The Payment Card Ecosystem

The four participants

A card payment moves between four institutions. The issuer issues the card and holds the account. The network operates the rules and routes the message. The acquirer signs the merchant and sends the request. The merchant provides the goods or services. Processors and tokenisation services sit between them.

• The issuer issues the card and owns the account
• The network operates the rules and routes messages
• The acquirer signs the merchant and submits the request
• The merchant delivers the goods or services
• Processors and tokenisation services sit in between

The life of a transaction

The cardholder presents the card. The terminal reads it, usually over the chip with cryptography, and creates a cryptogram over the transaction data. The acquirer sends an authorisation request to the issuer through the network. The issuer checks the account, applies its rules and returns a response code. The acquirer returns the result to the terminal, and the transaction is settled later through clearing.

• The terminal reads the chip and creates a cryptogram
• The acquirer sends an authorisation request
• The network routes it to the issuer
• The issuer applies its rules and returns a response code
• Clearing settles the transaction afterwards

The data formats involved

Several formats exist because each solves a different problem. The PAN identifies the account. Track data exists for legacy magnetic stripe reading. A token replaces the PAN for storage. A cryptogram proves a genuine chip transaction. An ATS or EMV record describes the chip environment. Each is appropriate in a different place, and mixing them up is a security error.

• PAN identifies the account
• Track data is the legacy magnetic stripe format
• A token replaces the PAN for storage and recurring use
• A cryptogram proves a genuine chip transaction
• EMV records describe the chip environment

Where the standards sit

ISO/IEC 7812 defines card identification, ISO/IEC 7813 the magnetic stripe records, EMVCo the chip application and TLV tags, and the PCI Security Standards Council the controls that protect cardholder data. Each answers a different question and none overlaps.

• ISO/IEC 7812 - card identification and the IIN
• ISO/IEC 7813 - magnetic stripe record formats
• EMVCo - chip application, AIDs and TLV tags
• PCI DSS - controls for protecting cardholder data
• The card network rules bind the participants together

Why understanding the ecosystem matters

Almost every operational problem in card payments is an ecosystem problem: an authorisation that behaves differently by country is a routing or configuration question, not a bug. A record that fails at one terminal but not another is usually a format or service-code question. Knowing which layer owns a behaviour tells you where to look.

• Cross-border behaviour differences are usually configuration, not bugs
• Terminal-specific failures are often format or service-code issues
• Response codes come from the issuer, not the network
• A token failing usually means a provisioning or vaulting problem
• Knowing the layer tells you where the fix belongs