How Visa Processes a Transaction in Milliseconds
How Visa Processes a Transaction in Milliseconds
Every time you tap, swipe, or click "Pay" with a Visa card, a message travels across VisaNet — Visa's global payment network — and back in under two seconds. At any given moment, VisaNet is simultaneously handling thousands of these transactions from every corner of the world. Visa's infrastructure processes over 65,000 transaction messages per second at peak capacity, across 200 countries and territories, around the clock.
How does Visa actually process a card transaction? What happens technically between the moment you tap and the moment the terminal says "Approved"? This guide traces the full journey — from the physical card tap to the authorization message, the role of VisaNet, how Visa handles issuer downtime, and how Visa makes money from all of it.
Visa's Role in the Payments Ecosystem
First, a clarification that confuses many people: Visa does not issue credit cards and does not lend money. When you have a Chase Visa Sapphire card, Chase issued that card, extends your credit, sets your limit, and earns the majority of the economics. Visa provides the network — the rails the transaction travels on, the rules that govern it, and the brand recognition that tells merchants worldwide the card will work.
Visa operates what's known as a four-party model:
- Cardholder — you, with the Visa card
- Issuing bank — Chase, Bank of America, HDFC, or any of the thousands of banks worldwide that issue Visa cards
- Visa (the network) — provides infrastructure, sets rules, routes the transaction
- Acquiring bank — the merchant's bank or payment processor that accepts the transaction
For a deeper look at the four-party model and how it compares to Mastercard, Amex, and regional networks globally, see our Complete Guide to Payment Networks.
VisaNet: The Infrastructure Behind Every Transaction
VisaNet is the global network that handles Visa transaction processing. It's not a single data center — it's a distributed infrastructure with primary and backup processing centers. Visa operates two primary processing centers in the US (one on the East Coast, one on the West Coast) plus additional global centers, all linked by redundant, private network connections.
Capacity and Scale
- 65,000+ transactions per second: Peak processing capacity
- 229 billion transactions: Total processed in fiscal year 2023
- 200+ countries: Operating reach
- 99.9999% uptime: VisaNet's claimed availability — "six nines"
- Sub-2 second response time: Average authorization response
- Over 80 million merchant locations: Accept Visa globally
This reliability is Visa's core product. Merchants accept Visa cards because they trust the network will work everywhere, every time. A payment network with 99% uptime means 88 hours of downtime per year — completely unacceptable. The "six nines" target means less than 32 seconds of downtime annually.
VisaNet's Two Core Functions
VisaNet performs two distinct functions:
1. Transaction processing (VisaNet Authorization System)
Real-time authorization of individual transactions. This is what most people think of when they imagine Visa "processing" a payment — the instant approval or decline.
2. Clearing and settlement (BASE II)
After authorization, transactions go through a separate clearing and settlement process via Visa's BASE II system. This is the accounting function — reconciling all the transactions across issuers and acquirers, and calculating net settlement positions.
The ISO 8583 Message Format
When a card is tapped at a point-of-sale terminal, the terminal doesn't send Visa a plain-text message. It encodes the transaction data into a standardized format: ISO 8583.
ISO 8583 is the international standard for financial transaction messaging. It structures transaction data into numbered "data elements" (fields), each with a defined format and meaning.
Key ISO 8583 Fields in an Authorization Request
| Field | Data Element | Example Content |
|---|---|---|
| Message Type Indicator | MTI | 0100 (authorization request) |
| Primary Account Number | DE2 | 4111 1111 1111 1111 (card number) |
| Processing Code | DE3 | 000000 (purchase) |
| Transaction Amount | DE4 | 000000000650 ($6.50) |
| Transmission Date/Time | DE7 | 0215143022 |
| Merchant Category Code | DE18 | 5812 (restaurants) |
| POS Entry Mode | DE22 | 07 (contactless) |
| Acquirer Institution ID | DE32 | 123456789 |
| Retrieval Reference Number | DE37 | 123456789012 |
| Terminal ID | DE41 | STBK0001 |
| Merchant Name/Location | DE43 | STARBUCKS #12345 SEATTLE WA |
| Card Acceptor Code | DE18 | 5812 |
| CVV2 Data | DE48/DE61 | Encrypted CVV value |
The ISO 8583 authorization request (message type 0100) is typically 200–500 bytes. The issuer sends back an authorization response (message type 0110) with an approval or decline code.
Authorization response codes:
00— Approved05— Do not honor (generic decline)14— Invalid card number51— Insufficient funds57— Transaction not permitted to cardholder61— Exceeds withdrawal amount limit65— Exceeds withdrawal frequency limit
The terminal displays a human-readable interpretation ("Approved", "Declined", "Call Your Bank") of these codes.
