To become a credit card issuer in the United States, you need either your own bank charter or a contractual relationship with a bank that already has one, plus membership in a card network such as Visa or Mastercard and a security program that satisfies PCI DSS. The work splits between convincing federal regulators you can safely extend consumer credit and proving to the networks that your systems can process transactions without leaking cardholder data. From first filing to first live card, plan on more than a year.
Pick Your Issuance Path First
Everything downstream depends on this choice. You can organize your own national bank and become a direct issuer, or you can partner with an existing chartered bank that acts as the legal issuer while you handle the brand, the technology, and the customer.
A direct charter gives you control and one specific commercial advantage: interest rate exportation. Under 12 U.S.C. § 85, a national bank may charge the interest rate allowed by the state where it is located even when lending into states with lower caps.1Office of the Law Revision Counsel. 12 USC 85 – Rate of Interest on Loans, Discounts and Purchases That is why so many credit card banks sit in Delaware, South Dakota, and Utah. The cost is that you take on OCC supervision for the life of the institution and you have to stand up the capital, management, and infrastructure of a real bank.
The partner-bank route, often called the fintech model, lets you launch without a charter of your own. The bank is the issuer of record and carries the regulatory responsibility; you typically run marketing, applications, and servicing. The trade-off is control: the partner bank sets your compliance framework and federal examiners look through the bank to your operations. You will also likely need state money transmitter licenses if you touch customer funds, with initial application fees running from nothing in some states up to roughly $10,000 in others, plus surety bond requirements that vary by state.
What a Direct OCC Charter Requires
If you go direct, you organize as a national bank under 12 U.S.C. § 21, which requires at least five natural persons to file articles of association with the Office of the Comptroller of the Currency.2Office of the Law Revision Counsel. 12 USC 21 – Formation of National Banking Associations; Incorporators; Articles of Association Filings go through the OCC’s Central Application Tracking System, a web portal for drafting, submitting, and tracking applications.3Office of the Comptroller of the Currency. Central Application Tracking System (CATS)
The core submission is a business plan covering at least three years of projected operations. Under 12 CFR 5.20, the plan has to show that the proposed bank has enough initial capital, net of organizational expenses, to support the projected volume and type of business.4eCFR. 12 CFR 5.20 – Organizing a National Bank or Federal Savings Association There is no single published minimum dollar figure for a credit card bank charter. The OCC sets the number against your risk profile and projected lending volume, and in practice organizers should expect to commit tens of millions in initial capital given the risk of unsecured consumer lending.
The OCC also evaluates your people. The agency looks at the organizing group’s banking experience and whether the proposed management team can actually run a lending operation. Organizers without deep banking backgrounds generally have to bring in experienced senior executives, especially a chief executive officer, well before filing. The OCC can block any officer or director hire for two years after the bank opens. The agency targets a decision within 120 days of accepting a complete application, but gaps in the file or a complex proposal will extend that.
Capital You Have to Hold Once You’re Operating
Launching is not the end of the capital story. Under 12 CFR Part 3, a national bank has to meet capital ratios at all times:5eCFR. 12 CFR Part 3 – Capital Adequacy Standards
- Common equity tier 1 capital ratio of 4.5 percent of risk-weighted assets
- Tier 1 capital ratio of 6 percent of risk-weighted assets
- Total capital ratio of 8 percent of risk-weighted assets
- Leverage ratio of 4 percent
The ratios measure capital against risk-weighted assets, so the dollar amount of capital you have to hold scales with how risky your portfolio is. Credit card receivables carry higher risk weights than Treasury bonds, which means an unsecured-consumer-credit book needs proportionally more capital than a safer bank of the same size. Breaching the minimums triggers regulatory action that ranges from dividend restrictions to forced closure, so most credit card banks run buffers well above the floor.
Consumer Credit Rules You Have to Comply With
Issuing cards means extending unsecured consumer credit, and that puts you under several overlapping federal statutes. Enforcement here can close a program, not just fine it.
Ability to Pay
Before opening any account, you have to evaluate whether the applicant can afford the required minimum payments. Regulation Z, at 12 CFR 1026.51, requires you to consider the consumer’s income or assets alongside existing debt obligations, and to look at a debt-to-income ratio, a debt-to-asset ratio, or residual income after obligations.6eCFR. 12 CFR 1026.51 – Ability to Pay Approving accounts without reviewing any financial information is per se unreasonable under the rule.
For applicants under 21, the standard is tighter: you must verify that the young consumer has independent income sufficient to make minimum payments, or that a cosigner who is at least 21 has agreed in writing to be liable and has the financial capacity to cover the debt.6eCFR. 12 CFR 1026.51 – Ability to Pay
CARD Act Rules and Disclosures
The Credit Card Accountability Responsibility and Disclosure Act of 2009 governs the core terms of how you can price and change an account. You cannot raise interest rates during the first year an account is open. You have to give 45 days’ advance notice of any rate increase. Penalty fees must be reasonable and proportional to the violation. Every billing statement has to disclose how long it would take to pay off the balance making only minimum payments and the total interest cost of doing so.
Regulation Z implements the detail, including the Schumer box, the standardized table of rates, fees, and terms that has to appear in every application and solicitation. Disclosures must be clear and conspicuous, delivered in a tabular format for applications and solicitations, and provided in writing in a form the consumer can keep.7Consumer Financial Protection Bureau. Regulation Z – 1026.5 General Disclosure Requirements Penalty APR disclosures have their own formatting requirements within the box.
