BIN sponsor concentration in crypto cards

The hidden banks behind 177 tracked crypto-linked cards, 142 of them currently obtainable, and how few of them there are.

On 21 January 2026, Poland's Financial Supervision Authority pulled the payment-institution license of a small Polish company called Quicko sp. z o.o. Within thirteen days, three crypto cards in different parts of the world had stopped working.

The three were CEX.IO Card, Trustee Plus and IN1. None of the parent brands had failed, been sanctioned or been hacked. The bank-equivalent that printed their plastic was all they had in common, and it had just lost its license.

A fourth brand on the same license, Utorg, only became visible in July, when its own terms gave the issuer away. Its card went offline on 9 February and came back as a USD Visa provided by Wirex Limited. Cascades are counted from public documents, and the documents understate them.

Our shutdowns dataset names a different third card for this event, because it counts cards in our database that were issued by Quicko: CEX.IO, Trustee and Mercuryo Spend. Mercuryo had already retired its Quicko-issued card on 1 January, before the decision, and IN1 is not a card in our database. IN1's own notice of 22 January 2026 says Quicko "acts as a card-as-a-service provider for IN1" and that card payments were "temporarily unavailable" from the revocation of 21 January by decision of the regulator. A replacement EUR-only fiat card ran from about 18 March 2026 with the provider unnamed, and IN1 closed its app for the European market after 29 May 2026 under MiCA. Nobody can order it.

If you owned one of these cards, your only warning was a support article. The public record gives this timeline. On 21 January the KNF notice goes up, in Polish, on a supervisory site a Trustee Plus user in Kyiv or Lisbon has no reason to read. In the last days of January a support post lands (CEX.IO's is at support.cex.io/en/articles/13460417) saying the card will stop. On 3 February it stops, mid-month, and whatever float had been topped up for everyday spending is frozen until the 30 April wind-down. The balance is not necessarily lost. But the person holding it did nothing wrong, picked a reputable brand, and never signed anything with a Polish company called Quicko. This piece is about the gap between who you think you contracted with and who holds the license.

Sponsor failure cascades are not new. Wirecard filed for insolvency in June 2020, and the FCA froze the UK arm behind the cards of Crypto.com, TenX, Cryptopay, Curve, ANNA, Pockit and Soldo. Crypto.com's cards were off for four days, from 26 to 30 June, and the programs were left to find new issuers. Metropolitan Commercial Bank exited crypto in January 2023; BitPay closed its prepaid Mastercard to applications that May and has not sold a card since. The Bank of Lithuania revoked UAB PayrNet's e-money licence in June 2023 and Cryptopay's EU card stopped with it.

The Quicko cascade was small and the Wirecard one was large. They share one structural property: a bank or licensed payment institution that never appears on the front of your card, and that you never signed up with, is what makes the card work. When the regulator pulls or freezes that license, the card stops working.

This is concentration risk. In crypto, it has been getting worse.

Unconcentrated in aggregate, concentrated in self-custody

1. The market is unconcentrated in aggregate and concentrated in the self-custody segments, and the top node is growing. Across the 142 cards obtainable at the end of September 2026, with Third National and Rain counted as the single corporate group they are, the largest group holds 28 cards, about 20%, and the index sits near 580, still inside the DOJ's unconcentrated band. The comparable readings were about 17 cards and about 12% in May, then 23 cards and 16% in August. The aggregate band did not change; the biggest node did. Most of the September step is our reading catching up with the documents. Oobit and Orbitx left the silent tier when their card terms, read to the end, named Third National, and nsave's relaunched card, Ethena Pay and belo LUX entered the catalogue already naming it.
2. US self-custody: the Rain group covers 11 of the 15 cards whose sponsor can be identified at all, and the index is about 5,800. The segment stands at 16 cards against 22 in May: five of the programs attributed to Third National stopped between May and August, and the stricter region parsing adopted on 10 August moved the remainder. Concentration held while the segment contracted, which is the opposite of the reassuring reading.
3. The rail had its first shared incident, and the cause was a contract, not a license. On 28 August 2026 an exploit of an outdated Rain contract drained roughly $1.1 million from users of at least two card programs at once. Rain repaid them within a day and has published no post-mortem since.
4. EU/UK self-custody: the Monavate concentration has broken. It was about 10 of 12 cards in May. At the end of September the segment stands at 16 cards, 14 of them with an identifiable sponsor: five on the Rain group and four on Monavate. Gnosis Pay, the card Monavate's lead was built on, closed to new sign-ups on 30 September. The August re-measurement had put the segment at 24; a re-read of card terms on 25 September moved three cards out of our self-custody category and rewrote region fields for others.
5. Read by availability, the Rain group is the largest identifiable group in every regional list. It is behind 43% of the identifiable cards open to residents of Latin America, of Asia and of the US, and 36% of those open to Canada. Those four lists sit in the moderately concentrated band or on its upper line. In the list open to Europe or the UK it ties with Monavate at nine cards each, and that list is unconcentrated.
6. No megabank issues a crypto card. The sponsors are mid-size specialists: Third National, Monavate, Lead Bank, Wallester, Wirex, Cross River. Two brands that look like competitors are often two skins on one regulated entity.
7. More than a quarter of obtainable cards will not say who their sponsor is. Of the 142 you can still get, 78 name the sponsor verbatim in a public agreement, 23 rest on an older document, a filing or the shared rail they run on, 38 name nobody, and 3 are unmapped. The silent group was around 25 cards in May and 40 in August. Since the 2022 Union54 suspension, some program managers withhold the name on purpose.
8. Table 3 records ten upstream events in six years, from Wirecard in 2020 to Kulipa in July 2026. Five of them fall between December 2025 and July 2026. In none did the brand on the card fail first. They range from seven programs frozen at once to an onboarding pause that leaves existing cards working, which is why Table 3 keeps them separate.
9. The measure is a concentration ratio, not a volume HHI. We have card counts, not transaction volumes; the DOJ's 1,000 / 1,800 bands are a yardstick for intuition here, not a finding about market power.

What a BIN sponsor is

Visa and Mastercard run two-sided card networks. To put your logo on a card and have that card work at any merchant on the network, you have to be a Principal Member. Principal membership requires a banking or e-money license, capital, dedicated compliance staff, and ongoing network fees.

Most crypto companies are not principal members. They rent the membership.

The rental contract is called BIN sponsorship. The "BIN" is the Bank Identification Number, the six-digit prefix that starts every card number and tells the network which member is liable for what comes next. The sponsor is the principal member whose BIN is being rented. The crypto company is the program manager: it sets the brand, the loyalty mechanics, the integration with the user's wallet, the customer support. The sponsor handles compliance, settlement, and the network relationship.