ISO 20022 is gradually replacing ISO 8583 for newer payment systems — FedNow, RTP, and SWIFT's cross-border messaging are all migrating to ISO 20022, which carries richer data and supports more complex payment types.
Step-by-Step: The ~1.5 Second Journey of a Card Tap
Let's trace the full path of a $6.50 contactless payment at Starbucks:
T=0ms: Card Tap
You tap your Visa card on the contactless reader. The NFC chip in your card and the terminal exchange data — the card provides an encrypted version of your account number (a token in most modern card-on-file and mobile wallet scenarios), the transaction amount, and a dynamic cryptogram unique to this transaction.
T=10ms: POS Terminal
The terminal constructs an ISO 8583 authorization request. The merchant's POS software bundles the card data, transaction amount, merchant ID, terminal ID, and timestamp into the message.
T=30ms: Acquirer
The terminal sends the message to the acquiring bank or processor (e.g., Fiserv, Worldpay, Adyen) via a dedicated payment network connection — typically a private IP network, not the public internet. The acquirer's system validates the message format and routes it to VisaNet.
T=50ms: VisaNet
VisaNet receives the authorization request. It performs several functions instantly:
- Validates message format and required fields
- Looks up the issuing bank from the card's BIN (Bank Identification Number — the first 6–8 digits)
- Routes the message to the correct issuer
- Records the transaction in VisaNet's own audit log
T=80ms: Issuing Bank
The authorization request arrives at Chase (or whatever bank issued the card). Chase's authorization system evaluates:
- Is the card valid and not expired?
- Is the card not on the "hot card" list (reported stolen/lost)?
- Does the CVV match?
- Does the cardholder have sufficient available credit?
- Does the transaction pass fraud scoring? (real-time ML model evaluation)
- Is the transaction consistent with the cardholder's spending patterns?
T=120ms: Authorization Decision
Chase makes its authorization decision and sends back an ISO 8583 0110 response with response code 00 (approved) or a decline code.
T=150ms: Response through VisaNet and Acquirer
The approval travels back through VisaNet to the acquirer to the terminal. VisaNet logs the response. The acquirer records the approved transaction.
T=200–1,500ms: Terminal Displays Result
The terminal displays "Approved." You grab your coffee. The total elapsed time is typically 500–1,500 milliseconds for a contactless transaction. Online transactions can be faster (no NFC communication step).
No money has moved yet. The issuer has placed a hold on $6.50 of your credit. Actual settlement happens later in the day via Visa's BASE II clearing system.
Stand-In Processing: What Happens When the Issuer Is Down
Banks are not perfectly available. Systems go down for maintenance, experience outages, or are temporarily unreachable. When VisaNet sends an authorization request to the issuing bank and doesn't receive a response within a timeout threshold (typically 8–15 seconds), VisaNet can step in.
Visa's Stand-In Processing (STIP) is a service where VisaNet makes the authorization decision on behalf of the issuer, using rules the issuer has pre-configured.
How STIP Works
- VisaNet routes the authorization request to the issuer as normal.
- The issuer doesn't respond within the timeout period.
- VisaNet invokes STIP rules configured by the issuer (floor limits, velocity rules, card status).
- VisaNet approves or declines the transaction based on these rules.
- The response is sent to the acquirer.
- When the issuer comes back online, Visa sends it the STIP decisions for reconciliation.
Issuers configure STIP floor limits — the maximum transaction amount Visa can approve on their behalf. Common STIP floor limits are $50–$200. Large transactions (above the limit) may be declined during an outage rather than risk approving something the issuer would have declined.
STIP is why your card often still works during your bank's scheduled Sunday maintenance window.
Visa's Revenue Model
Visa is one of the most profitable businesses in the world — operating margins consistently above 50%. But Visa's revenue model confuses people because Visa isn't the one charging you the 2% fee.
How Visa Actually Makes Money
Service revenues — Visa earns a small fee on each dollar of transactions processed on its network. These are percentage-based assessments on payment volume. Visa charges both the acquiring side and the issuing side.
Data processing revenues — Visa charges per-transaction fees for processing authorization, clearing, and settlement messages through VisaNet. These are fixed-fee per transaction (fractions of a cent).
International transaction revenues — Premium fees on cross-border transactions where the card and the merchant are in different countries. These are Visa's highest-margin revenue. A European transaction on a US card generates a higher fee than a domestic US transaction.
Other revenues — Value-added services, consulting, licensing, and data analytics.
