Card issuing programs offer payments companies and lenders a natural path to diversify revenue and deepen customer engagement. At the same time, card programs bring a new set of legal, regulatory, and operational challenges. These programs typically require close coordination among the fintech, an issuing bank, and a card processor, with each playing a distinct role in the program and performing distinct operational and compliance functions. For fintechs pursuing an issuing program, the right structure—with clearly defined responsibilities, risk allocation, and compliance controls—is critical to managing regulatory, enforcement, and reputational risk and to building a program that can scale over the long term.
What Is a Card Issuing Program?
Card issuing programs allow fintechs to offer network-branded payment cards to end users by partnering with an issuing bank and a processor. A typical program includes the following participants:
- The issuing bank, which issues the card, holds the cardholder account, and retains primary regulatory responsibility
- The program manager (often a fintech), which designs the product, manages the customer experience, and performs day-to-day operational and servicing functions on behalf of the issuing bank, including onboarding, customer support, and certain compliance-related activities, subject to bank oversight
- The processor, which provides the technology infrastructure for transaction processing and settlement
- The card network, which routes transactions and establishes network operating rules
When a customer uses a card issued through the program for an approved purpose, the processor routes the transaction through the network to the merchant's acquirer, and the issuing bank authorizes or declines the transaction. Card issuing is often attractive because the program manager may share in interchange revenue generated by card transactions, in addition to earning program or service fees. These programs can also support a wide range of embedded finance use cases, including consumer and small business spending, expense management, disbursements, bill payment, and in-platform payments, making them an attractive way for fintech platforms and payments companies to expand their product offerings.
Understanding the Relevant Laws and Regulations
Card programs are subject to a range of federal and state requirements, including the Electronic Fund Transfer Act (EFTA), anti-money laundering (AML) and sanctions rules, privacy and data security laws, standards prohibiting unfair, deceptive, or abusive acts or practices (UDAP), and, for consumer credit card programs, the Truth in Lending Act (TILA), among others. They also draw regulatory scrutiny: in recent years, the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and state regulators have brought enforcement actions against issuing banks and program managers for violations tied to card programs.
At the center of this framework are the EFTA and its implementing regulation, Regulation E, which govern EFT services to consumers. For card programs, Regulation E addresses account disclosures, limits consumer liability for unauthorized transactions, and imposes error resolution requirements—an area that has drawn significant enforcement attention for both issuing banks and program managers. For prepaid cards, Regulation E's Prepaid Accounts Rule imposes enhanced disclosure and access obligations, and overdraft features are treated as credit. Where a prepaid card is linked to a credit feature, Regulation Z's more prescriptive "hybrid prepaid-credit card" rules may apply.
Debit and prepaid card programs must also comply with Regulation II, which implements the Durbin Amendment. Regulation II caps interchange fees for large issuing banks (over $10 billion in assets) and mandates network non-exclusivity and routing choice for all debit and prepaid cards, requiring issuers to enable at least two unaffiliated networks per card. While Regulation II applies to issuing banks, program managers play a key role in ensuring that card design, network enablement, and transaction routing align with the bank's compliance obligations.
For consumer credit card programs, TILA and its implementing regulation, Regulation Z, impose even more prescriptive requirements. Issuers must provide standardized disclosures in connection with applications and solicitations for credit, at account opening, and on periodic statements. Regulation Z bars unsolicited card issuance, requires an assessment of the consumer's ability to pay before opening an account or raising a credit limit, restricts rate increases on existing balances, and requires penalty fees charged to consumers to reflect reasonable costs borne by the issuer or fit within certain safe harbors. As with the EFTA, TILA also imposes its own billing error resolution procedures under the Fair Credit Billing Act. Other federal laws may also come into play with respect to consumer credit cards: the Equal Credit Opportunity Act and Regulation B prohibit discrimination in any aspect of a credit transaction, and the Servicemembers Civil Relief Act limits the interest rates and fees that may be charged to eligible servicemembers.
Overlaying these rules are broad consumer protection standards enforced by the CFPB, FTC, federal banking regulators, and state attorneys general. Regulators have flagged UDAP risks in card programs, including unclear fee disclosures, misleading marketing, and operational failures in fraud handling, error resolution, and fund access—theories that often overlap with Regulation E obligations. These risks are not merely theoretical. In CFPB v. JPay, LLC (2021), the CFPB alleged that a prepaid card program violated UDAP standards by requiring inmates to receive their funds on release cards that carried unavoidable fees. More recently, in another action, the agency pointed to systemic failures in customer service, error resolution, and stop-payment processing on a federal benefits card program.
