CardsFTW #172: Managing Data and Dollars

[Editor: It's back to school season, so Matthew's feeling educational. I hope you're enjoying these deep dives into fintech topics. The amount of information in his brain never ceases to amaze.]

So Many Ways to Make a Credit Card

While we work across many different types of payments at Totavi (ACH, wires, even paper checks!), over the past year, we have spent more time in card issuing, specifically consumer credit, than anywhere else.

When I talk to a prospect or client early on, they often ask, “What are all the things we have to do to build a card?”

First, I usually try to dissuade them: building a credit card product is not for the faint of heart. While ubiquitous in our daily lives, consumer revolving credit cards are among the most challenging products to build.

If we get past that conversation, we discuss various options, such as program managers, direct-to-bank constructs, and more. At some point, we may start to talk about how the funds flow and how the money actually moves. 

With the recent high-profile blow-ups of companies like Synapse, customers also want to know how they will keep everyone’s money and data safe. This week, we’ll explore some of the key structures in both debit and credit that make fintech cards work. 

FBOs, BIN Ranges, ICAs, and the Separation of Data

If you want to ship a card program that scales without the 2 am call to a regulator, a sponsor bank, or an on-call engineer, you need to understand four core concepts and how they fit together:

1. FBO accounts
2. BIN ranges
3. ICAs
4. Data separation

They sound like back-office trivia. They’re not. They’re the plumbing that keeps funds safe, transactions routable, and auditors calm.

FBO accounts: How fintechs hold customer money (safely, most of the time)

An FBO (“For Benefit Of”) account is a pooled, custodial deposit account (often called an “omnibus” account) held at an FDIC-insured bank. It’s opened in the bank’s name, not the end customer’s, but it holds funds belonging to many individual cardholders. The program (or sometimes the bank or processor) maintains a subledger that tracks each of the customer’s balances.When properly structured, this setup allows for pass-through deposit insurance: each end customer can be covered by the FDIC as if they had their own account, as long as two things are true:

1. The bank’s records indicate the account is held for the benefit of others.
2. The subledger clearly identifies each beneficial owner and their corresponding balance.

FBO accounts are the norm in consumer fintech because they scale operationally and legally. However, they only work if your subledger and the bank’s records stay tightly in sync. Otherwise, you risk breaking the chain of ownership that enables pass-through insurance in the first place. Read all you want on FDIC pass-through insurance.

Why It Matters:

• Keeps customer funds separate from the program manager for clear ownership.
• Enables standard ACH/wire rails, interest handling (if applicable), and daily reconciliation.
• Sets the stage for authorization/settlement funding for cards tied to that balance.

Watch Out:

In September 2024, the FDIC proposed prescriptive record-keeping and reconciliation rules for custodial/FBO accounts (daily reconciliation, standardized data, and annual filings). If finalized, banks and fintech programs will need tighter data pipelines between the subledger and the bank. Well-respected fintech lawyers at Venable have some notes.

Treat your FBO as a funds custody control panel. The subledger is the source of truth for user balances: your job is to reconcile the subledger to the bank’s omnibus daily, with exception handling, aging of breaks, and immutable audit trails. If you ever need pass-through insurance to work, your records must be precise as of failure, not reconstructed later. (Or un-reconstructable, see Synapse, et al.)

Flow: funds & data around the FBO

BINs and BIN ranges: How transactions know where to go

The BIN (Bank Identification Number), now formally the Issuer Identification Number (IIN), sits at the start of the Primary Account Number (PAN) and tells the ecosystem which issuer/network to route to. Historically six digits, the industry moved to eigh-digit BINs to expand supply after ISO updated the standard (ISO/IEC 7812-1). Visa set an April 2022 readiness date for acquirers/processors.