The Four-Party Model

23.0 What this chapter gives you#

1. You will be able to name the five roles in a card payment and say which of them holds a contract with which others, and which pairs have no contract at all.
2. You will be able to break a fifty pound sale into interchange, scheme fees and acquirer margin, and say who receives each slice.
3. You will be able to correct the commonest error in payments journalism, that a scheme charges shops 0.3 per cent, and explain why it is wrong twice over.
4. You will be able to explain why a merchant in a dispute has no cause of action against the issuer and must raise the matter through its own acquirer.
5. You will be able to say why a scheme with a three-party corporate structure can be classified as four-party, and what that reclassification costs it.
6. You will be able to tell an independent sales organisation from a payment facilitator by asking who holds the merchant contract and who bears the chargeback.
7. You will be able to explain why interchange is capped by statute in Europe and published by the scheme in the United States, and what Regulation II’s exclusivity ban does to American debit economics.
8. You will be able to explain what IC++ pricing shows a merchant that blended pricing hides, and which of the three numbers is actually negotiable.
9. You will be able to explain why an outage at a card scheme stops new authorisations without destroying value that has already cleared.
10. You will be able to trace where the cost of a cashback reward finally falls, including on the customer paying cash.

The plain version#

Imagine a very large school. Nobody carries cash, because cash gets lost. Instead every pupil has an account with one of several house banks, and every shop in the town around the school has an account with one of several other banks. The shops want to sell to the pupils. The pupils want to buy from the shops. The problem is that a shop banking with Barnaby’s has no idea whether a pupil banking with Cresswell’s actually has any money, and no reason to trust Cresswell’s if it says so.

So the school sets up a switchboard in the middle, with a rulebook attached to it. The rules are the important part. They say what a shop is allowed to ask, what a bank must answer, how fast it must answer, what happens when the answer is wrong, and who pays when a pupil says “I never bought that.” Every bank that wants to join signs the rulebook. Every shop signs a contract with its own bank, not with the switchboard and not with anybody else’s bank.

Now watch what happens when a pupil buys a pair of trainers.

The pupil hands a card to the shop. The shop’s till sends a message to the shop’s own bank: “Someone is claiming to be a customer of another bank. This is the card number, this is the amount, this is my shop.” The shop’s bank looks at the first few digits of the card number, which act like a postcode, and sees that this card belongs to Cresswell’s. The shop’s bank does not phone Cresswell’s. It passes the message to the switchboard. The switchboard passes it to Cresswell’s. Cresswell’s checks the balance, checks that the card is not reported stolen, decides, and sends one word back down the same chain: approved. The whole round trip takes about a second, and the shop’s till prints a receipt.

That is four parties. The pupil. The shop. The shop’s bank. The pupil’s bank. And a fifth thing in the middle which is not a party to the purchase at all: the switchboard and its rulebook. In the real world the pupil is the cardholder, the shop is the merchant, the shop’s bank is the acquirer, the pupil’s bank is the issuer, and the thing in the middle is the scheme. Visa is a scheme. Mastercard is a scheme. Neither of them issued your card and neither of them has a contract with the shop.

Where the money actually goes#

Here is the part that surprises people, so let us do it with real numbers.

Say the trainers cost fifty pounds, and the pupil pays with an ordinary British consumer credit card at a British shop. Your statement will say £50.00. The shop will not receive £50.00. It will receive something like £49.65.

The missing 35 pence splits three ways.

The largest slice, in this example fifteen pence, goes from the shop’s bank to the pupil’s bank. It is called interchange, and in the United Kingdom and the European Union it is capped by law at 0.3 per cent of the transaction for a consumer credit card and 0.2 per cent for a consumer debit card. Nought point three per cent of fifty pounds is fifteen pence. That money does not go to Visa or Mastercard. It goes to the bank that issued the card, and it is one of the reasons your bank is happy to give you a card, send you a replacement when you lose it, and refund you when someone in another country buys a television with your card number.

A smaller slice, call it five pence, goes to the scheme. These are scheme fees, and both banks pay them: the pupil’s bank pays a fee for having its transaction switched, and the shop’s bank pays one too. This is how Visa and Mastercard make money. It is a much thinner slice than most people assume.

What is left, about fifteen pence here, is the shop’s bank’s own margin. It is the price of the terminal, the fraud checks, the money the bank fronts to the shop tomorrow morning before it has actually been paid by the pupil’s bank, and the risk that the shop goes bust next month owing refunds. The shop negotiated that margin when it signed its contract, and a big supermarket negotiates a very different number from a corner café.

Add them up: fifteen plus five plus fifteen is thirty-five pence on a fifty pound sale, which is 0.7 per cent. The whole deduction, taken together, is called the merchant service charge. The shop’s bank quotes it, collects it, and passes the interchange and scheme fee parts onwards.

