Admin · The Payments Corner

Excerpt

Content

# What you cannot outsource: the build-versus-buy decision in card issuing

For most of the past two decades, the build-versus-buy question in card issuing had a settled answer for everyone but the largest institutions. Building a program meant standing up the full apparatus of modern lending — origination and decisioning, statement and letter production, card manufacture and fulfillment, settlement and reconciliation, fraud systems, dispute handling — and carrying the compliance weight of all of it. For a community bank or mid-sized institution, the honest counsel was usually to refer the relationship out and collect a fee. That answer has come loose, and the reasons pull in opposite directions.

## The prize, and where it actually comes from

Credit card portfolios return between three and six percent on assets — among the most productive uses of a balance sheet a deposit institution has — against a banking-sector average closer to one; the Federal Reserve's annual report on the profitability of credit card operations has tracked the former for decades, and the FDIC put sector return on assets at 1.11 percent for the fourth quarter of 2024. But the source of that return is routinely misread. Interchange and fees are the visible revenue; the profit is overwhelmingly carried by interest on revolving balances. The Federal Reserve's own decomposition of card economics attributes roughly eighty percent of credit card profitability to the lending function, with the transaction function — interchange net of rewards — running slightly negative. A program optimized for swipe volume and rewards redemption can look healthy and barely clear its own cost of rewards, fraud, and servicing. The build-versus-buy decision is therefore really a decision about which economics an institution wants to own: the thin, predictable margin of facilitation, or the thicker and riskier margin of credit itself.

In practice that choice resolves into three distinct postures, not a binary. The first is the agent, or referral, model: the institution lends its brand to someone else's product and collects a clean, low-effort fee, but in doing so it cedes the underwriting, the data, and the customer relationship — effectively renouncing control of the business and its economics. The second is the opposite extreme, direct or self-issuance: the institution keeps the full profit-and-loss and the customer and takes principal membership in the networks, but in exchange must stand up and run the entire apparatus itself, carrying every operational and regulatory obligation that entails. The third sits between them and is, in practice, where the majority of federal credit unions and regional banks already operate — the hybrid, or managed, model. Here the institution holds its own license with the networks and keeps the portfolio economics and the customer, but buys the program-management and processing apparatus from a third-party processor rather than building and running it. The typical smaller issuer, in other words, is a licensed principal that has outsourced the machinery, not the membership. The market for that managed middle is growing quickly; Totavi's 2025 analysis projects U.S. debit program management alone rising from roughly one billion dollars in 2025 to four billion by 2034.

What has changed on the build side is that the apparatus is no longer a mainframe project measured in years. Cloud-native, API-first issuing platforms have unbundled the stack into components an institution can assemble — issuing, ledger, credit, fraud, dispute management — without writing the core itself. Building increasingly means orchestrating, and the gap between owning a program and outsourcing it has narrowed to a question of which specific layers an institution operates rather than whether it can operate any of them. The old assumption — that in-house issuance is the preserve of national giants — describes the legacy era, not the current one.

## The leverage problem smaller institutions inherit

For a federal credit union or community bank, the build-versus-buy question carries a complication the national issuers never feel: the buy side is itself a position of structural weakness, and the market structure differs by layer only in degree. Core banking is dominated by the three incumbents the Federal Reserve Bank of Kansas City calls the Big Three, which together serve the bulk of the more than ten thousand banks and credit unions in the country. Card issuer processing — the layer that actually matters to a card program — is tighter still: the third-party market is effectively a duopoly, with the single largest processor, by its own regulatory filings, handling roughly forty percent of U.S. card issuing. The labels and the headcount differ; the institution's predicament does not. Whether it is negotiating its core contract or its card-processing agreement, a single sub-billion-dollar institution — signing what is typically its largest and most critical vendor relationship, a deal that can exceed a million dollars in total value even for a modest bank — sits across the table from a counterparty that closes hundreds of such contracts a year, on its own paper, against benchmarks the institution cannot see. As one community banker on the American Bankers Association's own council put it, "Not one of us alone has enough leverage."

The consequences live in the contract, and they compound. Legacy agreements have tended toward long multi-year terms with automatic renewals, liquidated-damages clauses that penalize early exit, exclusivity and bundling requirements that make adding a best-of-breed component expensive, and deconversion fees that turn leaving into its own line item. Negotiating one has lengthened from an average of under three months in 2009 to roughly six today. The deepest exposure is the quietest: under many legacy contracts the institution's own data is effectively held by the core, reachable only through the provider's reporting tools and sometimes for an additional fee, scattered across application files never designed to yield a single clean customer view. An institution that cannot freely extract its own data has surrendered something more fundamental than price — it has surrendered optionality, because every future decision, including the decision to leave, routes back through the incumbent.