Finally, card programs are subject to financial crime compliance under the Bank Secrecy Act (BSA) and OFAC sanctions. Issuing banks retain primary responsibility for customer identification, due diligence, transaction monitoring, sanctions screening, and suspicious activity reporting. Program managers may also face AML obligations under FinCEN's MSB rules, though in most bank-sponsored programs the manager avoids direct custody of funds and does not independently qualify as an MSB. Instead, program managers typically perform onboarding, monitoring, and reporting functions under contract, requiring robust controls aligned with the issuing bank's compliance framework.
Practical Considerations and Compliance Best Practices
Regulators and the issuing bank expect program managers to maintain an appropriately sized compliance management system (CMS) that addresses the full range of legal, operational, and consumer protection obligations associated with the card program. A robust CMS with clear governance, documented controls, staff training, monitoring and testing routines, and processes for identifying and remediating deficiencies is the most effective way to mitigate regulatory, operational, and reputational risk. In practice, deficiencies in program governance, documentation, and execution are a common source of regulatory findings and program disruption.
A. Establishing Bank Partner and Processor Relationships
Launching a card program requires a fintech to enter into one or more agreements with an issuing bank and, in many cases, a processor that provides transaction processing, card management, and related support services. These agreements are foundational to the program's risk profile and should clearly delineate operational responsibilities, compliance obligations, and the allocation of risk and liability among the parties. For the fintech, this often includes negotiating appropriate data rights, audit and access provisions, and contractual commitments that support its ability to meet its regulatory and operational responsibilities.
Equally important are provisions addressing regulatory contingencies and program continuity. Fintechs typically seek indemnification frameworks aligned to each party's areas of control, termination rights tied to regulatory or compliance failures, and transition assistance obligations that facilitate an orderly migration of services if a relationship is terminated. Issuing banks, in turn, will focus on retaining sufficient oversight and control to satisfy supervisory expectations, particularly where the fintech performs customer-facing or compliance-related functions.
B. Compliance Policies and Procedures
Beyond contractual allocation of responsibilities, effective risk management depends on the program manager maintaining a documented and operational CMS that is proportionate to the complexity and risk profile of the card program. Regulators and issuing banks generally expect a program manager's CMS to be overseen by the company's board and management and to include (i) written policies and procedures covering applicable legal, regulatory, and operational requirements, (ii) role-specific training for company personnel, (iii) a compliance monitoring and/or auditing program, (iv) a complaint management program, and (v) a vendor management program, as appropriate based on the size and scope of the card issuing program.
These policies and procedures should cover core program functions, including customer onboarding, transaction monitoring, customer service and error resolution, marketing and disclosures, and data governance. They must be supported by adequate staffing and by training tailored to relevant personnel and refreshed as laws, regulations, or program features evolve. Ongoing monitoring is critical to identifying control failures or operational weaknesses before they become systemic. Periodic internal audits or independent reviews should also confirm that controls are operating as designed, regulatory and contractual obligations are being met, and identified gaps are escalated and remediated in a timely manner. A vendor management program is also critical to ensuring that vendors used to help fulfill critical program functions do not pose meaningful systemic risk and maintain sufficient controls to meet regulatory expectations. When designed and working correctly, the CMS functions as a critical tool for maintaining program stability and identifying, managing, and mitigating regulatory risk.
C. Drafting Consumer-Facing Agreements and Disclosures
Finally, program participants should carefully draft the consumer-facing agreements and disclosures associated with the card program, including cardholder agreements, fee schedules, privacy notices, and in-app or online disclosures. Consumer-facing materials are often a focal point for regulatory scrutiny, particularly where disclosures are unclear or inconsistent or are not implemented in practice. Marketing and advertising materials also warrant close review for deceptive or misleading claims regarding fees, functionality, access to funds, rewards, or fraud protection. Program managers should therefore establish review and approval processes that ensure consistency across marketing content, customer interfaces, and contractual documentation.
* * * * *
Card issuing programs can be attractive for fintechs seeking to expand functionality, deepen customer engagement, and participate more directly in the payments value chain. At the same time, these programs present regulatory, operational, and reputational challenges that must be addressed through program design and compliance. Fintechs that prioritize bank oversight, governance clarity, and compliance scalability are best positioned to mitigate regulatory risk while supporting long-term growth.