to create and manage payment cards (virtual and physical) without being a bank. The platform handles bank partnerships, card network connectivity, compliance, and authorization processing. The customer builds the card program, user experience, and custom controls on top of the platform APIs.
Why This Topic Matters
Card issuing creates new revenue streams (interchange income), enables new products (corporate cards, expense cards, disposable cards), and improves user experience (instant card issuance, programmable controls).
For platforms, card programs increase engagement, create data assets (transaction data), and generate interchange revenue. For users, modern cards offer better controls, instant issuance, and contextual features.
Why It Matters in 2026+
In 2026, card issuing is mainstream with companies like Uber, DoorDash, Shopify, and Amazon issuing cards. The market is expanding with more use cases: gig economy payments, expense management, subscriptions, and disposable cards for security.
AI-driven card controls are emerging, with dynamic spending limits based on user behavior, real-time fraud prevention, and personalized card offers.
Architecture Overview
Card-issuing platform architecture:
Reference Architecture
Platform App
↓
Issuing API
↓
Card Management
↓
Bank Partner
↓
Card Network
↓
Cardholder
The platform app calls the issuing API to create cards. The issuing platform manages card lifecycle and connects to the bank partner and card network. Cards are issued to cardholders. Authorization requests flow through the network to the issuing platform for real-time decisions.
Core Components
| Component | Responsibility | Technology |
|---|---|---|
| Issuing API | Card creation and management | REST APIs |
| Card Management | Card lifecycle, controls | Card management system |
| Authorization Processing | Real-time auth decisions | Authorization engine |
| JIT Funding | Just-in-time fund loading | Funding hooks |
| Card Controls | Spending limits, MCC, geography | Rules engine |
| Bank Partner | Regulatory coverage, deposits | Bank partnership |
| Network Connector | Visa/MC/RuPay connectivity | ISO 8583, APIs |
Detailed Technical Architecture
Card-issuing technical architecture:
Virtual Card Issuance
Instant virtual card creation via API. Card details returned immediately. Can be added to mobile wallets.
Physical Card Issuance
Physical card creation and mailing. Personalization, embossing, shipping. Activation on receipt.
Programmable Controls
Real-time card controls: spending limits (daily, monthly, per-transaction), MCC restrictions, geography blocks, merchant blocks, freeze/unfreeze.
JIT Funding
Just-in-time funding: funds loaded at authorization time, not in advance. Enables real-time balance management and custom funding logic.
Authorization Hooks
Webhook callbacks for each authorization. Custom logic can approve, decline, or modify the authorization in real-time.
Card Lifecycle
Creation → Activation → Usage → Renewal → Closure. State management for each card.
APIs and Integration Patterns
Card-issuing API patterns:
Create Cardholder
POST /cardholders to create a cardholder with KYC data.
Issue Card
POST /cards to issue a virtual or physical card for a cardholder.
Card Controls
PUT /cards/{id}/controls to update spending limits, MCC, geography.
Authorization Webhook
Webhook for each authorization with approve/decline decision.
POST
/v1/cardholdersCreate a cardholder
Request
POST /v1/cardholders
Authorization: Bearer sk_live_xxx
{
"name": "John Doe",
"email": "john@example.com",
"kyc": { "pan": "ABCDE1234F", "dob": "1990-01-01" }
}Response
{
"id": "ch_26JAnXxXx",
"status": "verified"
}POST
/v1/cardsIssue a virtual card
Request
POST /v1/cards
Authorization: Bearer sk_live_xxx
{
"cardholder_id": "ch_26JAnXxXx",
"type": "virtual",
"currency": "INR",
"spending_limit": 50000,
"controls": {
"allowed_mccs": ["5411", "5812"],
"blocked_geographies": ["CN", "RU"]
}
}Response
{
"id": "card_26JAnXxXx",
"number": "4111111111114242",
"exp_month": 12,
"exp_year": 2028,
"cvv": "123",
"status": "active"
}Data Architecture
Card-issuing data:
| Data | Purpose | Security |
|---|---|---|
| Cardholder Data | Customer profiles, KYC | Encrypted, access controlled |
| Card Data | Card numbers, controls, status | PCI scope, tokenized |
| Authorization Data | Transaction authorizations | Real-time, audit trail |
| Control Rules | Spending limits, MCC, geography | Config DB |
Security Architecture
Card-issuing security:
KYC
Cardholder verification at onboarding. Identity verification, sanctions screening.
PCI DSS
Card data protection. Tokenization reduces scope. HSM for key management.
Authorization Security
Real-time fraud detection for each authorization. Velocity checks, behavioral analysis.
Card Controls
Programmable controls prevent unauthorized spending. Real-time freeze capability.
Regulatory Considerations
Card-issuing regulations:
| Requirement | Description |
|---|---|
| Bank Partnership | Licensed bank partner for regulatory coverage |
| KYC | Cardholder identity verification |
| PCI DSS | Card data protection compliance |
| AML | Transaction monitoring, suspicious activity reporting |
| Network Rules | Visa/MC/RuPay issuing rules |
Business Model Considerations
Card-issuing economics:
| Revenue | Description |
|---|---|
| Interchange | Fee received from acquirer for each transaction |
| Card Fees | Annual fees, late fees (credit cards) |
| Platform Fees | Monthly platform fee, per-card fee |
| Interest | Credit card interest (if offering credit) |
Vendor Landscape
Marqeta
Enterprise card-issuing platform with JIT funding.
