Card issuing is changing because regulation and technology are pushing in the same direction. Regulators want stronger fraud controls and more transparency; customers expect a card in their phone within minutes, tokenised payments and full control in an app. Network tokenisation requirements are tightening and cloud-native processors are setting new standards on speed and cost. Together these define what a modern issuer needs.
Network tokenisation: from optional to expected
Network tokenisation replaces the card number with a token issued by the scheme and tied to a device, merchant or channel. Mastercard has committed to tokenising all e-commerce transactions in Europe by 2030, and Visa is also pushing issuers and processors towards tokens. What was a security best practice is becoming a basic operating requirement.
For issuers this means connecting to the Visa and Mastercard token services, managing the token lifecycle (including updates when the underlying card changes) and supporting provisioning into Apple Pay, Google Pay and Samsung Pay. Issuers without automated token management face a growing workload as token numbers rise.
The fraud benefit is clear. A token bound to one merchant or device is of little use elsewhere, and the real card number is not exposed in the transaction flow, which removes the main target for card data theft at merchants and processors.
Instant issuance and digital-first cards
Instant issuance means a customer receives a working card in their digital wallet within seconds, without waiting for a plastic card. For retail banks launching debit products, the expectation is that a new customer can complete KYC, add the card to a wallet and pay contactless within minutes of opening the account.
In commercial programmes, including expense management, virtual cards for supplier payments and single-use cards for online buying, instant issuance is simply how the product works. Platforms such as Marqeta and Stripe Issuing let fintechs and companies create virtual cards through an API, with real-time controls on spend limits, merchant categories and frequency. This underpins expense management platforms, B2B payment automation and embedded finance.
The modern issuing stack
Older card management systems, often batch-based and built decades ago, struggle with real-time authorisation, instant issuance and token management. Issuers are moving to cloud-native platforms because legacy systems cannot easily support wallet provisioning, real-time controls or API links to modern fraud and compliance tools.
A modern issuing platform should offer real-time authorisation decisions within a tight time budget; full card lifecycle management including instant issuance, wallet provisioning and automated token management; integration with behavioural analytics and machine learning fraud models; connectivity to Visa, Mastercard and domestic schemes; a complete API with real-time event notifications; and multi-currency support for international programmes.
The GCC issuing context
GCC issuers work within Visa and Mastercard rules alongside domestic schemes: mada in Saudi Arabia, BENEFIT in Bahrain, NAPS in Qatar and Jaywan in the UAE. The region adopted contactless and mobile wallets early, and contactless use in the UAE and Saudi Arabia is among the highest in the world. The main obstacle for established issuers is legacy core and card systems that predate modern tokenisation and API standards, which makes migration complex and disruptive.
New entrants, including digital banks, fintech issuers and banks launching new programmes, can use cloud-native issuing platforms to avoid the legacy problem altogether. Licensing for card issuing under QCB, SAMA and CBUAE rules is well established; the real decision is which platform best suits the business model, card type and target customers.