When we pay by credit card in a shop today, the transaction completes within a few seconds. But in that short time, a conversation takes place behind the scenes between banks, payment networks and various financial systems.
The two key actors in this process are called the issuer and the acquirer.
1. What is an issuer?
The issuer is the bank or licensed financial institution that provides the customer with a credit, debit or prepaid card.
Say you got a credit card from Garanti BBVA. In that case, your card's issuer is Garanti BBVA.
The issuer's core responsibilities are:
- Providing the customer with a physical or virtual card.
- Managing card usage and security.
- Checking card limits and account balances.
- Approving or declining transactions made with the card.
- Detecting suspicious transactions and running fraud checks.
- Managing the card's PIN, EMV and cryptographic security processes.
For example, if you try to make a 6,000 TL purchase with a credit card that has a 5,000 TL limit, the party that declines it is usually the issuing bank's authorization system.
The issuer's technical stack
An issuer platform may include the following components:
Card Management System (CMS): Manages card creation, lifecycle, limits and statuses.
Authorization System: Decides whether transactions coming in from POS terminals or ATMs should be approved.
Fraud Detection System: Analyzes suspicious card transactions.
HSM (Hardware Security Module): Performs PIN and cryptographic key operations securely.
Card Personalization System: Prepares the cards' EMV data and writes it to their chips.
2. What is an acquirer?
The acquirer is the bank or licensed payment institution that enables shops and businesses to accept card payments.
Say a shop gets its POS service from İş Bankası.
In that case:
- Bank that issued the card: Garanti BBVA (issuer)
- Bank providing the POS service: İş Bankası (acquirer)
The acquirer's core duties are:
- Enabling businesses to accept card payments.
- Providing POS and e-commerce (virtual POS) infrastructure.
- Forwarding payment transactions to the relevant card network or routing system.
- Managing financial reconciliation and payment processes for transactions.
- Transferring payment amounts to the businesses' accounts.
- Managing refunds, chargebacks and merchant risk processes.
The acquirer's relationship is with the business that accepts card payments, rather than with the cardholder.
3. Differences between issuers and acquirers
| Aspect | Issuer | Acquirer |
|---|---|---|
| Primary customer | Cardholder | Merchant |
| Core function | Issuing and managing cards | Enabling card acceptance |
| Card limit checks | Yes | No |
| POS service | Not its core role | Yes |
| Transaction authorization | Usually makes the final approve/decline decision | Forwards the request |
| Fraud management | Cardholder transactions | Merchant transactions |
| Money flow | Cardholder's account/debt | Merchant's collections |
A bank can be both an issuer and an acquirer at the same time. These roles don't require the institutions to be entirely separate.
4. How does the system work when you pay by card?
Let's walk through a realistic scenario.
Scenario:
- Customer: Ahmet
- Card: Garanti BBVA credit card
- Merchant: An electronics store
- POS bank: İş Bankası
- Card network: Visa
- Amount: 2,000 TL
The transaction goes through the following steps:
Step 1 — Presenting the card at the POS
Ahmet presents his Garanti BBVA credit card at the store's POS terminal.
The terminal reads the necessary payment data from the card and builds an authorization request for the transaction.
Step 2 — Sending to the acquirer
The POS terminal sends the payment request to İş Bankası's payment infrastructure.
Here, İş Bankası is acting as the acquirer.
Step 3 — Routing to the card network
The acquirer routes the request to the appropriate payment network. In this example, that's Visa.
Step 4 — Forwarding to the issuer
Visa routes the transaction to the authorization system of Garanti BBVA, the card's issuer.
Step 5 — Issuer checks
Garanti BBVA runs a series of checks:
- Is the card active?
- Does the card have enough available limit?
- Does the transaction comply with security rules?
- Is there any fraud risk?
- Did the required EMV validations pass?
Based on these checks, the transaction is approved or declined.
Step 6 — Returning the result to the POS
The issuer's response travels back through Visa to the acquirer, and from there to the POS terminal.
The result is shown on the POS screen.
5. What are authorization, clearing and settlement?
To understand card payment systems, you need to tell three concepts apart.
Authorization
The stage where it is decided whether a card transaction is allowed to go ahead.
The issuer runs its checks on the transaction and produces an approval or decline response.
Clearing
The stage where the financial records of completed card transactions are exchanged between the parties and processed.
During this process, transaction amounts, fees and other financial details are evaluated.
Settlement
The stage where money is transferred, or net positions are closed out, between the financial institutions involved.
When the acquirer pays the merchant depends on their agreement and payout schedule.
6. How ISO 8583 and EMV fit in
Two important technologies come up in the communication between issuer and acquirer systems.
ISO 8583
ISO 8583 is an international standard that defines the structure of financial transaction messages.
Authorization messages used in card payment systems may be based on different versions of this standard or on network-specific implementations of it.
For example, a transaction message may contain:
- MTI: Message type
- DE2: Card number (PAN)
- DE3: Processing code
- DE4: Transaction amount
- DE11: System trace audit number (STAN)
- DE39: Response code
- DE55: EMV chip data
These fields let systems identify, route and complete transactions.
EMV
EMV is the set of technical standards used for chip card transactions.
Under EMV, the card and the terminal perform various verification and cryptographic operations to secure the transaction.
For example, in online EMV transactions, the ARQC (Authorization Request Cryptogram) generated by the card can be verified on the issuer side.
The EMV transaction on the card is then completed based on the issuer's authorization decision.
HSMs play an important role in these processes, both for protecting cryptographic keys and for performing verification operations.
7. Can the issuer and acquirer be the same bank?
Yes.
For example, a customer may use an İş Bankası credit card at an İş Bankası POS terminal.
In this scenario, İş Bankası takes on both the issuer and the acquirer role.
Such transactions are usually called on-us transactions.
Transactions where the card issuer and the POS provider are different institutions can be called off-us transactions.
Which network or technical infrastructure a transaction goes through depends on how the banks and payment systems are configured.
Wrapping up
Issuers and acquirers are the two complementary core actors of the card payment ecosystem.
The issuer represents the cardholder's side; the acquirer represents the side of the business accepting the payment.
While the issuer is responsible for managing the card and authorizing the transaction, the acquirer handles the merchant's payment acceptance, transaction routing and financial collection processes.
Understanding these two roles gives software engineers building POS systems, card management platforms, EMV personalization applications, ISO 8583 messaging and payment services a strong foundation.