Free · Basics · ~6 min read

How Credit Cards Work: The Four-Party Model

In short: every swipe involves at least four parties — cardholder, merchant, acquirer, and issuer — connected by a card network (Visa/Mastercard/UnionPay). Once you know who does what, every field in an ISO 8583 message suddenly has a place to sit.

The four parties

Party	Who	Role
Cardholder	You, paying with a card	Initiates the payment, owes the balance
Merchant	The shop getting paid	Accepts the card, submits the transaction
Acquirer	The merchant's bank	Routes the transaction into the network, settles funds to the merchant
Issuer	The bank that issued your card	Approves/declines, funds the payment, bills the cardholder

A fifth, invisible player is the card network (scheme): Visa, Mastercard, UnionPay, American Express, JCB. It doesn't lend money; it is the switching and rulebook network between acquirer and issuer — messages travel over its rails, and it sets the standards and fees.

Three-party vs four-party: Amex and Discover are historically three-party — the network is both issuer and acquirer. Visa/Mastercard/UnionPay are four-party — issuer and acquirer are separate institutions linked by the network.

How money and messages flow

Initiate: you tap/swipe; the POS or gateway builds an authorization request (typically ISO 8583 0100/0200).
Route: the acquirer sends it into the network, which uses the card's BIN to find the issuer.
Decide: the issuer checks balance/limit/risk and returns an authorization response (0110/0210); response code DE39 = 00 means approved.
Clear & settle: later, transactions are cleared in batches and funds settle between banks — the merchant is paid (minus fees) and the issuer later bills you.

The fees in the middle

The merchant nets less than the sale amount. The gap is mainly three parts: interchange (paid by acquirer to issuer — the biggest slice), scheme fees (to Visa/MC), and the acquirer markup. This is exactly why issuers are motivated to hand out cards and encourage spending.

👉 Next: The Transaction Lifecycle: Authorization → Clearing → Settlement, which unpacks step 4 above. Want to see a real message? Open the parser tool and paste an ISO 8583.