Skip to content

Card Issuing Platforms Arena

Card Issuing Platforms arenaBuyer checklist

Every requirement we judge card issuing platforms products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.

53 requirements · 13 themes · verdicts for 5 products · updated 2026-09-15 · priorities mirror the story weights our scoring uses (methodology)

Procurement report →
Show the markdown export
# Card Issuing Platforms — buyer checklist (RFP)

Derived from ProductArena's evidence-graded user-story taxonomy for Card Issuing Platforms: 53 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have).

## Agenticness

- [ ] **[must-have]** Plug MCP servers into this product so it can use their tools
- [ ] **[must-have]** Connect an agent via an official MCP server
- [ ] **[must-have]** Drive the product through a documented public API
- [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product
- [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs
- [ ] **[should-have]** Run the product headlessly / in CI for automation
- [ ] **[should-have]** Use an official CLI
- [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent
- [ ] **[should-have]** Build against official SDKs
- [ ] **[should-have]** Subscribe to events via webhooks
- [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product
- [ ] **[should-have]** Set up automations that run autonomously in the background
- [ ] **[should-have]** Operate the product with natural-language commands
- [ ] **[should-have]** Explore an interactive API reference with runnable examples
- [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent)
- [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy
- [ ] **[nice-to-have]** Test against a sandbox environment without touching production data

## Auth decisioning

- [ ] **[must-have]** Approve or decline each authorization in real time — a webhook or auth-stream endpoint my code answers inside the network's time budget, with a documented timeout fallback I control
- [ ] **[should-have]** Every authorization event carries decision-grade context — merchant name and MCC, enhanced merchant data, wallet and entry-mode details, partial-approval and incremental-auth signals
- [ ] **[should-have]** Simulate the whole transaction lifecycle in the sandbox — authorizations, clearings, reversals, refunds, and declines — so my auth logic is tested before a real card ever swipes

## Automation depth

- [ ] **[must-have]** Define rules that trigger actions automatically on events
- [ ] **[should-have]** Perform bulk operations across many items at once
- [ ] **[should-have]** Schedule recurring jobs or workflows
- [ ] **[nice-to-have]** Version, review, and roll back my automations

## Card lifecycle

- [ ] **[must-have]** Create a virtual card through the API in one call — PAN, CVV, and expiry available programmatically the moment it's issued — and go from sandbox to a live card without a sales cycle
- [ ] **[should-have]** The full card lifecycle is API-driven — activate, pause, unpause, report lost or stolen, reissue with a replacement linked to the original, and permanently close
- [ ] **[should-have]** Order personalized physical cards through the API — custom card art, bulk orders, shipping methods and tracking — without managing a card manufacturer relationship myself

## Issuing agent access

- [ ] **[must-have]** Give an agent its own card — issue a scoped virtual card to an AI agent with merchant locks, amount caps, and expiry so autonomous purchases stay inside policy, a use the vendor documents by name
- [ ] **[should-have]** An agent can operate my card program — read balances and transactions, create and update cards, and adjust spend controls through the API or an MCP surface with scoped credentials

## Issuing compliance

- [ ] **[should-have]** Cardholder verification is built into issuance — KYC for consumers and KYB for businesses run through the platform with documented data requirements, review states, and re-verification flows
- [ ] **[should-have]** Show cardholders their own PAN and CVV without inheriting PCI scope — hosted components or ephemeral-key reveal flows the vendor documents as keeping me out of SAQ D

## Issuing disputes

- [ ] **[should-have]** File and track disputes on card transactions programmatically — network reason codes, evidence submission, provisional credit handling, and status webhooks through resolution
- [ ] **[should-have]** The platform fights fraud on my issued cards — network fraud scores or its own models surfaced at auth time, suspicious-activity alerts, and tooling to block and reissue compromised cards

## Ledger settlement

- [ ] **[must-have]** See money move in real time — account and card balances, a transaction ledger that ties every authorization to its clearing, and settlement reporting that reconciles to the penny
- [ ] **[should-have]** I get machine-readable reconciliation artifacts — daily settlement files or report APIs covering interchange, fees, and network adjustments — that my finance stack can consume automatically
- [ ] **[should-have]** Post-auth events are as programmatic as auth — clearings, refunds, reversals, and chargebacks arrive as webhooks with stable transaction identifiers, so my own ledger never drifts

