The SME card issuing stack: sponsor banks, issuer-processors, interchange economics and what a bank should ask

What is the SME card issuing stack, and who does what in it?

A business card is a contract between at least four companies, even when the business sees one brand. Visa's own guide for would-be issuers puts it in one sentence: “To launch a card program, you’ll need a banking relationship, an issuer processor and likely a program manager.” Visa defines the BIN sponsor as “the issuing bank that owns the Bank Identification Number (BIN), which is necessary to access the Visa network”, which “holds cardholder funds, and takes on the role of managing risk and local country regulations, adhering to Visa rules and often acting as the settlement agent.” Issuer processors “keep the system of record, manage issuance, authorize transactions and communicate with settlement entities.” The program manager “oversees your card program on the issuing bank’s behalf” and is “typically responsible for developing, launching and managing the program through its lifecycle.” Visa also lists end-to-end partners that bundle BIN sponsorship, processing and program management behind one interface.

Marqeta's FY2025 Form 10-K uses the same split from the processor's side: issuer processors “provide a technology platform, ledger, and infrastructure to support a card issuer and connects with a Card Network”, while issuing banks “issue a payment card (debit, prepaid, or credit) either on its own behalf or on behalf of a business.” The filing is also candid about who designs the program in practice: “While an Issuing Bank must ultimately approve each card program, Marqeta configures the program design, negotiates key program terms, and selects the Issuing Bank for each customer.” That sentence is the commercial reality of fintech card issuing in the US: the bank holds the charter and the regulatory duty, while the processor or program manager often holds the customer, the design and the choice of bank.

This page is about building and running the program. For how small businesses are adopting tokenised, digital-first cards and the networks' SME programmes for issuers, see SME cards and tokenisation; for banking-as-a-service beyond cards, including the Synapse collapse, see embedded payments explained.

Which issuer-processors run SME card programs, and what is on the public record about each?

Processors split into two families. Fintech-era API processors (Marqeta, Galileo, Lithic, i2c, Stripe Issuing, Adyen) sell to program managers and fintechs, often bundling a bank. Bank-era processors (Fiserv, FIS) run the credit and debit books of banks themselves. The 2025–2026 record moved both: FIS bought Global Payments' issuer business, the old TSYS franchise, and Marqeta and SoFi both disclosed how concentrated their revenue is.

Two patterns matter for a buyer. First, concentration cuts both ways: Marqeta and Galileo both depend on a few very large programs, which makes them attentive to large clients and exposed when one leaves; Marqeta's August 2023 Block amendment already handed Block the job of “managing the financial relationship between the Cash App program and the primary Card Network”. Second, the line between processor and bank is blurring from both sides. Adyen issues on its own licences, Stripe offers either model, and Lithic now sells a bundled route with a licensed issuer. What is not on the record: none of the private processors (Lithic, i2c, Stripe for issuing alone) publishes volume, uptime incidents or loss rates, and neither Fiserv nor FIS breaks out commercial or SME card accounts.

How does an SME card program make money: interchange, the Durbin exemption and revenue share?

The literal answer: mostly interchange, shared down the stack. Marqeta's 10-K defines interchange fees as “transaction-based and volume-based fees set by a Card Network and paid by a merchant bank to the Issuing Bank”. Under its agreement with Sutton Bank, Marqeta pays Sutton “a fee based on a percentage of the value of transactions processed” and is “entitled to receive 100% of the Interchange Fees for processing our customers’ card transactions”; it then pays its customers a revenue share “computed as a percentage of the interchange fees earned or processing volume”, monthly, booked as a reduction of revenue. Networks add volume incentives on top, which Marqeta notes are earned at the highest rates in the first quarter as annual thresholds are reached. Adyen markets the same mechanism to platforms: “Earn interchange revenue on every transaction.” Charge-card programs, such as the Ramp Commercial Charge Card listed in Ramp's issuing bank schedule, also involve credit, and someone in the stack carries those losses.

Why the issuing bank is usually under $10 billion

For debit and prepaid cards, which is what many SME accounts carry, the size of the issuing bank sets the price. Regulation II caps interchange for a covered issuer at “$0.21 plus 0.05 percent multiplied by the value of the transaction, plus a $0.01 fraud-prevention adjustment”; issuers with under $10 billion in worldwide assets are exempt. The Federal Reserve's 2024 data show what that is worth: exempt transactions averaged $0.51, or 1.21% of an average $42.27 ticket, against $0.23, or 0.47%, for covered transactions. Marqeta says it “generally work[s] with Issuing Banks that are exempt from the Interchange Fee caps in the Durbin Amendment” for prepaid and debit programs. The Bancorp, one of the largest sponsor banks, states the strategy outright: “We manage our balance sheet to remain under $10 billion in assets to maintain our exemption”, and certain of its fee-sharing agreements let partners terminate if it loses it. It reported total assets of $9.35 billion at 31 December 2025 against $178.21 billion of prepaid and debit gross dollar volume in 2025 (+17%).

