Demystifying Cards
The licensing question
At first glance, the world of licensing for card programmes might seem impossibly complex. Don’t let this deter you. It’s mainly due to the variety of licences, the different options for achieving your goals, and the overlap between roles and responsibilities, which depends on how you want to set up your card programme.
The trick is to define the objectives and ambitions for your card proposition and then work back from there. For example, what building blocks do you need to put in place to create your card proposition? How quickly do you need to launch? What in-house expertise or financial resources do you have? Once you’re clear on these kinds of questions, the right path to licensing should begin to reveal itself.
It’s helpful to think about your licensing options through three different, but related, lenses: Time, Financial Resources and In-House Resources and Expertise.
There are two broad types of licence – a network (scheme) licence and a regulatory licence. Which you will need will depend mainly on your business model and the size of your card programme as well as your specific business model at launch.
Network (Scheme) licence
You may not need to be licensed to launch a card programme if you’re working with a network (scheme) sponsor and a regulated entity. In fact, they’ll do all the work for you and make sure you’re compliant before you launch. This is often the most viable option for smaller-scale card programmes that don’t have the financial resources or expertise to support in-house operations.Typical requirements:
- Less in-house technical or operational expertise needed
- Smaller compliance team
- Network (scheme) deposit (smaller capital requirement than a regulatory licence)
Novus World
Our partners at Novus made the decision early on in their journey to partner with a regulated issuer. They felt that this route was the most cost-efficient, being a new startup. They commented that this route provides great legal and regulatory insights and guidance, and is typically quicker than the principal membership process.
- Network (scheme) application form completed, with supporting documents
- Customer completes the online License Kick-Off Form
- Network (scheme) Account Manager organises a call to present the process and set expectations
- Network (scheme) advises the customer about their application
Documents required will include Act of Incorporation or Articles of Association, Regulatory license Financial Statements or opening balance sheet; Anti-Money Laundering (AML) policy, processes and controls, Organisational Chart of Compliance Team
ICA/BIN Request form.
The Customer Risk Management (CRM) review process
Mastercard guarantees settlement finality of most processed transactions, so they have a risk exposure to Principal Customers, and CRM manages that risk, including obtaining collateral in some cases.
Principal Customers typically provide collateral, if required, before being set live in the network’s (scheme) systems. The CRM review determines whether and how much collateral needs to be provided by an applicant.
CRM published a document summarising the networks’s (scheme) approach to managing settlement-related credit exposure, including the risk standards applicable to customers, the types of collateral accepted, and the criteria applied to issuers of standby letters of credit and guarantees.
Options include a Standby letter of credit (SBLC) and cash collateral
CRM carries out its review of applicants once a complete license application package has been received.
- Licensing initial review
- Legal review
- AML review
- Customer Risk Management (CRM) review – could include Collateral placement
Final step – License is granted and ICA and BIN are assigned
Full Access to Mastercard Connect provisioned
Implementation phase with Customer Implementation Services commences and project opened.
The process to go live often takes around 6 months when ICA/BIN and technical parameters are put into a production environment. (From completion of an initial statement of work to go-live.)
Proof of eligibility for a Visa License, in the form of either: A copy of license to operate granted by the relevant regulatory authority showing that it is either:
- Organised under commercial banking laws and authorised to accept demand deposits; or
- A Payment Service Provider from an EU/EEA Member State or from a country where the PaymentServices Directive has been implemented by relevant national legislation.
Business Plan and Financial Information – Visa Business Programme Plan, including:
- Issuing: nominal amounts of Card Expenditure Volumes for 3 years
- Balance sheet, Profit & Loss and Cash-Flow statements
- Latest interim accounts Management details:
- CV‘s of top managers showing professional experience
- Details on any other entity providing financial support where applicable
- 3 year financial forecasts including Balance sheet, P&L and Cash-Flow statements
- Corporate structure
- Fundraising plans and business model
Compliance/Anti-Money Laundering For all applications
- A list of individuals holding 10% or more share of the institution and a list of beneficial owners holding 10% or more of these entities.