Virtual/Physical cardsJIT fundingAuth hooksControls
Stripe Issuing
Card issuing integrated with Stripe.
Virtual cardsPhysical cardsControls
Lithic
Developer-first card-issuing platform.
Virtual cardsDisposable cardsControls
M2P
Indian card-issuing platform.
CardsUPIBNPL
Real Enterprise Case Studies
Card-issuing implementations:
MarqetaUSA · Fintech
Context: Modern card-issuing platform.
Problem: Enable any company to issue cards with custom controls.
Architecture: API-first issuing with JIT funding, real-time auth hooks, programmable controls.
Technology: Java, Go, direct network connections
Outcomes: Powering cards for Klarna, DoorDash, Affirm, and others.
Lessons: JIT funding and real-time auth hooks enable innovative card programs. API-first design drives adoption.
Common Architecture Mistakes
Storing Raw Card Data
Storing PAN or CVV in databases creates massive PCI DSS scope and security risk. Always use tokenization.
No Idempotency on Payment APIs
Missing idempotency keys on payment endpoints causes duplicate charges on retries. Every payment API must support idempotency.
Synchronous Processing of Async Operations
Treating inherently asynchronous payment operations as synchronous causes timeouts and poor UX. Use webhooks and async patterns.
No Webhook Retry Logic
Failing to retry failed webhook deliveries causes merchants to miss critical payment status updates. Implement exponential backoff retry.
No Reconciliation Automation
Manual reconciliation at scale is error-prone and slow. Automate reconciliation from day one.
Single-Rail Dependency
Depending on a single payment rail creates a single point of failure. Implement multi-rail architecture with failover.
No Fraud Monitoring
Launching without fraud monitoring leads to chargebacks and losses. Implement real-time fraud detection from day one.
Payment Database as Financial Ledger
Using the transaction database as the financial ledger leads to accuracy and audit issues. Maintain a separate double-entry ledger.
KPIs
| KPI | Description | Target |
|---|---|---|
| Authorization Rate | Percentage of payment attempts that receive authorization | > 95% |
| Payment Success Rate | Percentage of initiated payments that complete successfully | > 97% |
| API Latency (p99) | 99th percentile API response time | < 500ms |
| TPS Capacity | Transactions per second the system can handle | Based on peak demand |
| Fraud Rate | Fraudulent transactions as percentage of total | < 0.1% |
| Chargeback Rate | Chargebacks as percentage of transactions | < 0.75% |
| Uptime | System availability | 99.99% |
| Reconciliation Accuracy | Percentage of transactions successfully reconciled | > 99.5% |
Practical Project
Build a Card Program
Objective: Design a card program using a modern issuing platform.
Scenario: Build a corporate expense card program with virtual cards, spending controls, and expense management.
Tasks:
- Design cardholder onboarding with KYC
- Design virtual card issuance
- Design card controls (limits, MCC, geography)
- Design JIT funding model
- Design authorization webhook handling
- Design expense management integration
Deliverables: Card program architecture, API integration, controls, compliance.
Validation: Issue card. Set controls. Process transaction. Verify controls. Test freeze/unfreeze.
Interview Questions
What is JIT funding?
JIT (just-in-time) funding loads funds onto the card at the time of authorization, not in advance. The issuing platform calls a webhook to the customer, who decides whether to fund the transaction. This enables real-time balance management and custom funding logic.
How do card controls work?
Card controls are rules applied to each authorization: spending limits (daily, monthly, per-transaction), MCC restrictions (allow/block merchant categories), geography restrictions (allow/block countries), merchant blocks, and freeze/unfreeze. Controls are checked in real-time during authorization.
What is a disposable virtual card?
A disposable virtual card is a single-use card number that is destroyed after one transaction. This prevents fraud for online purchases, as the card number cannot be reused. Some platforms auto-generate new card numbers for each transaction.
Frequently Asked Questions (53)
Glossary
PSP
Payment Service Provider: entity that enables merchants to accept payments through multiple payment methods via a single integration.
PayFac
Payment Facilitator: entity that enables sub-merchants to accept payments under the PayFac master merchant account.
Acquirer
Bank or financial institution that processes card transactions on behalf of merchants.
Issuer
Bank or financial institution that issues payment cards to consumers.
Interchange
Fee paid between the acquiring bank and the issuing bank for card transactions, set by card networks.
MID
Merchant ID: unique identifier assigned to a merchant by the acquirer.
PAN
Primary Account Number: the 14-19 digit number on a payment card, considered sensitive cardholder data under PCI DSS.
Tokenization
Process of replacing sensitive card data with a non-sensitive token.
Authorization
Process of verifying that a payment account has sufficient funds and is valid for a transaction.
Capture
Process of finalizing a previously authorized transaction, triggering the transfer of funds.
