How a Stablecoin Card Program Actually Works

The five layers between your tap and your coins

PaymentScan, the research arm of Castle Labs, spent 2026 interviewing the companies that sell card infrastructure and published the results in a launch guide for new programs. Read from the cardholder's side, their industry map explains almost everything confusing about these cards: the weird fee structures, the sudden shutdowns, and why two rival brands can fail on the same day.

The brand is the layer you chose, and it does the least regulated work: the app, the marketing, the support inbox, the card design. Underneath it, custody decides where your stablecoins actually sit. On a self-custody card they stay in a wallet you control until the moment of purchase. On a custodial card they sit in accounts the program controls, often with a specialist custodian such as BitGo or Fireblocks, and what you hold is a balance the program owes you.

The processor is the layer with the stopwatch. When a merchant's terminal asks whether a payment is good, the answer has to come back in a fraction of a second; Wirex's external authorisation setup, for example, expects a response within 300 milliseconds and treats anything over 500 as a decline. The issuer, the BIN sponsor, is the licensed company in your cardholder agreement. It carries the regulatory risk, holds the relationship with Visa or Mastercard, and can end a program's card access in a way the brand cannot override.

The last layer surprises most people: the merchant is not paid in stablecoins. Programs keep a prefunded fiat account with their issuer, topped up days ahead of expected volume (Wirex asks for a buffer of three to five days of spend, Rain's proposals run near four), and settlement flows from that account over the normal card rails. Your stablecoins are sold or drawn against behind the scenes. The crypto part of a crypto card happens entirely on your side of the wall.

Follow $100: what the card earns

The merchant pays for all of this through interchange, the percentage of each sale that flows back through the network. It varies enormously by region: as low as 0.2% on capped European debit, around 0.7% blended worldwide, and up to 1.5% in parts of Latin America. The network and the issuer take their cuts first. What reaches the program is a negotiated share, typically 20 to 80% of the gross, which lands at about 0.1% of spend for an early program and 0.5 to 0.6% for a large one. Per $1 million of monthly spend, that is roughly $1,000 of interchange revenue early and $5,000 to $6,000 at scale.

So why is the cashback higher than the revenue?

Because cashback is not paid out of card revenue. It is a customer acquisition cost, and PaymentScan's onchain measurements show how large it runs: in October 2026, ether.fi Cash paid out 1.2% of spend, Wirex One 1.4%, Plasma One 2.5% and Ethena Pay 2.9%, every one of them above what the program keeps from interchange. The money comes from the other legs of the business: yield on customer balances (ether.fi cardholders held about $318 million at the end of October 2026, most of it supplied to Aave; Plasma One held about $33 million), paid plan tiers, and token treasuries. In PaymentScan's sample P&L for a European fintech program, yield on balances is about 60% of total revenue.

This is why generous rates keep getting cut. A cashback rate is a budget line with a funding source behind it, and when the treasury allocation ends, the staking tier changes or the plan reprices, the rate follows. Our guide to cashback after FX fees runs the same logic from the cardholder's side: judge a card on the net number and on how durable the funding behind it looks, never on the headline alone.

Who holds your money while it waits

The custody layer decides what a shutdown, a freeze or an insolvency means for you, and the models differ more than the marketing suggests. With a self-custody card, the program can kill the card, but the coins in your wallet are not theirs to freeze or lose; when Kulipa wound down in July 2026, its card brands stopped working while balances stayed in users' own wallets. With a custodial card, your deposit is a claim. How strong that claim is lives in the terms: KAST's terms treat a crypto deposit as a sale to KAST for a USD-denominated claim, with assets held by BitGo and Fireblocks on KAST's behalf, which would make cardholders unsecured creditors in an insolvency. KAST added redemption rights for unspent balances after this structure drew public criticism in July 2026.

Neither model is automatically wrong. Custody buys convenience, recovery options and, in some programs, stronger fraud protection. But the two models fail differently, and the cardholder agreement, not the landing page, tells you which one you are in. Our security incidents guide walks through the documented cases, from data breaches to issuer exploits, and what each one did to the people holding the card.

Three platforms carry almost the whole market

Of the spend PaymentScan could attribute to an issuer in the third quarter of 2026, Rain processed 43%, StraitsX 36% and Wirex 17%. Our own directory tells the same story at brand level: Rain's infrastructure sits behind 12 of the 201 cards we track, including ether.fi Cash, KAST, Plasma One and the Western Union Stablecard, and the legal issuer named on those cards is Third National, a Rain group company. We mapped the whole arrangement in our BIN by BIN issuer guide, and the short video below walks through it.

Concentration cuts both ways. The big platforms are principal members of the networks with real compliance teams, and scale is why a two-person startup can offer a working card at all. But shared infrastructure means shared failure: in August 2026 an exploited Rain card contract hit Avici and Tria users at the same time, and programs that share a BIN range can share its problems too, as Slash cardholders found when a shared BIN started declining Meta ad purchases in October 2026. The larger programs hedge by splitting cardholders across two issuers: KAST runs on Rain and Reap, RedotPay on StraitsX and Reap, and Kolo on Rain and Wirex, usually because no single issuer covers every country a program wants to serve.

Geography is the quiet constraint in this market. Rain issues in the US and settles in USD only, which is one reason USD-only cards quietly cost their holders an extra 2 to 3% on international spending once network currency fees land. Wirex issues locally in the US, EEA, UK and Australia; StraitsX is based in Singapore with processing reach into around 100 countries; Stripe, through Bridge, covers the US, EEA and parts of Latin America and EMEA. Where you live decides which layer of the stack you get.

What it costs to launch one

The launch numbers explain the shape of the market. KYC checks run about $3 to $4 per user, every inactive card still costs about $1 a month, and the median program tracked from launch since 2024 was processing $660,000 a month by its sixth month, far under break-even. The median cardholder spends about $120 a month while the average is near $1,600, because fewer than a quarter of holders, the ones spending over $1,000, drive more than 90% of all spend. Programs are built for whales they mostly do not have.

The fastest launches, KAST, COCA, Tria and Plasma One, reached $9 to $15 million a month quickly, and every one of them arrived with an existing audience or a token community attached. That is the real barrier to entry in this market: not the license, which can be rented, but distribution. It is also why so many cards are launched by wallets, exchanges and protocols rather than by new companies, and why the graveyard of discontinued cards keeps growing. We track the closures in our card graveyard, and our shutdown guide explains what to do when your card is one of them.

What this means for you as a cardholder

• Judge the issuer, not just the brand. Your cardholder agreement names the company that actually stands behind the card, and our directory repeats it on each listing where the provider states it.
• Keep two cards on two different platforms. A backup on the same issuer is one point of failure wearing two logos, as the Kulipa and Cypher shutdowns showed in July and August 2026.
• Keep card balances small and top up close to spending. The prefunding model means your money sits inside someone else's stack; the less of it there, the less any layer can hurt you.
• Treat high cashback as a promotion with a funding source, not a feature. When you can see what funds it (a token treasury, a paid tier, yield on balances), you can guess how long it lasts.
• Save your cardholder agreement at signup. It is the document that defines your claim if the program winds down, and it gets much harder to find after the app closes.

None of this makes stablecoin cards a bad product. Spending a stablecoin balance anywhere Visa or Mastercard is accepted, without an exchange withdrawal in between, is genuinely useful, and the market processed $1.37 billion in October 2026 alone. It just pays to know which of the five layers you are actually trusting with each part of the journey. Our spending tracker follows the monthly totals program by program, and the card directory lists all 201 programs with their issuers, fees and custody models side by side.