Card issuing is shifting from plastic to tokenisation, APIs, and embedded finance. Incumbent banks must modernise or risk being left behind.
Card issuing used to be a straightforward game: get a licence, connect to a processor, and watch interchange and interest income flow. Now it’s no longer about how many cards a bank can print, but how quickly it can orchestrate secure, token-based credentials and offer modern card products. Yet many incumbents are still tied to batch files and issuance cycles measured in months.
The bottleneck is tightening. The EU is imposing tougher regulations and will punish laggards. At the same time, embedded-finance momentum means European businesses are shifting volumes to issuer-as-a-service platforms built for API speed. The question is simple: will traditional banks rewrite their issuing playbook now, or wait until the market and regulators do it for them?
How the playbook is rewritten
A decade ago, issuing in Europe and the UK was anchored in plastic and interchange; cash still dominated POS, and early contactless and wallet provisioning sufficed. Today, the ECB says most consumers prefer cashless, while networks report close to half of European e-commerce already tokenised, with full adoption expected by 2030.
Factor 1 – Regulation 3.0
Policy winds are sharpening. Brussels’ PSD3 and the UK’s PSR will tighten authentication, introduce faster refund obligations, and scrutinise fees. Any mandated changes could reduce issuers’ fee income and force a rethink of economics.
Factor 2 – Fraud and compliance
Fraud remains acute: £722 million of unauthorised cases in 2024, according to UK Finance. Networks argue that tokens cut card-not-present fraud by up to 60%, yet many legacy issuers still rely on multi-month reissuance cycles. Even digital challengers are not immune: the FCA fined Monzo £21 million in 2025 for weak onboarding and monitoring, underlining that scale without resilient KYC and integrated fraud controls is now a regulatory red line.
Factor 3 – Tokenisation
Tokenisation is becoming the default. Visa reported more than 11 billion active tokens by the end of 2024, adding another billion in the first quarter of 2025. Mastercard also shows similar momentum, with Juniper Research analysts expecting the vast majority of global online transactions to be tokenised by the end of the decade.
Factor 4 – Embedded finance
Embedded finance is projected to exceed €100 billion in Europe by 2030, shifting as much as 15% of banking income to API channels. SMEs and platforms now expect tokenised cards in days. Modern BaaS providers can assign BINs and issue virtual cards within a week. Legacy-bound banks, tied to mainframes and quarterly releases, simply cannot match. Cloud-native challengers handle tokens in real time, meet rules, and expose APIs to any platform—faster and cheaper.
Factor 5 – Legacy cores
Many banks still run decades-old issuing platforms that are slow, costly, and poorly suited to real-time processing or digital channels. This hampers tokenisation, instant issuance, and embedded finance while raising operating costs. As expectations rise, incumbents risk losing share to more agile rivals.
Strategy for incumbents – from retrofit to rewrite
Legacy cores were built for yesterday’s rules: batch files, annual scheme releases, and plastic that stayed valid for years. Modernisation is now essential.
Nearly all banks in EMEA plan upgrades in the next year. Modern card issuing platforms are API-first and real-time, enabling instant virtual cards and seamless app integration. The number of cards issued via such platforms is set to double from 748 million in 2024 to 1.4 billion by 2029. To remain competitive, incumbents must adopt them.
API-first issuing & embedded banking
Banks must become easy to plug in. NatWest offers a model: its first two non-bank partners (AA and Saga) went live in under six months, delivering white-label products from an API toolkit. The playbook is clear: publish a sandbox, guarantee low latency and 24-hour dispute callbacks, and offer attractive revenue-share tiers.
Cloud and microservice cores
Migrating to the cloud is no longer optional. Studies suggest banks save about 20% on operating costs and up to 40% for data workloads after migration. Beyond cost, cloud card management enables resilience and allows updates without outages.
Issuer-as-a-Service platforms
Choosing a cloud-native issuing processor means inheriting a stack pre-certified for PCI-DSS and 3D Secure, patch-updated for new mandates, and proven at scale. Banks adopting such platforms can launch programmes for marketplaces, ride-hailing apps, or SME platforms, capturing interchange, KYC fees, and customer data while keeping regulatory accountability in-house.
What comes next – and the decision that cannot wait
In the EU, PSD3 and PSR are expected by 2026 with adoption by 2027; an IFR fee review remains underway. In the UK, the Data Act 2025 enables mandatory Smart-Data APIs extending open banking, with guidance emphasising standards and interoperability. Regulation is driving technology.
Meanwhile, networks are embedding AI and machine learning for risk scoring, wallets are making tokens the default, and next-generation issuing must handle token lifecycle, wallet support, AI-first fraud controls, and biometrics—updated overnight in a single stack.
The question each traditional bank must ask is this: when Smart-Data APIs go live and merchants switch to token-only checkout, will your cards rise to the top of the authorisation stack, or be routed last?
