Chaos and Order

💡 왼쪽 원문을 읽으면서 오른쪽에 따라 써보세요. Tab 키로 힌트를 받을 수 있습니다.

원문 렌더가 준비되기 전까지 텍스트 가이드로 표시합니다.

Prologue — Twelve systems spin behind a single card

You swipe a credit card in a cafe. 1.5 seconds later you hear "approved." Inside those 1.5 seconds, exactly this happens.

1. The terminal (POS) reads the PAN (Primary Account Number, the 16-digit card number) from the card's chip.

2. The terminal hands an ISO 8583 0100 message to the acquirer — in Korea that's BC, Shinhan, KB; in the US it's Chase, Worldpay, Fiserv.

3. The acquirer routes that message to the issuer via the card network's rail (VisaNet, Banknet).

4. The issuer checks balance, limit, and fraud, then returns a 0110 response.

5. The response retraces the path back to the POS.

6. The POS prints "approved" — but **no money has moved yet.**

7. 24 to 48 hours later, in a separate **clearing** cycle, the acquirer, issuer, and network actually move the funds.

8. Interchange fee, scheme fee, and acquirer markup are subtracted somewhere in that path.

These 8 steps happen roughly **2 trillion times** in 2026 alone. Visa alone discloses 76,000 transactions per minute. Korea processes 400 million transactions per day; Japan, 70 million. Behind one card, **twelve systems are spinning.**

And the names of those twelve systems have all changed. **Stripe** now runs `$1T+ TPV` and is effectively a new standard; **Adyen** has bundled online and in-store into one backend under the single word "unified commerce"; **PayPay** in Japan has gathered 65M users and absorbed LINE Pay. Korea ends payments without a physical card at all through Toss Pay, Naver Pay, and Kakao Pay.

This article tries to set the scene **in a single breath**: the grammar (4-party model, ISO 8583, interchange, 3DS 2.0, SCA, tokenization), then the topology of 50 players — global (Visa, MC, Amex, Discover, JCB, UnionPay, Stripe, Adyen, Square, PayPal, Wise, Worldpay, Fiserv, GP), Korean (BC, Shinhan, KB, Samsung, Hyundai, Hana, Woori, Lotte, Toss, Naver, Kakao, Payco, Compay), and Japanese (PayPay, LINE, Rakuten, d-Barai, au PAY, Merpay, FamiPay).

1 · Payment infrastructure 2026 — the landscape in numbers

First, the landscape in numbers. These are public figures as of Q1 2026.

- **Visa**: market cap ~`$650B`, annual payment volume `$15T`, 4.9 billion cards issued, revenue `$36B` (FY2025).

- **Mastercard**: market cap ~`$450B`, GDV (gross dollar volume) `$9.8T`, 3.3 billion cards, revenue `$28B`.

- **American Express**: market cap ~`$210B`, 140 million cards, billed business `$1.9T`. One company does issuing, acquiring, and the network (closed-loop).

- **JCB**: 150M cards issued in Japan, 50M merchants globally, ~`$420B` global transactions.

- **UnionPay**: 9 billion cards (most in the world), ~60M merchants globally. Effectively a monopoly inside mainland China.

- **Stripe**: 2025 processing volume `$1.4T`, revenue `$28B`, 7 consecutive years of profit, valuation ~`$91B`.

- **Adyen**: 2025 processing volume `$1.2T`, revenue `$2.4B`, market cap ~`$50B`. One headquarters, one codebase.

- **Square/Block**: GPV (gross payment volume) `$240B`, Cash App 57M active users.

- **PayPal**: TPV (total payment volume) `$1.7T`, 430M active accounts.

- **Wise**: quarterly volume `£40B`, 15M users, average cost UK→Europe 0.49%.

- **Korea**: Toss Pay 40M registered users (overlap included), Kakao Pay 45M, Naver Pay 30M.

- **Japan**: PayPay 65M users, 4.1M merchants, 50M transactions per day. Absorbed LINE Pay's balance and features in 2025.

What these numbers say in one line: **payments is an OS.** And the OS has four layers — network (Visa, MC) → PSP (Stripe, Adyen) → wallet (Apple Pay, PayPay) → merchant. Look at any one layer alone and the picture stays hidden.

2 · 4-Party Model — four protagonists

The core grammar of card payments is the **4-party model**. Four parties appear.

┌─────────────────────────┐

│ Card Network │ ← Visa, Mastercard

│ (VisaNet · Banknet) │

└────────────┬────────────┘

│ network routing

┌──────────┐ │ ┌──────────┐

│ Issuer │ ←────────┼────────→ │ Acquirer │

│ (issuer) │ ISO 8583 0100/0110 │ (acquirer)│

│ KB/Shinhn│ │ NICE/KSNET│

└────┬─────┘ └─────┬────┘

│ issues card │ provides terminal

v v

┌──────────┐ ┌──────────┐

│Cardholder│ │ Merchant │

│(consumer)│ ─── pays at POS ───> │ (shop) │

└──────────┘ └──────────┘

The four roles are distinct.

- **Cardholder** — pays with a card.

