Visa and Mastercard Aren’t Banks: How Their Payment Networks Work

⏱️ Lectura: 12 min

When you pay with a card at Costco in the United States, you notice something odd: that store doesn’t accept Mastercard, only Visa. That everyday detail hides a four-party architecture that defines how nearly all the planet’s digital money moves, one that most developers who integrate payments never fully understand.

📑 En este artículo

1. TL;DR
2. What Card Networks Are
3. Context and History of Card Networks
4. Technical Details: How Card Networks Operate
5. How to Start Integrating with Card Networks
6. Impact and Analysis for Developers
7. What’s Next for Card Networks
8. Frequently Asked Questions
   1. Do Visa or Mastercard issue credit cards?
   2. What is a BIN and what is it for?
   3. Why do some merchants only accept one network?
   4. What’s the difference between authorization, clearing, and settlement?
   5. Do I need to talk directly to Visa or Mastercard to accept card payments?
   6. What happens if I store the full PAN in my database?
9. References

Visa and Mastercard don’t issue cards, aren’t banks, and don’t process your purchase directly. They’re card networks: technical and financial intermediaries that connect whoever lends you the money with whoever charges the merchant. Understanding that distinction changes how you design a payments integration, why a charge takes time to settle, and why certain fees don’t depend on your payment provider but on the network itself.

TL;DR

• Visa and Mastercard don’t issue cards or operate as banks: they’re networks that connect issuers and acquirers.
• The BIN (the first 6 to 8 digits of the PAN) identifies the issuing bank, the same way an IP identifies a host.
• Every transaction goes through authorization, clearing, and settlement: three distinct steps, not one.
• Visa uses daily net settlement: it adds up each participant’s debits and credits and moves the balance just once.
• Mastercard calls the routing of messages between issuer and acquirer switching.
• Visa’s flagship data center, Operations Center East, spans 140,000 square feet and withstands winds of up to 170 mph.
• The model has four parties: cardholder, issuer, merchant, and acquirer.

What Card Networks Are

The confusion is understandable: to the end user, the card, the bank, and the network feel like a single thing. But a recent article about card networks reviews, drawing on the experience of someone who spent years in the payments industry, what Visa actually does (and by extension Mastercard, which operates in an almost identical way under different names).

First, what they DON’T do. They aren’t card issuers: they don’t issue the card in your wallet, a bank does that (Chase, BBVA, Banorte, Bancolombia). They aren’t banks, even though almost all your cards are issued by one. They don’t distribute point-of-sale terminals or online checkouts, that’s the job of payment processors like Stripe, Adyen, or dLocal in the region. They don’t do merchant acquiring, meaning they don’t onboard or assess the risk of a merchant: banks with merchant accounts do that, or increasingly, modern processors themselves. They also don’t manufacture physical cards or POS terminals.

What they do is operate a network that connects four participants: the cardholder, the issuing bank, the merchant, and the acquiring bank. That four-party model has four core responsibilities: running the telecommunications network that routes transaction messages, coordinating the banking network that moves and settles the money, setting incentives so banks and merchants use the network, and establishing and enforcing rules, including a dispute mechanism (chargebacks). That four-party model is, in essence, the operational definition of modern card networks.

Context and History of Card Networks

This model wasn’t born from a modern technical design: it’s the evolution of a banking business from the middle of last century. Visa emerged from the BankAmericard program that Bank of America launched in California in 1958, which became independent as a shared network among banks in 1970, adopting the Visa name in 1976 to operate globally without depending on a single issuing bank. Mastercard has a parallel origin: it started as Master Charge, an alliance of banks competing with BankAmericard, and was renamed Mastercard in the late 1970s.

The reason behind that design is economic rather than technical: no individual bank could convince merchants across an entire country, and later the world, to accept its own proprietary card. The solution was to create a shared, neutral network among issuing banks, one that any bank could join and that any merchant could accept without negotiating with each issuer separately. That’s essentially the same problem that instant payment networks like Pix in Brazil or SPEI in Mexico solve today, though with different settlement architectures.