Approving is not paying#

The second thing that surprises people is that nothing has moved yet. When Cresswell’s said “approved”, it did not send any money. It made a promise, and it set aside fifty pounds of the pupil’s available balance so it could keep that promise. Actual money moves later, usually the next working day, and it moves in bulk. At the end of the day the switchboard adds up everything every bank owes every other bank, cancels most of it out, and produces one number per bank: Cresswell’s owes 4.2 million pounds today, Barnaby’s is due 3.8 million. Only those net numbers are actually paid, through the ordinary banking system, bank to bank. Thousands of individual card payments become one transfer.

So a shop can be approved and still not be paid. If the pupil later says “that wasn’t me”, the rulebook lets the pupil’s bank claw the money back from the shop’s bank, and the shop’s bank takes it back off the shop. That is a chargeback, and it travels back along exactly the same chain of contracts the payment came down.

Why the shop never phones your bank#

Because it has no relationship with your bank whatsoever. There is no contract between them, no account, no phone number, no way to prove who is calling. The shop’s only counterparty is its own bank. Your only counterparty is your own bank. The two banks’ only shared counterparty is the scheme, and the scheme’s whole job is to be the trusted stranger in the middle so that a card issued by a bank in Manila works in a bakery in Cardiff without those two institutions ever having heard of each other.

There is a practical reason as well as a legal one. Visa alone had close to five billion cards in circulation and more than 175 million merchant locations in its 2025 financial year. If every merchant had to arrange terms with every issuing bank, the number of contracts would be the number of merchants multiplied by the number of banks, and nobody would ever accept a foreign card. The scheme reduces that multiplication to addition: every bank signs one rulebook, every merchant signs one contract with one acquirer, and everything connects.

Now for the interesting variation. American Express, for most of its history, did not do this. It issued its own cards to its own customers and signed up its own shops directly, both ends, one company. There was no other bank in the picture, so there was no interchange, because there was nobody to pay it to. Amex simply decided what to charge the shop and kept all of it. That let it pay for very generous cardholder rewards, and it is why shops complained that Amex was expensive and why, for decades, plenty of them did not take it.

Where the plain version stops being true#

The switchboard analogy makes the scheme sound neutral. It is not. A telephone exchange does not set the price of the call, decide who is allowed to be a customer, or fine you for connecting badly. A card scheme does all three. It writes the rulebook, and the rulebook runs to hundreds of pages of binding obligations on both banks. It sets the default interchange rate, which is the rate that applies whenever an issuer and an acquirer have not agreed something bilaterally, which in practice is nearly always. It operates the network, sells processing and fraud services in competition with its own members’ vendors, arbitrates disputes between the two banks, and levies non-compliance assessments. Calling it a neutral intermediary is the single most misleading thing in the plain version. The European Union thought so too: Article 7 of the Interchange Fee Regulation forces schemes to separate the scheme business from the processing business, with independent accounting, organisation and decision-making, precisely because the two roles conflict.

Interchange does not go to the scheme, and scheme fees are not interchange. In the plain version I kept these separate, but almost every article you will read outside this book blurs them, and practitioners will judge you instantly for it. Interchange is defined in the Regulation as a fee paid between the issuer and the acquirer for each transaction. The scheme sets the default level but receives none of it. Scheme fees are a completely separate charge, billed by the scheme to its licensed members, and they are not published. When a newspaper says “Visa charges shops 0.3 per cent”, it is wrong twice over: Visa charges the shop nothing, and the 0.3 per cent goes to a bank Visa does not own.

“Four parties” undercounts the participants by a factor of two or three. A real card payment in 2026 touches, at minimum, a payment gateway, possibly a payment facilitator or an independent sales organisation, an acquirer processor that may not be the acquirer, the acquiring bank of record, the scheme’s authorisation network, the issuer’s processor, the issuing bank, and often a token service provider, a 3-D Secure directory server and access control server, and a digital wallet provider holding the credential. “Four-party” is a legal and commercial classification of who holds the licences and who bears the liability. It is not a headcount of the boxes the message passes through, and it never was.

Three-party and four-party are regulatory categories, not descriptions of plumbing, and a scheme can cross the line without changing its logo. American Express has not been purely three-party for a long time. Through Global Network Services it licenses other banks to issue Amex-branded cards, and through OptBlue it lets third-party acquirers sign small merchants for Amex acceptance and set their own price. Under Article 1(5) of the Interchange Fee Regulation, a three-party scheme that licenses other payment service providers to issue or acquire, or that issues with a co-branding partner or through an agent, “is considered to be a four party payment card scheme” for the purposes of the rules. The classification follows the licensing behaviour, not the corporate structure. That is a live commercial decision with a price attached, not a historical footnote.

Finally, the scheme does not move any money. It calculates. The instruction that actually transfers value between two banks is executed outside the card network, through settlement banks and national payment systems, and the card scheme’s role ends with producing an authoritative net figure and a settlement report. A card network is a messaging and rule system that happens to determine who owes what. The payment leg is somebody else’s infrastructure.