- **Issuer** — the bank/card company that issued the card. Manages balance and credit limit. In Korea, the 8 specialized credit card companies (Shinhan, KB, Samsung, Hyundai, Lotte, Woori, Hana, BC). In the US, Chase, Bank of America, Citi, Capital One, and so on.

- **Acquirer** — contracts with the merchant and provides terminals, POS, and gateways. In the US: Chase Payment Solutions, Worldpay, Fiserv, Global Payments. In Korea: NICE, KSNET, KICC, KOCES, Daou Data.

- **Card Network** — Visa and Mastercard do neither issuing nor acquiring. **They route messages and clearing between the two sides.**

**The flow of money** runs opposite to the flow of messages. Messages travel acquirer → network → issuer → network → acquirer; money travels issuer → network → acquirer → merchant. Interchange, scheme fee, and acquirer markup are deducted somewhere along that path.

American Express and Discover are **3-party** (closed-loop): one company does issuing, acquiring, and the network. As a result, merchant fees are higher (avg 2.5–3.5%) and merchant coverage is narrower. JCB also acts more closed-loop inside Japan.

3 · ISO 8583 — the common tongue of payment messages

Set by ISO in 1987, **ISO 8583** is the lingua franca of nearly every card payment message. Even in 2026, Visa, Mastercard, JCB, and UnionPay all run on it.

An ISO 8583 message is composed of **MTI (message type indicator) + bitmap + data elements**.

ISO 8583 message structure

[MTI: 0100] ← Authorization Request

[Bitmap] ← 128-bit; marks which fields are present

[Data Elements]

DE2: Primary Account Number (PAN, 16-digit card number)

DE3: Processing Code (purchase=000000, refund=200000)

DE4: Amount, transaction (12 digits, in minor units)

DE7: Transmission Date & Time

DE11: System Trace Audit Number (STAN)

DE14: Expiration Date

DE22: POS Entry Mode (chip=051, contactless=071, ecom=812)

DE32: Acquiring Institution ID

DE37: Retrieval Reference Number (RRN)

DE38: Approval Code (6-digit auth code)

DE39: Response Code (00=approved, 51=insufficient, 05=declined)

DE41: Card Acceptor Terminal ID

DE49: Currency Code (KRW=410, JPY=392, USD=840)

DE55: ICC Data (EMV chip auth payload)

MTI 0100 (request) → 0110 (response) is the **authorization** cycle. 0200/0210 is **financial** (including clearing); 0420 is reversal. Since 2024, Mastercard and Visa have been migrating ISO 8583 toward **ISO 20022** (XML-based), but as of 2026 over 90% of live traffic is still ISO 8583.

If you memorize just the two-digit response codes, you'll have covered 80% of card troubleshooting.

- `00` — approved

- `05` — declined (general)

- `14` — invalid card number

- `41` — lost card

- `43` — stolen card

- `51` — insufficient funds / over limit

- `54` — expired card

- `55` — PIN error

- `61` — exceeds withdrawal limit

- `91` — issuer system down

- `96` — system malfunction

4 · Interchange Fee — who pays whom how much

Merchants usually see payment fees as a single bundle (avg `2~3%`), but inside that bundle are **three parts**.

Merchant discount rate (MDR)

= Interchange Fee (issuer's share, ~70%)

+ Scheme Fee (Visa/MC network's share, ~5%)

+ Acquirer Markup (acquirer/PSP's share, ~25%)

**Interchange fee** is what the acquirer pays the issuer. It is set by the giant tables Visa and MC publish each quarter; rates differ by category, MCC (merchant category code), and card type (credit, debit, corporate, premium).

- **US debit, regulated** — capped by Durbin at `$0.21 + 0.05%`. Applies to banks with $10B+ in assets.

- **US debit, unregulated** — small banks. Avg `~1.5%`.

- **US credit, consumer non-rewards** — avg `~1.5%`.

- **US credit, consumer rewards** — avg `~1.8%`.

- **US credit, premium (World Elite, Visa Infinite)** — `~2.4%`.

- **CNP (card-not-present)** — about 0.3pp more expensive than CP, because of higher fraud risk.

- **EU** — IFR (Interchange Fee Regulation) of 2015 caps consumer credit at `0.3%` and debit at `0.2%`.

- **Korea** — the Specialized Credit Finance Business Act caps merchant fees by sales tier. Small merchants `0.5%`, mid-size `1.1%`, large `~2.3%`.

- **Japan** — no cap. Avg `~3.25%`. That is why small Japanese shops historically didn't take cards, and PayPay filled the gap.

PSPs like Stripe and Adyen present merchants a **single blended rate** (e.g., Stripe 2.9% + 30¢). Interchange, scheme, and markup are all bundled inside. Large merchants can opt into **interchange++** (cost + margin).

5 · The Durbin Amendment — what the US tore into

Passed as part of the Dodd-Frank Act of 2010, the **Durbin Amendment** carved a huge dent in US payments.

- Caps debit interchange for cards issued by banks with `$10B+` in assets at `$0.21 + 0.05% + $0.01` (fraud) ≈ `~0.5%` (vs `~1.2%` pre-Durbin).