A worked example using only the published formula: on a $100 business debit purchase, a covered bank can receive at most $0.21 + $0.05 + $0.01, or $0.27. The exempt average of 1.21% is an average across all exempt transactions, not a rate any one program is promised, so the gap for a given program depends on its network, merchant mix and pricing tier. None of the filings read for this page publishes a sponsor bank's fee rate or a program's revenue-share percentage.

What is the legal state of Regulation II and the Credit Card Competition Act in 2026?

Both halves of card economics are contested. On debit, the 2011 cap is in court. On credit, which is where commercial charge cards sit, Congress has a routing bill that would reach the largest issuers. The table lists each step from the documents themselves.

For a bank designing an SME card program the practical reading is narrow. A sponsor bank under $10 billion keeps the debit exemption whatever happens to the cap, unless Congress or the Fed changes the threshold. A covered bank's debit economics depend on the Eighth Circuit: affirmance of the vacatur would send the Fed back to rewrite the standard. And the credit bill, as introduced, would not touch issuers below $100 billion in assets at all, which includes most sponsor banks; it would reach the large commercial card issuers. The bill text read for this page contains no separate carve-out for commercial cards; whether one is added is not on the record.

How do KYB, credit decisioning and spend controls work, and what AI claims are on the record?

Every business card starts with know-your-business: verifying the entity, its owners and its address, then deciding whether, and how much, to lend. The legal duty sits with the bank. Sutton Bank's 2024 FDIC order, for example, required it to make its prepaid program managers “collect all required information” for its customer identification program and to look back at prepaid card customers from 1 July 2020. The work itself is increasingly done by the program manager or the processor, and that is where the AI claims are.

• Brex (Capital One since 7 April 2026). Brex says it rebuilt onboarding as “an AI-native, multi-agent system” and that “most eligible businesses onboard to Brex in minutes”, against days before. Segmentation agents classify startups at application; OCR agents verify proof of address, articles of incorporation, SAFEs and bank statements; a fuzzy-match agent “reduced manual identity reviews by 70%”; underwriting agents “reconstruct a company's financial profile by automatically qualifying and mapping applicants to UW segment policies” (January 2026).
• Capital One. Announcing the $5.15 billion Brex purchase on 22 January 2026, Capital One paired Brex's software with its own “sophisticated underwriting”; its 10-K places “domestic small business card lending” in the Credit Card segment. It does not describe the models.
• American Express. The FY2025 10-K says “our models and analytical tools help us reduce fraud and underwrite risk, such as in determinations regarding the extension of credit”; Commercial Services billed business grew 3% in 2025 on “modest growth from U.S. small and mid-sized enterprise (SME) Card Members”.
• Marqeta. An AI-powered risk score inside Real-Time Decisioning (31 March 2026) “evaluates 300+ real-time transaction attributes against historical behavioral patterns” with “millisecond-level response times”, alongside customer-defined rules and controls.
• Stripe and Adyen. Stripe lists account creation and KYC, and fraud tools trained on “trillions of transactions”; Adyen lists “integrated KYC/KYB infrastructure and fraud protection” and spend controls that “restrict merchant categories, and enforce approval workflows”.

Spend controls are where the processor's authorization engine meets the business's policy. The common set across Stripe, Adyen and Marqeta's pages is instant virtual cards, per-card and per-employee limits, merchant-category restrictions, and real-time authorization decisions that the program can intercept with its own rules. A bank adding these to its own commercial card can build on its processor's engine or buy a front end, which is what Fifth Third did with Brex Embedded (below).

What is not on the record: Ramp and Mercury do not publish how they underwrite card limits; no issuer publishes approval rates, loss rates or adverse-action reason distributions for AI-underwritten business cards; and Brex's 70% figure measures manual reviews avoided, not credit outcomes. Business credit is still covered by the Equal Credit Opportunity Act, so a model that declines or cuts a limit must still produce reasons; see AI credit underwriting.

Where do banks sit versus fintechs in SME card issuing in 2026?

The 2025–2026 record shows the boundary moving toward banks. A large bank bought the best-known fintech card issuer, a regional bank made a fintech's card its default commercial product, and a fintech that relied on sponsor banks applied to become one. The table sorts the models on the record.