This split is hidden in cardholder agreements that almost nobody reads. The Phantom Cash agreement, on bridge.xyz, opens: "This agreement (“Agreement”) contains the terms and conditions that apply to the Lead Bank Prepaid Visa (the “Card”) issued to you by Lead Bank, a Missouri state-chartered bank (the “Bank,” “we,” or “us”)." Further down it says: "Bridge Ventures LLC, a Delaware Limited Liability Company, is the Program Manager". Lead Bank is the sponsor. Bridge is the program manager. Phantom is the brand. Three layers, and only one of them appears on the card itself.

A few side roles muddy the picture. Marqeta, often described in trade press as Coinbase Card's "issuer," is the processor that operates the issuing rails. The BIN sponsor for Coinbase Card is Pathward, NA, a US bank formerly named MetaBank. Processor and sponsor are different roles, and crypto coverage often swaps them.

The other recurring mix-up is brand versus entity. Two unrelated companies called Rain work in crypto-card infrastructure. Signify Holdings, Inc. of New York does business as Rain. It is the US Visa principal member and program manager that became a Mastercard principal on 4 May 2026 (older card documents also carry the name Rain Liquidity). Rain Management WLL is a Bahrain-licensed crypto exchange that touches some Middle East product launches. Our dataset treats them as separate entities.

How this dataset was built

The dataset behind this article covers the 142 crypto-linked cards obtainable somewhere in the world at the end of September 2026, out of the 177 the Sweepbase base tracks. The BIN-sponsor attribution was first built in May 2026, on 141 cards, and has been re-run twice since. For each card, the goal is to identify the BIN sponsor named in the cardholder agreement or terms-and-conditions document on the card's own website.

This sounds simple, but agreements bury the sponsor's name wherever is least convenient. On a good card it is in the first sentence. On a bad one it sits in an apply-only PDF or a chargebacks clause three documents deep, and on a handful it is nowhere reachable from outside the application flow.

The 142 cards fall into tiers by how reachable the sponsor name is. 78 have a public cardholder agreement or terms naming the sponsor verbatim. 23 rest on an older document, a filing or the shared rail the card runs on. 38 name nobody: some never have, some removed the disclosure when their sponsor changed, and some (post-Union54) now treat naming it as a risk in itself. 3 are not yet mapped (Emoney, Wavecard and the Argentine Belo Card). That leaves 101 cards with an identifiable sponsor.

The earlier counts, for comparison. The May 2026 snapshot, over 141 cards, gave around 79 cards naming the sponsor verbatim, around 34 resting only on an older T&C, a press release or a regulator filing, and about 25 naming no sponsor, with a handful left unclassified. On a 16 May 2026 spot-audit of 32 of the verbatim cards, only 14 were re-verifiable that day, so that tier is best read as "documented at least once at primary source." The appendix records when each of the cards the first edition documented by hand was last re-fetched. The August run, over 140 cards, gave 73, 25, 40 and 2.

The comparison with May is loose in one respect: the middle tier now includes rail-inference, which the May tiers filed under the cross-cutting “circumstantial” label instead, so tier two is not like-for-like. The silent tier is. It went from about 25 in May to 40 in August and stands at 38 now. Cards moved both ways. Oobit and Orbitx left it when their card terms, read to the end, named Third National. nsave's relaunched card, Ethena Pay and belo LUX entered the catalogue already naming it. Silence is sometimes ours: a card can name its issuer in a document nobody had opened.

Cutting across the tiers is a "circumstantial" label for sponsors inferred from the program manager and not stated outright. Group counts in this article include those inferred bindings. Of the Rain group's 28 cards, 20 carry a verbatim naming of Third National or Rain and 8 are inferred from the rail; Table 2 prints both columns. The full 177-card comparison dataset is at sweepbase.net/dataset. The BIN-sponsor attribution specific to this piece is not in that file: it lives in the issuer directory, the tables here and the Sources section.

Concentration by region and product

The first instinct when measuring market concentration is to compute a Herfindahl-Hirschman Index across the whole market. For the 142 crypto cards obtainable at the end of September 2026, with Third National and Rain counted as one group, that calculation gives an index near 580. The May 2026 snapshot of 141 cards gave roughly 400 to 500. The US Department of Justice and the FTC treat an index between 1,000 and 1,800 as moderately concentrated and anything above 1,800 as highly concentrated, so anything under 1,000 is unconcentrated. Those are the lines of the 2023 Merger Guidelines; the older 2010 guidelines drew them at 1,500 and 2,500.

By this measure, the global crypto-card market is fine, as it was in May.

Two things before the numbers. First, we have card counts, not transaction volumes or cardholder numbers, so the primary measure here is a concentration ratio (what share of a segment's cards run through its single largest issuer group), not a true HHI. Second, where a familiar HHI-style index appears below, it is those same counts squared into the index antitrust uses. The DOJ's 1,000 / 1,800 bands are a yardstick for intuition, not a finding about market power, which would need volume data we do not have.

The aggregate number hides the spread, because crypto cards do not compete in a single market. A US dollar self-custody card issued out of Puerto Rico and a Brazilian real card issued out of Buenos Aires are not after the same customer. Split the dataset into regions and product types, which is the choice a user faces when picking a card, and the readings land in all three bands. The self-custody segments are highly concentrated. The lists of cards open to residents of the US, Latin America, Asia and Canada sit in the moderate band or on its upper line. The broad European list is as unconcentrated as the whole market.

US self-custody and stablecoin cards

Most of the recent product launches have happened in this segment. At the end of September 2026 it holds 16 cards, among them Ether.fi Cash, Tangem Pay, Phantom Cash, Tuyo, Avalanche Card, Hyperbeat, Plasma One and Fuse. The sponsor can be identified for 15 of the 16. The Rain group is behind 11 of those and Lead Bank behind five, with Solid counted under both. The May snapshot counted roughly 22 cards here; by August the count was 16, with Cypher and Moonwell among the departures.

Two groups anchor almost every card in the segment. The first is the Rain group. Third National is named as issuer in the card terms of five: Ether.fi, Solid, Tuyo, Hyperbeat and Xplace. Rizon, Plasma One and Tangem Pay name Rain itself, and Avici, Avalanche and Exa are attributed from the shared rail. (Spritz, a hybrid-custody card outside this segment, names only "Rain" in its terms, which leaves the issuer inferred.)

Rain's own site no longer names an issuer. Its footer says: "Cards are issued through partners licensed in their respective jurisdictions. Banking services are provided by SSB, Member FDIC." The wording "issued by Third National" comes from the card terms of Ether.fi, Hyperbeat and Solayer, and Rain's privacy policy lists Third National inside the group. Third National is the trading name of Nimbus LLC. Its licence disclosure at third-national.com names it a Puerto Rico money transmitter (NMLS #2612780, licence TM-0207), which is not a bank charter. An earlier description of it as a Tennessee state-chartered bank was wrong.