- Debit issuers must support **at least two networks** as routing options (Visa + Star, Mastercard + Maestro, and so on).

- Merchants get the right to choose the cheaper network (merchant routing choice).

Effects:

- Merchants save roughly `$8B` per year, although most analyses find that little of it reached consumers.

- Issuers cut free-checking benefits and raised minimum-balance requirements.

- Credit interchange was untouched, so issuers expanded credit rewards more aggressively (rewards inflation).

In 2024, the Fed proposed lowering the cap further to `$0.144 + 0.04%`; as of 2026 the proposal is in comments/litigation. The **Credit Card Competition Act** (Durbin-Marshall) is reintroduced each year to attack credit interchange but has yet to pass.

6 · CP vs CNP — Card-Present vs Card-Not-Present

Payments fall into two branches based on **whether the card is physically present**.

| Category | CP (Card-Present) | CNP (Card-Not-Present) |

|----------|-------------------|-------------------------|

| Examples | in-store POS, ATM | e-commerce, phone orders, recurring billing |

| Auth method | EMV chip, NFC, PIN, signature | PAN + CVV + 3DS, tokenization |

| Fraud rate | ~`7bps` (0.07%) | ~`12bps` (0.12%) |

| Interchange | cheaper | more expensive (~0.3pp) |

| Liability | post-EMV: shifts from issuer to merchant | almost always on the merchant |

| Lost/stolen | hard with EMV chip | feasible with just the card number |

| Tokenization | NFC (Apple Pay, Google Pay) keeps PAN off the wire | network tokens replace the PAN |

CNP has grown by double digits each year alongside the **e-commerce explosion**. As of 2026, ~35% of global card transactions are CNP, and ~80% of fraud happens in CNP. That is why 3D Secure 2.0 and tokenization are the two pillars of CNP fraud control.

In CP, fraud dropped roughly 80% after the US made EMV mandatory in 2015. Korea, Europe, and Japan had chip mandates much earlier. So **magstripe fraud is functionally going extinct.**

7 · 3D Secure 2.0 — frictionless authentication

To fight CNP fraud, Visa created 3D Secure (3-Domain Secure) in 1999. The first version (3DS 1.0) demanded an extra password at every checkout, pushing cart abandonment over 20%.

**3DS 2.0** (2018+) fixed the problem.

3DS 2.0 frictionless flow

[Cardholder] [Merchant] [3DS Server] [Issuer ACS]

│ │ │ │

│ enter card │ │ │

├──────────────────────────>│ │ │

│ │ 100+ data points │ │

│ │ (device, IP, browser, │ │

│ │ shipping addr, ...) │ │

│ ├───────────────────────>│ │

│ │ │ risk assess │

│ │ ├────────────────>│

│ │ │ │

│ │ if low risk: │ │

│ │<───── frictionless ────┤ │

│ payment complete │ │ │

│<─────────────────────────┤ │ │

│ │ │ │

│ │ if high risk: │ │

│ │<──── challenge ────────┤ │

│ OTP/biometric │ │ │

│─────── verify ───────────────────────────────────────────────────────>│

The core is **device fingerprinting** (some 100 signals: browser, OS, resolution, timezone, etc.) and **risk-based authentication**. 75–85% of transactions pass frictionless, while fraud rates land lower than 3DS 1.0.

Legal effect: a transaction authenticated through 3DS 2.0 **shifts chargeback liability to the issuer** (per EMVCo, Visa, MC rules). For merchants, it is a shield.

From **EMV 3DS 2.3** (2023) onward, features like SPC (Secure Payment Confirmation), delegated authentication, and decoupled flow were added. Apple Pay and Google Pay sidestep 3DS in practice via their device-bound cryptography (out-of-band authentication).

8 · SCA — strong customer authentication, made by PSD2

Europe went one step further in 2019 with the **RTS for SCA** (Regulatory Technical Standards for Strong Customer Authentication) under PSD2.

**SCA = mandatory 2-factor authentication for card payments.** At least **two of three** must be combined:

- **Knowledge** — password, PIN

- **Possession** — phone, card

- **Inherence** — fingerprint, face, voice

Explicit exemptions:

- Low-value transactions (< €30, cumulative €100 / 5 attempts)

- Merchant on the cardholder's trust list (MIT, merchant-initiated transaction)

- TRA (Transaction Risk Analysis) pass (exempt if fraud rate stays under thresholds)

- Recurring payments (MIT)

- Unattended terminals (parking, tolls)

Outcome: European CNP fraud rates dropped into the 30 bps range. But decline rates rose by a similar margin, and how a PSP sets exemption flags became a major selection criterion. Adyen has RevenueAccelerate; Stripe has Smart Disputes and Network Tokens.

Korea and the US have no exact SCA equivalent, but Korea uses the Specialized Credit Finance Act limits plus the Electronic Financial Transactions Act identity verification as a substitute. Japan's revised **Installment Sales Act**, in force April 2026, mandates EMV 3DS 2.0 in full.

9 · Tokenization — how Apple Pay and Google Pay hide the card number

When you register a card on an iPhone, **the actual card number (PAN) is not stored on the phone.** Instead, a **DPAN (Device Primary Account Number)** or **network token** is stored.

