Banks should compare credit-card processing platforms only after defining the job to be done: issuer processing, acquiring, or both; the channels, card schemes and countries in scope; and which capabilities the bank expects to operate itself. Then evaluate providers against the same evidence-based criteria—operational resilience, authentication, tokenization, security, integration, commercial terms and exit options. Available evidence supports this procurement framework, not a defensible vendor ranking.
First define what “card processing” means for your bank
The phrase credit-card processing platform can describe different roles in the payments chain. A bank comparing providers should name the function, transactions and responsibilities it is buying before it builds a shortlist; otherwise, proposals may cover unlike services.
As an Amazon Associate I earn from qualifying purchases.
Issuer processing
Issuer processing supports a bank that issues cards. Depending on the arrangement, the platform may handle authorization decision flows and related operational processes. Ask vendors to map the functions they provide against those the bank retains, including card management, fraud decisioning, reversals, exceptions and reconciliation. Do not assume that a product labelled “issuer processing” includes every function your operating model needs.
Acquiring and acceptance
Acquiring supports merchants’ acceptance of card payments. The relevant scope may include card-present and card-not-present transactions, payment gateways or switching, and other acceptance services. Confirm whether the bank is buying software, processing capacity, managed operations, or a combination. A provider focused on issuer processing is not automatically a substitute for an acquiring platform.
#1 Best Overall
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
Channels, schemes and markets
Specify the card-present and card-not-present flows, card schemes, countries and relevant transaction types in scope. Identify applicable regional rules and network requirements rather than assuming one configuration or authentication flow applies everywhere. PCI Security Standards Council’s PA-DSS Program Guide, version 3.2, distinguishes payment middleware, payment gateway/switch and payment back-office software; it can help clarify terminology, but it is an older guide and not a current bank procurement standard.
Use a common evidence standard across the shortlist
Ask each provider to respond to the same questions and substantiate answers with architecture, contract language, test evidence and operational references. The following matrix ties each evaluation area to evidence the bank can request.
Rank #2
- Includes Elavon encryption
- Chip Card / EMV / NFC Compatible
- 2.4’’ Color LCD with backlight
- 192 MB of Memory (128 MB RAM / 64 MB DDR RAM)
- Includes terminal and power supply
| Evaluation area | Questions for the RFP and diligence | Evidence to request |
|---|---|---|
| Scope and fit | Which issuer or acquiring functions, channels, schemes and markets are covered? What stays in-house? | Architecture, supported-scheme and market list, and reference implementations. |
| Authorization operations | Which transaction types and decision flows are supported? How are stand-in processing, reversals, exceptions and reconciliation handled? | Technical flow diagrams, operating procedures, test results and customer references. |
| Availability and resilience | What counts toward availability? What exclusions, recovery objectives, remedies and incident-notification commitments apply? | Contractual SLA, audited resilience evidence, and business-continuity and disaster-recovery test summaries. |
| Authentication and fraud | Can the platform support applicable EMV 3-D Secure flows? How are frictionless and challenge paths handled, and how are authentication results passed into authorization? | Supported versions and schemes, integration diagrams, regional applicability assessment and bank-specific outcome measures. |
| Tokenization | Which network tokens and lifecycle events are supported? What provisioning, cryptogram and authentication data are needed for each use case? | Network and brand coverage, APIs, lifecycle scenarios, conformance evidence and end-to-end test plan. |
| Security and oversight | What compliance evidence is current? Which controls and responsibilities remain with the bank? How are subcontractors and incidents handled? | Current Attestation of Compliance, responsibility matrix, incident and subcontractor processes, and audit rights. |
| Integration and change | How does the platform connect to core banking, card management, fraud systems, digital channels and networks? How are releases and scheme changes managed? | Interface catalogue, migration plan, versioning approach and change process. |
| Commercial terms and exit | What are the implementation and run costs, volume tiers, minimums, termination rights, data-portability terms and transition commitments? | Complete pricing schedule, draft contract, exit plan and comparable references. |
Test authorization operations and resilience, not just the feature list
A feature checklist will not show how the platform behaves when transactions fail, systems are unavailable or exceptions need resolution. Require an end-to-end description of authorization and operational flows, with the bank’s own transaction types and dependencies represented. Ask how stand-in processing is invoked, what data it uses, how reversals and exceptions are reconciled, and which party owns each operational action.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Assess resilience through contractual commitments and evidence: service-level definitions and exclusions, recovery objectives, remedies, hosting and incident communications, plus summaries of business-continuity and disaster-recovery tests. DECTA’s issuer-processing page advertises a 99.99% uptime SLA; its publication year is not stated. Treat that figure as a vendor claim, not independently verified uptime or a comparison with other providers, and examine the scope and terms in the proposed contract.
Rank #3
- Same look and feel as the FD130.