The May snapshot rested on weaker evidence. When first published, the text named three cards carrying Third National in their terms: Cypher, Solayer and Tangem Pay. (Tangem Pay's page was later found to name Rain itself, leaving two.) On the other cards built on top of Rain, roughly thirteen of them, Third National was the implied but not publicly named issuer. Rain is the Visa Principal program manager that contracts directly with it. That brought the footprint to around seventeen of the twenty-two (all of these numbers are approximate). Ether.fi Cash was in that circumstantial group then, and names Third National in its own terms now.

In July 2026 the pattern started to shift. Plasma One's June 2026 terms, Jupiter's card docs and Tangem Pay's page named Rain itself as the issuer, the first Rain-rail programs to skip the Third National layer. (Jupiter has since left our self-custody category.) The concentration did not ease: all three stayed on the same Rain rail, so for them the bottleneck moved from Third National to Rain itself. The same month brought a second shift. Cypher, then one of the two cards still naming Third National verbatim, announced on 8 July 2026 that it was winding down after its acquisition by Nium. Card loading had already stopped, and 7 August 2026 was the last day its cards worked for purchases.

The second group is Lead Bank, a Missouri state-chartered bank. Three cards in this segment name it verbatim in their cardholder agreements: Phantom Cash, Fuse and Exodus. Solid and Decaf are attributed to it by inference. Wayex and Airtm name it too, and sit outside the segment. All five that name it are on Bridge, the program manager whose acquisition Stripe closed on 4 February 2025.

Lead Bank's footprint is wider than our catalogue. On 30 September 2026 Bridge's site carried 26 cardholder agreement pages (Airtm and Fuse each have two), and every one names Lead Bank as the issuer. Besides the five above they cover El Dorado, Gate's US card, Remitly, Sendwave and Chipper Cash, among others. Kraken's US Krak card reaches the same bank through a second Stripe door: its terms, dated 3 August 2026, say "The Card is issued by Lead Bank pursuant to a license from Visa U.S.A. Inc." and name Stripe, LLC as program manager, with no mention of Bridge. Bridge also holds a preliminary conditional approval from the OCC, dated 12 February 2026, for a national trust bank limited to trust activities. It has not changed who issues the cards: all 26 agreements still say Lead Bank.

At the end of September 2026 fifteen of the sixteen brands funnel down to two groups, which between them are three issuing entities: Third National, Rain and Lead Bank (Figure 1b). In May the same funnel held roughly twenty-two brands.

On a count basis the segment's index is about 5,800, more than three times the DOJ line for "highly concentrated". Across all 31 self-custody cards in every region it is about 3,500, with the Rain group behind 17 of the 28 whose sponsor can be identified. The May figures gave about 6,300 for the US segment, on 22 cards. If the issuing arrangements of Third National and Rain were suspended or restricted (there is no public indication that they will be), most US self-custody crypto cards would wind down at once.

Update, 20 July 2026: five cards stopped, none because of the issuer

By 20 July, five of the sixteen cards we then attributed to Third National had stopped taking cardholders (sixteen was the count in our issuer directory in July; the May estimate for the same node was about seventeen): Cypher and Moonwell on 8 July (existing cards kept working until 7 August), Offramp on 1 July, Pyra on 15 June, and AmpBlack, whose app was discontinued in early May before the card ever reached customers. Roughly a third of the node, inside two months. That is the sort of number this article was built to anticipate.

Third National caused none of the five. Pyra wound down after the Drift protocol exploit. Offramp closed commercially. AmpBlack's parent retired its app. Cypher was acquired by Nium and shut its platform, and Moonwell (a white-label built on Cypher) went down with it, posting its own notice on X on 9 July, the day after Cypher closed applications. The issuer did nothing. Its arrangement was never suspended or restricted, and the cards died for reasons unrelated to the licence they shared.

So the concentration risk did materialise, one layer above where we pointed. The failure that took two brands at once came from the program layer, not the issuing layer: a platform wound down and its dependents had no say in it. Counting cards per issuer measures a real bottleneck and under-counts the fragility, because a brand can also lose its card when the company operating the program between it and the issuer changes hands. Moonwell did not choose Cypher's acquirer, and its notice to users came a day after applications had already closed.

The single-issuer figure is still the right measure of what a supervisory action against Third National would do. It is also only a floor on how many ways a card on this rail can end: the failures so far have all come through the other doors. We track the cascade record separately in our shutdowns research.

Update, 30 September 2026: the rail itself had an incident

On 28 August 2026 the shared-infrastructure risk showed up in a form this article had not described: a contract, not a license. Rain said its monitoring had found "a vulnerability impacting a small number of programs using an outdated version of our Solana contracts". An attacker had drained card collateral from users of several programs at once. Avici counted 1,685 users and $500,859. Tria counted 636 users and $431,945. Blockaid, a security firm, put the total at roughly $1.1 million and reported Solayer Pay as affected too, which Solayer has not confirmed. Jupiter's card partner briefly paused card-balance withdrawals, and Jupiter says none of its accounts was affected.

The damage was contained fast. Rain upgraded every program on the old contract the same day and wrote the next day: "All cardholders impacted in yesterday's incident have been repaid in full." Avici said Rain covered the reimbursements. We found no card brand that left the rail over it. Rain also said outside forensics and law enforcement were engaged. A month on, it has published no post-mortem, no loss total and no count of affected programs. The figures above come from the brands and from two security firms, and the two firms count differently. Blockaid describes four deployments of the contract, at least two of them drained. Verichains counts 25 deployments with the same flaw, four of them drained, and says almost all the money came from two.

The brands that were hit had separate apps, separate terms and separate customers, and they shared code none of them wrote. That is the dependency the card counts measure, reached through a door the counts cannot see: a group of cards can share an issuer, and some of them also share a contract. The group is larger than our catalogue, too. Rain said in September that it runs "130+ live programs", against "more than 100" in June. Western Union announced a card on Rain in August and MoneyGram's went live in Colombia in September. We track 28.

A caveat on the largest number in the piece, as it reads in September. When this article was first published, the text named three US cards carrying Third National in their terms (Cypher, Solayer and Tangem Pay), and the "~17 of 22" rested on circumstantial Rain attribution, not on seventeen separate cardholder agreements. Tangem Pay's page was later found to name Rain itself, leaving two, and Cypher's cards stopped on 7 August. Attribution passes since then have read more agreements end to end. At the end of September 2026 fourteen obtainable cards name Third National verbatim and six name Rain itself. Inside the US self-custody segment, eight of the Rain group's eleven cards carry a verbatim naming and three are inferred from the rail. The six Lead Bank cards in the appendix are documented separately. On the European side, Monavate is named verbatim on seven obtainable cards in all, but on only two of its four cards in the EU/UK self-custody segment (MetaMask and MiniPay; Exodus's own card and Rebind are inferred). So the US claim is now the better-documented one, which reverses what this paragraph said in June.

