THE GUIDE · THE BUILDER SIDE

How anyone launches a card.

Every fintech card — the neobank debit, the startup corporate card, the rewards app — is a stack of rented parts: a bank's licence and BIN, a processor's rails, and an app on top. Here is how it fits together, and who earns what.

SCROLL ↓
PART 01

The stack behind a fintech card.

Step through standing up a program, issuing a card by API, authorizing a swipe with just-in-time funding, and splitting the interchange.

PART 02

The parts you rent.

A fintech card is three rented layers plus your app. Here is each one.

THE ISSUING STACK

"Rent the bank, own the app."

A fintech card = sponsor bank (licence + BIN) + issuer-processor (auth rails) + program manager (the fintech's product and risk). Each owns a different piece of the licence, the funds and the liability.

BIN SPONSOR

"Whose licence is it, really?"

The card runs on the sponsor bank's BIN and regulatory licence. The bank is legally the issuer and carries the compliance obligation — which, after Synapse, banks are policing far more closely (see Field Notes).

PROGRAM MANAGER

"The brand you actually see."

The fintech is the program manager: it owns the app, the customer, the marketing and much of the risk decisioning. To you it looks like the bank; legally it is a partner riding a sponsor's rails.

ISSUER-PROCESSOR

"The engine under the card."

The processor authorizes, clears and settles each transaction and exposes the APIs. The modern, API-first generation — Marqeta, Lithic, Stripe Issuing, Galileo — is what made programmable cards possible, versus legacy cores like TSYS and FIS.

JUST-IN-TIME FUNDING

"Decide and fund at the swipe."

Instead of pre-loading a card, the program funds the exact amount at authorization via a real-time webhook. It lets software enforce balances, spend rules and fraud checks at the instant of the tap — the backbone of expense and corporate-card products.

INTERCHANGE AS REVENUE

"The swipe pays you."

For an issuer, interchange is income. A card program's P&L is roughly interchange in, minus rewards, fraud losses, and processor + sponsor fees. Get the mix right and the card funds the whole app — the neobank playbook.

PART 03

The webhook that funds the swipe.

Just-in-time funding is the primitive under every modern card. This is the moment, in miniature.

// JIT FUNDING — the authorization stream

→ auth.request   { card: tok_9f2, amount: 40.00, mcc: 5814 }
   your code: balance ok? spend rules ok? not fraud?
← approve   { fund: 40.00, from: program_pool }
← or decline   { reason: over_limit }

// You checked a balance, enforced policy, and moved money — in ~200ms, at the instant of the tap.
PART 04

Why the model works.

$10B
the sponsor-bank asset line below which debit interchange is uncapped — the engine of neobank economics.
~200ms
to check balance, apply spend rules and fund the card at the instant of the tap (JIT).
API-first
Marqeta, Lithic, Stripe Issuing and Galileo turned card issuing into a few API calls.
Virtual
most programs mint a usable card number in seconds and ship plastic later.
FIELD NOTES — THE PRO LAYER

For the professionals.

The stack up close — the Durbin-exempt engine, sponsor-bank risk after Synapse, the modern processors, spend controls, and reading a program P&L.

DURBIN-EXEMPT — THE ENGINE OF FREE BANKING
Here's the trick behind 'free' neobank accounts: US debit interchange is capped for banks over $10B in assets, but exempt below it. So fintechs deliberately partner with small sponsor banks and earn roughly double the interchange a big bank could on the same swipe. That uncapped debit revenue — not fees, not lending — funds no-fee accounts, cashback and the customer-acquisition machine. It's also why the Durbin fight (see the card-types chapter) matters existentially to this model.
SPONSOR-BANK RISK AFTER SYNAPSE
In 2024 the BaaS middleware firm Synapse collapsed, and because its ledgers didn't reconcile with the partner banks, real customers couldn't reach their money. The fallout reset the industry: regulators made clear the sponsor bank is fully accountable for its programs' BSA/AML, KYC and — critically — reconciliation of the for-benefit-of (FBO) accounts. Banks now underwrite and monitor programs far more heavily. Building a card program in 2026 means proving you can keep the ledger honest.
THE MODERN ISSUER-PROCESSORS
The reason programmable cards exist: a generation of API-first issuer-processors — Marqeta (Square, DoorDash, many expense cards), Lithic/Privacy, Stripe Issuing, Galileo (Chime) — replaced batch-era cores (TSYS, FIS) with webhooks and real-time controls. Their key primitive is the authorization stream: subscribe to auth events and decide, per swipe, whether and how much to fund. Teen cards, fuel cards and fraud controls are all built on that hook.
SPEND CONTROLS & AUTH LOGIC
Because the program decides at auth, controls live in code: allow only certain MCCs, cap per-transaction or daily amounts, restrict to named merchants, require the app be open, block cross-border. Corporate-card and expense products are essentially rules engines on the authorization stream. It's also where real-time fraud defence sits — the same hook that funds the card can decline a suspicious one.
READING A CARD PROGRAM'S P&L
A program's economics: interchange plus any subscription/FX fees come in; out go rewards, fraud and credit losses, and processor + sponsor + network fees. Debit programs live or die on interchange volume; credit programs add interest income and underwriting risk. The classic failure mode is over-rewarding to grow, then discovering the interchange never covered the points — the same trap co-brand cards manage for a living.
PART 05

Remember three things.

1
A fintech card is a stack it rents: a sponsor bank's licence and BIN, an issuer-processor's rails, and the fintech's own app and risk logic on top.
2
Interchange is the revenue, not the cost. The business is interchange in, minus rewards, losses and fees — and on Durbin-exempt debit it's rich enough to fund 'free' banking.
3
Just-in-time funding puts software at the moment of the swipe. A webhook lets a program check balance, enforce rules and fund the exact amount in a fraction of a second — the foundation of every modern card product.
← PREVIOUS
FX: the invisible profit center