Debit card issuing means putting a card on a deposit or prepaid account, so each purchase draws on money the cardholder already has. In the US, a fintech or software company typically does not issue the card itself. It works with a bank as issuer and BIN sponsor, a card network, an issuer processor and often a program manager. This guide covers those roles, the launch steps and the federal rules that apply.
Who does what in a debit card program
| Role | Responsibility | Example in public documents |
|---|---|---|
| Issuing bank (BIN sponsor) | Issues the card under its network membership, holds or settles the funds, approves the program | Sutton Bank, Marqeta’s largest issuing bank by volume |
| Card network | Network rules, authorization routing, settlement, interchange schedules | Visa, Mastercard, PULSE (named by Marqeta) |
| Issuer processor | Ledger, real-time authorization, card management API | Marqeta, Lithic, Highnote, Thredd |
| Program manager | Program design, compliance with bank and network rules, operations | Marqeta or Lithic when engaged to manage the program |
| Brand | Product, customer experience, often first-line support | The fintech or platform launching the card |
A BIN (bank identification number) is the opening digits of the card number. It tells the network which issuer to route a transaction to. “BIN sponsor” is the common name for the bank whose BIN a program uses.
Marqeta’s 2026 annual report describes how this works in practice. When engaged, Marqeta connects a customer with an issuing bank to act as BIN sponsor and manages compliance with the bank’s requirements and network rules. The bank “must ultimately approve each card program.” Sutton Bank settled 64% of Marqeta’s total processing volume in 2025, down from 76% in 2023.
Program managed or processing only
Most issuer processors sell two models. Lithic’s documentation sets them side by side:
| Processing only | Program managed | |
|---|---|---|
| Program ownership | You own and run the program | Lithic and its partner bank manage it |
| Bank and BIN | You bring your own | Provided by Lithic |
| KYC, fraud, oversight | Your team | Lithic |
| Ledgering and settlement | Your team | Lithic |
| Speed to market | Longer setup | Faster launch |
| Fits | Experienced fintechs and financial institutions | Startups and SaaS platforms |
KYC (“know your customer”) is the identity check a bank must run before opening an account. Under Lithic’s program-managed model, Lithic also covers AML/BSA compliance, card manufacturing and network connectivity.
BaaS platforms go one step further and bundle the account itself. Unit sells debit, credit and prepaid cards alongside deposit accounts from its partner banks. Synctera offers debit, credit, charge and fleet cards on sponsor banks from its network. The card issuing guides compare the layer.
Steps to launch a debit card program
- Define the account. A debit card needs an underlying account: a bank deposit account, or a prepaid account. That choice decides which rules apply.
- Pick the operating model. Program managed means less work and less control. Processing only means your own bank contract and compliance program.
- Get bank approval. The issuing bank reviews the program design, the business and its compliance plan. See how to choose a sponsor bank.
- Set up the BIN and network. Lithic lists the steps before physical cards can ship: establish and validate BINs with the network and card manufacturer, set card art and manufacturing requirements, then test spend and shipping.
- Build onboarding and controls. KYC, fraud rules, spend limits and dispute handling.
- Launch virtual first, if possible. Lithic lets a newly created physical card be used online and in digital wallets while the plastic is being made. Our guide to virtual card issuance covers card-number-only programs.
Interchange and the Durbin cap
Interchange is the fee the merchant’s side pays the card issuer on each transaction. For debit, federal law limits it for large issuers. Regulation II, the Federal Reserve’s rule under the Durbin Amendment to the Dodd-Frank Act, caps the fee at:
- 21 cents per transaction, plus
- 5 basis points (0.05%) of the transaction value, plus
- 1 cent if the issuer meets the Fed’s fraud-prevention standards.
On a $39 purchase, the base cap is 22.95 cents, the example given in the regulation itself. The cap applies to “covered issuers”: issuers that, with their affiliates, have $10 billion or more in assets. Smaller issuers are exempt, as are some reloadable prepaid cards under set conditions.
Because the cap is tested at the issuer level, the asset size of the BIN sponsor decides whether a program’s debit interchange is capped. That matters when a program shares interchange. Marqeta’s contracts with issuing banks entitle it to the interchange its customers’ programs generate, which it then shares with customers as revenue share.
The routing rules apply to every issuer, including exempt ones. Each debit card must be enabled on at least two unaffiliated networks, and merchants choose the route. A Fed rule effective July 1, 2023 made clear this covers card-not-present payments too.
What changed in 2023–2026. In October 2023 the Fed proposed lowering the cap to 14.4 cents plus 4.0 basis points, with a 1.3-cent fraud adjustment, and updating it every two years. As of August 29, 2026, that proposal has not been finalized. On August 6, 2025, the US District Court for the District of North Dakota vacated Regulation II’s fee standard in Corner Post, Inc. v. Board of Governors, then stayed that ruling while the case is appealed. The eCFR still shows the 21-cent cap as the current rule.
Regulation E and the Prepaid Rule
Regulation E governs electronic fund transfers from consumer accounts. A debit card is an “access device” under it. Key duties fall on the financial institution:
- Unauthorized transfers. Consumer liability is capped at $50 if the loss is reported within two business days, and at $500 in most later cases.
- Error resolution. The institution must investigate reported errors within set deadlines.
- Prepaid accounts. The CFPB’s Prepaid Rule, effective April 1, 2019, extends tailored disclosures, liability limits, error resolution and periodic statement rules to prepaid accounts. It also brings some overdraft credit features on prepaid cards under Regulation Z.
The CFPB’s commentary notes that employers and service providers are usually not “financial institutions” under the prepaid rules, unless they hold the accounts or issue the cards. That is why the bank and the program manager split these duties in their contract. This section describes the rules; it is not legal advice.
Questions to ask a provider
- Which bank will issue our cards, and is it above or below $10 billion in assets?
- Who owns KYC, fraud monitoring and disputes under our contract?
- How is interchange shared, and what happens to it if the bank changes?
- Which networks will the cards carry, and how is dual routing met?
- How long does BIN setup and physical card production take?
- Can we move from program managed to processing only later?
- Is pricing published? Marqeta and Lithic do not publish issuing prices.
Profiles: Marqeta, Lithic, Highnote, Thredd, Sutton Bank, Patriot Bank.
