How to choose an issuer processor

The short answer on how to choose an issuer processor: decide who approves each authorization and whose ledger is the system of record, then compare networks and debit routing, sponsor bank partners, published uptime and PCI DSS or SOC evidence, API and webhook design, whether program management comes with the deal, what pricing is disclosed, and the terms for moving your BINs out later.

What an issuer processor does

An issuer processor sits between the card network and a program’s own systems. It answers authorization messages in real time, holds a balance or mirrors the one your service holds, runs the card lifecycle, provisions tokens into digital wallets, and carries dispute and 3-D Secure traffic. The card issuing guides cover the layers around it.

Two of those jobs shape the rest. The first is the authorization decision. Marqeta documents both arrangements: under Gateway just-in-time (JIT) funding, where funds come from the program’s own gateway funding source, “the Marqeta platform and your system both participate in authorization decisions”, while under Managed JIT the platform sends “only JIT Funding notifications”. The second job is the system of record. Thredd sells its own ledger as the basis of its reliability claim, describing “the system of record as the backbone” of a 99.99% platform uptime figure.

Card lifecycle and tokenization decide how fast a card becomes usable. Highnote issues virtual cards on Visa and Mastercard and provisions them to “Apple Pay, Google Wallet, and Samsung Pay” by manual entry, in-app push, Apple web push or Tap to Add. Thredd documents connections to Mastercard’s Digital Enablement Service and the Visa Digital Enablement Programme. For programs that never ship plastic, see virtual card issuance.

For 3-D Secure, Lithic publishes two models: Lithic decides, or your system must “respond with an authentication decision within one second”. Lithic’s docs also state that “Mastercard mandates a minimum 70% approval rate for frictionless 3DS authentications” and that the penalties pass through to the program. Ask in writing who absorbs that risk.

Who approves each transaction

The order of the rows below carries no meaning.

What happens at the deadline differs more than the deadline itself. Marqeta declines the transaction to the card network if your gateway misses three seconds. Lithic runs its own security rules, Auth Rules and balance checks first, so a transaction that fails them never reaches your endpoint, and it declines after six seconds. Stripe Issuing falls back to your timeout settings or Autopilot. Highnote applies the card product’s stand-in settings. SoFi Tech Solutions (formerly Galileo) states that “there is no retry mechanism for Auth API messages” and requires “Proof of bank approval” and a signed statement of work before setup.

Thredd’s EHI has four modes: Gateway Processing, where your systems hold the balance and decide; Cooperative, where Thredd decides and you can override; Full Service, where Thredd decides; and Gateway with stand-in, where Thredd authorizes when your systems are unavailable. Its default timeout is 800 milliseconds and can be changed; that figure entered the guide on May 1, 2026, replacing the 200 ms listed in earlier versions. Treat the window as a contract term and ask whether it is set per program.

Networks and debit routing

Regulation II bars an issuer or a network, “directly or through any agent, processor”, from restricting a debit transaction to fewer than two unaffiliated networks. The Federal Reserve’s final rule of October 3, 2022 confirmed that the requirement covers card-not-present transactions and took effect July 1, 2023. The Fed’s Regulation II guide adds that it applies to all issuers “regardless of asset size” and to any form of debit card, including e-wallets.

So ask which networks a processor is already integrated with, and how the second, unaffiliated debit network gets attached. SoFi Tech Solutions lists Mastercard Banknet, Maestro/Cirrus, Visa, Interlink, Plus, PULSE, Discover, STAR, MoneyPass, Allpoint and Presto!, and says a program “might also need to associate a secondary, unaffiliated debit network”. Marqeta’s annual report for 2025 names Visa, Mastercard and PULSE. Stripe Issuing supports Visa and Mastercard, with a default chosen at onboarding. Highnote and Thredd document Visa and Mastercard. For the underlying product economics, see debit card issuing.

Bank partners and concentration

The processor’s bank relationships are the part of the stack you inherit. Marqeta’s annual report for 2025 says 64% of total processing volume settled through one issuing bank, Sutton Bank, down from 70% in 2024 and 76% in 2023, on total processing volume of $382.5 billion, up 31%. The same filing says Marqeta selects the issuing bank for each customer when it manages the program, and its 2025 annual report puts the current term of the Sutton agreement as expiring in 2029; moving volume elsewhere “would take time”.