Penalty Fee Limits
Regulation Z caps what you can charge for late payments and similar violations. Current safe harbor amounts are roughly $32 for a first violation and $43 for a subsequent violation of the same type within six billing cycles, and the figures adjust annually with CPI. Regardless of the safe harbor, a penalty fee cannot exceed the dollar amount of the violation, so a $20 minimum payment caps a late fee at $20. You also cannot stack multiple penalty fees on a single event.
Fair Lending and Credit Reporting
The Equal Credit Opportunity Act prohibits discrimination in any aspect of a credit transaction based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. The Fair Credit Reporting Act requires you to send adverse action notices when you deny an application based on a credit report, and to investigate disputes when consumers challenge information you have reported to the bureaus. These obligations are built into every stage of application review and account management.
When the CFPB Starts Examining You
The Consumer Financial Protection Bureau has direct supervisory authority over banks, thrifts, and credit unions with more than $10 billion in assets, along with their affiliates.8Consumer Financial Protection Bureau. Institutions Subject to CFPB Supervisory Authority Below that threshold, the CFPB can still bring enforcement actions but does not conduct routine exams. If you plan to scale, build the compliance infrastructure that will survive CFPB examination before you cross the line.
AML Program and Customer Identification
Every issuer has to maintain an Anti-Money Laundering program under the Bank Secrecy Act. That means written policies and procedures, a designated compliance officer, ongoing staff training on suspicious activity, and independent testing to confirm the program works. Examiners audit these pieces regularly.
The Customer Identification Program is the operational core. Before opening an account, you have to collect at minimum the customer’s name, date of birth, address, and an identification number such as a Social Security number for U.S. persons or a passport number for non-U.S. persons.9eCFR. 31 CFR 1020.220 – Customer Identification Program You then verify identity using risk-based procedures, which can be documentary (a government-issued ID) or non-documentary (database comparison). The standard is a reasonable belief that you know the customer’s true identity.
Network Membership and Your BIN
Joining a card network is a separate process from the charter work, and the two generally run in parallel. The network wants evidence of financial stability, technical capability, and compliance infrastructure before it lets you into the global payment system.
Your application package typically includes the business plan, audited financial statements, PCI DSS certification, evidence of a dedicated settlement account, projected monthly transaction volumes, and the geographic regions where you will market cards. Networks charge non-refundable application and registration fees that vary with membership level and program scope. Under a partner-bank model, the application identifies both the sponsoring bank and the program manager. A direct issuer lists itself as both the BIN owner and the sponsoring entity.
The BIN, the six- to eight-digit prefix on every card number that identifies the issuer, is what routes transactions back to your processing systems. In practice you obtain a BIN through the card network rather than applying directly to the ISO registration authority, and getting it registered correctly has to happen before any cards go live.
PCI DSS and Card Production Security
Any entity that stores, processes, or transmits cardholder data has to comply with PCI DSS, and the networks make the issuer responsible for its own compliance and that of its service providers.10Visa. Account Information Security (AIS) Program and PCI Your security infrastructure has to be built and audited before the network will approve you.
Compliance at the highest level involves an annual on-site assessment by a Qualified Security Assessor who examines network architecture, encryption, access controls, and vulnerability management. The assessor produces a Report on Compliance that goes to the network. The assessment repeats every year, and material changes to the technology environment can trigger an interim review. Building to pass this audit is one of the largest upfront costs for a new issuer and usually requires dedicated security staff and specialized hardware.
Card production and personalization have their own PCI security standards. Hardware Security Modules have to be certified to FIPS 140-2 Level 3 or higher for cryptographic key management. Sensitive data has to be encrypted in transit and at rest. The physical specifications for a production facility, including vault construction, access controls, and CCTV placement, read more like a bank vault than a print shop. Most new issuers outsource production to an established bureau that already meets the standards rather than build and certify a facility from scratch; in-house production generally only makes economic sense at very high card volumes.
Testing and Launch
Once network membership is approved and the charter or partnership is in place, you enter User Acceptance Testing with the network. You simulate authorization requests, settlement cycles, and dispute workflows to confirm your systems communicate correctly with the network’s infrastructure. Edge cases get surfaced here: partial approvals, foreign currency, declines. The network assigns a representative to manage the integration, and how quickly you respond to information requests and fix test failures directly affects your launch date. Once testing closes and any outstanding regulatory conditions are satisfied, the network issues formal authorization to onboard cardholders and process live transactions.
Realistic Timeline
End-to-end, a direct charter stretches well past a year. The OCC’s 120-day decision clock does not start until it formally accepts a complete application, and preparing one, which means recruiting qualified management, committing capital, and writing the business plan, takes months on its own. Network onboarding, PCI DSS certification, and technical testing overlap in parts but each adds time.
The partner-bank model compresses the regulatory piece because the bank already holds the charter, but negotiating the partnership, integrating systems, and completing network certification still take substantial lead time. Either way, incomplete applications, gaps in the management team, or failed security assessments do not just add weeks; they can reset entire portions of the review. Treat the documentation and compliance work as the product, not the paperwork around it, and the process moves faster.