- Upgraded to PCI 5.0.
- Memory: 128MB, Flash: 256MB
- Chip Card / EMV / NFC Compatible
- Processor: Cortex A5 500MHZ
Evaluate 3-D Secure as an end-to-end authentication flow
For card-not-present payments, determine whether the proposed platform supports the bank’s applicable issuer-side EMV 3-D Secure requirements. J.P. Morgan Payments describes 3-D Secure as an authentication protocol that lets a merchant request issuer authentication before payment authorization or verification. Visa’s materials describe authentication data exchange and the sequence in which Visa Secure authentication is followed by authorization. These descriptions explain the flow; they do not establish that every version, market or use case has the same requirements.
Questions to resolve in the design
- Which versions, schemes, countries and transaction types are supported, and which current mandates apply to the bank?
- How does the service handle both frictionless authentication and a challenge when additional cardholder interaction is required?
- What authentication outcome and related data reach authorization, and how are failures, timeouts and unavailable services handled?
- Which party is responsible for configuration, monitoring, exception handling and changes when network or regional requirements evolve?
J.P. Morgan Payments’ 3-D Secure material and Visa Secure documentation are useful starting points for mapping the flow. Confirm applicability and current rules directly for the bank’s schemes and jurisdictions, then ask the provider to demonstrate the relevant paths in an integration diagram and test plan.
Rank #4
- Verifone VX520 with Smart Card generates new recurring revenues from value-added applications, thanks to an extraordinary increase in memory of 160 MB standard, increasing to over 500 MB
- Included: Terminal, power supply, 1 roll paper
- Mfr Part Number: M252-753-03-NAA-3
- Specs & Features: Dual EMV Condition
Compare tokenization by brand, use case and lifecycle
Network tokenization is an integration capability, not a guarantee of higher approval rates or lower fraud. Compare what the platform can provision and manage for the bank’s actual use cases, rather than accepting a general claim of “token support.” J.P. Morgan Payments’ Network Tokenization material and Visa’s Visa Token Service and provisioning documentation describe network-token capabilities and issuer participation; requirements and data vary by card brand and flow.
- List the networks and token use cases the bank requires, including relevant provisioning paths.
- Map lifecycle events the platform supports, such as credential changes and token updates, and identify the responsible party for each event.
- Document the required token, cryptogram and authentication data for each brand and transaction flow.
- Request APIs, conformance evidence and an end-to-end test plan that covers the bank’s intended scenarios.
Make security oversight and responsibilities explicit
Do not treat a provider’s compliance status as a substitute for the bank’s own oversight. Request current PCI DSS evidence, a responsibility matrix, audit rights, and documented incident and subcontractor processes. Visa’s Account Information Security (AIS) Program and PCI page states: “Issuer and acquirers must ensure all their service providers demonstrate PCI DSS compliance at least every 12 months.” The bank should confirm current requirements for its role and jurisdiction and establish how it will obtain refreshed evidence.
Best Value
- Chip Card / EMV / NFC Compatible
Compare integration, commercial terms and exit before selecting
Map dependencies with the bank’s core banking, card management, fraud, digital-channel and network systems. For each integration, identify the interface, data owner, operational handoff, migration dependency and change process. Request a migration plan and release/versioning approach that shows how scheme changes are assessed and implemented. The cited provider materials do not establish comparable integration performance, so assess it through bank-specific architecture review, testing and references.
Request a complete commercial schedule rather than comparing a headline processing rate. Separate implementation and recurring charges, volume tiers and minimums, and identify any assumptions that could change the cost. The available evidence does not establish reliable comparable pricing. Review draft terms for termination, data portability and transition support alongside the proposed service levels; these determine how accountable the provider is during service disruption and how practicable an eventual move would be.
Turn the evaluation into a decision process
- Write a scope statement. Specify issuer processing, acquiring or both; channels, schemes, countries, transaction types and the functions the bank will retain.
- Issue one requirements matrix. Use the same operational, resilience, authentication, tokenization, security, integration and commercial questions for every candidate.
- Separate claims from proof. Mark each response as contractual commitment, independently reviewed evidence, demonstration, reference, or vendor assertion. Define what proof is needed before a claim affects selection.
- Test the bank’s real flows. Use representative authorization, reversal, exception, 3-D Secure and token lifecycle scenarios. Evaluate outcomes against requirements the bank has set, not a generic vendor ranking.
- Assess total accountability. Confirm who operates each control, meets each obligation, manages incidents and supports recovery; compare the contract and exit plan as well as the technical design.
A bank-specific shortlist and total-cost comparison cannot be determined without the bank’s geography, issuer/acquirer scope, channels, schemes, transaction profile, incumbent stack and procurement constraints. The available provider information does not supply a neutral, independently validated comparison across those criteria, so selection should rest on the bank’s own RFP evidence and diligence.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