Tokenization flow (EMVCo Payment Tokenization)

[Cardholder] [Wallet] [TSP] [Issuer]

│ (Token Service │

│ Provider) │

│ Visa: VTS │

│ MC: MDES │

│ │

enter PAN │ │

───────────>│ │

│ request: PAN → tokenize │

├──────────────────────────────────>│

│ │ verify

│ │ (BIN check,

│ │ issuer policy)

│ v

│ issuer approves

│ <─────────────────────┤

│ DPAN issued (16 digits, │

│ distinct from real PAN) │

│<──────────────────────────────────┤

│ stored in Secure Element │

done │ │

<───────────┤ │

At payment time:

- Apple Pay sends the DPAN plus a **dynamic cryptogram** (a one-time secret regenerated each transaction) over NFC.

- Terminal → acquirer → network → TSP detokenizes DPAN back to PAN and routes to the issuer.

- The issuer responds as it would for a normal transaction.

Effects:

- **PAN never lands at the merchant, the terminal, or the app.** PCI DSS scope shrinks.

- If a device is lost, no PAN reissue needed — only the device's DPAN is deactivated.

- **Network Tokens** (VTS, MDES) deliver the same effect for e-commerce. When Stripe or Adyen stores the network token instead of the PAN, the token auto-updates through card expiry and reissue (LCM, lifecycle management).

- Approval rate rises roughly `2~5pp` on average (figures the networks publish), because declines from expiry or CVV errors fall away.

10 · Visa Network (VisaNet) — 70,000 routes per minute

**VisaNet** is Visa's global processing rail — the largest card-payment network on earth.

- **Footprint**: redundant across 4 US data centers (Ashburn, Highlands Ranch, etc.).

- **Throughput**: 65,000 TPS at peak; ~750,000 per minute.

- **Latency**: average card auth cycle is 1–2s end-to-end, with VisaNet's internal routing under `< 200ms`.

- **Participants**: 16,000 issuers, thousands of acquirers, 80M merchants.

- **Annual volume**: payment volume `$15T`, total volume (incl. cash withdrawal) `$16T`.

VisaNet sells value-added services beyond a simple message router:

- **Visa Risk Manager** — fraud scoring

- **Visa Token Service (VTS)** — the tokenization we just saw

- **Visa Direct** — push payments (P2P, payout)

- **Visa Click to Pay** — checkout without entering a card number on a merchant site

- **Visa Installment Solutions** — BNPL (buy-now-pay-later) options

Revenue mix (FY2025): **service revenue** scaled to payment volume (merchant/issuer fees), **data processing** charged per transaction, and **international transaction fees** for cross-border (the highest-margin line). Operating margin sits above `60%`. This isn't a payment company so much as an **infrastructure company.**

11 · Mastercard (Banknet) — eternal #2, but a strong one

**Banknet** is Mastercard's payment network. The structure mirrors VisaNet, but a few differentiation points stand out.

- **GDV** (gross dollar volume) `$9.8T` — roughly 65% of Visa's scale.

- **Cards**: 3.3 billion (consumer + commercial).

- **Data centers**: anchored in O'Fallon, Missouri, globally distributed.

- **Europe strength**: market share in Europe is roughly even with Visa, slightly ahead.

Mastercard's differentiation strategy is **value-added services**. ~35% of revenue comes from non-payments services.

- **Mastercard Send** — Mastercard's answer to Visa Direct.

- **MDES** — Mastercard Digital Enablement Service, the tokenization platform.

- **Mastercard Identity Check** — Mastercard's 3DS 2.0 implementation.

- **Cyber & Intelligence Solutions** — Ekata, NuData, RiskRecon all rolled into a fraud-analytics package.

- **Open Banking** — Finicity (US), Aiia (Europe).

- **Mastercard Move** — cross-border remittance infrastructure.

For issuers and acquirers, Visa and Mastercard are usually **issued in tandem**. The two networks have functionally never been down simultaneously. So 4-party payments is a **dual-homed industry by default.**

12 · American Express — the last giant of closed-loop

Amex does issuing, acquiring, and the network all under one roof — **closed-loop**. As a result, it looks different.

- **Volume**: billed business `$1.9T` (2025).

- **Cards**: ~140 million. But **average spend per card is 4–5x the other networks.** Concentration on high-income customers.

- **Merchant fees**: avg `2.5~3.5%` — about 1pp higher than Visa/MC. Many small merchants don't accept Amex (notably in Europe and Japan).

- **Closed-loop advantage**: owning both sides' data lets the card company **design rewards programs directly** — Centurion (Black), Platinum, Gold lines.

- **Global Network Services (GNS)** — Amex partners with local banks to issue/acquire to widen coverage. In Korea: BC, Samsung. In Japan: SMBC (Mitsui Sumitomo).

In the late 2010s, Amex broadened US merchant coverage via **OptBlue**, outsourcing acquiring to Worldpay, Fiserv, and others. The result: US merchant coverage roughly equals Visa's. But pulling outside acquirers in means giving up some closed-loop data edge.

