Issuer (Issuing Bank)

An issuer, or issuing bank, is the financial institution that provides a payment card (credit, debit, or prepaid) to a consumer and manages the underlying account. When a cardholder makes a purchase, it is the issuer that receives the authorization request and decides whether to approve or decline the transaction.

That decision is based on several factors: whether the account has sufficient funds or available credit, whether the transaction matches the cardholder's typical spending patterns, whether the card has been reported lost or stolen, and whether the transaction passes the issuer's fraud rules. Issuers apply increasingly sophisticated machine learning models to this decision in real time, which is why authorization decisions typically resolve in under two seconds.

When the issuer approves a transaction, it places a hold on the cardholder's funds for the authorized amount. When the merchant later submits the transaction for settlement, the issuer transfers those funds through the card network to the Acquirer, who deposits them into the merchant's account.

Issuers bear a significant share of fraud liability in the payments ecosystem, particularly for Card-Not-Present (CNP) transactions. This is a primary reason issuers invest heavily in authentication tools such as 3D Secure (3DS) and Risk-Based Authentication (RBA). It is also why the relationship between merchant authentication practices and issuer approval rates is so direct: transactions that come with richer authentication data are more likely to be approved.

Issuers are not required to undergo PCI DSS validation in the same way acquirers and merchants are, though they are obligated to secure cardholder data in PCI-compliant ways. In markets governed by PSD2, issuers are also required to support Strong Customer Authentication (SCA) for online transactions.