- Latest written Anti-Money Laundering / Anti-Terrorist Financing policy and actual procedure documents
- Independent Audit Report of the institution’s Compliance control framework undertaken either by: The institution’s Internal Audit Department, which must be independent from the company’s operational team or an external Third Party Auditor
In addition:
- Documented evidence of the company’s organisational profile, including:
- Company overview, business plan, and strategy
- Organisational structure charts, including FTEs
- Risk management
- Fraud management
- Chargeback handling
- Outsourcing, including activities outsourced, data handling locations
- Documented evidence validating Payment Card Industry – Data Security Standard (PCI-DSS) compliance
- Documented evidence of the company’s Key Performance / Risk Indicators, including
- Fraud rate, Chargeback rate and Fraud loss write-off
- A list of available Management Information reports, Fraud detection capability
- Fraud detection rule & parameter effectiveness
- Overall effectiveness of the fraud management function
- Operational process flow diagram for the issuing business, detailing the transaction process and risk management activities
- Risk management strategy and policy documentation, including
- New account on-boarding policy
- Authorisation policy & parameter change management
- Fraud transaction detection
- Fraud application detection
- Fraud and dispute management
- PIN production / storage / key management
- Card production, replacement & distribution
- Chargebacks / disputes
- Write offs
Further reading here, which provides more details on the fall-out from the regulated issuer (and BIN sponsor) Wirecard, and several Fintech companies had to migrate away from using the company’s services to support their businesses when Wirecard’s parent company filed for insolvency. Curve are featured here.
Regulatory licence
The type of regulatory licence you need to issue cards depends on your card proposition. So if you’re a bank or credit union and want to hold customer funds, you’ll typically need a financial institution (FI) licence. If you want to offer payment services only, a payment institution (PI) license will typically be enough. And if you want to offer payment services and issue e-money, you’ll typically need an e-money institution (EMI) licence.
Typical requirements:
- A licence application usually takes six months
- High staffing levels to administer
- Large capital requirement
- Extensive in-house expertise and compliance requirement
Choosing the right licensing route for you
The first point to make is that you don’t need to be a licenced entity to start a card programme. But you will need to operate under a regulated entity or card network (scheme) principal member that has a license for the card services you want to provide. This entity could be either a BIN Sponsor or a Programme Manager (who is a regulated issuer directly, or uses a regulated issuer’s licence.)
Which route works best for your business generally depends on how many cardholders and employees you have.
NB: A recent example of not getting this quite right are Lanistar. They jumped the gun slightly when announcing they were FCA approved and the FCA were quick to disprove that statement. Many in the industry were also skeptical of how an early stage startup would manage to get regulatory approval so quickly as it looked like they were still quite early in their journey and hadn’t launched yet. It may have just been misunderstanding or miscommunication because they later announced that they would have agent approval under a Principal Member (see later) which was an Authorised Electronic Money Institution who did have FCA approval.
Here is the current status (May 2021) on the FCA financial services register, however in November 2020 they issued this warning that was subsequently removed and this article goes into the reasons why.
Whatever happened behind the scenes, it is fundamentally important to understand (or indeed work with a partner who understands) the requirements of the regulator for card issuance into their geographical area of responsibility.
Programme Manager
An end-to-end Programme Manager looks after the day-to-day administration of a card programme. This route allows you to focus on your go-to-market proposition, knowing that everything from onboarding, KYC, AML to fraud and chargebacks is being taken care of. They can manage the commercial or operational relationships with the BIN Sponsor, but as they’re probably a principal member, you wouldn’t need a third-party BIN Sponsor.
Advantages:
- You can use a PM’s BIN Sponsor and processor contracts to go to market faster (typically 3-6 months, rather than 4-9 months)
- Lower set-up and ongoing monthly costs compared to other routes
- Access other services you may need, such as contact centres, multi language support, IVR for card activation, due diligence check for your customers, etc.
- Know-how and experience of launching and running previous card programmes
BIN Sponsor
The BIN Sponsor route is a quick, easy and compliant way to join a card network (scheme) directly. In effect, you’re allowing an established and regulated principal member to sponsor your product, and therefore access to a card network. If your card programme isn’t your core business, this route avoids the sizeable investment of becoming a principal member, along with the resources overhead and regulatory scrutiny.