13 · Discover, JCB, and UnionPay — the three non-Big-Two networks

Beyond Visa, MC, and Amex, three globally meaningful card networks remain.

- **Discover Financial Services** — US-centric. 64M cards, payment volume `$200B`. Owns Diners Club. In 2024 Capital One announced a `$35B` acquisition; completed 2025; Discover is currently integrating into Capital One's issuing infrastructure. Some concern that the US is dropping from 4 networks to 3.

- **JCB** — Japan Credit Bureau. Founded 1961. 150M cards issued in Japan, 50M merchants globally. Inside Japan, on par with Visa/MC for merchant coverage. Internationally, focused on Asia. JCB has a reciprocal acceptance agreement with American Express — Amex merchants accept JCB and vice versa.

- **UnionPay International** — China's 银联. **9 billion cards issued** (most in the world). Effectively monopoly in mainland China, although Visa and MC have begun receiving issuing licenses since 2018. ~60M global merchants. Runs its own **QR payment rail**. Chinese tourist payments in Korea, Japan, and Southeast Asia rely heavily on UnionPay.

These three are strong in their home markets, but in global integrated traffic share, Visa + MC together command roughly 80%.

14 · Stripe — the PSP that hit `$1T+ TPV`

**Stripe** was founded in 2010 by the Collison brothers, Patrick and John. The early tagline was "sign up at stripe.com and accept payments in 7 lines of code." In 2026, that company is:

- 2025 payment volume `$1.4T` — past Adyen and Square, top of the global table.

- Revenue `$28B`, 7 consecutive profitable years, valuation ~`$91B`.

- **Over 3 million merchants**, including OpenAI, Anthropic, parts of Amazon, BMW, Shopify, and Wayfair.

Stripe did one thing: **throw payments at developers as an SDK.** That simple pitch reshaped the industry's personality.

Stripe's core API — Checkout Session.

// server (Node.js)

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY)

const session = await stripe.checkout.sessions.create({

payment_method_types: ['card', 'apple_pay', 'google_pay', 'link'],

line_items: [

{

price_data: {

currency: 'usd',

product_data: { name: 'Pro Plan (monthly)' },

unit_amount: 1900, // $19.00 (in cents)

quantity: 1,

mode: 'subscription',

success_url: 'https://example.com/success?session_id={CHECKOUT_SESSION_ID}',

cancel_url: 'https://example.com/cancel',

automatic_tax: { enabled: true },

customer_creation: 'always',

payment_intent_data: {

setup_future_usage: 'off_session',

})

res.redirect(303, session.url) // redirect to Stripe-hosted Checkout

These 7 lines bundle: the card-input UI, 3DS 2.0 challenge, Apple Pay/Google Pay buttons, automatic tax (Stripe Tax), idempotency, and webhook notifications (`checkout.session.completed`).

Stripe pricing (US standard): card `2.9% + 30¢`, ACH `0.8% (cap $5)`, Stripe Tax `0.5%/tx`. Large merchants get interchange++.

Stripe Connect handles multi-party payouts for marketplaces (Shopify, Lyft, DoorDash); Stripe Atlas even spins up your company for you. Stripe isn't just selling payments — it wants to be the **OS for online business.**

15 · Adyen — apostle of unified commerce

**Adyen** (founded 2006 in the Netherlands) is Stripe's mirror opposite. The weapon isn't a 7-line SDK; it is **enterprise integration plus a single backend.**

- 2025 volume `$1.2T`, revenue `$2.4B`, market cap ~`$50B`.

- Customers: Spotify, Uber, Netflix, McDonald's, Microsoft, H&M, Nike, LVMH.

- **Global single platform** — one company handles 200+ payment methods worldwide on one backend.

Adyen invented the phrase **unified commerce**.

Unified Commerce — Adyen-style

[Web] [iOS app] [In-store POS] [Marketplace seller]

│ │ │ │

└────────┴─────────────┴───────────────────┘

│

┌────────────────┐

│ Adyen │

│ (single API) │

└───────┬────────┘

│

┌──────────────────┼─────────────────┐

v v v

Visa/MC iDEAL, Klarna, Apple Pay,

acquiring SEPA, Boleto Google Pay

│ │ │

v v v

issuers local payment tokenization

schemes

The benefit: when a single shopper pays on web, in app, and in-store, Adyen joins them under **one customer ID**. Refunds and clearing become unified. Cross-channel chargeback and loyalty work end-to-end.

Adyen is strong for **larger merchants** than Stripe targets. Stripe owns long-tail SMB; Adyen owns enterprise. The two collided less than expected — until 2024–2026, when Stripe began pushing into enterprise and Adyen launched Adyen for Platforms for SMB.

16 · Square (Block), Checkout.com, Worldpay, Fiserv, Global Payments

Top-tier PSPs and acquirers in one pass.

|---------|------|------------------------|--------------|

**Square** was the company Jack Dorsey introduced in 2009 with a small white card-reader dongle. In 2026 the corporate name is **Block**. Cash App has become a pillar of US P2P payments, plus bitcoin trading.

