Credit Card Authorization: The Four-Party Model and Six-Step Routing Sequence

A credit card transaction is authorized through a six-step digital handshake between four distinct financial entities: the cardholder, the merchant, the acquiring bank, and the issuing bank. When a consumer swipes a card, the data travels from the point-of-sale terminal to a payment gateway, through the card network to the issuer for approval, and back down the chain in roughly three seconds, long before any actual money moves.[5]

The system that makes this instant trust possible is known as the four-party model. Despite marketing claims from fintech startups promising direct peer-to-peer payments, the global credit infrastructure still relies on this long-standing separation of risk. The four parties hold specific liabilities, ensuring that if a consumer defaults or a merchant goes bankrupt, the system does not collapse.[1][5]

The first party is the consumer, who holds the card and the line of credit. The second is the merchant, who provides the goods and wants guaranteed payment. Because these two parties do not inherently trust each other, they rely on the third and fourth parties: the issuing bank that gives the consumer the card, and the acquiring bank that holds the merchant's account.[1]

"The four-party model is the foundation of the global payments ecosystem," notes Payment Expert in their 2026 analysis of Visa's architecture. The model ensures that the merchant's bank pays the merchant, while the consumer's bank takes on the risk of collecting the debt from the cardholder.[1]

Connecting these four parties requires a network, typically Visa or Mastercard, which acts as the routing infrastructure rather than a bank. The actual transaction execution follows a strict six-step sequence, beginning with the swipe, dip, or tap at the point of sale.[3][5]

Step one is authorization initiation. The merchant's point-of-sale system captures the primary account number, expiration date, and security code. It encrypts this payload and sends it to a payment gateway. The gateway is simply a digital courier; it holds no funds and assumes no risk, merely translating the terminal's data into a format the banking system understands.[3][4]

Step two is the acquirer routing. The gateway forwards the encrypted data to the merchant's acquiring bank or its designated processor. According to NMI's documentation on credit card flow, the processor identifies the specific card network associated with the primary account number and pushes the request into that network's switch.[3]

Step three is the network clearing. The card network receives the request from the acquirer and routes it to the specific issuing bank that provided the consumer's card. This is where the network earns its fraction of a cent per transaction, acting as the toll road between the merchant's bank and the consumer's bank.[1][4]

Step four is the issuer's decision. The issuing bank receives the request and runs a series of algorithmic checks in milliseconds. It verifies the card is active, checks the security code against its database, runs a fraud-scoring model based on location and purchase history, and confirms the account has sufficient available credit to cover the requested amount.[3]

Step five is the response routing. If the checks pass, the issuer generates an authorization code and places a hold on the consumer's funds. It sends this approval code back through the card network, which forwards it to the acquiring bank, which passes it to the gateway, which finally delivers it to the point-of-sale terminal.[3][4]

Step six is the merchant completion. The terminal displays an approval message, the receipt prints, and the consumer leaves with the goods. The entire six-step authorization process takes between one and three seconds. However, at this exact moment, zero actual currency has changed hands.[4][5]

The distinction between authorization and settlement is the core capability of the four-party model. As the Federal Reserve History project details in its archive of electronic point-of-sale payments, the system was designed to separate the immediate need for trust at the checkout counter from the slower, batch-based reality of interbank transfers.[2]

Settlement happens later, usually at the end of the business day. The merchant sends a batch of all authorized transactions to their acquiring bank. The acquirer pays the merchant, minus a merchant discount rate, which typically ranges from 1.5 to 3 percent of the transaction value.

The acquirer then requests those funds from the issuing banks via the card networks. The issuers transfer the money to the acquirer, keeping a portion called the interchange fee, which compensates them for the risk of issuing the credit and funding consumer rewards programs.[1]

This fee structure is why the four-party model remains dominant despite the rise of digital wallets and crypto-payment promises. As Virginia Tech's Treasury Operations manual outlines in its payment card transaction flow, the fees are distributed precisely to balance the risk taken by the acquirer and the issuer.

Closed-loop networks, like American Express, operate differently. They use a three-party model where the network acts as both the issuer and the acquirer. While this allows them to capture the entire fee, it limits their reach compared to the open four-party networks that allow any bank to plug into the system.[1][5]

The next time a fintech company announces a revolutionary new payment rail, look for the underlying architecture. If the system relies on a standard credit card for funding, it is still riding on the four-party model, paying the same interchange fees, and executing the same six steps to guarantee the funds. The interface may change, but the foundational distribution of risk remains intact.[5]