## Openness

- [ ] **[must-have]** Export all of my data in open formats and leave
- [ ] **[must-have]** Self-host the core product
- [ ] **[should-have]** Do everything through the API that I can do in the UI
- [ ] **[should-have]** Read the product's source under an open license

## Privacy posture

- [ ] **[must-have]** Prevent my data from being used to train AI models
- [ ] **[should-have]** Choose where my data is stored (region/residency)
- [ ] **[should-have]** Control data retention and deletion
- [ ] **[should-have]** Opt out of telemetry and usage tracking

## Program management

- [ ] **[must-have]** Launch a card program without becoming a bank — BIN sponsorship, network membership, and program management are the platform's problem, and the time from signup to first live card is documented
- [ ] **[should-have]** The platform supports the card types my product needs — debit, prepaid, commercial credit, and consumer credit programs — not just one prepaid rail
- [ ] **[should-have]** Choose how transactions are funded — prefunded balances or just-in-time funding where my system approves and funds each authorization — with the cash-flow tradeoffs documented

## Spend controls

- [ ] **[must-have]** Set spend limits per card and per cardholder — amount caps over daily, monthly, or all-time windows, and transaction-count velocity rules — enforced by the platform, not my code
- [ ] **[should-have]** Restrict where a card works — merchant category (MCC) allowlists and blocklists, and single-merchant locks — applied at authorization time
- [ ] **[should-have]** Issue single-use and tightly scoped cards — one purchase, one merchant, an exact amount — so a leaked number is worthless the moment it's used

## Wallets tokenization

- [ ] **[should-have]** Cardholder credentials are manageable through the API — PIN set and reset flows, 3DS enrollment for online use where the region requires it — without support tickets
- [ ] **[should-have]** Network tokens are first-class — I can see and manage the tokens created for a card, know which wallet or merchant holds them, and revoke them independently of the PAN
- [ ] **[should-have]** Cards land in Apple Pay and Google Pay — push provisioning from my app with the entitlements process documented, plus in-wallet card art and manual provisioning as a fallback

---

Source: https://ultrametric.ai/productarena/arena/card-issuing (evidence-graded verdicts for 5 products) · methodology: https://ultrametric.ai/productarena/methodology

Chips show the top 5 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.

Agenticness — how well agents can access and operate the productAgenticness· 17 items

How well agents can access and operate the product

Auth decisioning — stories about auth decisioning in this arenaAuth decisioning· 3 items

Stories about auth decisioning in this arena

  • developerApprove or decline each authorization in real time — a webhook or auth-stream endpoint my code answers inside the network's time budget, with a documented timeout fallback I control

    Core requirement — weighs 3× in arena scoring · 1 of 5 products fully deliver this today

    must-have
  • developerEvery authorization event carries decision-grade context — merchant name and MCC, enhanced merchant data, wallet and entry-mode details, partial-approval and incremental-auth signals

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • developerSimulate the whole transaction lifecycle in the sandbox — authorizations, clearings, reversals, refunds, and declines — so my auth logic is tested before a real card ever swipes

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Automation depth — how much of the product can run unattendedAutomation depth· 4 items

How much of the product can run unattended

Card lifecycle — stories about card lifecycle in this arenaCard lifecycle· 3 items

Stories about card lifecycle in this arena

  • developerCreate a virtual card through the API in one call — PAN, CVV, and expiry available programmatically the moment it's issued — and go from sandbox to a live card without a sales cycle

    Core requirement — weighs 3× in arena scoring · no product fully delivers this yet

    must-have
  • developerThe full card lifecycle is API-driven — activate, pause, unpause, report lost or stolen, reissue with a replacement linked to the original, and permanently close

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • ops userOrder personalized physical cards through the API — custom card art, bulk orders, shipping methods and tracking — without managing a card manufacturer relationship myself

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Issuing agent access — stories about issuing agent access in this arenaIssuing agent access· 2 items