Disclosure varies. Stripe names its US issuing banks by product in its required disclosure statements: Celtic Bank for commercial cards, Fifth Third Bank for charge cards, Sutton Bank and Cross River Bank for prepaid and payout cards. Lithic does not publish a bank list, though a customer case study carries a Patriot Bank issuing disclosure. Highnote and i2c do not publish bank partners on the pages reviewed. Thredd’s docs claim “95+ Issuing Banks and BIN Sponsors integrated” without naming them. If the processor picks the bank, read how to choose a sponsor bank before signing, because the bank’s rules end up in your product.

Uptime, PCI DSS and SOC reports

Figures are the providers’ own. Marqeta publishes 99.99% platform uptime in 2025 plus its certifications, and its docs cite PCI DSS level 1 and SSAE-18. Lithic publishes “99.99%+ uptime” and no scheduled downtime. Thredd publishes 99.99% and said on March 9, 2026 that it holds PCI DSS certification and completed SOC 1 and SOC 2 Type II audits. Highnote lists PCI DSS Level 1 and SOC 1 and 2 with AES-256 encryption at rest. i2c says it can “Achieve 99.999% uptime with dual-active data centers”, a marketing claim on its own page. Stripe cites “99.995% historical uptime”.

Ask for the artifacts, not the logos. PCI DSS v4.0.1 has been the only active version since v4.0 retired on December 31, 2024, and 51 future-dated requirements took effect March 31, 2025. A processor’s compliance does not end yours: Marqeta’s own matrix says “your PCI responsibility will not be entirely eliminated by using our widgets”. Registration can be checked against Mastercard’s SDP list, which is “updated monthly” and lists a provider only when a customer registered it and a QSA-signed attestation was received, and against Visa’s Global Registry of Service Providers.

Disputes and consumer error resolution

The deadlines belong to the issuer, so the processor’s tooling has to fit them. Under Regulation E, a consumer has 60 days from the statement to give notice; the institution must determine whether an error occurred within 10 business days, report results within 3 business days and correct within 1 business day. It may take up to 45 days if it provisionally credits the account within those 10 business days, and 90 days instead of 45 for point-of-sale debit card transactions, out-of-state transfers or new accounts, where the investigation window is 20 business days. For credit cards, Regulation Z requires written acknowledgment within 30 days and resolution “within 2 complete billing cycles”, never later than 90 days.

Processor support is uneven. Marqeta exposes a /cases endpoint with separate Visa, Mastercard and PULSE references, a regulation_type value of REG_E, and says provisional credit is “a joint responsibility shared between you and Marqeta” while reconciliation stays with the program. Thredd’s legacy Smart Client lets program managers raise chargebacks “only for Mastercard issuers in Europe/UK at present”. Stripe advertises optional dispute handling and 24/7 cardholder support.

Program management, processing only and published price

Most providers sell two shapes. Stripe offers program management or processing only, where you “keep your existing banking relationships and licenses”. Lithic sells a Processor Client model where you “own your bank relationship” alongside its own program management. Marqeta’s annual report is explicit about the handover: when it does not manage the bank and network relationships, the customer is responsible for that compliance. Highnote lists full program management; i2c lists program management support.

Pricing is mostly private. Stripe publishes per-card fees: virtual cards at $0.10 and standard physical cards at $3.50 in the US, plus shipping, with custom cards priced separately. Marqeta, Lithic, Highnote, Thredd, SoFi Tech Solutions and i2c do not publish card program prices. Lithic’s terms point to an API pricing section unless enterprise terms apply and pass through “actual, attributable bank and network fees”. Marqeta’s filings describe a different structure: its bank contracts entitle it to the interchange its customers’ programs generate, shared back as revenue share.

BINs, card numbers and the way out

Put the exit in the first contract. Thredd’s migration sheet says an end-to-end issuer-processor migration “typically takes at least 4-5 months”, with clearing switched before authorizations, the authorization cutover run off-peak after a Go/No Go meeting, and most runbook tasks closed within two days of it.

Whether cardholders keep their numbers depends on the bank, not the processor. In the US, BINs are issued only by a bank or credit union, and a SoFi Tech Solutions blog post from August 28, 2023 states that if you are switching processors and not banks, you do not have to switch BINs as long as the new processor already works with that bank. Otherwise the choice is a BIN migration or a new BIN plus reissued cards. Ask also how the processor handles eight-digit BINs: Visa says it now assigns only eight-digit issuing BINs and that in expansion “PANs and tokens will not be modified”.