The Buckingham Capital Consulting Card Issuing Index.

Overall

The mean of the 3 segment scores.

For fintechs and e-money firms

Weighted to card range and integration: consumer debit, prepaid and wallet cards launched quickly through an API.

For expense and b2b payment platforms

Weighted to published pricing, issuing countries and integration: many virtual cards for business clients in several countries at a known cost.

For banks and lenders

Weighted to card range and regulatory standing: credit products on a processor with strong security credentials.

Weights by segment

What each score means

Score out of 100 is the sum of each criterion score divided by five and multiplied by its weight. The overall ranking is the mean of the segment scores. Ties are broken by card range, then regulatory standing. A provider that does not publish a price is scored as though the price were high, because a business cannot plan on an unpublished price. Prices are scored on the standard published rate, never an introductory, promotional or "from" rate, and a figure counts only when it appears on a pricing, fee or terms page rather than in a marketing line. A provider that serves one country only is scored on access for that country, and the limitation is printed in its profile.

Stripe Issuing

Stripe's card issuing product for platforms and businesses. It is the only provider in this edition with a full published price list, names its US issuing banks, issues in the UK and EU through its own regulated entities, and holds PCI DSS Level 1 and SOC 2 Type II. Local issuing is live in 22 countries.

• Card range: 5/5. Virtual, physical, debit, prepaid, credit and charge cards and digital wallet support all published.
• Published pricing: 5/5. Per-card, per-dispute and cross-border transaction prices published on the pricing page.
• Issuing countries: 3/5. Local issuing in 22 listed countries published.
• Integration: 4/5. API, self-serve sign-up and a stated time to go live; no test environment described on the pages read.
• Regulatory standing: 5/5. Named issuing banks and own UK and EU entities, PCI DSS Level 1 and SOC 2 Type II.
• Programme support: 4/5. Bank sponsorship, KYC, fraud tools and dispute handling published; programme management not described as a separate service.

Facts read on 26 October 2026 from: stripe.com, stripe.com, docs.stripe.com, docs.stripe.com.

Marqeta

A US card issuing processor with debit, prepaid, credit and tokenised cards and operations certified in 40+ countries. It holds SOC 2 Type 2 and ISO 27001 and gained an e-money institution and BIN sponsor in the UK and EEA through its TransactPay acquisition. It does not publish prices, and does not name its bank partners on the pages read.

• Card range: 5/5. Virtual, physical, tokenised, debit, prepaid and credit cards published.
• Published pricing: 0/5. Not published on the pages read.
• Issuing countries: 5/5. 40+ countries published; no country list.
• Integration: 3/5. API and private sandbox; no self-serve sign-up or launch time published.
• Regulatory standing: 3/5. SOC 2 Type 2 published; PCI DSS without level and an e-money licence without a named regulator count as half.
• Programme support: 2/5. Programme management and UK and EU BIN sponsorship published; KYC, fraud and dispute services not described on the pages read.

Facts read on 26 October 2026 from: www.marqeta.com, trust.marqeta.com, www.marqeta.com, www.marqeta.com.

Nium

A Singapore-headquartered payments firm issuing virtual and physical cards in 30+ markets without a separate BIN sponsor, under licences it lists by jurisdiction with numbers. It publishes the fullest integration terms in this edition, including self-serve sandbox access and a time to production. It does not publish card prices.

• Card range: 3/5. Virtual, physical, prepaid and tokenised cards published; debit and credit not specified.
• Published pricing: 0/5. Not published on the pages read.
• Issuing countries: 3/5. 30+ markets published.
• Integration: 5/5. API, sandbox, self-serve sign-up and a stated time to production.
• Regulatory standing: 4/5. Own licences with numbers and SOC 2 Type 2; PCI DSS without level counts as half.
• Programme support: 3/5. Own issuing, programme management and fraud protections published; KYC and dispute services not described on the pages read.

Facts read on 26 October 2026 from: www.nium.com, www.nium.com, www.nium.com, www.nium.com.

Enfuce

A Finnish issuer processor that is also a dual-regulated e-money institution and a principal member of Visa and Mastercard, so it can sponsor card programmes itself across the UK and EEA. It publishes the full card range, a sandbox and PCI DSS Level 1. It describes its fee structure but publishes no figures.

• Card range: 5/5. Physical, virtual, tokenised, prepaid, debit and credit cards published.
• Published pricing: 1/5. Fee structure described without figures.
• Issuing countries: 3/5. UK and EEA published.
• Integration: 3/5. API and sandbox; no self-serve sign-up or stated launch time.
• Regulatory standing: 3/5. Own e-money licences and PCI DSS Level 1; SOC 2 not published.
• Programme support: 2/5. BIN sponsorship and programme management published; KYC, fraud and dispute services not described on the pages read.

Facts read on 26 October 2026 from: enfuce.com, enfuce.com, docs.enfuce.com.

Lithic

A US card issuing processor with credit, debit and prepaid cards, a self-serve sandbox and the fullest published programme management service in this edition, covering bank relationships, KYC, fraud and disputes. It does not publish prices, issuing countries or its sponsor banks.

• Card range: 5/5. Credit, debit, prepaid, virtual and physical cards and digital wallet provisioning published.
• Published pricing: 1/5. Pricing described in words without figures.
• Issuing countries: 0/5. Not published on the pages read.
• Integration: 4/5. API, sandbox and self-serve sign-up; no launch time published.
• Regulatory standing: 2/5. SOC 2 Type 2 published; PCI DSS without level counts as half; sponsor banks not named.
• Programme support: 5/5. Bank sponsorship, programme management, KYC, fraud tools and dispute handling all published.