Technical Details: How Card Networks Operate

A card transaction isn’t a single event: it’s at least three steps separated in time, and confusing them is a common mistake among developers new to payments.

Stage	What Happens	Who’s Involved	When It Occurs
Authorization	Verifies the account exists and has funds or available credit; places a temporary hold	Merchant, acquirer, network, issuer	At the moment of payment, in milliseconds
Clearing	The merchant submits the final amount (which can vary due to tips or adjustments) to initiate the transfer	Merchant, acquirer, network, issuer	Hours after authorization, in batches
Settlement	Actual money moves between banks, almost always netting the day’s debits and credits	Network, issuing and acquiring banks	At the close of the network’s daily cycle

The card number (PAN, Primary Account Number) works in a way similar to an IP address: the first 6 to 8 digits are the BIN (Bank Identification Number) and identify the issuing bank. When an authorization message reaches the network, those digits tell it which bank to forward it to, just like a router looks at the first bits of an IP to decide the next route.

Mastercard calls this routing task switching: the network literally acts as a telecommunications switch between the acquirer and the issuer. Here’s what the full flow of an authorization looks like within card networks:

sequenceDiagram
    participant CH as Cardholder
    participant M as Merchant
    participant A as Acquirer
    participant N as Card network
    participant I as Issuer
    CH->>M: presents the card
    M->>A: requests authorization
    A->>N: routes the message
    N->>I: forwards the request
    I-->>N: approves or declines
    N-->>A: forwards the response
    A-->>M: confirms the authorization
    Note over M,I: clearing and settlement arrive hours or days later

The infrastructure behind that routing is no minor detail. Visa’s flagship data center, known as Operations Center East, spans 140,000 square feet, is designed to withstand earthquakes and winds of up to 170 miles per hour, and its physical access includes hydraulic bollards capable of stopping a vehicle traveling at 50 miles per hour. That obsession with resilience makes sense: if that network goes down, it’s not processing a single website, it’s processing a significant fraction of the planet’s physical and digital commerce.

💭 Key point: the network nets out each participant just once a day. Instead of moving money for every individual transaction, Visa adds up all the debits and credits for each bank and transfers only the net balance, which drastically reduces the number of actual bank transfers.

How to Start Integrating with Card Networks

If you work on integrating payments in Latin America, you won’t talk directly to Visa or Mastercard: you’ll integrate a processor (Stripe, Adyen, dLocal, Mercado Pago) that already handles the connection to card networks and acquiring banks. But understanding the BIN and the Luhn algorithm is useful every day for validating cards on the frontend before spending a real call to the network.

First, install Node.js if you don’t have it, you’ll need it to run the following examples:

# macOS (with Homebrew)
brew install node

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt install -y nodejs

# Windows (with winget)
winget install OpenJS.NodeJS.LTS

With Node installed, here’s the Luhn algorithm, the checksum every card network uses to discard mistyped numbers before spending a real authorization:

function esPanValido(pan) {
  const digitos = pan.replace(/\s+/g, '').split('').map(Number);
  let suma = 0;
  for (let i = digitos.length - 1, posicion = 0; i >= 0; i--, posicion++) {
    let d = digitos[i];
    if (posicion % 2 === 1) {
      d *= 2;
      if (d > 9) d -= 9;
    }
    suma += d;
  }
  return suma % 10 === 0;
}

console.log(esPanValido('4111111111111111')); // true: Visa test PAN

That check only validates the format, not whether the account exists or has funds. To identify the issuer from the BIN, here’s a realistic example querying a public lookup API:

async function identificarEmisor(pan) {
  const bin = pan.slice(0, 8);
  const respuesta = await fetch(`https://lookup.binlist.net/${bin}`, {
    headers: { 'Accept-Version': '3' }
  });
  if (!respuesta.ok) throw new Error('BIN not found');
  const datos = await respuesta.json();
  return {
    marca: datos.scheme,       // "visa" or "mastercard"
    tipo: datos.type,          // "credit" or "debit"
    banco: datos.bank?.name,
    pais: datos.country?.name,
  };
}

identificarEmisor('411111111234').then(console.log);
// { marca: 'visa', tipo: 'credit', banco: '...', pais: '...' }

⚠️ Watch out: never log, store, or send the full PAN in plain text through your own backend. Delegate that part to your processor (Stripe Elements, Adyen Web Components) to avoid falling into the full scope of PCI DSS.

