A card sale is a round-trip authorization message. The terminal or gateway builds a request, the acquirer or processor switches it into a card network, the network routes it to the issuing bank, and the issuer's yes, no, or partial yes travels back the same path. Visa describes that network hop as returning authorized or declined in milliseconds, on a network that processes up to 83,000 transaction messages per second worldwide (Visa, 29 Oct 2025). That answer is a hold on the cardholder's open-to-buy. It is not a deposit in your checking account.
This path is how most U.S. register sales actually clear. The Federal Reserve counted 236.6 billion noncash payments in 2024. Cards were 79 percent of those payments by number and 8 percent by value (Federal Reserve Payments Study, released 1 Jul 2026). Debit ran 120.6 billion. Credit ran 67.1 billion. Each of those card payments still had to complete this round trip.
- 1Terminal or gateway. Builds the request: amount, how the card was captured, merchant ID.
- 2Acquirer or processor. Switches the request into the card network.
- 3Network. Routes to the issuing bank. Visa, Mastercard, Discover, or American Express.
- 4Issuer. Approves, declines, or partially approves against the cardholder's credit or funds.
- 5Back the same path. The yes or no hits the pad in milliseconds. That is authorization, not a deposit.
The hops, named
The stack of names behind that trip is the payments ecosystem. Zoom in on the message itself.
Terminal, POS, or gateway. The device or software captures the card (tap, dip, swipe, keyed, or a wallet token) and builds an authorization request: amount, how the card was captured, merchant ID. Online, the payment gateway is the pipe that encrypts that request. Card-present, the gateway job often lives inside the terminal host. Absence of a gateway logo is not absence of the job.
Acquirer or processor. The engine switches the request into the network. Contracts often print one logo on both jobs. The work is still switching.
Network. Visa, Mastercard, Discover, or American Express routes the request to the bank that issued the card. You do not have a contract with the network. The customer's plastic chose it.
Issuer. The issuing bank checks that the card is open, that credit or funds cover the amount, and that its risk rules do not fire. It returns an approval, a decline, or, on some debit and prepaid cards, a partial approval.
Back the same path. The response hits the pad. The sale can complete at the register. Money has not moved.
Label a grocery tap illustrative. A $42.50 contactless sale still makes those five hops. The customer sees a yes in well under a second. Your deposit still waits on capture, batch, settlement, and funding.
Authorization is a hold. Settlement is the money.
Authorization is the issuer's yes. Capture is you claiming the sale. Settlement is the networks moving value between the acquirer and the issuer. Funding is the later deposit into your bank. Those clocks are authorization, capture, and settlement. PIN-authenticated debit is often a single message: approval and presentment travel together. Signature credit and most card-not-present sales are dual-message: auth first, capture later.
Interchange is decided on this trip too, by merchant category, card product, and how the card was captured. It is not a number your sales organization invented after the fact. The round-trip only decides whether the sale may proceed. The statement is the bill for that decision.
When the issuer is late: timeout, then stand-in
The round trip is fast until someone on the path does not answer.
Visa's public Core Rules (April 2023 edition, Table 7-1) give issuers a maximum 10 seconds to answer a POS authorization in the U.S., Canada, and the other non-Europe regions in that table. ATM cash disbursement (MCC 6011) is 25 seconds. If Visa does not receive the issuer's response in time, Visa answers on the issuer's behalf using Stand-In Processing (STIP). Separately, a U.S. issuer or its authorizing processor, including STIP, must respond in an average time not exceeding 5 seconds during each calendar month (Visa Core Rules, section 7.3.3.1).
The merchant clock is longer on purpose. An acquirer or merchant must not timeout a POS transaction in less than 15 seconds. If an approval arrives after you already timed out, you must send an authorization reversal (Visa Core Rules, section 7.3.4.2; the 15-second floor is not a Europe rule). Hang the pad at 3 seconds and you will create ghost holds: the issuer approved, your POS gave up, and the cardholder's balance is still reduced until someone reverses.
Visa defines STIP as the component that authorizes on behalf of an issuer when the issuer or its processor is unavailable, when the issuer's response exceeds the maximum time, or when the issuer has instructed Visa to process the transaction (Visa Core Rules glossary, ID 0025121). Other card networks run an equivalent on-behalf service. The merchant sees an ordinary approval or decline. You usually cannot tell from the receipt whether the issuer or the network's stand-in answered.
If stand-in does not apply, the switch can return action code 91: issuer or switch inoperative, or timeout when no stand-in (Visa Developer, Request and Response Codes). That is a decline, not a maybe. Do not force-post it.
