Aashna Jain

What is a BIN, and what is BIN sponsorship?

4 min readFor buildersBuilding on it12 of 21

The card has your logo on it. The leading digits belong to a bank you have never mentioned to your customers.

WHOSE NUMBER IS ON THE CARD
YOUR BRAND 4 2 7 1 0 9 • • • • • • • • • • • • the BIN the account the sponsor bank holds the licence you holds the customer the regulator only asks one of them

Your brand on the front. Their licence in the first six digits.

What the BIN actually encodes

The leading digits of every card number identify the institution that issued it. The very first digit indicates the network family: cards beginning with four are Visa, five is Mastercard, and other ranges cover the rest.

The rest of the prefix tells any system in the chain a surprising amount before a single authorisation is sent: which bank, which country, whether it is debit, credit or prepaid, and often which product tier. That is why a checkout can show the right card logo the moment you type six digits, and why interchange can be priced before the transaction completes.

Historically the prefix was six digits. It is now commonly eight, because the six-digit space was running out, but this is a coexistence rather than a completed switch. Visa stopped issuing new six-digit BINs and assigns eight-digit ranges to new requests, while the six-digit BINs already in circulation remain valid and in use. Both lengths are live across the global card base today, which is a small detail that quietly broke a great deal of software that assumed six and a fixed length.

Why you cannot simply get one

A BIN is issued to a licensed institution that is a member of the card network. Getting your own means becoming a network member, meeting capital requirements, and carrying the compliance obligations of an issuer. That is a multi-year, heavily capitalised undertaking, and for most fintechs it is not the business they are trying to be in.

So the ordinary path is sponsorship. A bank that already holds BINs lets you issue cards under one. Your brand goes on the card, your app controls the experience, and the bank remains the issuer in every sense that a regulator or a card network cares about.

What the arrangement really costs

The economics are shared, not yours. Interchange flows to the issuer, and your share is whatever the sponsorship agreement says. Sponsors also charge per card, per transaction and per programme, and there is usually a minimum.

The compliance perimeter is the bank's, which makes it yours in practice. The sponsor is answerable for what happens on its BIN, so it will impose onboarding standards, monitoring, and limits on what kinds of customers you may serve. Expect those to be enforced, and expect them to tighten after any incident anywhere in the sponsor's portfolio, not just yours.

Concentration risk is real. If your sponsor exits the business, is told to withdraw from it, or simply decides your segment is not worth the supervision, your cards stop. Migrating a card programme to a new BIN means reissuing every card, which is expensive, slow and visible to every customer.

The questions worth asking before signing, in order: how many programmes has this sponsor migrated off in the last two years and why, what is the notice period, who owns the customer relationship contractually, and what happens to funds and data if the agreement ends.

A small publisher without its own ISBN prefix puts out books under a larger house's imprint. The cover is yours, the writing is yours, the readers are yours. The catalogue number says someone else, and if that house decides it no longer wants your genre, every book has to be reissued.

Where you meet it

Every fintech card whose terms name a bank you had not heard of. Every "issued by" line in small print on the back. Every card programme that migrated and made every customer update their details somewhere.

Building this? A second pair of eyes on the architecture is what the advisory is for. →

Get the next one in your inbox.

New fundamentals and one memo every two weeks.

One memo every two weeks. Unsubscribe in one click. Delivered through Substack, so their terms and privacy policy apply.