The technical version#

The five roles and the contract lattice#

The precise definitions are worth quoting, because they are legally operative in the European Economic Area and in the United Kingdom, where the Regulation was retained after withdrawal from the European Union. Regulation (EU) 2015/751, the Interchange Fee Regulation, defines them in Article 2.

An acquirer, Article 2(1), is “a payment service provider contracting with a payee to accept and process card-based payment transactions, which result in a transfer of funds to the payee”. An issuer, Article 2(2), is “a payment service provider contracting to provide a payer with a payment instrument to initiate and process the payer’s card-based payment transactions”. A payment card scheme, Article 2(16), is “a single set of rules, practices, standards and/or implementation guidelines for the execution of card-based payment transactions and which is separated from any infrastructure or payment system that supports its operation”. Note what that definition does: it makes the scheme a rulebook, not a network. The network is a separate thing which the same corporate group may or may not own.

A four party payment card scheme, Article 2(17), is “a payment card scheme in which card-based payment transactions are made from the payment account of a payer to the payment account of a payee through the intermediation of the scheme, an issuer (on the payer’s side) and an acquirer (on the payee’s side)”. A three party payment card scheme, Article 2(18), is “a payment card scheme in which the scheme itself provides acquiring and issuing services and card-based payment transactions are made from the payment account of a payer to the payment account of a payee within the scheme”.

The commercial architecture follows from the contracts, and the contracts are worth setting out explicitly because almost every dispute in card payments is resolved by asking who has privity with whom.

There is no contract between the merchant and the issuer. There is no contract between the cardholder and the acquirer. There is no contract between the merchant and the scheme, though the scheme’s rules reach the merchant indirectly because the acquirer is obliged to flow them down into the merchant agreement. This flow-down is the mechanism by which a merchant in Leeds ends up bound by a rule written in San Francisco without ever having signed anything from San Francisco.

What each party actually does#

The issuer underwrites and funds. It performs know-your-customer checks, sets credit limits or account access, manufactures or provisions the credential, and holds the ledger against which authorisations are drawn. Operationally its critical function is the authorisation decision: within a scheme-mandated response window it must evaluate the incoming request against balance, velocity, fraud models and any Strong Customer Authentication requirement, and answer. It bears fraud losses on transactions where the liability rules place them with it, funds the interchange it receives, and handles cardholder disputes. It is also the party that answers to the cardholder in law: in the United Kingdom, section 75 of the Consumer Credit Act 1974 makes a credit card issuer jointly and severally liable with the merchant for breach of contract or misrepresentation on qualifying purchases, which is a liability the merchant’s own bank does not carry.

The acquirer underwrites and funds in the other direction, and this is consistently underappreciated. When an acquirer signs a merchant, it is taking a credit exposure, not selling a service. If the merchant takes payment for holidays in January, collapses in March, and every customer charges back, the acquirer must return the money to the issuers and then try to recover from an insolvent estate. That is why merchant underwriting looks like lending, why acquirers impose rolling reserves and delayed settlement on high-risk categories such as travel and event ticketing, and why merchant category codes matter so much. The acquirer also allocates merchant identifiers and terminal identifiers, registers its agents with the schemes, ensures PCI DSS compliance across its estate, and funds the merchant, typically on a T+1 basis, before it has itself received settlement.

The scheme is a rule-maker, a brand, a numbering authority, a specification body and, in most cases, a network operator. It allocates issuer identification numbers, publishes and versions the message specifications, operates the authorisation switch and clearing system, calculates settlement positions, publishes default interchange, arbitrates issuer-acquirer disputes, runs compliance and fraud-monitoring programmes with financial penalties, and licenses participants. Its revenue is scheme fees, which are charged on both sides and generally combine a per-transaction element with an ad valorem element and a set of behavioural fees, plus a growing book of value-added services.

The scale of that thin slice is worth making concrete. Mastercard reported gross dollar volume of $10.632 trillion for 2025 with net revenue of $32.8 billion. That is roughly thirty-one basis points of volume, and the figure is generous to the network, because net revenue includes cyber, intelligence and other value-added services that are not switching at all, and is stated after customer incentives and rebates. Visa’s fiscal 2025, ended 30 September 2025, ran to $16.7 trillion of total volume and $14.2 trillion of payments volume, with 329 billion Visa-branded transactions of which 258 billion were processed by Visa itself.

The message flow#

Card authorisation is carried in ISO 8583, a message format that has outlived several attempts to replace it. Every message begins with a four-digit message type indicator. Position one gives the version of the standard: 0 for the 1987 edition, 1 for 1993, 2 for 2003. Position two gives the message class: 1xx for authorisation, 2xx for financial, 3xx for file actions, 4xx for reversal and chargeback, 8xx for network management. Position three gives the function: 0 request, 1 request response, 2 advice, 3 advice response. Position four gives the origin: 0 acquirer, 2 issuer, 4 other.