The common thread is control of the balance sheet. Charge-card programs need someone to fund receivables and absorb losses, and enforcement made a rented charter more expensive; owning the bank (Capital One), being the bank (Mercury's application) or bringing the software into an existing bank (Fifth Third) all solve that. Brex's chief executive put the Fifth Third deal in distribution terms: access to “roughly 8% of the U.S. commercial banking sector through a single partner”.

What does the sponsor-bank enforcement record mean for a card program?

Between 2023 and 2026 the FDIC, the OCC and the Federal Reserve put several fintech sponsor banks under formal orders; the full list with dates is on our embedded payments page. Three matter directly to card programs, because the banks named are card issuers for fintechs and the orders spell out what a card sponsor must control.

The lesson for both sides is the same: the bank cannot outsource accountability. Every order above makes the bank inventory what its program managers do, monitor their customers as its own and be able to stop onboarding. For a fintech, a sponsor bank under an order can mean frozen launches and forced migrations, as Mercury's exit from Evolve showed. For a bank considering becoming a sponsor, these are the controls an examiner will test. The interagency third-party relationship guidance (OCC Bulletin 2023-17, cited in the Blue Ridge order) applies to all of them.

What should a bank ask before launching or sponsoring an SME card program?

The questions below follow from the documents on this page; each maps to a disclosure or an order requirement rather than a vendor's marketing.

• Who picks whom? If a processor selects the issuing bank, as Marqeta's 10-K says it does, ask what share of the processor's volume your program would be, and what happens to your BIN range and cardholders if the processor or program manager leaves.
• Concentration. Ask for the processor's largest-client share (Block was 45% of Marqeta's 2025 revenue; a large Galileo client left before December 2025) and what service levels survive a client loss.
• Interchange exposure. Model the program at both covered and exempt debit rates, at a lower cap if the Eighth Circuit sends Reg II back, at the Illinois tax-and-tip carve-out, and, for issuers over $100 billion, under the Credit Card Competition Act as introduced.
• Revenue-share terms. Get the formula in writing: percentage of interchange or of volume, how network incentives are split, and who bears losses. Marqeta's Sutton agreement includes indemnities and termination fees.
• Ledger and reconciliation. Who holds the system of record for balances and credit lines, and can the bank reconcile to each end customer daily? Synapse is the reason this question exists.
• KYB and CIP ownership. An inventory of which AML/CFT duties each party performs, as Sutton's order requires; evidence of identity data completeness; the right to audit; a lookback plan.
• Model governance. For AI onboarding and underwriting agents (Brex) or authorization risk scores (Marqeta): validation data, confidence thresholds, human review triggers, adverse-action reasons, and how changes are approved.
• Exit. Termination plans for each fintech and sub-partner, as orders require; portability of BINs, tokens and card data to another processor.
• Charter path. Whether the partner intends to become a bank (Mercury's OCC conditional approval, April 2026) or be acquired by one (Brex), and what that does to the sponsor relationship.

For the bank and network partnership side, including how a bank signs a branded program with Visa or Mastercard, see payment networks and bank partnerships; for fraud models at authorization, see AI fraud detection.

