BIN sponsorship: how to launch a card programme

Who does what in a sponsored card programme, what the BIN sponsor, Visa and Mastercard ask of a programme manager, the rules for crypto-linked cards, and where an EMI licence fits.

· Head of IT
· 7 min read
Two payment cards, one pink and one dark, with card and shield blocks and a gold dollar coin

A card programme does not need its own Visa or Mastercard licence. It can start with a BIN sponsor: a licensed issuer, already a scheme member, that issues cards for a programme someone else designs, brands and runs.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply.

What card issuing is in law

In the EU, issuing payment instruments is a payment service under PSD2 (Annex I, point 5). A prepaid balance is electronic money when it is value issued on receipt of funds to make payments, and only authorised issuers may issue it (E-Money Directive, Articles 2 and 10). The UK keeps the same split (Payment Services Regulations 2017, Schedule 1), and the FCA names card issuers and e-money institutions as examples of issuers of payment instruments (PERG 15.3, Q20).

The schemes add a second layer. Mastercard admits Principals and Affiliates, the members that issue cards, only if they are authorised to engage in financial transactions, issuing e-money included (Mastercard Rules, Rule 1.1.1), and Visa checks an applicant's regulatory permissions, AML programme and ability to meet settlement obligations (Visa licensing).

The three parties

  • The BIN sponsor. A Visa principal client holds settlement risk, may sponsor others and is fully responsible for all activity on its BIN (Visa licensing). A Mastercard Principal that issues for a programme manager is a BIN Sponsor and needs Mastercard's approval for that activity, a requirement that applies to every new or renewed programme manager registration since 20 May 2025 (Rule 1.1.4).

  • The issuer-processor. It connects the programme to the network for authorisation, clearing and settlement (Visa Rules, glossary). Mastercard lets a third-party processor run settlement processing but never possess or control settlement funds (Rule 7.1).

  • The programme manager. That is you. Mastercard's "Sponsored Program Manager" chooses the service providers, may hold the cardholder relationship and always works under the sponsor, one per card programme (Rule 7.7.6). For Visa, a company that provides payment-related services to an issuer, such as soliciting cardholders, is a third party agent, which the issuer must register before it performs any service (Visa Rules, glossary and 1.9.8.6).

Who regulates it and where

Regulators license the issuer: in the EU, an e-money institution or a bank authorised in its home member state; in the UK, a firm authorised by the FCA. In the UAE, issuing a payment instrument needs a Central Bank licence, and banks are deemed licensed (CBUAE Retail Payment Services and Card Schemes Regulation, Articles 2 and 3); prepaid cards are stored value, which needs its own prior licence (SVF Regulation).

The schemes hold the sponsor to account: Mastercard makes each sponsor liable for everything its programme managers do (Rule 2.2.2), and Visa makes the member responsible for all card activity performed through an agent (Visa Rules 10.2.2.7).

What a sponsor will ask of you

Compliance

  • Due diligence before signing: a senior officer's review, evidence that you are financially responsible, background checks on your principals and an on-site inspection, then an annual review (Visa Rules 10.2.2.1 to 10.2.2.4).

  • A contract binding you to the scheme rules, the law and PCI DSS (Visa Rules 10.2.2.2). Visa's agent registration asks for a current PCI DSS Attestation of Compliance or self-assessment questionnaire (Visa Third Party Agent Registration).

  • KYC stays with the issuer. If you run the checks, you must also be registered as an AML and sanctions service provider, and the sponsor may rely on them only for issuing the card (Mastercard Rule 7.2.1).

  • AML and sanctions oversight. Where you do that work, a Mastercard sponsor must oversee it, with documented risk assessments of you and annual testing of your sanctions screening (section 7.7). The issuer also screens you against sanctions lists, at onboarding and afterwards (Rule 1.2.2).

Funding

The sponsor carries the settlement risk, so it will test your finances: Mastercard requires a programme manager to stay financially sound for as long as it manages the programme (Rule 7.7.6). Money received for e-money must be safeguarded by the issuer (E-Money Directive, Article 7).

Programme approval

  • Mastercard requires a dedicated BIN or BIN range for each programme manager's activity, in Europe since 1 June 2024 (Rule 3.17), and its approval of each card programme where its standards call for it (Rule 7.7.6).