That yields the message types a practitioner sees daily. An 0100 is an authorisation request. An 0200 is a financial request. An 0800 is a network management request, which is how the two ends of a link exchange sign-on, sign-off and echo tests to prove the connection is alive.

Immediately after the MTI comes the primary bitmap, sixty-four bits indicating which of data elements 1 to 64 are present. Bit 1 is not a data element; it signals the presence of a secondary bitmap covering elements 65 to 128. This is why ISO 8583 is compact: absent fields cost nothing, and a parser walks the bitmap rather than the message.

The elements that carry the commercial meaning of a four-party transaction are these.

DE11 and DE37 deserve a note, because they are what makes a four-party model auditable. The system trace audit number is assigned by the message originator and echoed back, which lets a party match a response to its own request across a link where messages may arrive out of order. The retrieval reference number is the handle by which the same transaction is identified later, in clearing, in a retrieval request, and in a chargeback, potentially months afterwards and by an institution that was not present at authorisation. Without a stable identifier travelling the full length of the chain, disputes between two banks that have never spoken would be unresolvable.

The critical structural point is that DE2 is the routing key. The acquirer’s switch reads the leading digits of the primary account number, matches them against a table of issuer identification numbers, and determines which scheme owns the range and therefore where to send the message. Card numbering is governed by ISO/IEC 7812, which since its 2017 revision provides for eight-digit issuer identification numbers within a primary account number of up to nineteen digits, with a Luhn check digit in the final position. Visa ranges begin with 4; Mastercard uses 51 to 55 and the 2221 to 2720 range added in 2017; American Express uses 34 and 37 with a fifteen-digit account number. The acquirer therefore knows which scheme to route to and, from the fuller BIN table, which issuer and which product. What it does not have is any means of contacting that issuer directly.

Two processing models coexist. In the dual-message model, typical of credit, an 0100 authorisation request obtains a decision and a hold, and a separate clearing record submitted later, in a batch, actually presents the transaction for settlement. In the single-message model, typical of domestic debit and PIN-based networks, an 0200 financial request both authorises and clears in one exchange. The distinction matters commercially: in dual-message the authorised amount and the cleared amount can differ, which is what makes tipping, fuel pre-authorisation and partial shipment possible, and it is also what creates the reconciliation problem that DE37 exists to solve.

Both schemes are engaged in a long migration towards ISO 20022 message structures for card traffic, but ISO 8583 remains the working format in the overwhelming majority of acquiring estates, and any acquirer building today will still be writing bitmap parsers.

Clearing and settlement#

Authorisation creates an obligation. Clearing records it. Settlement discharges it.

After authorisation, the acquirer submits presentments into the scheme’s clearing system, historically Visa’s BASE II and Mastercard’s Global Clearing Management System with its Integrated Product Message format. The scheme edits each record against the rulebook, applies the correct interchange rate based on the transaction’s characteristics, and produces reconciliation and settlement reports for each member. Interchange is not invoiced; it is applied as an adjustment inside the clearing figures, so the acquirer’s settlement position is already net of the interchange it owes.

Settlement itself is a net obligation between each member and the scheme’s settlement service, denominated in a settlement currency and discharged through nominated settlement banks over ordinary interbank payment infrastructure. The scheme is not a bank and does not hold customer funds in the general case. It computes positions and instructs. This is why an outage at a card scheme prevents new transactions from being authorised but does not, by itself, destroy value that has already cleared.

The fee stack, exactly#

Three distinct charges sit between the price on the shelf and the money in the merchant’s account, and confusing them is the most common analytical error in the industry.

Interchange is defined at Article 2(10) of the Regulation as “a fee paid for each transaction directly or indirectly (i.e. through a third party) between the issuer and the acquirer involved in a card-based payment transaction”, and the definition explicitly adds that “the net compensation or other agreed remuneration is considered to be part of the interchange fee”. It flows from acquirer to issuer.

Scheme fees flow from both licensees to the scheme. They are contractual, confidential, and revised on a published bulletin cycle.

Merchant service charge is defined at Article 2(12) as “a fee paid by the payee to the acquirer in relation to card-based payment transactions”. It is the merchant’s total cost and it contains the other two.

Interchange in the United States is unregulated for credit and published by the schemes. The Visa USA Interchange Reimbursement Fee schedule effective 18 April 2026 gives, among many hundreds of rates, the following.