Visa's Smarter STIP, announced 26 Aug 2020, is the same job with a model trained on the issuer's own history instead of only static BIN parameters. It still fires only when the issuer is not there. It is not a second processor you hired.
Partial authorization is a smaller yes
Most authorizations are all-or-nothing. On Visa debit and prepaid, the issuer can approve less than you asked for when the available balance is short. Visa's Partial Authorization Service (merchant guide, April 2017) is the rule set.
The participating merchant sends a partial-authorization indicator on the request. If the card cannot cover the ticket, the issuer returns response code 10 (partial approval) and the amount it will stand behind. Visa's own example: a $95.50 ticket on a card with $75.30 available comes back approved for $75.30. Your POS subtracts, asks for another tender for the rest (split-tender), and clears only the partial amount. If the customer walks, reverse the partial hold. Do not capture $95.50 against a $75.30 approval.
Visa requires all prepaid issuers and all acquirers to support partial authorization. On the merchant side it is required for U.S. automated fuel dispensers with real-time clearing, U.S. cash-back at the POS, and U.S. aggregated transactions. It is optional for other merchants (same Visa guide). A stand-alone terminal that treats code 10 as a generic decline will void a sale the issuer already partly funded. Train for the code, or the customer leaves with a hold and no groceries.
Cash-back cannot be partially approved. Tips cannot ride on a partial: Visa says there is no tip tolerance on a partially approved amount, and restaurants should authorize the check without a guessed tip.
What to do when the pad hangs
Three failures live on this path. Treat them as three jobs, not one "processing is down."
Timeout at the terminal. Wait the 15-second floor. If an approval then prints, reverse it if you already walked the customer. Do not run the card a second time until you know the first request died.
Issuer outage, stand-in answering. The sale can still approve. If it declines with a 91-class code, try another brand or another tender. Do not key the same Visa twice hoping the issuer woke up.
Partial approval. Read the approved amount. Collect the remainder or reverse. Capture only what was approved.
The logo on the plastic picked the network. The logo on the terminal is usually software. The bank that said yes is the issuer. The bank that will fund you is the acquirer. Name those four and a hung pad stops looking like a mystery.
FAQ
How does a credit card transaction work step by step? The terminal or gateway builds an authorization request. The acquirer or processor switches it into a card network, which routes it to the issuing bank. The issuer approves, declines, or partially approves, and that answer travels back the same path. That is a hold, not a deposit. Capture, settlement, and funding happen later.
What is stand-in processing (STIP)? STIP is the network authorizing on the issuer's behalf when the issuer or its processor is down, late, or has asked the network to stand in. Visa's public Core Rules (April 2023) define it that way. The merchant usually sees an ordinary approval or decline, not a special stand-in receipt.
What is a partial authorization? A partial authorization is an issuer yes for less than you asked, most often on debit or prepaid when the available balance is short. Visa returns response code 10 and the approved amount. Collect the rest as split-tender, or reverse the hold if the customer walks. Capture only what was approved.
Why did my card terminal time out? Someone on the path did not answer in time: your host, the processor, the network, or the issuer. Visa gives U.S. issuers 10 seconds on POS and tells merchants not to time out a POS sale in less than 15 seconds. If an approval arrives after you already walked away, reverse it. Do not run the card a second time until you know the first request died.
Is an approved authorization the same as getting paid? No. Authorization is the issuer's hold on the cardholder's open-to-buy. Capture is you claiming the sale. Settlement is the networks moving value between banks. Funding is the later deposit into your checking account.
What should I do if the customer's bank is down? Wait the POS timeout floor. The network may stand in and still approve. If you get a timeout-with-no-stand-in decline (Visa action code 91), try another card brand or another tender. Do not force-post, and do not key the same card twice hoping the issuer woke up.
Sources
- Federal Reserve, "Federal Reserve issues initial findings from its 2025 triennial payments study," 1 Jul 2026
- Federal Reserve Payments Study, National Payment Volumes, Top-Line Data (CY 2015-24), last update 1 Jul 2026
- Visa, "Inside Visa's engine of global commerce," 29 Oct 2025
- Visa Core Rules and Visa Product and Service Rules, April 2023 public edition, sections 7.3.2 to 7.3.4 and glossary (STIP, ID 0025121)
- Visa, "Visa Harnesses Real-Time Deep Learning to Enhance Transaction Processing" (Smarter STIP), 26 Aug 2020
- Visa Developer, Request and Response Codes (action code 10 partial approval; 91 timeout when no stand-in)
- Visa, "Visa Partial Authorization Service," VBS 06.APR.17
Questions about how this applies to your business?
Talk it through