In the world of payments acquiring there\u2019s probably nothing more alluring than the idea of building directly to the card networks.<\/p>\n\n\n\n
But as is the course with everything in payments, nobody knows what the hell they\u2019re talking about.<\/p>\n\n\n\n
More often than not the folks who casually throw out the idea of building to the networks are payment ISOs who do so under a pathetically veiled \u201cthreat\u201d aimed at their bank and processing partners.<\/p>\n\n\n\n
This is completely milk-toothed since no payments company – let alone an ISO – knows how to spell R&D, a major requirement, it turns out, for building software.<\/p>\n\n\n\n
ISOs are frustrated because:<\/p>\n\n\n\n
But whatever.<\/p>\n\n\n\n
We rolled up our sleeves and undertook substantial research to answer the question: what does it really<\/em> take to build to the networks?<\/p>\n\n\n\n Turns out it\u2019s harder to pin down than we thought.<\/p>\n\n\n\n In the early 2000\u2019s an interested party would build to the networks by procuring a MIP server from Mastercard and DEX server from Visa. These would be stored in a secure facility after the processor acquired a bank sponsor and spent years building and certifying with the card schemes.<\/p>\n\n\n\n In 2001 the card schemes had these huge binders that contained all the guidelines for writing directly. It was thousands of pages and it would take a few years to consume and certify. But once you built to the networks the work didn\u2019t stop: the networks would issue an update and give you 6 months to re-certify both digitally and physically. It was a treadmill.<\/p>\n\n\n\n Mitch Jacobs, cofounder Plink, former founder OnDeck<\/p>\n<\/blockquote>\n\n\n\n Mitch estimated that the cost of building to the networks is $5.3M in today\u2019s dollars, but the ongoing costs were even higher.<\/p>\n\n\n\n I remember after we wrote to the networks they had this encryption update that would be nearly $9M in today\u2019s dollars. And every time a new terminal came out we had to certify that thing. Suffice it to say that you need very large scale to justify the amount of continual investment.<\/p>\n<\/blockquote>\n\n\n\n Mitch also acknowledges that procedures might have changed in the past 20-some years since he wrote the integrations, and the networks are \u201ctrying\u201d to make it easier for software companies to write to them directly, with explicit divisions now established for direct network connections.<\/p>\n\n\n\n Yet when we reached out to the responsible teams at the networks they couldn\u2019t be bothered to respond.<\/p>\n\n\n\n Cuz, you know, being a duopoly<\/a> means you don\u2019t actually work. <\/p>\n\n\n\n This prompted us to talk with people who have done more recent integrations.<\/p>\n\n\n\n We spent a good deal of time with Jason Kafer<\/a>, a serial payments entrepreneur and co-host of the CentsChat podcast<\/a>.<\/p>\n\n\n\n Jason tells us it takes 18 months from cradle to grave once you have a sponsoring bank lined up.<\/p>\n\n\n\n \u201cIt takes a few weeks or a few years to find a sponsoring bank,\u201d cautions Jason. That\u2019s because the sponsoring bank is signing on the proverbial dotted line on behalf of the processor that wants to write to the networks. This means the bank owns all the risk if the processor screws something up.<\/p>\n\n\n\n Many acquiring banks are skittish about underwriting an unknown processor because the banks themselves don\u2019t know how to appropriately manage the risk of writing to the networks.<\/p>\n<\/blockquote>\n\n\n\n The sponsoring bank needs at least $1B in Tier 1 assets per Visa. Tier 1<\/a> is in reference to the minimum amount of capital that a bank must hold in its reserves to finance its banking activities as specified in Reg F from the OCC<\/a>. <\/p>\n\n\n\n \u201cTechnically,\u201d advises Jason, \u201ca processing party could get to a Tier 1 threshold by commingling assets across multiple banks and multiple BIN relationships.\u201d <\/p>\n\n\n\n Once the bank signs the 18-month timer starts.<\/p>\n\n\n\n But not surprisingly, much of that 18 months is spent waiting for the networks to, you know, get out of bed.<\/p>\n\n\n\n The first step is the audit: the networks audit both the sponsoring bank and the processor.<\/p>\n\n\n\n The purpose of the audit is to ensure that the applying parties are adequately staffed with knowledgeable people to oversee the program. In Visa\u2019s case, the audit is called a GARS<\/a> (Global Acquirer Risk Standards) audit and in Mastercard\u2019s case it\u2019s called a Franchise audit. <\/p>\n\n\n\n But Visa doesn\u2019t even do the audit themselves: they outsource it to a third party.<\/p>\n\n\n\n A lot of the 18 months is just waiting on card schemes to do audits. For example, Visa will outsource the GARS audit and it takes time to get in the queue. Mastercard does the audit themselves while Discover and Amex are less stringent on auditing requirements in some areas, but more stringent in other areas because they\u2019re banks and must adhere to banking regulations.<\/p>\n<\/blockquote>\n\n\n\n Jason was emphatic that the audit process exists so everyone comes in eyes-wide-open.<\/p>\n\n\n\n If the processor doesn\u2019t architect something right, and it goes haywire, it can bankrupt the bank. <\/p>\n\n\n\n It\u2019s not<\/em> a triviality.\u00a0<\/p>\n\n\n\n When the audits pass, then you finally get into the technical work of building to the card schemes.<\/p>\n\n\n\n Visa\u2019s documentation is the most complicated. It\u2019s based on the ISO 8583<\/a> standard and the documentation is over 2,000 pages in total. It\u2019s separated into two sections: Base I<\/a> for authorizations (also called VIP<\/a> internally), and Base II for clearing and settling.<\/p>\n\n\n\n\n
\n
\n
\n