The last two lines are the entire American debit interchange debate in miniature. Regulation II, at 12 CFR Part 235, caps the interchange an issuer may receive on an electronic debit transaction at the sum of 21 cents and 5 basis points of transaction value, with a further 1 cent fraud-prevention adjustment available to issuers that implement qualifying fraud policies. Section 235.5 exempts issuers that, together with affiliates, hold less than $10 billion in assets, which is why the schedule carries both an “exempt” and a “regulated” line for the same product. Section 235.7 separately prohibits network exclusivity: an issuer must enable at least two unaffiliated payment card networks on every debit card and may not restrict the merchant’s routing choice. That single provision is what gives American merchants a genuine routing decision and what makes debit economics in the United States structurally different from credit. The Federal Reserve proposed in October 2023 to reduce the base component to 14.4 cents and the ad valorem component to 0.04 per cent; as of the end of 2025 the proposal had not been finalised, and banking trade associations were formally asking for its withdrawal.

In the European Economic Area and the United Kingdom the position is the opposite: interchange is capped by statute rather than published by the scheme. Article 3 caps consumer debit card interchange at 0.2 per cent of transaction value, with member state discretion for domestic debit including a per-transaction maximum of five euro cents combined with a rate not exceeding 0.2 per cent. Article 4 caps consumer credit card interchange at 0.3 per cent. Chapter II does not apply to commercial cards, to cash withdrawals, or to cards issued by three-party schemes, per Article 1(3).

Article 5 is the anti-avoidance provision and the one that catches designs that look clever on a whiteboard: any agreed remuneration with equivalent object or effect, including net compensation, is treated as part of the interchange fee. Article 2(11) defines net compensation as “the total net amount of payments, rebates or incentives received by an issuer from the payment card scheme, the acquirer or any other intermediary in relation to card-based payment transactions or related activities”. An issuer incentive routed through the scheme rather than the acquirer is still interchange for the purposes of the cap.

The remaining business rules complete the picture. Article 6 prohibits territorial licensing restrictions, which is what makes cross-border acquiring within the Union lawful and is the legal basis for a merchant in one member state contracting with an acquirer in another. Article 8 protects co-badging and bars automatic mechanisms that force brand selection, while permitting the merchant to set a priority. Article 10 restricts the Honour All Cards Rule so that accepting one issuer’s cards does not compel acceptance of all, save within the same brand and category of regulated consumer card. Article 11 preserves the merchant’s right to steer. Article 12 requires the acquirer to give the payee itemised information showing the merchant service charge and the interchange separately, which is the legal foundation of what the market calls interchange-plus-plus, or IC++, pricing.

The practical consequence of Article 12 is a genuine change in merchant negotiating power. Under blended pricing, a merchant is quoted one rate for everything and cannot see whether a rise in its costs came from the scheme, the issuer mix, or its acquirer’s margin. Under IC++, the invoice separates pass-through interchange, pass-through scheme fees, and the acquirer’s own markup, and only the third number is negotiable. Larger merchants insist on IC++ for exactly this reason, and smaller merchants are usually on blended rates because they lack the volume to make the analysis worth anyone’s time.

Cross-border interchange within Europe has been the live regulatory fight of the decade. Following the United Kingdom’s withdrawal from the European Union, Mastercard and Visa raised interchange on UK-EEA card-not-present consumer transactions from 0.2 and 0.3 per cent to 1.15 and 1.5 per cent respectively, because the statutory caps applied to intra-EEA transactions that these had ceased to be. The Payment Systems Regulator’s market review found that the two schemes were not subject to effective competitive constraint, that it could identify no documented justification for the increases, and that the cost to United Kingdom businesses ran to roughly £150 million to £200 million a year. The regulator consulted on a two-stage price cap, then in October 2025 abandoned the interim cap in the face of litigation about its powers and instead consulted on the methodology for a longer-term cap. Separately, the European Commission accepted binding commitments from both schemes in 2019 to cut inter-regional interchange for transactions in the EEA on cards issued elsewhere, reducing them by around 40 per cent on average.

Three-party schemes and what the difference buys#

In a three-party scheme the issuing and acquiring functions sit inside one balance sheet. There is no interchange, because interchange is by definition a payment between two institutions and there is only one. The scheme sets the merchant discount rate unilaterally and keeps all of it.

American Express describes the resulting information position precisely in its own filings: “Wherever we manage both the card-issuing activities of the business and the acquiring relationship with merchants, there is a ‘closed loop’ in that we have direct access to information at both ends of the card transaction.” It uses that position to underwrite risk, reduce fraud and target marketing, and it describes its business as spend-centric, focused on driving spending on its cards rather than on lending balances.

Commercially, four consequences follow.

First, revenue concentration. A four-party scheme captures a thin switching margin, on the order of tens of basis points, while the fat part of the merchant’s cost goes to thousands of issuers as interchange. A three-party scheme captures the whole discount rate. The Supreme Court, in Ohio v. American Express Co. in 2018, noted that Amex derives the bulk of its revenue from merchant fees, in contrast to networks whose issuers earn from lending.