EU and UK self-custody cards

At the end of September 2026 the EU/UK self-custody segment stands at 16 cards, 14 of them with an identifiable sponsor. Five are on the Rain group, four on Monavate (MetaMask, Exodus's own card, Rebind and MiniPay), three on Lead Bank through cards whose US side it issues (Solid, Exodus, Decaf) and two on Unlimit EU (Table 1). Of those two, Bleap names Unlimit EU in its terms; Holyheld's terms no longer name an issuer, though they did earlier in 2026. MetaMask has paused new sign-ups in the UK and the US since June 2026, so in the UK it cannot currently be ordered. The index is about 2,300. That is still above the 1,800 line on a count basis, but the segment is small enough that one card moves the reading a lot, and no sponsor has anything like a lock on it.

In the May 2026 snapshot the European side looked even more concentrated than the US: around 12 cards, about 10 of them on one sponsor, for an index above 7,000. That sponsor was Monavate. The cardholder agreements of Gnosis Pay, OKX EEA and Krak (Kraken's spending card, UK and EEA) name Monavate as the sponsor. Ledger's CL Card (EU side) and 1inch rest on the shared Crypto Life (Baanx) disclosure. Monavate Limited is a UK FCA-authorised e-money institution; UAB Monavate, in Lithuania, issues the EEA side. In May this article described both as subsidiaries of Monavate Holdings Ltd., part of W3C Corp. The record on the Lithuanian entity is less clear than that, as the ownership paragraphs below explain. The first card on that list has closed: Gnosis Pay stopped taking card sign-ups on 30 September 2026, and its formal notice of 21 September says the card and web app stop working on 20 December 2026. Partner cards on the same infrastructure, Rebind and MiniPay, carry on.

The May reading broke by August. Re-measured against the live catalogue on 12 August, the EU/UK self-custody segment stood at 24 cards, 21 of them with an identifiable sponsor, and Monavate covered 6, one fewer than the Rain group. On 25 September a re-read of card terms moved the Ledger CL Card, xPortal and Jupiter out of our self-custody category (each keeps the card balance with the card provider, not in the wallet) and rewrote region fields for other cards. With Gnosis Pay closed on 30 September, the segment came to the 16 cards described above (Table 1b). The Monavate attributions above stay correct card by card.

On 24 November 2025, Exodus Movement Inc. announced a definitive agreement to acquire W3C Corp for $175 million. It did not close on those terms. After Exodus sued to force completion and called the loans it had already extended, UK receivers were appointed over W3C's operating subsidiaries, and on 1 May 2026 Exodus completed the takeover through them for $76.27 million, the exact balance owed on its loans, with a separate $30 million purchase of Baanx US Corp and certain other assets, payable over four years. The parties agreed to dismiss the Delaware suit under the same agreement. (The mechanics are in the Sources note; buying out of a receivership with your own debt and the original negotiated stock purchase are not the same kind of transaction.)

What Exodus bought is narrower than this article said until September 2026, and the record on the Lithuanian entity is mixed. Exodus's 10-Q for the second quarter of 2026 lists the acquired entities as Monavate Holdings Limited, Monavate Ltd, Baanx.com Ltd and Baanx US Corp. UAB Monavate, which issues the EEA cards, is not named. On the August earnings call Michael Rolph, Monavate's chief executive, said: "Whilst Monavate UAB was not part of the Exodus transaction, it is important context." Against that, the BNS report of 4 December 2025 cites Lithuanian registry data showing Monavate Holdings Limited as owner of 100% of UAB Monavate's shares, and Monavate Holdings' audited accounts, which Exodus filed in July 2026, say the company disposed of its investment in UAB Monavate on 31 October 2025 for £768k without naming the buyer. The UK sponsor belongs to Exodus. By Monavate's own account the EEA sponsor was not part of the deal. The public record does not say cleanly who owns it today.

UAB Monavate has also been under supervisory restriction since late 2025, which the earlier versions of this article missed. The Bank of Lithuania fined it 270,000 euros for anti-money-laundering failings and told it, until further notice, not to take on new intermediaries or distributors through which cards are sold (BNS, 4 December 2025). A second instruction, which took effect at the end of December 2025, barred it from serving six named partners, among them Kulipa, Brighty and Immersve UK. On the August call JP Richardson, Exodus's chief executive, described "Monavate's inability to issue new cards for new clients in Europe", said the issue "was known at the time of our purchase" and said Exodus is "on track to establish a new issuing arrangement during the fourth quarter". That arrangement runs through the purchase of a Latvian-licensed institution, which needs the Bank of Latvia's non-objection (Exodus's 10-Q, subsequent events). We have found no notice lifting either instruction. Kulipa, one of the six, stopped supporting its partner cards seven months later (Table 3); no source we have read connects the two.

A self-custody wallet brand now owns the UK sponsor its rivals' cards run on. Monavate Limited issues the UK side of Krak, Kraken's spending card, and on its first-quarter call Exodus listed MetaMask, Ledger, Kraken and OKX among the relationships the deal brought. By Monavate's own account the EEA sponsor was not part of it.

The regulatory trouble was reported, in the Lithuanian press and in a Wirex blog post that named all six partners. The ownership angle has gone almost entirely unreported. We found no competition-authority review and no trade-press treatment of a wallet brand owning the issuer of competing wallets' cards. Two things may explain that: the parent-subsidiary structure is opaque from the outside, and the final purchase price was small next to typical antitrust thresholds.

Cards open to US residents

The two segments above are product slices. The rest of this section reads the catalogue by availability: every card a resident of a region can order, wherever it is issued.

Forty cards in our catalogue are open to US residents, and the sponsor can be identified for 35 of them. The Rain group is behind 15 of those, 43%, and Lead Bank is behind six. The index is about 1,800, just over the line where the DOJ band turns to highly concentrated. This list is wider than the self-custody segment: it adds every card a US resident can order that is not self-custody, and it reads far lower than the 16-card self-custody segment. The May snapshot did not measure this list.

Cards open to Europe or the UK

Sixty-nine cards are open to residents of Europe or the UK, the longest list of any region, and 53 have an identifiable sponsor. The Rain group and Monavate are behind nine each, 17% of the identifiable cards apiece. Wirex is behind six and Wallester five. The index is about 600, in the unconcentrated band and close to the reading for the whole market. This is the one regional list where no group leads. The concentrated part of Europe is the self-custody segment described above. The May snapshot did not measure this list either.

Latin America

Fifty-nine cards are open to residents of Latin America, and 44 have an identifiable sponsor. The Rain group is behind 19 of those, 43%. Lead Bank follows with six, Monavate with five, and Wirex and Pomelo with four each. The index is about 1,400, in the moderately concentrated band. Fifteen of the 59 have no sponsor we can identify. The home-market sponsor is Pomelo, an Argentine BaaS provider, on four cards. The largest single block in the list runs on a rail based in New York and Puerto Rico.

The May snapshot counted something narrower: six cards native to the region, three of them on Pomelo (Lemon in Argentina and Peru; Ripio in Argentina), with Bitso's Mexican card already discontinued in May 2025 per Bitso's own support FAQ. That hand-built count gave an index of roughly 3,900 and is not comparable with today's list.

