The Main Players and the Three-Corner and Four-Corner Models

The cardholder is the person who holds the card and uses it to pay, and the merchant is the business that accepts the card as payment for goods or services. The issuer is the bank that gives the card to the cardholder, holds the account or the credit line, and decides whether a transaction is authorised. The acquirer is the bank or payment institution that serves the merchant, provides the terminal or the online checkout, and collects the money from the issuer on the merchant behalf. The card scheme, such as Visa or Mastercard, sets the rules, provides the network that carries the messages, and defines how fees, clearing and settlement work between issuer and acquirer. In the three-corner model, also called the three-party model, a single institution acts as both issuer and acquirer, so only three parties are involved, the cardholder, the merchant and the institution. The cardholder pays the merchant, the merchant sends the transaction to the institution, and the institution debits the cardholder and credits the merchant, all inside its own books. This model is common for closed loop cards, such as a store card that only works in one retail chain, or a card scheme where one company issues cards and signs up merchants directly. The model is simple, because there is no interbank clearing, but it is limited, because the card only works where that one institution has signed up merchants. In the four-corner model, also called the four-party model, the issuer and the acquirer are separate institutions, so four parties are involved, the cardholder, the issuer, the acquirer and the merchant, with the scheme sitting in the middle as the network and rule maker. The cardholder buys goods for EUR 120 from a merchant whose acquirer is Harbour Bank Manchester, while the card is issued by Meridian Bank London. The merchant sends the transaction to Harbour Bank, Harbour Bank sends it through the scheme to Meridian Bank, Meridian Bank authorises the payment, and the money later moves from Meridian Bank to Harbour Bank through clearing and settlement. The four-corner model is open, because any issuer card works at any acquirer merchant that displays the scheme logo. The difference between the models matters for a business analyst, because it changes the number of parties, the messages and the places where a payment can fail. In the three-corner model, authorisation and settlement happen inside one institution, so there is one ledger, one set of rules and one point of failure. In the four-corner model, authorisation crosses from acquirer to scheme to issuer and back, and settlement crosses from issuer to scheme to acquirer, so the analyst must design for timeouts, mismatched amounts, duplicate messages and late settlement. A product owner should consider which model applies to each product, because a closed loop gift card and an open scheme credit card need very different flows, tests and exception handling. Worked example with numbers: a cardholder buys EUR 120 of goods from an online merchant, and the payment follows the four-corner model. Meridian Bank London is the issuer, Harbour Bank is the acquirer, Visa is the scheme, and the merchant is the fourth corner. The merchant gateway sends the authorisation request to Harbour Bank, which sends it to Visa, which sends it to Meridian Bank, which checks the account and approves. The approval travels back along the same path in under two seconds, and the merchant shows the cardholder an approval code. At the end of the day the acquirer sends the clearing file to the scheme, the scheme calculates the net positions, and the banks settle through their settlement accounts. Failure and recovery: the four-corner model fails when any party is unreachable, and the failure shows up as a declined or timed out transaction. If the issuer does not answer within the scheme timeout, usually a few seconds, the acquirer must decide whether to decline the transaction or to stand in for the issuer with a pre-agreed limit, and that decision is called stand-in authorisation. If the scheme is unavailable, the acquirer cannot route the request at all, and the merchant must offer another payment method. The recovery for a timed out transaction is a clear decline message, not a silent retry, because a retry after the customer has left the checkout can debit the account twice, and the merchant must reconcile the duplicate. For a business analyst, product owner or subject matter expert, the model requirement must state the parties in each model, three parties in the three-corner model and four parties plus the scheme in the four-corner model, and must state the messages on each leg, the authorisation request, the authorisation response, the clearing file and the settlement. The requirement must also state the stand-in authorisation rule, because that is the control that decides what happens when the issuer does not answer. The test pack must include a three-corner payment, a four-corner payment, an issuer timeout, and a scheme outage, because each case exercises a different part of the model. Source: Visa and Mastercard scheme rules; last reviewed 7 November 2026.