How the rules define a cardholder
The definitions are short. The Visa Core Rules of 18 April 2026 call a cardholder an individual who is issued a card, the Mastercard Rules of 2 June 2026 the authorised user of a card issued by a member, and PCI SSC's glossary adds any individual authorised to use the card.
The Visa definition, last updated in October 2025, adds that an agentic payment provider, the provider of an application that carries out purchases on a cardholder's behalf, is considered the cardholder for an agentic transaction. The EU's Interchange Fee Regulation and PSD2 use the word without defining it: their defined terms are the payer and the payment instrument.
Cardholder and account holder
The cardholder applies to the issuer, passes its identity checks and receives the card. The issuer authorises each payment, handles a lost card and takes the cardholder's disputes into the scheme's chargeback process.
A cardholder and an account holder can differ: an employee with a company's expense card, a teenager with a card on a parent's account, an additional cardholder on a credit card account.
Why the term matters to a card product
Scheme rules and security standards hang duties on the word. Cardholder data is PCI DSS's term for what has to be protected: at a minimum the full card number, and with it the cardholder's name, the expiry date and the service code.
Cardholder verification is the check at the point of payment that the person presenting the card is its legitimate holder, for example by PIN. In a programme run under BIN sponsorship, the cardholder deals with the brand's app, and the issuer of the card is the sponsor.
Where a cardholder shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
- Teen banking apps: the rules on accounts and cards for under-18sWho holds the account, how parents pass KYC and give consent, card controls, why there is no credit, and the rules on children's data and marketing in the EU, the UK and the UAE.
- How to launch a business account with expense cards for SMEsThe account, the cards and the controls around them: what a business account with expense cards needs, from licensed partners and KYB to SCA and the interchange rules for commercial cards.
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Cardholder (Visa)
- Mastercard Rules, 2 June 2026: definitions, Cardholder (Mastercard)
- PCI SSC, Glossary: Cardholder, Cardholder Data
General information, not legal advice: what applies to you depends on your services and your market.