Asia

Fifty-one cards are open to residents of Asia, and 37 have an identifiable sponsor. The Rain group is behind 16 of those, 43%, and Wirex and DCS Card Centre are behind four each. The index is about 1,300, in the moderately concentrated band. Fourteen of the 51 have no sponsor we can identify. The home-market sponsor is DCS Card Centre, the former Diners Club Singapore, which sponsors Decard, MEXC's APAC card, Coin98 Fusion and the APAC side of Jupiter. StraitsX and Reap are the other issuing members in Singapore and Hong Kong, where the visible home-market concentration sits.

The May snapshot counted about ten cards native to the region, most of which did not name their sponsor on any public page, and put the visible part at an index of about 3,500. It is not comparable with today's list. The transparency deficit it described has not gone away.

Canada

Twenty-two cards are open to Canadian residents, and 14 have an identifiable sponsor. The Rain group is behind five of those, 36%. Monavate is behind three, and Cross River and Peoples Trust behind two each. The index is about 1,100, in the moderately concentrated band. Eight of the 22 have no sponsor we can identify. The home-market sponsor is Peoples Trust Company, on the two Canada-only cards in our issuer directory, Shakepay and Wealthsimple. Both name Peoples Trust in their own terms, so a buyer choosing between them is choosing a brand, not a sponsor.

The May snapshot counted those two Canadian cards alone, both on Peoples Trust, which read as a monopoly on a sample of two. It is not comparable with today's list.

The top sponsors

Table 2 ranks the sponsors by attributed card count, with the verbatim count beside the total that includes circumstantial attribution. It leaves out Foris Group, which holds four regional licenses for Crypto.com's own cards (UK, EU, Australia and Singapore) and is the rare crypto company that sponsors itself. It is one card in our catalogue, so it does not rank.

The cast is the same in every region, whatever the band. A few mid-size issuers do most of the issuing, and no megabank is involved. Public discussion of "crypto card competition" treats the front-of-card brands as substitutes. Often two brands are two skins on the same regulated entity.

Sponsor failures that took cards down together

The argument against caring about BIN sponsor concentration is that this is just back-office infrastructure. Banks fail, other banks pick up the cards, the brand on the front of the plastic absorbs the friction, and the user is mostly insulated.

History does not support this picture.

On 25 June 2020 Wirecard's management board announced its decision to file for the opening of insolvency proceedings in Munich, in the company's own ad hoc announcement. Its UK subsidiary, Wirecard Card Solutions, issued the cards of Crypto.com, TenX and Cryptopay. The next day the FCA froze Wirecard Card Solutions' regulated activity to protect safeguarded funds, and it lifted the restriction on 30 June. Crypto.com's cards were off for those four days and were then reactivated. Curve, ANNA, Pockit and Soldo were caught in the same freeze. The programs were left to find new issuers.

The other early cases vary in speed and reach. Metropolitan Commercial Bank's January 2023 exit from crypto ended BitPay's prepaid Mastercard, which has not been replaced (BitPay's product list no longer mentions a card), and pushed Uphold's US card onto Cross River, where it still is. The Bank of Lithuania's revocation of UAB PayrNet in June 2023 stopped Cryptopay's EU card. Union54's Mastercard suspension in 2022 did something more lasting than any single migration: after it, African and LatAm operators became reluctant to name their sponsor on public pages at all, which is why the transparency deficit in those regions reads as structural, not accidental. Modulr is the mild end. Its 2024 accounts say it "ceased active marketing" to crypto, remittance and consumer-banking clients, as Tech.eu reported in September 2025, and it still has some crypto clients. No card stopped.

Then Quicko, in January and February 2026. KNF revoked the license on 21 January. IN1's card payments went off that day, by its own notice of 22 January; CEX.IO and Trustee Plus stopped processing on 3 February. The wind-down deadline was 30 April 2026, and on 28 August KNF upheld the revocation and called the decision final. CEX.IO's notice still says it is working on a new card partner and names none. The KNF notices are in Polish, the CEX.IO and Trustee Plus support announcements are in English and unambiguous, and the dates line up.

Quicko was one of five such events in the eight months from December 2025 to July 2026. A supervisory instruction to UAB Monavate in December 2025 had already cut off six of its partners. The Bank of Lithuania revoked Paytend Europe's license with effect from 3 March 2026, which took down the BingX card and Bit.Store's physical card; BingX came back on 11 September as a Visa provided by Wirex. In July, Fiat24 stopped taking new clients, and seven card programs that share its Swiss license closed to new applicants within two weeks. It calls the pause temporary, and its site still said on 30 September that it is not accepting new applications. At the end of the month Kulipa, a French program manager, stopped supporting its partners: Solflare's cards "stopped working today, 28 July 2026", in Solflare's words, and Ready's co-founder wrote the next day: "We were given no notice". Solflare's co-founder attributed it to solvency problems; Kulipa's chief executive has said the company is not insolvent.

In none of these cases did the card brand fail first. Something upstream of it did, and in most of them the cards stopped or closed to new customers anyway.

The customer-facing brand absorbs the support load and, if it survives, migrates to a new sponsor at real operational cost. If it does not survive, the product disappears and the customer balance can end up as a creditor claim in whichever jurisdiction the sponsor was wound up. That is the worst case, not the usual one, as the next section explains.

What happens to your money

The phrase "creditor claim" needs a caveat, because it is the part most likely to push a reader to the wrong conclusion. In most of these cascades the customer did not lose the money. They lost access to it for a while.

In the EU and UK, the e-money institutions and program managers discussed here operate under safeguarding rules. Customer funds are held in segregated safeguarding accounts at a separate bank, not on the failed firm's own balance sheet, so they are not supposed to be reachable by its general creditors. In the UK the FCA's supplementary safeguarding regime took effect on 7 May 2026 and adds daily reconciliation, annual audits and monthly returns. Safeguarding is not deposit insurance, and access can still be frozen for weeks or months during an administration while a trustee reconciles balances. The starting legal position, though, is that the money is the customer's, not the estate's. In the United States, prepaid programs structured for it can carry FDIC pass-through insurance, but only against failure of the sponsor bank itself, only when the account is titled to pass through, and not against insolvency of the program manager or fintech sitting in the middle. That middle-layer gap is what stranded customer balances in the 2024 Synapse collapse.

The likely harm from a sponsor failure is loss of access, a forced migration to a new card, and a balance frozen during wind-down. The rarer harm is a real shortfall, which is what happens when safeguarding was done badly. Wirecard's UK arm was the first kind. The FCA froze Wirecard Card Solutions' regulated activity from 26 to 30 June 2020 to protect safeguarded funds and then lifted the restriction.

Why your bank card doesn't do this to you

Ordinary bank cards rest on sponsors and processors too. Your debit card runs through a card network, a processor, and an issuing bank, and most people could not name two of the three. Yet a Chase or a Barclays customer never lives through the Quicko experience.