Advantages:
- Use BIN Sponsor’s principal membership to access relevant card networks simply
- Access to technical, regulatory and compliance expertise
- The right BIN Sponsor will have the UK and European coverage you need
- Faster route to market than becoming a principal member
- A stepping-stone to learning the ropes before becoming a principal member
Principal member
The route to becoming a principal member takes longer and is more expensive. You’ll need to become a financial institution (FI) and go through the process of obtaining your payment institution (PI) or e-money institution (EMI) licence. Once a card programme reaches 50,000 card users, this is typically a critical mass to consider becoming a principal member.
Advantages:
- Complete control over every aspect of your card programme
- Bigger margins as you’re running everything in-house
- Closer relationship with card networks to develop new products
- Faster and easier route to launch new products
- Additional revenue streams through licensing and BIN sponsorship opportunities
Agent of a Principal Member
A quicker route to get to market whilst still ticking all the regulatory boxes and good for the short-medium term. This also means that you’ll be partnering with a Principal Member who has regulatory approval to provide payment services or e-money activities. A common way of doing this is to partner with an organisation who provides a key part of the card programme like a payments or core banking platform who are a regulated PI or EMI.
Advantages:
- Quicker route to market
- Partnering with a recognised market participant
- A good short-medium term solution until the programme is more mature and you want to bring more services in-house and apply for principal membership
Worth considering
Expertise
Launching a card programme requires a specific skill-set, as well as specific knowledge and expertise. So it’s worth asking who in your organisation has this? If no one has, it’s time to bring in specialist help. The networks (schemes) may be able to help and have specifiats teams to offer support, so worth checking with them. There are also many consultancy firms out there who will provide support and guidance. Bear in mind that once live you will need to ensure ongoing compliance with the network (scheme) requirements so consider the right resource for this across your team.
Standalone BIN
You may consider a private (stand-alone) BIN from the outset. It will cost more and take more time and effort for both the project phase and for ongoing programme management, but it gives you flexibility and scalability as your programme matures. So, if in future, becoming a principal member makes commercial and operational sense, you can take your BIN with you and avoid the cost and hassle of extricating yourself from a shared one.
Ask the question of your potential partners – do I get a private or shared BIN if I chose to work with you?
Licensing Strategy
Choose a licensing option that will take you to a defined strategic point:
- If you change issuer, you may have to re-card. (Not doing so requires the permission of both the new and incumbent issuer.) This involves considerable work and can be expensive.
- Consider principal membership at the outset if your business has the financial and in-house resources to do so. This route will require you to have inhouse card regulation and compliance expertise from both a network (scheme) and regulatory perspective and will inevitably add to the onboarding time.
- Don’t underestimate your card proposition from a compliance point of view, so ask yourself if a potential issuer’s compliance rules on reporting and risk fit your business model. Also ask yourself if their commercial model fits your business model.
Partner capabilities
Are your partners innovative, with technology that compliments modern day requirements?
- Do they offer fully open APIs for you to test their technology before committing any further?
- Are they cloud based, or do they have legacy infrastructure?
- Are they able to provide customer testimonies that demonstrate their ability to collaborate, enabling you to build and test a card programme before launching and then continually iterating it as you and your customers require?
- Aside from their technology, do they have the right people in place who will work with you to create a card programme fit for the future and who understand your value proposition?
- Are you able to launch in new geographies quickly and with little technical lift?
Compliance
Choose a BIN sponsor who offers compliance as part of their service. They’ll help make sure you have everything you need in place when you launch.
Regional Availability
Choose a BIN sponsor who already operates in the countries you’re entering. They should know what you need, without you spending large sums to work it out for yourself.
Rewire – Brexit and Passporting
Getting a financial services licence is a big decision in any company’s life. Rewire issued a celebratory announcement stating that it has received an Electronic Money Institution Licence (EMI) in the Netherlands. This article tells you more about why they decided to become licensed, and what it means for them going forward. Read more.
Continue reading
Product
Legal
Location
© 2024 Marqeta, Inc. 180 Grand Avenue, 6th Floor, Oakland, CA 94612