Facts read on 26 October 2026 from: www.lithic.com, www.lithic.com, www.lithic.com, trust.lithic.com.

Paymentology

A global issuer processor with prepaid, debit, credit, virtual and physical cards and five tokenisation services, operating in 60+ countries. It is PCI DSS Level 1 and ISO 27001 certified and arranges BIN sponsorship through partner sponsors. It does not publish prices, SOC 2 or a launch time.

• Card range: 5/5. Prepaid, debit, credit, virtual and physical cards and digital wallet tokenisation published.
• Published pricing: 0/5. Not published on the pages read.
• Issuing countries: 5/5. 60+ countries published.
• Integration: 3/5. API and developer sandbox; no self-serve sign-up or launch time.
• Regulatory standing: 1/5. PCI DSS Level 1 published; no own licence or named issuing bank; SOC 2 not published.
• Programme support: 2/5. BIN sponsorship through partners and programme management published; KYC, fraud and dispute services not described on the pages read.

Facts read on 26 October 2026 from: www.paymentology.com, www.paymentology.com, www.paymentology.com, developer.paymentology.com.

Airwallex

An Australian-founded payments firm and principal member of Visa that issues multi-currency virtual and physical cards in 50+ countries. It states PCI DSS Level 1 and publishes a 0% international card transaction fee. It does not publish card types, per-card prices, a sandbox or programme services on the pages read.

• Card range: 2/5. Virtual and physical cards and digital wallets published; card types not specified.
• Published pricing: 2/5. International transaction fee published; per-card prices not published.
• Issuing countries: 5/5. 50+ issuing countries published with named regions.
• Integration: 2/5. API and documentation; no test environment, self-serve issuing sign-up or launch time on the pages read.
• Regulatory standing: 3/5. PCI DSS Level 1; Visa principal membership and SOC 2 without type count as half.
• Programme support: 1/5. Own issuing as a Visa principal member published; other programme services not described.

Facts read on 26 October 2026 from: www.airwallex.com, www.airwallex.com.

Thredd

A UK issuer processor, formerly GPS, that lists 49 countries and territories where it can process card issuing and holds SOC 2 Type II and ISO 27001. It is a processor only: clients bring their own issuer or BIN sponsor. It does not publish prices, and its test environment cannot simulate payments.

• Card range: 4/5. Virtual, physical, debit and prepaid cards published; credit processed but not offered; wallet provisioning not described on the pages read.
• Published pricing: 0/5. Not published.
• Issuing countries: 5/5. 49 issuing countries and territories listed.
• Integration: 3/5. API and a test environment that cannot simulate payments; no self-serve sign-up or launch time.
• Regulatory standing: 2/5. SOC 2 Type II published; PCI DSS without level counts as half; no licence.
• Programme support: 0/5. Not offered: clients bring their own issuer and run their own programme.

Facts read on 26 October 2026 from: www.thredd.ai, docs.thredd.ai, cardsapidocs.thredd.com.

Galileo (SoFi Tech Solutions)

Galileo, now trading within SoFi Tech Solutions, processes debit, credit, prepaid and virtual cards across 13 countries in North and Latin America. It publishes a sandbox and a launch time of 2 to 6 months. It does not publish prices, a sponsor bank or the level and type of its certifications on the pages read.

• Card range: 5/5. Debit, credit, prepaid, virtual and physical cards and mobile wallet provisioning published.
• Published pricing: 0/5. Not published on the pages read.
• Issuing countries: 3/5. 13 countries in North and Latin America published.
• Integration: 4/5. API, sandbox and a stated launch time; no self-serve sign-up.
• Regulatory standing: 1/5. SOC 2 and PCI DSS without type or level count as half each; no licence or named bank.
• Programme support: 0/5. Not published on the pages read.

Facts read on 26 October 2026 from: tech.sofi.com, tech.sofi.com.

Highnote

A US platform combining card issuing, credit, acquiring and money movement, with programme management and in-house KYC and transaction monitoring. It publishes a test environment and dashboard sign-up. It does not publish prices, issuing countries, its sponsor bank or security certifications on the pages read.

• Card range: 5/5. Virtual, physical, tokenised, debit, credit and prepaid cards published.
• Published pricing: 0/5. Not published on the pages read.
• Issuing countries: 0/5. Not published on the pages read.
• Integration: 4/5. API, test environment and dashboard sign-up; no launch time published.
• Regulatory standing: 1/5. FinCEN registration and an unnamed sponsor bank count as half; PCI DSS and SOC 2 not published on the pages read.
• Programme support: 3/5. Bank sponsorship, programme management and KYC published; fraud tools and dispute handling not described on the pages read.

Facts read on 26 October 2026 from: docs.highnote.com, docs.highnote.com, highnote.com, highnote.com, docs.highnote.com.

Adyen Issuing

Adyen's card issuing product, run on its own banking licences and PCI DSS Level 1 infrastructure. It issues Visa and Mastercard virtual and physical cards in the EEA, the UK and the US. It does not publish card prices, debit or credit card types, or a test environment on the pages read.

• Card range: 2/5. Virtual and physical cards published; card types and wallet provisioning not described on the pages read.
• Published pricing: 1/5. Pricing model named without figures.
• Issuing countries: 3/5. EEA, UK and US published.
• Integration: 2/5. API and documentation; no test environment, self-serve sign-up or launch time on the pages read.
• Regulatory standing: 3/5. Own banking licence and PCI DSS Level 1; SOC 2 not published on the pages read.
• Programme support: 2/5. Issuing under its own licence and KYC published; programme management, fraud and dispute services not described.

Facts read on 26 October 2026 from: www.adyen.com, docs.adyen.com, www.adyen.com, help.adyen.com.