Part of the reason is what sits at the bottom of the stack. A high-street debit card is usually issued by an insured deposit-taking bank, wrapped in a resolution regime built for continuity. When a US bank fails, the FDIC resolves it, and the standard route is a purchase-and-assumption: a healthy bank takes on the failed bank's deposits and accounts, and the regulator's stated aim is continuity for the failed bank's customers (Congressional Research Service overview). In the cleanest cases access is preserved over a single weekend. (The FDIC's own materials describe customer continuity as the goal of a P&A; they do not separately promise that every card program keeps running, so read this as the resolution regime's intent, not a guarantee for any one card.) Card portfolios also change hands in an orderly way outside of failure: issuers buy and sell card books as routine transactions, and cardholders are carried across, not cut off.

The crypto cards in this article mostly do not sit on insured deposit banks. They sit on e-money institutions and payment institutions, which hold customer money under safeguarding rules, not deposit insurance. No resolution regime lines up a successor when one of them loses its license. When the KNF withdrew Quicko's authorisation, no regulator arranged a new sponsor, ported the balances, or guaranteed continuity. A licence revocation for cause is a messier event than an insured-bank failure even in traditional finance: the licence is pulled, and the cards built on it stop. The plumbing is the same, with no equivalent of the FDIC standing behind it. The orderly-transfer machinery that can make a bank failure nearly invisible to cardholders does not exist for a payment institution's BIN-sponsorship book.

Arguments against reading too much into this

Most of the concentration identified here is at small or mid-sized institutions. Third National, Lead Bank, Monavate, Wallester, Cross River, Pomelo and the rest are not systemic; none is too-big-to-fail in any country. The risk of any single one of them failing in a given year is not zero, but it is not catastrophic either. Wirecard and Quicko are at the tails of the distribution, not the median.

The highest readings also rest on the smallest samples. The two highest regional readings, US and EU/UK self-custody, rest on sixteen cards each, so one card changing sponsor moves the index a lot. The all-regions self-custody reading rests on 31. The availability lists are larger, from 22 cards for Canada to 69 for Europe and the UK, and they read lower: Latin America, Asia and Canada sit in the moderate band, the US list sits just over the 1,800 line, and the list for Europe and the UK is unconcentrated.

Concentration also enables things. A specialised crypto-friendly sponsor can build internal compliance tooling that a generalist bank cannot. Lead Bank, Third National and Cross River have repeatedly approved stablecoin-funded card programs, which is part of why stablecoin spending has scaled at all. If the market were spread evenly across two hundred sponsors that each understood crypto poorly, approving a program would cost more and take longer.

The transparency deficit cuts both ways. For a consumer, knowing your sponsor matters because it tells you which regulator has jurisdiction if something goes wrong. For an operator, hiding the sponsor reduces the risk of a Union54-style contagion, where one fintech's fraud problem closes the sponsor for all other fintechs.

The Exodus / Monavate deal puts a sponsor under a wallet brand, and it may also improve the product: vertically integrated wallet-and-issuer stacks can ship faster than two-party joint ventures, though that is an expectation this dataset does not measure. Whether the trade is good depends on whether you weight market structure or user experience.

None of this changes the underlying observation: the crypto-card market looks competitive at the front end, and the back end is much more concentrated than that suggests. The re-counts since May do not move in one direction. The largest node grew each time, the group that names no sponsor grew and then eased, and the EU/UK segment spread out.

For anyone shopping for a card, sponsor concentration is a tail risk. It bites on the rare day a regulator acts, not on an average Tuesday. The cost you pay every time you tap is the crypto-to-fiat conversion spread and the FX markup, which we break down in our guide to hidden FX fees. A sensible reader weighs both, and usually weighs the everyday cost first.

The exposure is easier to manage than to measure. Find out who holds your balance and which regulator would step in if the issuer failed; the better cardholder agreements say so plainly, and the ones that bury it are telling you something too. Treat the card as a way to spend, not a place to store value, so a wind-down freezes a small float instead of your savings. And if real money runs through your cards each month, avoid routing all of it through one sponsor. Quicko took down three unrelated cards in a fortnight, with a fourth brand on the same license surfacing months later. A second card on a different rail is the cheap protection against that.

Regulators and networks have a modest fix available. Much of the disclosure problem in this article is self-inflicted: the sponsor and its regulator are already named in a contract somewhere, buried in an appendix or a PDF generated at the end of the application flow. A rule requiring program managers to name the BIN sponsor and its home regulator on the first screen of the cardholder agreement, the way a fund must name its custodian, would let a buyer see the concentration this piece had to reverse-engineer, and let a user who already holds the card know which regulator to watch before anything goes wrong. Disclosure is not a cure: mandated terms still get buried, and a "first screen" rule would face the usual UX and legal pushback. But it forces no one to diversify, only to disclose, and it would at least have given a Trustee Plus user more than a Polish-language notice they were never going to read.

Appendix: the cards the first edition documented by hand

The first edition of this study documented these cards by hand. They are listed here with the disclosure each attribution came from and the card's status today, together with two Lead Bank cards added in September 2026 (the US cards of Exodus and Kraken). Per-card attribution for the whole catalogue lives in the issuer directory. Each row carries its own read date. "Re-fetched" or "Read" with a date means the disclosure was confirmed at the primary source on that date. "Named, not re-fetched" means the attribution is from the card's agreement but was not independently re-pulled in this pass. "Secondary" means the attribution rests on a shared program-manager disclosure, not on the card's own terms.