Clearing
Process of exchanging transaction details between acquiring and issuing banks.
Settlement
Actual transfer of funds between banks to complete a payment transaction.
Chargeback
Transaction dispute initiated by a cardholder through their issuing bank.
MCC
Merchant Category Code: 4-digit code classifying the type of goods or services a merchant sells.
3DS
3-D Secure: authentication protocol for card-not-present transactions.
PCI DSS
Payment Card Industry Data Security Standard: security standard for organizations handling cardholder data.
HSM
Hardware Security Module: physical computing device that safeguards and manages digital keys.
Idempotency
Property of an API where making the same request multiple times produces the same result as making it once.
Webhook
HTTP callback triggered by an event, used in payments for asynchronous notifications.
UPI
Unified Payments Interface: India real-time payment system developed by NPCI.
NPCI
National Payments Corporation of India: umbrella organization for retail payment systems in India.
RBI
Reserve Bank of India: India central bank and regulatory authority for payment systems.
ISO 20022
International standard for electronic data interchange between financial institutions.
ACH
Automated Clearing House: US electronic payment network for batch-processed bank-to-bank transfers.
FedNow
US Federal Reserve instant payment service launched in 2023.
SEPA
Single Euro Payments Area: EU payment integration initiative.
RTP
Real-Time Payments: payment infrastructure enabling instant, irrevocable payments 24/7.
Ledger
Financial record-keeping system using double-entry accounting.
Reconciliation
Process of matching transaction records across different systems to ensure consistency.
Escrow
Financial arrangement where a third party holds funds until conditions are met.
BNPL
Buy Now Pay Later: short-term financing allowing consumers to pay in installments.
BaaS
Banking-as-a-Service: model where licensed banks provide banking infrastructure via APIs.
Open Banking
Practice of providing secure API access to bank account data and payment initiation.
Embedded Finance
Integration of financial services into non-financial platforms via APIs.
Stablecoin
Cryptocurrency designed to maintain stable value by pegging to a reference asset.
JIT Funding
Just-in-time funding: funds loaded at authorization time, not in advance.
Auth Hook
Webhook callback for each card authorization, enabling custom approve/decline logic.
Card Controls
Programmable rules for card spending: limits, MCC, geography, merchant blocks.
Implementation Checklist
- Architecture designed and reviewed
- API contracts defined with idempotency
- Authentication and authorization implemented
- PCI DSS scope assessed and minimized via tokenization
- Error handling and retry logic designed
- Webhook delivery and retry implemented
- Security review completed (encryption, HSM, key management)
- Regulatory requirements identified (RBI, PCI DSS, AML)
- Data model defined (transactions, ledger, reconciliation)
- Observability implemented (metrics, logs, traces, alerts)
- Testing completed (unit, integration, load, chaos)
- Disaster recovery designed and tested
- Reconciliation process validated
- Fraud detection deployed and tuned
- Production readiness assessed and approved
Career & Enterprise Skills
Payment Architect
Designs end-to-end payment architecture including gateways, orchestration, rails, security, and compliance.
Fintech Architect
Designs comprehensive fintech platform architecture including payments, banking, ledgers, risk, and compliance.
API Architect
Designs API-first payment platforms including REST APIs, webhooks, SDKs, developer portals, and API governance.
Payment Engineer
Implements and operates payment infrastructure including gateway, routing, processing, reconciliation, and settlement.
Platform Engineer
Builds internal developer platforms for payment integration, providing self-service APIs, SDKs, and golden paths.
SRE Engineer
Applies software engineering to payment operations, managing SLI/SLO/error budgets and incident response.
Fraud Analyst
Monitors transaction patterns, investigates suspicious activity, tunes fraud rules, and manages chargeback disputes.
Fintech Product Manager
Defines payment product strategy, manages roadmap, balances user experience with compliance, and drives payment metrics.
Compliance Specialist
Ensures payment systems meet PCI DSS, RBI, AML, and other regulatory requirements.
Treasury Technology Specialist
Implements and operates treasury management systems including liquidity management, settlement, FX, and bank connectivity.
Future Outlook
2027: Card Issuing APIs will see increased AI integration with AI agents handling routine payment decisions, intelligent routing optimization, and predictive fraud prevention becoming standard capabilities.
2028: Autonomous payment systems will mature with self-healing infrastructure, AI-driven reconciliation, and cross-border real-time payments reducing settlement time from days to seconds.
2029: Programmable money and tokenized deposits will enable new payment models with conditional settlement, smart contract-based escrow, and machine-to-machine payments becoming practical.
2030: The convergence of AI, blockchain, and real-time payments will be complete. Card Issuing APIs will be managed through AI agents with humans governing policy, security, and business alignment. Payments will be invisible, instant, and intelligent.
Key Takeaways
- Modern card-issuing platforms enable any company to issue cards via APIs.
- Key features: instant virtual cards, programmable controls, JIT funding, auth hooks.
- Bank partnership provides regulatory coverage for card issuing.
- Interchange revenue is the primary economic driver for card programs.
- Card controls enable use cases like corporate expenses, disposable cards, and security.