  • The issuer approves your marketing and cardholder documents first, and the issuer, not you, is named as the issuer of the card (Visa Rules 10.2.2.9; Mastercard Rule 7.2.8).

  • The issuer controls the approval of cardholder applications (Visa Rules 10.2.2.6).

Crypto-linked cards

Both schemes publish rules on this. Visa requires crypto to be converted to fiat, under the law of the country of issuance, before it is deposited into an account linked to a Visa card, and the issuer needs Visa's approval before launching such a programme (Visa Rules 1.4.4.6). Mastercard requires conversion into a currency it recognises before funds are loaded to a card, its prior written consent for crypto-funded activity, and its consent for marketing that links a card to crypto (Rules 3.18 to 3.18.2). Its global BIN rule also asks for a dedicated BIN for programmes that use a crypto exchange to convert stored crypto into fiat (Rule 3.17; check your regional chapter).

The crypto side needs its own authorisation: in the EU, custody and exchanging crypto for funds are crypto-asset services (MiCA, Articles 3 and 59; see the MiCA checklist).

Where an EMI licence fits

Without a licence, you can launch as programme manager under a sponsor and, where the sponsor is an e-money institution, distribute its e-money, but you cannot issue it (E-Money Directive, Article 3; UK EMRs, regulation 33), and the institution stays responsible for what you do on its behalf (regulation 36).

With your own licence, you become the issuer and can join a scheme, sponsored or as a principal. An EU e-money institution needs:

  • initial capital of at least €350,000, and own funds of at least 2% of average outstanding e-money (E-Money Directive, Articles 4 and 5);

  • customer funds safeguarded (Article 7);

  • an application with a programme of operations, a three-year budget, governance and internal controls, AML controls, a security policy and directors of good repute (PSD2, Article 5);

  • a head office in the home member state, and outsourcing that does not weaken internal control (PSD2, Articles 11 and 19, applied by Article 3(1) of the E-Money Directive).

The regulator must decide within 3 months of a complete application (PSD2, Article 12). The UK sets the same €350,000 of capital and the same 3 months, or 12 months for an incomplete application (EMRs, regulation 9 and Schedule 2).

This will change. PSD3, which would replace both PSD2 and the E-Money Directive, was awaiting the Council's first-reading position on 6 October 2026, with a plenary sitting forecast for 14 December 2026 (European Parliament Legislative Observatory).

The steps

  1. Fix the product and the money flow: prepaid e-money, a debit card on an account, or crypto-linked.

  2. Choose a sponsor and a processor that cover your countries and, for crypto, accept crypto programmes. In the UK, Mastercard accredits sponsors that meet enhanced standards (BIN Sponsor Plus).

  3. Pass the sponsor's due diligence and sign the programme agreement.

  4. Get registered and approved by the scheme through your sponsor (Mastercard gives it 30 days to complete a registration, Rule 7.10).

  5. Integrate and test with the processor, and have every document approved.

  6. Launch, then expect annual reviews.

Common mistakes

  • Presenting yourself as the issuer. The cardholder contracts with the issuer (Visa Rules 10.2.2.9), and you act as the sponsor's agent, not the programme's owner (Mastercard Rule 7.7.6).

  • Marketing before approval, including anything linking the card to crypto (Mastercard Rules 7.2.8 and 3.18.2).

  • Sharing one BIN across programmes. Mastercard's BIN sponsorship guidance says each partner needs its own BIN (Rule 3.17).

  • Planning only your own timeline. Registration must be complete before you provide any service (Visa Rules 1.9.8.6).

What this means for your platform

Our white-label crypto card app and banking app issue cards through the card issuing module, which connects to issuer processors including Marqeta, Thredd, Nium, Paymentology, Enfuce, Galileo, Adyen Issuing and Stripe Issuing, on Visa and Mastercard. It runs under the BIN sponsor you choose or your own principal membership, and we help prepare the programme documents the processor and the scheme ask for. In the crypto card app, each authorisation converts the user's stablecoin balance into the card currency at the moment of payment; the scheme approvals above still apply to that model. The platform is ready in about 30 days; the sponsor's onboarding and the scheme's approvals run alongside, on their timeline.

Sources

All checked on 6 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project