**Checkout.com** offers a single API covering 200 currencies and 150 payment methods, strong with cross-border merchants (global SaaS, gaming, content).

**Worldpay/Fiserv/Global Payments** share roughly 70% of the US acquirer market. They are backend-infrastructure companies and average consumers don't know the names, but they sit behind the Clover, Verifone, and Ingenico terminals you swipe in stores.

17 · PayPal — the 30-year-old digital wallet

Born in 1998 as Confinity and merged with X.com in 2000, **PayPal** is the original digital wallet — and still alive in 2026.

- TPV `$1.7T`, active accounts 430M, revenue `$32B`.

- Assets: PayPal, Venmo (US P2P), Xoom (international remittance), Braintree (developer PSP), Honey (coupons), Hyperwallet (payouts).

- **Braintree** is the in-house Stripe rival PSP. Uber, Airbnb, Dropbox are customers.

In the 2010s, "pay by email" was PayPal's strength. In the 2020s that ground is being taken by Apple Pay, Stripe, and local wallets (PayPay, Toss). PayPal's response: **PayPal Complete Payments** (a PSP repositioning), **PayPal Pay Later** (BNPL), and expanding **Venmo merchant payments**.

A peculiar position: PayPal does **wallet + acquirer + issuer + risk** in one. It looks closed-loop, but it accepts Visa/MC as funding sources, so it sits in a hybrid spot.

18 · Wise (formerly TransferWise) — the new standard for cross-border

Founded in London in 2011 by Taavet Hinrikus and Kristo Käärmann, **Wise** (rebranded from TransferWise in 2021) permanently reset the price of international remittance.

- Quarterly volume `£40B`, 15M users (personal + business).

- Average cost UK→Europe `0.49%`, UK→US `0.43%`. Traditional bank cost: `3~5%`.

- **Multi-currency account** — hold 50 currencies in one account; receive into local rails in 10 countries (UK sort code, US routing, eurozone IBAN, AUD BSB, ...).

Core technology: **peer-to-peer matching.** If A is sending GBP→USD while B is sending USD→GBP at the same time, the two flows are matched without funds crossing the border. **Mid-market rate (interbank FX)** plus transparent fees.

Wise also began selling its rails to banks via **Wise Platform**. Monzo, N26, and Standard Chartered use Wise as white-label. The company is morphing into a payments-infrastructure company.

19 · Korea's payment market — eight card companies and the PG landscape

Korea is #1 in OECD for card-payment share (`~75%`), and its infrastructure is correspondingly dense.

**Eight specialized credit card companies** (as of 2026):

|--------------|--------|---------|-------|

**PG (Payment Gateway, 전자지급결제대행)** is a Korea-specific concept: an intermediary between merchant and card company for e-commerce checkout. NICE Payments, KG Inicis, Toss Payments, KCP, Danal, Payletter, Settlebank.

**VAN (Value Added Network)**: offline terminal payments. NICE Information & Telecommunication, KSNET, KICC, KOCES, Daou Data.

The integration of PG and VAN — their evolution into PSPs — is the big trend in Korean payments in the 2020s. Toss Payments (spun out from LG U+ in 2021, then acquired by Toss) is the headline example.

20 · Korea's "simple payment" five — Toss, Kakao, Naver, Payco, Compay

Korea's **simple payment (간편결제)** pattern is: card members use a big-tech app instead of the card company's own app as the checkout UX.

|---------|--------|-------|-------|

All five compress the **card/account → auth → pay** sequence into a couple of taps. At payment time: Toss Pay uses a 4-digit PIN/Face ID; Kakao Pay uses a 6-digit PIN/fingerprint. The card company's standard auth (ARS, SMS, app-card OTP) is bypassed.

Underneath, they still ride the **card company network**. A Toss Pay payment = Toss acting as PG, requesting authorization from the issuer; the issuer approves. Only the user-facing UX ends inside the Toss app.

**Samsung Pay** sits in a different slot. Device NFC + MST (magnetic secure transmission, discontinued 2024) wallet. Register a card, tap a Galaxy phone. Same category as Apple Pay. Strong in Korea, where Galaxy market share is ~60% in 2026.

**Apple Pay** landed in Korea in March 2023 exclusively with Hyundai Card; BC Card joined in 2024; Shinhan and KB announced 2026 participation. But NFC-terminal penetration is only ~30% of merchants, so adoption stays slow.

21 · Japan's credit-card market — JPY 90T of quiet giant

Japan's credit-card volume hit ~JPY 90T in 2025 (`$600B`). But the mood is still **the shadow of a cash society**.

**Major issuers** (brand + issuer):

|--------|-------|---------------------|-------|

| JCB | JCB | ~140M (direct + partner) | Domestic network |

| JR East (View Card) | JR | ~7M | Suica points |

Notes:

- **Cards with no annual fee dominate.** Japanese consumers are highly fee-sensitive.

- **Merchant fees are high** — avg `~3.25%`. Small shops and restaurants used to refuse cards.

- The government set a target of **40% cashless** by 2025; nearly hit at ~39% in 2024. 2030 target: 80%.