Second, price setting. In a four-party model, the acquiring market is competitive and the acquirer’s markup is squeezed by rivals, but the interchange floor is set collectively or by regulation and no individual merchant can negotiate it. In a three-party model there is no floor and no competitive acquiring layer at all: the merchant negotiates with the scheme itself, and large merchants therefore obtain real concessions while small ones do not.

Third, acceptance. A higher single price bought Amex a narrower merchant footprint for decades, which in turn constrained cardholder value. This is the classic two-sided platform bind, and it was the analytical heart of Ohio v. American Express. The Court, dividing five to four, held that Amex’s anti-steering provisions, which prohibit merchants from dissuading customers from using Amex cards or promoting other cards more heavily, did not violate the Sherman Act, because the relevant market had to be defined to include both sides of the platform simultaneously. The opinion recorded 2013 shares of United States credit and charge card purchase volume of 45 per cent for Visa, 26.4 per cent for Amex, 23.3 per cent for Mastercard and 5.3 per cent for Discover.

Fourth, and most importantly for anyone designing a scheme today, the boundary is porous and crossing it has a regulatory price. Amex operates Global Network Services, under which partner institutions issue Amex-branded cards and in some markets also acquire, under independent operator arrangements, network card licence arrangements and joint ventures, with issuer rates agreed bilaterally with each partner. It operates OptBlue, under which third-party acquirers contract directly with small merchants for Amex acceptance and set the merchant’s Amex rate themselves, exactly as they set the rate for the other brands. Amex’s own merchant materials put the OptBlue eligibility ceiling at an estimated annual charge volume of less than $3 million, with certain categories such as charity, education, government, healthcare, insurance, residential rent and utilities exempt from the volume test.

Both of those programmes are, functionally, four-party arrangements wearing a three-party brand, and Article 1(5) of the Interchange Fee Regulation says so in terms. A scheme that licenses other payment service providers to issue or acquire, or issues through a co-branding partner or agent, is treated as a four-party scheme, which pulls it inside the interchange caps it would otherwise escape under Article 1(3)(c). Article 1(4) exempts three-party schemes from Article 7’s scheme-processing separation requirement, so the classification carries structural obligations as well as pricing ones. The choice between three-party and four-party is therefore not a description of what a company is; it is a decision about how much distribution to buy and how much regulatory scope to accept in exchange.

The historical direction of travel is worth noting. Visa and Mastercard began as bank co-operatives: BankAmericard, launched in 1958 and licensed to other banks from 1966, became National BankAmericard Incorporated in 1970 and Visa in 1976; the Interbank Card Association, formed in 1966, became Master Charge and then MasterCard. Both were owned by their member banks, which is why the word “association” persists in older documents, and both demutualised in the 2000s, Mastercard in 2006 and Visa in 2008, becoming ordinary listed companies whose customers are the banks that used to own them. The four-party model is a co-operative artefact that outlived the co-operative.

Distribution: acquirers, ISOs, payment facilitators and marketplaces#

An acquirer licence is expensive to hold and slow to obtain, and acquiring banks are, as a class, poor at selling to small businesses. The industry therefore developed intermediaries, and the distinctions between them are precisely the distinctions of contract and liability set out earlier.

An independent sales organisation, or ISO, in Mastercard’s vocabulary a member service provider, is a sales and servicing agent. It is registered with the scheme by a sponsoring acquirer, it may brand terminals and statements, and it earns residuals on the portfolio it introduces. What it does not do is hold the merchant contract or touch settlement funds. The merchant contracts with the acquirer. The ISO’s role in law is agency, and the acquirer remains liable for its agent’s conduct.

A payment facilitator, Visa’s term, with Mastercard using the same concept and calling the merchant beneath it a sub-merchant, is a different animal entirely. The facilitator signs its own merchant agreement with the acquirer and then signs sub-merchants under that agreement, becoming, in Visa’s vocabulary, the sponsor of sponsored merchants. It is the merchant of record. It receives settlement from the acquirer and disburses to its sub-merchants. It performs onboarding and underwriting under the scheme’s standards, and it carries the liability for its sub-merchants’ chargebacks and fraud, with the acquirer standing behind it. This is what allows an online platform to onboard a self-employed tradesman in ninety seconds when a bank’s own onboarding would take three weeks.

Both schemes limit how far this can go by transaction volume. Mastercard raised its sub-merchant threshold from $100,000 to $1,000,000 in annual volume in 2014, and Visa followed with the same $1,000,000 threshold for sponsored merchants in the United States and Canada from 31 August 2017, granting merchants that crossed it a two-year window to complete a direct agreement with the acquiring bank. Above that level, the scheme’s position is that the merchant is too large to be an anonymous line item inside somebody else’s portfolio and must have a direct relationship with a licensed acquirer. The exact drafting, categories and effective dates are set out in the current editions of the Visa Core Rules and Visa Product and Service Rules and the Mastercard Rules, and any acquirer relying on them should read the edition in force rather than a summary, including this one: the schemes revise these provisions on a semi-annual bulletin cycle.