This is the context that should frame a smaller institution's deliberation. The binding disadvantage is not technical capability — modern, API-first platforms have narrowed that gap — but leverage: the scale to command terms, the influence to move a roadmap, the freedom to recombine providers without penalty. Pooling arrangements and independent benchmarking advisors exist precisely because the individual institution's bargaining position is so weak. The incumbents' recent pivot toward simplified, cloud-native offerings is itself an admission that the old model's lock-in had become a liability worth shedding. For the credit union or community bank, "buy" has never been the frictionless default the framing implies. It has been a relationship in which the institution trades capability it could not easily build for terms it could not meaningfully shape — and the build-versus-buy decision is, in part, a decision about how much of that imbalance to keep accepting.

## The asymmetry that shaped the whole market

None of this can be understood without the regulatory fact that organizes it. The Durbin Amendment, implemented through the Federal Reserve's Regulation II, caps debit interchange for issuers above ten billion dollars in assets at twenty-one cents plus 0.05 percent of the transaction and a one-cent fraud adjustment, while leaving institutions below that threshold to earn the unregulated rate. The gap is not marginal. The Federal Reserve's data has consistently shown exempt issuers receiving roughly double what covered issuers do — the Board described the exempt fee as "slightly more than double" the regulated rate, around forty-odd cents against the low twenties when the rule took hold, and the spread has persisted since. That single asymmetry is why the partner-bank model exists in the form it does. A non-bank that cannot hold a charter and has no deposit base generating net interest margin can still build a viable business on interchange by issuing through a sub-threshold bank and sharing the exempt economics. An entire generation of consumer fintechs was built on that arithmetic. It is also why the threshold itself is now a live policy question: the Community Bank Relief Act, introduced by Senators Ted Cruz and Katie Britt in February 2026, would index the ten-billion-dollar line to inflation — a change that would widen a pool of exempt institutions that has already shrunk as the line stayed fixed, with the number of banks above the threshold rising from roughly eighty at Dodd-Frank's passage to about a hundred and thirty today.

The gravity of that asymmetry cuts against tidy build-versus-buy logic. For an institution under the threshold, the economics of facilitation are unusually good, and the case for lending one's charter and infrastructure to a partner with superior distribution can be more compelling than the case for building a competing product. The decision is not only about capability; it is about which side of a regulatory line an institution sits on, and what that line is worth.

## The reset, and the thing that does not transfer

Then came the correction. In April 2024, Synapse Financial Technologies — the banking-as-a-service middleware connecting scores of fintech apps, among them Yotta and Juno, to a handful of small sponsor banks — filed for Chapter 11, and the unwinding exposed how little stood behind the arrangement. The court-appointed trustee, former FDIC chair Jelena McWilliams, found a shortfall of roughly sixty-five to ninety-five million dollars between what the partner banks held and what end users were owed; against the roughly two hundred and nineteen million dollars the partner banks held as of May 2024, more than a hundred thousand customers were frozen out, and many ultimately recovered pennies on the dollar. The principal partner bank, Evolve Bank & Trust — alongside Lineage Bank, American Bank, and AMG National Trust — found that reconstructing the ledgers fell to them even as they disputed who had caused the gap. They had outsourced the operation but not the accountability.

Regulators converged on the same lesson. The Consumer Financial Protection Bureau moved against Synapse for failing to maintain records matching its partner banks'; more than a quarter of the FDIC's 2024 enforcement actions touched sponsor banks in embedded-finance partnerships; and by October 2024 the agency had proposed a custodial-account recordkeeping rule requiring banks to know who actually owns the funds behind a fintech program rather than trusting a third party's books. The episode was not isolated — at least one other middleware platform failed in the same window — and by early 2026 the term banking-as-a-service had fallen far enough out of favor that the industry was openly rebuilding its vocabulary around a more sober idea of sponsorship.

The lesson is not that outsourcing is reckless. Custodial structures and third-party operations have served the banking system reliably for decades. The lesson is narrower and more durable: control can be delegated, but responsibility cannot. This is not merely an editorial conviction; it is the regulators' stated position. The 2023 interagency guidance on third-party relationships, issued jointly by the Federal Reserve, the FDIC, and the OCC, holds that a banking organization's supervisory obligations are the same whether it performs an activity itself or hands it to a third party — responsibility travels with the function, not the contract. A program owner who hands the ledger, the reconciliation, or the compliance function to a counterparty has not transferred the obligation owed to a regulator, a court, or a wronged customer; it has only added a dependency. When that counterparty is thinly capitalized, opaque about its own runway, or structurally positioned as a single point of failure between the bank and the end user, the institution has bought operational convenience at the price of an existential risk it may never have priced.

