Actor

CBPII

Card Based Payment Instrument Issuer

The issuer of a card backed by an account held at another bank. Before each payment, it asks that bank a single question: "are the funds available?"

Definition

A CBPII (Card Based Payment Instrument Issuer) issues a payment card backed by an account held at another bank (the ASPSP).

Its PSD2 role is deliberately minimal: before each transaction, it asks the bank whether the funds are available. That's all.

CBPII vs PISP vs AISP

Three TPP roles, three very different scopes:

  • AISP — full reading of accounts (balances, history).
  • PISP — triggering a transfer from the account.
  • CBPII — a simple yes/no check of fund availability, in the context of a card payment that it has itself issued.

The CBPII does not see your history and makes no transfer: it just asks your bank a closed question, each time its card is used.

What a CBPII can do

  • Issue a card (physical or virtual) linked to an account held at another ASPSP.
  • Ask the ASPSP, transaction by transaction, whether the balance covers the amount.
  • Receive a binary answer (funds available: yes / no), with no detail of the balance.

What a CBPII cannot do

  • See the exact balance or the transactions (the AISP's role).
  • Initiate a transfer (the PISP's role).
  • Store the answer for future use: the check is one-off.
  • Operate without a licence or without the PSU's explicit consent.

In the PSD2 ecosystem

The CBPII is a very specific case: it only makes sense if the issued card is not backed by its own account — otherwise it does not need PSD2 to query its own data.

Real-world examples

  • Multi-account card — Curve: the emblematic example. In store, at the moment of payment, Curve queries the bank you chose (BNP, Revolut, N26, etc.) to check the funds, then debits it via the card network. Curve acts as a CBPII.
  • Corporate cards: some B2B fintechs issue employee cards backed by the main business account (Qonto, Shine) and use the CBPII status to check the funds before each spend.
  • "Challenger" cards with no account of their own: a few issuers prefer to avoid bank status and rely on the CBPII plus a Visa/Mastercard partnership to attach a card to the customer's existing account.
  • Worth noting: it is by far the least common TPP status — highly constrained, whereas most players prefer to issue their own accounts (EMI or PI).

See also: STET handbook

Sources

Go deeper

From the blog

Longer reads to go beyond the definition.

April 7, 2026
technical

Technical architecture of a PSD2 API: what to know before writing the first line of code — Read more

A technical overview of PSD2 for CTOs, developers and technical PMs: API standards, security (mTLS, eIDAS certificates), OAuth2, SCA flows, consent management, implementation pitfalls.

April 6, 2026
regulation

Understanding PSD2: what it changes for your customers and your business — Read more

Everything an executive, a product manager or a business team needs to understand about PSD2. Players, consent, opportunities, without technical jargon.