Marketplaces are a further variation, where the platform aggregates supply from many sellers but the commercial and legal position varies by jurisdiction and by scheme rule. The two questions that determine everything are who is the merchant of record and who bears the chargeback. A platform that answers “us” to both is operating as a facilitator whether or not it uses the word.

Finally, the acquirer of record is often not the entity doing the work. Much of the world’s acquiring processing is done by specialist processors under contract to licensed acquiring banks, which is why a merchant may hold a contract with a bank it never speaks to, receive statements from a processor, be sold to by an ISO, and be onboarded by a facilitator, all inside what the rulebook regards as a single acquiring relationship.

Why the merchant never talks to your bank#

Pull the threads together and the answer has four independent parts, any one of which would be sufficient on its own.

There is no contract. Privity runs merchant-to-acquirer and cardholder-to-issuer, and the only bridge is the pair of scheme licences. A merchant asserting a claim against an issuer has no cause of action to assert it under; it must go through its acquirer, which raises the matter under the scheme’s dispute rules, which is why chargeback representment is a process between two banks in which the merchant is a supplier of evidence rather than a party.

There is no settlement path. The merchant has a bank account at its acquirer or nominated for funding by its acquirer. It has no account at your bank and no means of receiving funds from it. Money reaches the merchant because the acquirer pays it, out of the acquirer’s own funds, in advance of the acquirer being made whole through scheme settlement.

There is no addressability, and no trustworthy identity. The merchant knows the primary account number, from which it can derive the issuer identification number and therefore, via a BIN table, the issuing institution’s name. That is a lookup, not a channel. There is no authenticated path from a terminal in a shop to an issuer’s authorisation host that does not run through an acquirer’s licensed connection and the scheme’s switch, and there could not be: the whole security model depends on both ends being licensed, audited entities with cryptographic keys exchanged under scheme control.

And there is deliberate data minimisation. Under PCI DSS, the merchant is obliged to minimise what it stores, and network tokenisation is steadily removing the real account number from the merchant environment altogether, replacing it with a token that only the scheme’s token service can map back to the underlying credential. The direction of travel is for the merchant to know less about the cardholder’s bank over time, not more.

The nearest the two sides ever come is 3-D Secure, where an issuer’s access control server briefly renders a challenge inside the merchant’s checkout flow. Even that is mediated: the merchant’s server talks to a 3DS server, which talks to the scheme’s directory server, which routes to the issuer’s access control server. The issuer and the merchant appear on the same screen and still never exchange a message directly.

What it costs, and who is actually paying#

The final thing worth saying plainly is that the four-party model is a transfer mechanism as much as a payment mechanism, and every participant’s economics depend on someone else’s.

The merchant pays the merchant service charge, and prices it into the goods. The issuer receives interchange and spends most of it on rewards, fraud losses and the cost of running the credential. The scheme receives basis points from both banks. The acquirer receives a margin for taking credit risk it is often not thanked for taking. The cardholder pays nothing at the point of sale in most markets and receives a cashback or points benefit funded, ultimately, out of the merchant’s margin and therefore out of the retail price, including the retail price paid by customers using cash.

That last transfer is the reason interchange is regulated in the European Union, the United Kingdom, Australia and a growing list of other jurisdictions, and the reason it remains largely unregulated for credit in the United States. It is a genuine policy disagreement about whether the price that balances a two-sided market should be set by the platform or by the state, and it is not going to be settled by an appeal to how the plumbing works. The plumbing works the same way either way. Only the numbers change.

23.98 Common wrong ideas#

Wrong: interchange is what the card scheme charges. Right: interchange is paid by the acquirer to the issuer; the scheme sets the default rate, receives none of it, and earns its own money from separate and confidential scheme fees billed to both licensees.

Wrong: the scheme is a neutral switchboard. Right: it writes a binding rulebook, sets default interchange, arbitrates disputes between its own members, sells processing and fraud services in competition with its members’ vendors, and levies non-compliance assessments.

Wrong: a four-party transaction involves four participants. Right: “four-party” is a legal and commercial classification of who holds the licences and bears the liability; a real payment also touches a gateway, processors on both sides, often a facilitator, a token service provider and 3-D Secure components.

Wrong: American Express is a three-party scheme. Right: through Global Network Services and OptBlue it licenses others to issue and to acquire, and Article 1(5) of the Interchange Fee Regulation therefore treats it as a four-party scheme for the purposes of the rules.

Wrong: the card scheme moves the money. Right: it calculates net positions and instructs; the transfer between banks is executed outside the card network through settlement banks and ordinary interbank payment systems.

Wrong: an approval means the merchant has been paid. Right: an approval is a promise and a hold on the cardholder’s balance; settlement happens later and in bulk, and a chargeback can travel back down the same chain of contracts and take the money off the merchant again.