- **JCB and UnionPay carry unusually heavy weight in Japan.** Their merchant coverage is near-parity with Visa/MC.

The gap left by this dynamic was filled by **QR payments.**

22 · PayPay — 65 million people's QR dominance

**PayPay** (launched 2018 by SoftBank and Yahoo Japan as a joint venture) captured ~65% of Japan's QR-payment market in five years and became the de facto standard.

- Users 65M — about 75% of Japanese adults.

- Merchants 4.1M — effectively every neighborhood shop in Japan.

- Daily transactions ~50M.

- In December 2024, PayPay **absorbed LINE Pay's Japan business**; LINE balance and features migrated to PayPay (completed April 2025).

Why PayPay won in Japan:

1. **0% merchant fee** (through September 2021). Small shops that couldn't stomach the `~3%` credit-card fee took the PayPay QR.

2. **Massive 20% cashback** campaigns (funded by SoftBank/Yahoo capital).

3. **QR scan, done.** No terminal needed — a printed QR is enough to onboard a merchant.

Merchant fee was lifted to `1.6~1.98%` from 2022, but the locked-in user/merchant base is overwhelming. Rather than competing head-on with credit cards, PayPay layered its own credit card (PayPay Card) on top and is building a **bundled card + QR asset.**

23 · LINE Pay, Rakuten Pay, d-Barai, au PAY, Merpay, FamiPay

QR/wallets beyond PayPay.

|---------|--------|-----|-------|

Notable:

- The three telcos (Docomo, KDDI, SoftBank/PayPay) hold the keys to the payment market. SoftBank has dominated via PayPay.

- Rakuten built a different axis: **vertically integrated economy** (#1 issuer Rakuten Card + Rakuten Pay + Rakuten Ichiba) versus PayPay's horizontal QR.

- **Merpay** is the unique model: turning C2C marketplace balance into payment power. You sell on Mercari, you spend the proceeds at a convenience store.

Japan's QR has a unified standard code called **JPQR**, but in practice each app prefers its own code, with JPQR as fallback. A merchant who wants to take PayPay, Rakuten Pay, d-Barai, and au PAY often ends up sticking four QR stickers up; integrated codes require separate merchant signup.

24 · PG vs Acquirer — the difference Korea conflates

In Korea, the word "PG" is used as a combined meaning of **PSP (Payment Service Provider) + acquirer** globally. Properly broken down:

Global standard

Merchant ── Gateway ── PSP ── Acquirer ── Network ── Issuer

(UI) (orch.) (funds) (routing) (funding src)

Korea ("PG")

Merchant ── PG ────────────── Card company (acquiring + issuing) ── Card company

(gateway + orchestration, sometimes acquiring-ish)

- **Gateway** — the checkout-form UI, secure tokenization, card-data capture/transport. Pulls the PCI DSS burden off the merchant.

- **PSP** — gateway + multi-acquirer routing + reporting + fraud + reconciliation as a bundle. Stripe, Adyen, Checkout.com.

- **Acquirer** — directly contracts with the merchant and disburses funds received from the issuer into the merchant's account. In Korea, the card company itself plays the acquirer role.

The Korean "PG companies" (NICE Payments, KG Inicis, Toss Payments, KCP) are mostly **gateway + light orchestration**. Acquiring is done by the card company itself. So a Korean PG signs directly with card companies and offers merchants the card-company bundle as PaaS.

Japan separates the concepts as **authorization agent (オーソリ代行)** and **collection agent (収納代行)**. Major players: GMO Payment Gateway, SB Payment, Sony Payment, Stripe Japan.

25 · Stripe Checkout — follow one real payment

We said "Stripe Checkout ends with one API call"; let's look once more at what happens behind that one call.

// 1) Merchant server: create the checkout session

const session = await stripe.checkout.sessions.create({

payment_method_types: ['card'],

line_items: [{ price: 'price_xxx', quantity: 1 }],

mode: 'payment',

success_url: 'https://shop.example/success?sid={CHECKOUT_SESSION_ID}',

cancel_url: 'https://shop.example/cancel',

// 3DS 2.0 — merchant forcing

payment_intent_data: {

payment_method_options: {

card: { request_three_d_secure: 'automatic' },

})

// 2) Merchant → redirect to Stripe-hosted checkout page

// 3) User enters card / taps Apple Pay

// 4) Stripe Radar (fraud) scores against 100+ signals

// 5) If needed: 3DS 2.0 challenge (else frictionless)

// 6) Stripe → acquirer → Visa/MC rail → issuer

// 7) Response: approved / declined

// 8) Stripe → webhook 'checkout.session.completed' → merchant server

The merchant server receives the webhook and updates order state.

// Merchant webhook handler

export async function POST(req) {

const sig = headers().get('stripe-signature')

const raw = await req.text()

const event = stripe.webhooks.constructEvent(

raw,

sig,

process.env.STRIPE_WEBHOOK_SECRET

)

if (event.type === 'checkout.session.completed') {

const session = event.data.object

await db.orders.update({

where: { stripeSessionId: session.id },

data: { status: 'paid', paidAt: new Date() },

})

}

return new Response('ok', { status: 200 })

}

This is what payment code looks like in 2026. The 4-party rail still runs underneath; Stripe abstracts it into a single bundle. What used to be the merchant's burden — PCI DSS, 3DS, tokenization, fraud, reconciliation — has moved inside the SDK.

