You are launching a crypto platform and want to issue a debit card that converts BTC to USD seconds before payment. The problem: integration with Visa/Mastercard requires three levels—principal member (bank with network membership), program manager (Marqeta/Stripe Issuing), and your platform. Direct membership takes 12–24 months and capital from $2M. A realistic path for a startup is working through a program manager that already has membership. We specialize in the technical side of such turnkey integration: from choosing a processing partner to launching the card product.
Our experience shows that most crypto platforms choose Marqeta as the card issuing API—it is the most flexible solution with JIT Funding support. An alternative is Stripe Issuing, but it requires a pre-funded fiat reserve. We will help evaluate your project and choose the optimal provider.
To understand the architecture, let's break down the structure:
Visa/Mastercard Network
↓
Principal Member Bank (BIN owner)
↓
Card Program Manager (Marqeta, Stripe Issuing, Galileo)
↓
Your Crypto Platform
↓
End User
Principal Member is a bank with direct membership in Visa/MC, issuing BIN ranges. Program Manager is the technological intermediary, providing APIs for card issuance and authorization processing, taking on technical and partially regulatory obligations. Your platform handles the crypto side: asset storage, conversion, user interface.
How JIT Funding Works for Crypto Cards
Marqeta is a leading card issuing API, used by Cash App, DoorDash, Coinbase Card. It operates as a program manager: you issue cards via their API, they process authorizations and via Just-In-Time (JIT) funding request funds from you at the moment of each transaction. This makes Marqeta the best choice for consumer crypto cards compared to Stripe Issuing, which requires pre-funding.
JIT (Just-In-Time) Funding is a mechanism where Marqeta does not hold the user balance on its own. Instead, at each card authorization, Marqeta makes a webhook request to your API, and you respond with approve/decline and the amount. This allows applying your business logic (check crypto balance, convert) in real time.
// Your JIT Funding endpoint
app.post("/marqeta/jit-funding", async (req, res) => {
const { token, type, amount, currency_code, card_token } = req.body;
const userId = await getUserByCardToken(card_token);
const user = await getUser(userId);
const cryptoAmount = await convertUSDToCrypto(amount, user.preferredAsset);
const hasBalance = await reserveBalance(userId, cryptoAmount);
if (!hasBalance) {
return res.json({
jit_funding: {
token: token,
method: "pgfs.authorization",
user_token: userId,
amount: 0,
},
});
}
return res.json({
jit_funding: {
token: token,
method: "pgfs.authorization",
user_token: userId,
amount: amount,
currency_code: "USD",
},
});
});
Marqeta API — Card Issuance
import Marqeta from "@marqeta/core-api";
const marqeta = new Marqeta({
applicationToken: process.env.MARQETA_APP_TOKEN,
accessToken: process.env.MARQETA_ACCESS_TOKEN,
baseUrl: "https://sandbox.marqeta.com/v3",
});
async function createMarqetaUser(userId: string, userData: UserData) {
const marqetaUser = await marqeta.users.create({
token: userId,
first_name: userData.firstName,
last_name: userData.lastName,
email: userData.email,
birth_date: userData.birthDate,
address1: userData.address,
city: userData.city,
state: userData.state,
country: userData.country,
postal_code: userData.postalCode,
});
return marqetaUser;
}
async function issueVirtualCard(userId: string) {
const card = await marqeta.cards.create({
user_token: userId,
card_product_token: process.env.CARD_PRODUCT_TOKEN,
});
const cardDetails = await marqeta.cards.getShowPAN(card.token);
return {
cardToken: card.token,
last4: card.last_four,
expiration: card.expiration,
pan: cardDetails.pan,
cvv2: cardDetails.cvv_number,
};
}
When to Choose Stripe Issuing vs Marqeta
Stripe Issuing is simpler to integrate, available in 30+ countries. It does not fully support JIT Funding—balance must be pre-funded on Stripe account, which requires holding a fiat reserve at Stripe. This complicates crypto integration. Suitable for B2B expense management cards, corporate cards with crypto balance. Not optimal for consumer crypto debit cards.