Reader questions on sponsors, concentration and failures

Sources and notes

1. Wirecard insolvency: the company's own ad hoc announcement of 25 June 2020: "The management board of Wirecard AG has decided today to file an application for the opening of insolvency proceedings". The freeze on Wirecard Card Solutions: the FCA, which imposed requirements on 26 June 2020 and lifted the restriction at 00.01 on 30 June 2020.
2. Quicko licence revocation: Poland's KNF (21 January 2026). CEX.IO customer notice at support.cex.io/en/articles/13460417; Trustee Plus shutdown announcement, late January 2026.
3. Monavate authorisation: UK FCA register, FRN 901097. UAB Monavate is authorised separately by the Bank of Lithuania.
4. Exodus / W3C: definitive agreement announced 24 November 2025 ($175M); suit against W3C and Garth Howat to compel completion filed in the Delaware Court of Chancery 13 April 2026, which the parties agreed to dismiss with prejudice under the 1 May agreement; closing through UK receivers announced 1 May 2026 ($76.27M, the principal and interest outstanding on Exodus's loans, for Monavate Holdings and Baanx.com; $30.0M for Baanx US Corp and certain other assets in four instalments over four years, none contingent on performance; a $10.0M loan to Mr Howat forgiven). Acquired entities per Exodus's 10-Q for the second quarter of 2026: Monavate Holdings Limited, Monavate Ltd, Baanx.com Ltd and Baanx US Corp; the same filing's subsequent-events note covers the Latvian purchase. "Monavate UAB was not part of the Exodus transaction" and the European issuing constraint: Exodus's second-quarter earnings call, in the transcript published 19 August 2026, a third-party transcription. Against that: Lithuanian registry data showing Monavate Holdings Limited as owner of 100% of UAB Monavate's shares is cited in the BNS report of 4 December 2025 (the LRT link in the next note), and the disposal of the investment in UAB Monavate on 31 October 2025 for £768k is in Monavate Holdings' audited accounts, an exhibit to the 8-K/A Exodus filed in July 2026. MetaMask, Ledger, Kraken and OKX as relationships the deal brought: Exodus's first-quarter call, in a third-party transcript.
5. UAB Monavate supervision: 270,000 euro fine and the instruction not to take on new intermediaries or distributors, BNS via LRT (4 December 2025). The instruction naming six partners is a Bank of Lithuania notice that we could not open directly (the site blocks automated readers); the six names are corroborated by Wirex's post, and search extracts of the notice give 29 December 2025 as the date it took effect.
6. Quicko, final decision: KNF communiqué of 28 August 2026 (“Decyzja jest ostateczna”). PayrNet, Paytend, Fiat24 and Kulipa: sourced card by card in the shutdowns dataset. Modulr: Tech.eu, 12 September 2025, on Modulr's 2024 accounts. Bitso's Mexican card discontinuation per Bitso's support FAQ, May 2025.
7. Lead Bank: the 26 agreement pages are those under bridge.xyz/card-agreements, read 30 September 2026. Krak US terms: Issuing Bank Terms, Lead Bank Krak Card, last updated 3 August 2026. Bridge National Trust Bank: OCC Corporate Decision #1365, 12 February 2026, preliminary conditional approval.
8. Concentration thresholds: the US DOJ and FTC 2023 Merger Guidelines, § 2.1, as summarised on the DOJ's HHI page: “between 1,000 and 1,800 points to be moderately concentrated” and “in excess of 1,800 points to be highly concentrated”. Earlier versions of this article used the 1,500 and 2,500 bands of the 2010 Horizontal Merger Guidelines.
9. Rain contract exploit, 28 August 2026: Rain's statements of 28 August and 29 August; Avici and Tria for their own counts (the Avici link is its refund update; the user and dollar counts are from Avici's 28 August update, quoted in the linked post); Jupiter Mobile; analyses by Blockaid (2 September) and Verichains (7 September, $1,118,597 from 2,682 vaults). Program count: Rain, September 2026.
10. Union54 BIN suspension: problems began in May 2022 and the card API was shut on 18 July, per Union54's client memos; we found no public Mastercard statement. As reported: African fintechs halted USD virtual cards after a chargeback-fraud surge on Union54's Mastercard BIN, July 2022, per TechCrunch.
11. Synapse collapse: the 2024 failure of the Synapse banking-as-a-service intermediary froze fintech customer balances and exposed the program-manager gap in FDIC pass-through coverage, per TechCrunch.

Every table and figure in this article is an end-of-September 2026 reading, taken after Gnosis Pay closed to new sign-ups. There are three exceptions: Table 4, which is a historical selection; the appendix, where each row carries its own read date; and the dated history lines, meaning the May and August columns of Table 1b and the comparison sentences in the text. The cascade record (Table 3) was re-checked against its sources the same day. The Sources section lists the primary records behind the cascade events and the deal timeline. Per-card sponsor names come from each card's own cardholder agreement where it names one, and from the inferred bindings in the issuer directory where it does not. The safeguarding and FDIC passages are general regulatory background, not card-specific guarantees. Figures credited to a named outlet or filing are cited inline.

This is independent research, not financial advice. Sweepbase's affiliate relationships are listed on our disclosure page.