The Fee Waterfall on a $100 Transaction
When you pay $100 at a US merchant with a US Visa rewards card:
| Party | Fee | Who Pays |
|---|---|---|
| Issuer (your bank) | ~$2.10 interchange | Merchant's acquirer pays to your bank |
| Visa assessment | ~$0.13 | Merchant's acquirer pays to Visa |
| Acquirer margin | ~$0.25–$0.50 | Merchant pays to acquirer |
| Merchant nets | ~$97.27–$97.52 | After all fees |
Visa's cut (~$0.13) is small per transaction, but on 229 billion annual transactions, it compounds into over $15 billion in annual revenue. Visa's profitability comes from scale and marginal cost near zero — processing the 10 billionth transaction costs Visa almost nothing more than the first.
Visa Direct: Real-Time Push Payments
Visa's core business is authorization of card-present and card-not-present purchases. But Visa has built a parallel capability: Visa Direct — a platform for pushing money to Visa debit cards in real-time.
Visa Direct enables:
- Gig economy disbursements: Uber, Lyft, and DoorDash workers can receive earnings instantly to their debit card after a shift, rather than waiting for ACH.
- Insurance claim payouts: Insurers send payments directly to claimants' debit cards within minutes of claim approval.
- P2P transfers: Western Union, Moneygram, and P2P apps use Visa Direct to push funds to recipients.
- Cross-border remittances: Sending money to a Visa debit card in another country, settling in local currency.
Visa Direct operates over existing Visa rails but in reverse — instead of pulling authorization for a purchase, it pushes funds. Over 7 billion Visa credentials are eligible to receive Visa Direct payments globally.
Visa vs. Mastercard: Network Comparison
Visa and Mastercard are structurally identical businesses with nearly identical revenue models. The differences are at the margins.
| Feature | Visa | Mastercard |
|---|---|---|
| Global transaction market share | ~46% | ~26% |
| Annual transactions | ~229B | ~130B |
| Network name | VisaNet | Banknet |
| Revenue (FY2023) | ~$32B | ~$25B |
| Acceptance footprint | 200+ countries | 210+ countries |
| Debit brand | Visa Debit / Interlink | Maestro / Debit Mastercard |
| Real-time push | Visa Direct | Mastercard Send |
| Key acquisition | None major recently | Vocalink (UK faster payments, 2017) |
Mastercard's acquisition of Vocalink (the operator of UK Faster Payments and Bacs) was strategically significant — it gave Mastercard a foothold in A2A real-time payments infrastructure, not just card rails. This positions Mastercard to be relevant even as account-to-account payments grow.
For the broader comparison including regional networks like RuPay, UnionPay, and UPI, see our Complete Guide to Payment Networks.
Key Takeaways
- Visa is a network, not a bank — it doesn't issue cards or lend money. It provides the rails (VisaNet) and earns small fees on every transaction.
- VisaNet processes 65,000+ transactions per second with "six nines" uptime (99.9999%), routing messages between acquirers and issuers in under 1.5 seconds.
- ISO 8583 is the messaging standard for card authorization — a compact, structured binary format encoding card data, amounts, and merchant info. ISO 20022 is its modern replacement for newer rails.
- The authorization journey: POS → Acquirer → VisaNet → Issuer → decision back in milliseconds. No money moves until settlement (end of day via BASE II).
- Stand-In Processing (STIP) lets VisaNet approve transactions on the issuer's behalf when the issuing bank is temporarily unavailable — within pre-configured rules.
- Visa's revenue comes from assessment fees (percentage of volume) and per-transaction data processing fees, not interchange (which goes to the issuing bank).
- Visa Direct extends Visa's rails beyond card purchases to real-time push payments — gig worker pay, insurance disbursements, and cross-border remittances.
- Visa vs. Mastercard: Both are nearly identical in structure. Visa is larger; Mastercard's Vocalink acquisition positions it more directly in the A2A payments future.
Related Reading
- How Payment Networks Work: Visa, Mastercard, UPI, and More — The complete guide to global payment rails, card networks, interchange, and the four-party model
- How ACH Payments Work — The US bank transfer network that handles payroll and recurring payments
- Real-Time Payments (RTP) Explained — How FedNow and the RTP network are building instant alternatives to card authorization
- BNPL Explained: How Buy Now Pay Later Works — How fintech lending products layer on top of card and bank rails at checkout
Stay Current on Payment Technology
VisaNet is evolving — ISO 20022 migration, Visa Direct expansion, and responses to RTP are all in motion. Sign up for FinTekCafe's free newsletter for weekly analysis of payment infrastructure, card network strategy, and the technology behind money movement.