To confirm your integration truly distinguishes between authorization and clearing, check your processor’s dashboard: Stripe, for example, shows the PaymentIntent in requires_capture status right after authorization, and it only moves to succeeded once the capture executes, which triggers clearing toward the network.

Impact and Analysis for Developers

For a developer who’s never worked on the processor side, this card network architecture explains behaviors that would otherwise seem arbitrary. Why Costco only accepts Visa: it negotiated a lower interchange rate in exchange for exclusivity, something that only makes sense once you understand that each network sets its own rates and that a large merchant can negotiate them. Why a card charge can disappear from your statement for a day and reappear with a different amount: that’s the difference between the authorization hold and the final clearing amount.

It also explains why switching payment processors isn’t just a matter of changing an API key. Each processor has its own merchant acquiring relationship with banks, and PCI certification, dispute rules, and settlement times depend in part on that relationship, not just your code.

The real limitation of this model is the latency of clearing and settlement: although authorization is nearly instant, the actual money takes hours or days to move. For a fintech developer that matters: if your product promises instantly available funds after a card charge, in practice you’re fronting the capital yourself, or your processor is, not the network.

What’s Next for Card Networks

Four-party networks no longer have the monopoly they had twenty years ago. Instant payment systems like Pix in Brazil or SPEI in Mexico move money between bank accounts without going through a card network, with settlement in seconds instead of days. In Europe, local banking alliances are moving in the same direction to reduce dependence on Visa and Mastercard for domestic payments.

The networks’ response has been to invest in tokenization (replacing the real PAN with a token specific to each device or merchant, the way Apple Pay does) and in opening their own APIs for use cases beyond physical card payments. For anyone building payments in Latin America, the practical takeaway is that the four-party model remains the default for e-commerce, but it’s no longer the only option for moving money between accounts.

📖 Summary on Telegram: View summary

Try it yourself: run the Luhn snippet above against the test PAN 4111111111111111 and confirm in seconds why that validation avoids spending a real call to the network.

Frequently Asked Questions

Do Visa or Mastercard issue credit cards?

No. Cards are issued by a bank (the issuer); Visa and Mastercard only operate the card networks that connect that bank with the merchant.

What is a BIN and what is it for?

It’s the Bank Identification Number: the first 6 to 8 digits of the PAN, which identify the issuing bank and allow the transaction to be routed to the correct bank.

Why do some merchants only accept one network?

Because each network charges its own interchange rates, and a high-volume merchant can negotiate exclusive terms with a single network, as Costco does with Visa in the United States.

What’s the difference between authorization, clearing, and settlement?

Authorization verifies funds and places a hold in milliseconds; clearing confirms the final amount hours later; settlement moves the actual money between banks, almost always netted at the end of the day.

Do I need to talk directly to Visa or Mastercard to accept card payments?

No. In practice, you integrate a payment processor (Stripe, Adyen, dLocal, Mercado Pago) that already has a certified connection to the networks and acquiring banks.

What happens if I store the full PAN in my database?

You fall into the full scope of PCI DSS, with strict audits and security requirements. The recommended practice is to delegate PAN capture to the processor and store only a token.

References

• What do Visa and Mastercard do? An intro to card networks: the original article that inspired this piece, detailing the four core responsibilities of a card network.
• ISO 8583 on Wikipedia: the messaging standard that card networks use to authorize transactions.
• PCI Security Standards Council: the organization that defines the security requirements for handling card data (PCI DSS).
• Visa: the network’s official website, with public documentation on its operation as a card network.

📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Imagen destacada: Foto de rupixen en Unsplash