Wrong: a payment facilitator is just a reseller with better software. Right: it signs its own merchant agreement, becomes the merchant of record for its sub-merchants, receives settlement and disburses it, and carries their chargeback and fraud liability with the acquirer standing behind it.

Wrong: the acquirer is selling the merchant a service. Right: it is taking a credit exposure, funding the merchant on a T+1 basis before it has itself been settled, which is why merchant underwriting looks like lending and why travel and ticketing attract rolling reserves.

Wrong: 3-D Secure lets the merchant and the issuer talk to each other. Right: the merchant’s server talks to a 3DS server, which talks to the scheme’s directory server, which routes to the issuer’s access control server; the two appear on the same screen and never exchange a message directly.

Wrong: the schemes have always been the listed companies they are today. Right: Visa and Mastercard began as bank co-operatives owned by their members and demutualised in 2008 and 2006, and the four-party model is a co-operative artefact that outlived the co-operative.

23.99 Chapter summary in 20 lines#

1. A card payment connects a cardholder, a merchant, the merchant’s acquirer and the cardholder’s issuer, with a scheme in the middle that is not a party to the purchase at all.
2. The scheme exists so that every bank signs one rulebook and every merchant signs one contract, which turns a multiplication of relationships into an addition.
3. On a fifty pound British consumer credit card sale the shop receives about £49.65, and the missing thirty-five pence splits into interchange, scheme fees and the acquirer’s own margin.
4. Interchange flows from acquirer to issuer, is capped at 0.3 per cent for consumer credit and 0.2 per cent for consumer debit in the United Kingdom and the European Union, and reaches the scheme not at all.
5. Scheme fees are a separate, confidential charge levied on both licensees, and they are a far thinner slice than most people assume.
6. The merchant service charge is the merchant’s total cost and contains the other two, which is why the itemisation duty in Article 12 is the legal foundation of IC++ pricing.
7. The switchboard analogy fails because the scheme sets prices, writes binding rules, arbitrates disputes and fines its members, which is why Article 7 forces the scheme business to be separated from the processing business.
8. Privity runs cardholder-to-issuer and merchant-to-acquirer, bridged only by the two scheme licences, and almost every dispute in card payments is resolved by asking who has privity with whom.
9. The scheme’s rules bind a merchant in Leeds only because the acquirer is obliged to flow them down into the merchant agreement.
10. The issuer underwrites and funds one side, makes the authorisation decision inside a scheme-mandated response window, and is the party that answers to the cardholder in law.
11. The acquirer underwrites and funds the other side, taking a credit exposure it is rarely thanked for, which is why reserves, delayed settlement and merchant category codes matter as much as they do.
12. Authorisation is carried in ISO 8583, whose four-digit message type indicator encodes version, class, function and origin, and whose bitmap makes absent fields free.
13. DE 2 is the routing key, DE 11 matches a response to its request across one link, and DE 37 is the handle by which the same transaction is found months later in a chargeback.
14. Dual-message and single-message models coexist, and the gap between authorised and cleared amounts in the dual-message model is what makes tipping, fuel pre-authorisation and partial shipment possible.
15. Authorisation creates an obligation, clearing records it, and settlement discharges it through nominated settlement banks over infrastructure the scheme does not own.
16. In the United States credit interchange is unregulated and published by the schemes, while Regulation II caps debit interchange and bans network exclusivity, which is what gives American merchants a genuine routing decision.
17. In Europe and the United Kingdom interchange is capped by statute instead, with Article 5 catching any equivalent remuneration, including issuer incentives routed through the scheme.
18. A three-party scheme captures the entire discount rate because there is no second institution to pay interchange to, and it historically paid for that with a narrower merchant footprint.
19. The boundary between three and four party is porous: licensing others to issue or acquire reclassifies a scheme, making the choice a decision about how much distribution to buy and how much regulatory scope to accept in exchange.
20. The four-party model is a transfer mechanism as much as a payment mechanism, funding cardholder rewards out of the merchant’s margin and therefore out of the retail price, including the price paid by customers using cash.

Sources: Regulation (EU) 2015/751 (Interchange Fee Regulation) via EUR-Lex; 12 CFR Part 235 (Regulation II) via eCFR and the Federal Reserve; Visa USA Interchange Reimbursement Fees schedule effective 18 April 2026; Visa Core Rules and Visa Product and Service Rules; Visa Inc. Fiscal 2025 Annual Report; Mastercard Incorporated fourth quarter and full year 2025 earnings release; American Express Company Form 10-K and OptBlue merchant materials; Ohio v. American Express Co., 585 U.S. 529 (2018); UK Payment Systems Regulator market review MR22/2 into cross-border interchange fees; European Commission antitrust commitments decision IP/19/2311; ISO 8583 and ISO/IEC 7812 message and numbering standards.