1. Visa Partner Types: BIN sponsors, issuer processors, program managers (undated page, retrieved 2026-10-21) — Visa, Oct 21, 2026 (partner.visa.com)
2. Marqeta, Inc. Annual Report on Form 10-K for fiscal 2025 — Marqeta via SEC EDGAR, Feb 24, 2026 (sec.gov)
3. Marqeta Reports Second Quarter 2026 Financial Results (Exhibit 99.1) — Marqeta via SEC EDGAR, Aug 4, 2026 (sec.gov)
4. Marqeta Delivers AI-Driven Risk Score to Help Customers Prevent Payment Fraud — Marqeta via Business Wire (Yahoo Finance), Mar 31, 2026 (finance.yahoo.com)
5. SoFi Technologies, Inc. Annual Report on Form 10-K for fiscal 2025 — SoFi Technologies via SEC EDGAR, Feb 17, 2026 (sec.gov)
6. SoFi Reports Second Quarter 2026 with Record Net Revenue of $1.2 Billion — SoFi Technologies via Nasdaq, Jul 29, 2026 (nasdaq.com)
7. Fidelity National Information Services Annual Report on Form 10-K for fiscal 2025 — FIS via SEC EDGAR, Feb 24, 2026 (sec.gov)
8. FIS Reports Second Quarter 2026 Results (Exhibit 99.1) — FIS via SEC EDGAR, Aug 4, 2026 (sec.gov)
9. Fiserv, Inc. Annual Report on Form 10-K for fiscal 2025 — Fiserv via SEC EDGAR, Feb 19, 2026 (sec.gov)
10. Lithic and Monavate Partner to Power Card Programs Across Traditional and On-Chain Finance — Lithic via Business Wire (Nasdaq), Aug 13, 2026 (nasdaq.com)
11. i2c Named "Overall FinTech Company of the Year" in 2026 FinTech Breakthrough Awards — i2c via Business Wire, Mar 24, 2026 (businesswire.com)
12. Stripe Issuing (undated product page, retrieved 2026-10-21) — Stripe, Oct 21, 2026 (stripe.com)
13. Adyen Issuing (undated product page, retrieved 2026-10-21) — Adyen, Oct 21, 2026 (adyen.com)
14. Regulation II: Average Debit Card Interchange Fee by Payment Card Network (2024 data; retrieved 2026-10-21) — Board of Governors of the Federal Reserve System, Oct 21, 2026 (federalreserve.gov)
15. Federal Reserve Board requests comment on a proposal to lower the maximum interchange fee that a large debit card issuer can receive — Board of Governors of the Federal Reserve System, Oct 25, 2023 (federalreserve.gov)
16. North Dakota federal court vacates Regulation II — ABA Banking Journal, Sep 2, 2025 (bankingjournal.aba.com)
17. Kentucky federal court upholds Regulation II, creating split with North Dakota federal court — ABA Banking Journal, Oct 1, 2025 (bankingjournal.aba.com)
18. Federal Reserve files reply brief in Reg. II appeal — ABA Banking Journal, Apr 1, 2026 (bankingjournal.aba.com)
19. The Clearing House and BPI File Amicus Brief in Appeal of Case Vacating Portions of the 2011 Debit Interchange Rule — The Clearing House, Jan 9, 2026 (theclearinghouse.org)
20. S.3623 — Credit Card Competition Act of 2026 (all information) — congress.gov, Jan 13, 2026 (congress.gov)
21. S.3623 — Credit Card Competition Act of 2026 (text as introduced) — congress.gov, Jan 13, 2026 (congress.gov)
22. H.R.7035 — Credit Card Competition Act of 2026 (all information) — congress.gov, Jan 13, 2026 (congress.gov)
23. The Bancorp, Inc. Annual Report on Form 10-K for fiscal 2025 — The Bancorp via SEC EDGAR, Feb 25, 2026 (sec.gov)
24. Consent Order FDIC-23-0110b, Sutton Bank — FDIC and Ohio Division of Financial Institutions, Feb 1, 2024 (orders.fdic.gov)
25. Consent Order AA-ENF-2023-68, Blue Ridge Bank, N.A. — Office of the Comptroller of the Currency, Jan 24, 2024 (occ.gov)
26. Order Terminating the Consent Order AA-ENF-2025-58, Blue Ridge Bank, N.A. — Office of the Comptroller of the Currency, Nov 13, 2025 (occ.gov)
27. Federal Reserve Board issues an enforcement action against Evolve Bancorp, Inc. and Evolve Bank & Trust — Federal Reserve Board, Jun 14, 2024 (federalreserve.gov)
28. Mercury to pivot from partner bank Evolve — Banking Dive via Yahoo Finance, Mar 17, 2025 (finance.yahoo.com)
29. Issuing Bank Schedule (last updated April 22, 2026) — Ramp, Apr 22, 2026 (ramp.com)
30. The end of the trade-off: How AI agents broke the onboarding trilemma — Brex, Jan 20, 2026 (brex.com)
31. Fifth Third and Brex Partner to Bring AI-Powered Finance to Businesses, Unlocking $5.6B in Commercial Card Volume — Brex, Dec 9, 2025 (brex.com)
32. Capital One to Acquire Brex — Capital One, Jan 22, 2026 (capitalone.com)
33. Capital One completes acquisition of Brex — Capital One, Apr 7, 2026 (capitalone.com)
34. Capital One Financial Corporation Form 10-K for fiscal 2025 — Capital One via SEC EDGAR, Feb 19, 2026 (sec.gov)
35. American Express Company Annual Report on Form 10-K for 2025 — American Express via SEC EDGAR, Feb 6, 2026 (sec.gov)
36. Mercury Receives OCC Conditional Approval to Establish Mercury Bank, N.A. — Mercury via Business Wire, Apr 27, 2026 (businesswire.com)