## The map that replaces the binary

The useful question is no longer whether to build or buy, as though the two were exclusive and the stack were a single object. It is which layers an institution must own to maintain control of its own accountability, and which it can safely rent — and from whom. Underwriting and the data that informs it, the system of record for who owns what, and the compliance posture that regulators will hold the institution to are poor candidates for full delegation, because their failure lands on the owner regardless of contract. Card manufacture, statement production, network connectivity, and much of the processing tedium are better candidates, because a failure there is recoverable and substitutable.

The criterion the reset has elevated to first-class status is one that build-versus-buy frameworks rarely named: counterparty durability. A capability that can be insourced or migrated is a vendor decision. A capability whose provider's insolvency would strand your customers is a strategic exposure — and it deserves to be evaluated as one.

For banks and credit unions weighing the question now, the honest framework is less a make-or-buy line item than a map. Set the program's ambitions — the economics to be owned, the customer relationship to be kept, the risk appetite to be honored — against the institution's genuine operational acumen, and then decide layer by layer where ownership protects the franchise and where it merely consumes scarce attention. The modern platform era has made far more of that map ownable than legacy assumptions allowed. The Synapse episode has made clear which parts of it an institution can never truly give away.

---

*Control can be delegated. Accountability cannot — and every outsourcing decision is, in the end, a decision about which of the two you are trading away.*

---

*Disclosure: the author works in payments infrastructure at Euronet. This analysis is kept at the category level and names no individual card issuer-processing vendors. It is not investment advice.*

## Sources

- Card return on assets: Federal Reserve Board, *Profitability of Credit Card Operations of Depository Institutions* (annual report to Congress; latest edition November 2025); FDIC Quarterly Banking Profile, Q4 2024 (sector ROA 1.11%).
- Profit composition: Federal Reserve, FEDS Notes, *Credit Card Profitability* (September 9, 2022) — credit function ≈80% of profitability.
- Debit program-management forecast: Totavi, *2025 U.S. Debit Card Program Management Platform Market Analysis* (October 1, 2025) — ≈$1B (2025) to $4B (2034), 14% CAGR.
- Core-market structure ("Big Three"): Federal Reserve Bank of Kansas City, *Market Structure of Core Banking Services Providers* (Payments System Research Briefing, 2024).
- Issuer-processing concentration (~40%): largest third-party issuer processor's SEC filings (2019), reporting ≈40% of domestic Visa/Mastercard credit card accounts.
- Contract dynamics, leverage quote, and negotiation timeline: ABA Banking Journal, *Core Exercises* (2016); BPI Network / Paladin fs, *Less Burn, More Return* (2013) — ≈$1M over a five-year contract for $500M–$1B institutions.
- Durbin / Regulation II: Federal Reserve Board, Regulation II interchange standards; Board press release, May 23, 2013 ("slightly more than double"; exempt 43¢ vs. covered 24¢); Board biennial debit-card report, December 2025.
- Threshold legislation: Community Bank Relief Act (Sens. Cruz and Britt, introduced February 12, 2026); ~80 banks above the threshold at Dodd-Frank's passage vs. ~130 today.
- Synapse collapse: Chapter 11 trustee status reports (Jelena McWilliams); CFPB stipulated final judgment (2025); reporting by American Banker, Banking Dive, and PYMNTS — $65–95M shortfall; ~$219M held by partner banks; partner banks Evolve, Lineage, American, AMG National Trust.
- Sponsor-bank enforcement: analysis of 2024 FDIC enforcement actions (Klaros Group tracking, as reported) — more than a quarter touched sponsor banks in embedded-finance partnerships.
- Third-party accountability: *Interagency Guidance on Third-Party Relationships: Risk Management* (Federal Reserve, FDIC, OCC, 2023).

Audio script

Metadata

Author

Name

Role

Audio briefing

14:51 (891s)

https://pub-821e1149918048b5b3422c8b2a307c6a.r2.dev/audio/stitched/research-control-cannot-be-delegated-why-smaller-banks-still-own-the-card-issuing-risk-1781550297509.mp3

Save changes first if you just edited the script. Generation calls ElevenLabs and writes to R2 — takes ~10–30s for typical scripts.

Edits aren't saved until you click Save.