26 · Compare — Visa, Mastercard, Amex, JCB

|------|------|------------|------|-----|

| Cards issued | 4.9B | 3.3B | 140M | 150M |

| Annual volume | `$15T` | `$9.8T` | `$1.9T` | `$420B` |

| Avg merchant fee | `~1.8%` | `~1.8%` | `~2.8%` | `~3%` |

27 · Compare — US, KR, JP payment ecosystems

|------|----|-------|-------|

Epilogue — Payments should be invisible

A good payment is **invisible.** Swipe a card; half a second later, "thank you." Inside that half second:

- The POS reads the chip

- ISO 8583 0100 fires off to the acquirer

- The acquirer routes it through Visa/MC

- The issuer checks balance and fraud

- 0110 returns

- The issuer marks the money to be cleared in 24 hours

- Interchange + scheme + markup, bundled around `~2%`, is taken somewhere

The user does not participate in any of the 8 steps. That is the proof that the payment infrastructure has been built well.

In 2026, payments have become even more invisible. Apple Pay, PayPay, and Toss have wiped card numbers from the user's field of view; 3DS 2.0 frictionless eliminated the OTP-entry friction; Stripe and Adyen shrank the merchant's payment code to a 7-line SDK.

But the complexity hasn't disappeared — it has only **been buried deeper.** Twelve systems are still spinning behind one card, and when one of them goes down — the Toss outage of 2023, Japan's Zengin system outage in 2024, the UK Faster Payments incident in 2025 — entire cities seize up.

Payments are infrastructure. Infrastructure works only when invisible. But because we are the people who build it, there has to be someone, every so often, willing to look inside.

References

- Visa Inc. — "Annual Report FY2025" — https://investor.visa.com/financial-information/annual-reports/

- Mastercard — "Annual Report 2025" — https://investor.mastercard.com/investor-relations/financial-information/

- American Express — "2025 Annual Report" — https://ir.americanexpress.com/

- JCB Co., Ltd. — "JCB at a Glance" — https://www.global.jcb/en/about-us/

- UnionPay International — "Company Overview" — https://www.unionpayintl.com/en/aboutUs/

- Stripe — "Annual Letter 2025" — https://stripe.com/annual-updates/2025

- Stripe Docs — "Checkout Sessions API" — https://docs.stripe.com/api/checkout/sessions

- Adyen — "Annual Report 2025" — https://www.adyen.com/investor-relations

- Block (Square) — "FY2025 Shareholder Letter" — https://investors.block.xyz/

- Checkout.com — "About Us" — https://www.checkout.com/about

- PayPal Holdings — "2025 Annual Report" — https://investor.pypl.com/

- Wise plc — "Annual Report 2025" — https://wise.com/gb/investor-relations

- Worldpay — "Worldpay from FIS" — https://www.fisglobal.com/en/merchant-solutions

- Fiserv — "Investor Relations" — https://investors.fiserv.com/

- Global Payments — "Annual Report" — https://investors.globalpayments.com/

- EMVCo — "EMV 3-D Secure Specifications" — https://www.emvco.com/emv-technologies/3d-secure/

- EMVCo — "Payment Tokenisation Specification — Technical Framework" — https://www.emvco.com/emv-technologies/payment-tokenisation/

- ISO — "ISO 8583-1:2003 Financial transaction card originated messages" — https://www.iso.org/standard/31628.html

- Federal Reserve — "Regulation II (Debit Card Interchange Fees)" — https://www.federalreserve.gov/paymentsystems/regii-about.htm

- European Banking Authority — "RTS on Strong Customer Authentication under PSD2" — https://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money

- Korea Financial Supervisory Service — "Specialized Credit Finance Business Act / merchant fee guidelines" — https://www.fss.or.kr/

- Bank of Korea — "Payment & Settlement Trends" — https://www.bok.or.kr/portal/main/contents.do?menuNo=200766

- Toss Payments — "Payment infrastructure" — https://docs.tosspayments.com/

- Kakao Pay — "Developer Center" — https://developers.kakaopay.com/

- Naver Pay — "Merchant Center" — https://admin.pay.naver.com/

- BC Card — "BC Card network overview" — https://www.bccard.com/

- METI (Japan) — "Cashless Vision" — https://www.meti.go.jp/policy/mono_info_service/cashless/

- PayPay Corporation — "PayPay business overview" — https://about.paypay.ne.jp/

- Rakuten Payment — "Rakuten Pay" — https://pay.rakuten.co.jp/

- NTT Docomo — "d-Barai" — https://service.smt.docomo.ne.jp/keitai_payment/

- Cashless Promotion Council Japan — "JPQR unified QR code standard" — https://www.paymentsjapan.or.jp/

- Mercari Inc. — "Merpay" — https://jp.merpay.com/

- Capital One / Discover Merger — SEC 8-K filings — https://www.sec.gov/