Changelog. v3.11 (30 September 2026): full refresh. The segment counts, the sponsor ranking and the disclosure tiers were re-run on the 142 cards obtainable once Gnosis Pay had closed to new sign-ups (Rain group 28 cards and about 20%, against 23 and 16% in August; tiers 78, 23, 38 and 3; US self-custody 16 cards with the Rain group on 11 of 15 identifiable; EU/UK self-custody 16 cards with the Rain group on five and Monavate on four). Table 2 now shows the September ranking in place of the May one, and a short section reads Latin America, Asia and Canada by availability. Corrected the ownership of Monavate: Exodus acquired the UK entity and its holding company, and by Monavate's own account UAB Monavate, the EEA issuer, was not part of the transaction; the pull-quote that said one wallet brand owned the sponsor behind five EU rivals is withdrawn. Added the Bank of Lithuania measures against UAB Monavate from late 2025, which earlier versions missed. Table 3 went from six events to ten: PayrNet (2023), the Monavate instruction, Paytend, Fiat24 and Kulipa were added, Quicko gained the final KNF decision of 28 August, Modulr was re-dated to 2024 and Union54 to May-July 2022, and the Moorwand row was removed because no source for a 2023 exit could be found. Added the Rain contract exploit of 28 August. Lead Bank: Bridge now publishes 26 agreement pages naming it, and the US cards of Kraken and Exodus were added to the appendix and to the issuer directory. The Exodus deal terms in the Sources note were corrected ($30.0M for Baanx US in fixed instalments, not $5M plus up to $25M deferred). A second pass the same day corrected the BitPay date in the lede, the Rain deployment counts, the event counts around Table 3, and the ownership of UAB Monavate, where the record is mixed and is now printed as such. The recount was re-run on 142 cards after Gnosis Pay was flagged closed. Figure 1b was redrawn for the end-of-September segment (it had shown the May funnel). Table 1 and Figure 2 now show the end-of-September reading for nine segments, and the May table is reduced to a comparison in Table 1b. The regional sections are read by availability, which puts the lists open to Latin America, Asia and Canada in the moderately concentrated band and the list open to Europe or the UK in the unconcentrated one. A final pass the same day followed changes in the issuer directory: Solid is counted under Third National, which its card terms name as the issuer; Trustee is attributed to Wirex Limited, which its card page names; and Holyheld moved to the inferred tier, because its terms no longer name Unlimit EU. That pass also corrected the Wirecard account (the FCA froze Wirecard Card Solutions from 26 to 30 June 2020; the list of affected programs is now seven, after three that Contis issued were removed), replaced the Phantom Cash quotation with the agreement's own wording, and relabelled the appendix as the first edition's record. v3.10 (25 September 2026): after a re-read of card terms, noted that Utorg's card went offline on 9 February 2026 and came back as a USD Visa provided by Wirex Limited, dropped Morph from the DCS Card Centre list (Morph never issued its card), corrected the Ledger CL EU-side network to Mastercard in the appendix, and recorded that the Ledger CL Card, xPortal and Jupiter left our self-custody category. The August segment counts were not re-run. The same day: the DOJ bands were updated from the 2010 guidelines (1,500 / 2,500) to the 2023 Merger Guidelines (1,000 / 1,800), which moves no segment across a line that matters here; the non-crypto HHI examples, which had no source, were removed; Fiat24's licence is recorded as having no card open to new applicants, since UR and Zoomex share it; Gnosis Pay's wind-down is noted; the BitPay and Cryptopay rows of Table 4 were corrected to their closure dates; and the Table 1b caption no longer calls the rail group the only like-for-like figure that grew. v3.9 (12 August 2026): the two regional segments were re-measured against the live dataset instead of the May attribution, using the region predicates as they stand after a 10 August fix to how exclusion clauses are parsed (“US Persons excluded” had been read as availability in three separate places). Table 1 is unchanged and now carries its May 2026 date in the header; Table 1b holds the re-run. Two findings moved in opposite directions. US self-custody went from 22 cards to 16 (five Third-National-attributed programs stopped, and the stricter predicates moved the remainder), while the Rain group still covers 10 of the 14 cards there with an identifiable sponsor, so the concentration held while the segment contracted. EU/UK self-custody went from 12 cards to 24 (partly new programs, partly the re-measurement itself), and Monavate fell from about ten of twelve to six of twenty-one identifiable, which retires the “~83% on Monavate” headline; the Rain group is now marginally larger in EU/UK than Monavate. At the aggregate the like-for-like comparison is the grouped one, and it grew: the rail group went from ~17 cards to 23 (about 12% to 16%), while the Third National entity alone still reads 17 and 12%. The same pass removed the retired Monavate story from the EU/UK body, the Exodus pull-quote and the meta description, corrected an accessibility label still carrying a funnel figure corrected in v3.3, and fixed the “because five stopped” arithmetic that did not close. Separately, the three-tier disclosure count was re-run over the 140 cards obtainable that day and gives 73 verbatim, 25 inferred (now including rail-inference, unlike the May tier two), 40 naming nobody and 2 unmapped; the silent tier, which is like-for-like, grew from ~25 to 40 while the verbatim tier barely moved. v3.8 (20 July 2026): first check of the central claim against events, added as a new section in the US segment. Five of the sixteen cards attributed to Third National have now stopped: Cypher and Moonwell (8 Jul), Offramp (1 Jul), Pyra (15 Jun) and AmpBlack (app retired pre-launch). Each cause was checked individually and none of them was the issuer. The realised cascade came from the program layer instead: Cypher's wind-down after the Nium acquisition took its white-label Moonwell with it, with no separate notice to Moonwell users (corrected 21 September 2026: Moonwell posted its own notice on X on 9 July, the day after Cypher closed applications). The single-issuer concentration figure is therefore restated as a floor on how a card here can end. Snapshot tables are unchanged and remain a May 2026 reading. Also this day: the Utorg card's issuer was identified as Quicko from cl. 2.4.2 of Utrg UAB's own terms, which adds a fourth brand to the January Quicko cascade and removes Utorg and BingX from the "sponsor undisclosed" list. v3.7 (10 July 2026): propagated the v3.6 finding into the body. The US caveat and Table 2 now carry the current verbatim count for Third National (2: Cypher and Solayer, with Tangem Pay reclassified to Rain-as-issuer), the verbatim-subset index paragraph groups the Rain rail explicitly (arithmetic unchanged), and the title/subtitle now say "141 tracked programs" with the live count stated, matching the dataset's Discontinued flags. Same day, recorded Cypher's wind-down (announced 8 July 2026: acquired by Nium; loading already stopped, cards stop 7 August, platform closes 6 September). The live count was then 132, and one of the two verbatim Third National namings is exiting the market. v3.6 (7 July 2026): noted the first crack in the Third National funnel: Plasma One's June 2026 terms, Jupiter's card docs, and Tangem Pay's re-fetched page name Rain itself as the issuer ("issued by Rain, a Visa Principal Member"), so three Rain-rail attributions now resolve to Rain directly rather than Third National. The May 2026 snapshot figures are unchanged, and the concentration reading is unaffected because all three cards stay on the same Rain rail. Also corrected Rain's legal identity: Signify Holdings, Inc. of New York, doing business as Rain (older documents say Rain Liquidity). v3.5 (25 June 2026): confirmed Third National's identity as the trading name of Nimbus LLC, a Puerto Rico money transmitter (NMLS #2612780), not a bank and not FDIC-insured; replaced the "charter unconfirmed" hedge with the confirmed fact and removed a stray "issued out of Tennessee" geographic reference, after a full registry re-audit of every named issuer. v3.4 (23 June 2026): trim after a full math re-check (all concentration ratios, HHI-style figures, and verbatim counts reconcile). Removed only restated content: the counter-arguments small-sample paragraph (it repeated the Table 1 caption), a filler line, and the Exodus deal date/mechanism in the counter-arguments (already stated in the EU section). No fact, source, or argument dropped. v3.3 (23 June 2026): length trim (~6,800 → ~6,100 words) plus a math-correctness pass. Corrected the funnel's Lead Bank count (~6/22 → ~4/22, since 17+6 exceeds the 22-card segment), the EU/UK row (Monavate ~12/~100% → ~10/~83%, matching Monavate's ~10-card total), the US index (single ~6,300 instead of a denominator-mixing range), and the US caveat (it is Third National's count, not the whole segment, that leans on inference). Trimmed without dropping facts or sources: six cascade paragraphs condensed to two (Table 3 carries the rest), methodology compressed, the top-sponsor prose list removed (Table 2 covers it), the Exodus mechanics shortened (figures remain in the Sources note), the redundant "what the data is" section cut, and the brand-vs-entity figure removed (the funnel makes the point). v3.2 (23 June 2026): demoted the HHI to a count-native concentration ratio (share of a segment held by its single largest issuer) as the primary measure, with the HHI-style index kept only as a secondary, derived column; shortened the methodology caveat; added a caveat that the US "~17 of 22" reading rests on circumstantial Rain attribution while the EU/Monavate concentration is the best-documented; fixed a "two banks" phrasing to "two issuers" (Third National's charter is unconfirmed); condensed this changelog. v3.1 (23 June 2026): corrected the unverified "Third National = Tennessee state-chartered bank"; re-confirmed the Exodus price and the Lead Bank/Bridge and Monavate attributions at primary source; added the card-count caveat and a per-card verbatim-tier appendix; reframed the bank comparison to insured-bank-vs-EMI; removed false precision; replaced the Figure 2 bar chart with a conclusion-only contrast. v3.0 (23 June 2026): added a reconstructed intro timeline, bottleneck funnel (Fig 1b) and brand-vs-entity view (Fig 1c), the "why your bank card doesn't do this" section, and a disclosure proposal. Earlier history (v1.0, 18 May 2026, through v2.5) is condensed; the full log lives in the project repository.

About the author. Mihail B. runs Sweepbase, an independent crypto-card comparison and research project tracking 177 cards across regions, networks and BIN sponsors. New research is announced on his personal LinkedIn and the Sweepbase company page.