Marqeta is twice as suitable for consumer cards as Stripe Issuing due to JIT Funding. If your product is a crypto debit card for users, choose Marqeta. For B2B expense management, Stripe Issuing.
import Stripe from "stripe";
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
const card = await stripe.issuing.cards.create({
cardholder: cardholderId,
currency: "usd",
type: "virtual",
status: "active",
spending_controls: {
spending_limits: [{ amount: 50000, interval: "daily" }],
},
});
| Parameter | Marqeta | Stripe Issuing |
|---|---|---|
| JIT Funding | Yes | No (pre-funded) |
| Crypto cards | Excellent | Limited (B2B) |
| API | Powerful, flexible | Simpler, fewer options |
| Geography | Global | 30+ countries |
| Card issuance cost | ~$2 | ~$3 |
Marqeta charges about $2 per virtual card issuance and $0.10 per authorization. At a volume of 10,000 cards per month, savings on fiat reserve can reach $50,000 per year.
Authorizations, Settlement, and Currency Risk
It's important to understand the difference: Authorization—check and hold funds, happens instantly, your JIT endpoint must respond within 2-3 seconds. Clearing/Settlement—actual charge, occurs 1-3 business days later. Refund/Reversal—transaction cancellation, may arrive days after authorization.
app.post("/marqeta/webhook", async (req, res) => {
const event = req.body;
switch (event.type) {
case "authorization":
await holdCrypto(event.card_token, event.amount);
break;
case "authorization.clearing":
await settleTransaction(event.transaction.token, event.amount);
break;
case "authorization.reversal":
await releaseHold(event.transaction.token);
break;
case "refund":
await refundCrypto(event.card_token, event.amount);
break;
}
res.status(200).send("OK");
});
How to Manage Currency Risk with JIT Funding?
When holding a USD amount in crypto equivalent, there is a risk of rate change between authorization (T+0) and settlement (T+1..3). Three approaches:
- Stablecoin by default (USDC/USDT). No currency risk. Users hold stablecoins, payment is straightforward. Disadvantage: no crypto upside.
- Over-reservation. At authorization, reserve amount with a buffer (+2-3%). At settlement, excess is returned. Simple solution for small volumes.
- FX hedge. At authorization, fix the rate through derivatives or fast CEX trade. More complex, expensive, but precise. Needed for large volumes or volatile assets.
PCI DSS and Regulatory Path
Handling card numbers (PAN) requires PCI DSS certification. Levels: SAQ A—if you don't process PAN directly (Marqeta stores them, you use tokens), minimal requirements; SAQ D—if you store/process PAN, full audit, expensive. We recommend using card tokenization (Marqeta Token Vault)—your system operates only with card_token, PAN never passes through your servers.
| Jurisdiction | Requirement | Timeline | Notes |
|---|---|---|---|
| EU | EMI license (Lithuania) | 6-12 months | Requires passportization, partnership with issuer |
| UK | FCA EMI | 9-18 months | High regulatory requirements |
| USA | MTL in each state | 12-24 months | Expensive, alternative: partnership with a bank |
| Singapore | MAS Major Payment Institution | 12-18 months | Requires local presence |
Minimum path for EU: registration in Lithuania + passportization. For the rest of the world—partnership with an already licensed issuer.
Step-by-Step Integration Process
- Analytics and provider selection: volume assessment, choose Marqeta or Stripe Issuing.
- Architecture design: JIT Funding, conversion scheme, key storage.
- API integration: card issuance, webhooks, 3DS.
- Crypto custody integration: wallet, conversion, reservation.
- KYC/AML: integration with verification services.
- Testing: authorization, settlement, refund scenarios.
- Compliance: PCI DSS, licensing.
What's Included in Turnkey Integration
- Consultation on card issuing provider selection (Marqeta/Stripe Issuing)
- JIT Funding endpoint setup with crypto balance check
- API integration for virtual and physical card issuance
- 3D Secure (3DS) implementation for transaction protection
- KYC/AML document upload integration
- PCI DSS assistance: tokenization recommendations, SAQ completion
- Load testing and monitoring
- Documentation and team training
Timelines and Indicative Cost
- Marqeta integration (JIT + card issuance + webhooks): 4-6 weeks
- 3DS integration: +2-3 weeks
- Crypto custody + conversion: parallel, 4-8 weeks
- KYC/AML: 2-4 weeks
- Mobile app: 8-12 weeks
- Compliance + testing: 4-6 weeks
- Total (technical): 5-7 months
Investment in integration: from $50,000 to $200,000 depending on stack complexity and volume. Savings on infrastructure due to JIT Funding: up to 40% compared to holding your own fiat reserve.
Get a consultation for your project—we'll assess the architecture and timelines in 1-2 days.