Stories about issuing agent access in this arena

  • ai-native userGive an agent its own card — issue a scoped virtual card to an AI agent with merchant locks, amount caps, and expiry so autonomous purchases stay inside policy, a use the vendor documents by name

    Core requirement — weighs 3× in arena scoring · 4 of 5 products fully deliver this today

    must-have
  • ai-native userAn agent can operate my card program — read balances and transactions, create and update cards, and adjust spend controls through the API or an MCP surface with scoped credentials

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Issuing compliance — stories about issuing compliance in this arenaIssuing compliance· 2 items

Stories about issuing compliance in this arena

  • ops userCardholder verification is built into issuance — KYC for consumers and KYB for businesses run through the platform with documented data requirements, review states, and re-verification flows

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • developerShow cardholders their own PAN and CVV without inheriting PCI scope — hosted components or ephemeral-key reveal flows the vendor documents as keeping me out of SAQ D

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Issuing disputes — stories about issuing disputes in this arenaIssuing disputes· 2 items

Stories about issuing disputes in this arena

  • ops userFile and track disputes on card transactions programmatically — network reason codes, evidence submission, provisional credit handling, and status webhooks through resolution

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • ops userThe platform fights fraud on my issued cards — network fraud scores or its own models surfaced at auth time, suspicious-activity alerts, and tooling to block and reissue compromised cards

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Ledger settlement — stories about ledger settlement in this arenaLedger settlement· 3 items

Stories about ledger settlement in this arena

  • finance leadSee money move in real time — account and card balances, a transaction ledger that ties every authorization to its clearing, and settlement reporting that reconciles to the penny

    Core requirement — weighs 3× in arena scoring · no product fully delivers this yet

    must-have
  • finance leadI get machine-readable reconciliation artifacts — daily settlement files or report APIs covering interchange, fees, and network adjustments — that my finance stack can consume automatically

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • developerPost-auth events are as programmatic as auth — clearings, refunds, reversals, and chargebacks arrive as webhooks with stable transaction identifiers, so my own ledger never drifts

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Openness — open source, data portability, and self-hosting storiesOpenness· 4 items

Open source, data portability, and self-hosting stories

Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items

Data-handling and privacy stories

Program management — stories about program management in this arenaProgram management· 3 items

Stories about program management in this arena

  • founderLaunch a card program without becoming a bank — BIN sponsorship, network membership, and program management are the platform's problem, and the time from signup to first live card is documented

    Core requirement — weighs 3× in arena scoring · no product fully delivers this yet

    must-have
  • founderThe platform supports the card types my product needs — debit, prepaid, commercial credit, and consumer credit programs — not just one prepaid rail

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • finance leadChoose how transactions are funded — prefunded balances or just-in-time funding where my system approves and funds each authorization — with the cash-flow tradeoffs documented

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Spend controls — stories about spend controls in this arenaSpend controls· 3 items

Stories about spend controls in this arena

  • ops userSet spend limits per card and per cardholder — amount caps over daily, monthly, or all-time windows, and transaction-count velocity rules — enforced by the platform, not my code

    Core requirement — weighs 3× in arena scoring · 3 of 5 products fully deliver this today

    must-have
  • ops userRestrict where a card works — merchant category (MCC) allowlists and blocklists, and single-merchant locks — applied at authorization time

    Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today

    should-have
  • developerIssue single-use and tightly scoped cards — one purchase, one merchant, an exact amount — so a leaked number is worthless the moment it's used

    Important, not disqualifying — weighs 2× in arena scoring · 3 of 5 products fully deliver this today

    should-have

Wallets tokenization — stories about wallets tokenization in this arenaWallets tokenization· 3 items

Stories about wallets tokenization in this arena

  • developerCardholder credentials are manageable through the API — PIN set and reset flows, 3DS enrollment for online use where the region requires it — without support tickets

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • developerNetwork tokens are first-class — I can see and manage the tokens created for a card, know which wallet or merchant holds them, and revoke them independently of the PAN

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have
  • developerCards land in Apple Pay and Google Pay — push provisioning from my app with the entitlements process documented, plus in-wallet card art and manual provisioning as a fallback

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    should-have

Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.