Your BINs May Be in the AI Grey Market
The Economist ran a piece on September 29 linking the boom in crypto-funded payment cards to a quieter trade: users in China buying access to American AI models that are not offered in their market.
The timing was ironic; here at CHAINTECH, we’ve been researching a new wave of card-issuing models and the use cases driving adoption, including this kind of AI token “grey market” business out of China. Recently, we spoke with the operators of this type of card-issuing business. What these people described is less a crypto story than a card-issuing story. The lesson: it is about who a program’s cardholders actually are, and how many layers sit between the BIN sponsor, the program manager, and those cardholders.
Between us, we have spent our careers on both sides of the card business. Mike worked on the acquiring side, with a clear view into the issuing side of the house, from Visa and CyberSource in Asia Pacific to payment facilitator infrastructure here in the U.S. Kevin built issuing and virtual card programs in China and worked with Mastercard for about 18 years.
What we see in this case is really a remake of a movie we have seen before: nested layers of customers/partners/distributors, and intense demand for specific international card processing services (in 2010 in AsiaPac, it was international merchant acquiring – today’s hot property is crypto-backed card issuance with U.S. BINs to buy AI tokens, among other things). During the plot, foundational KYC/KYB can get lost, with potentially significant consequences for those ostensibly trying to follow the rules.
Let us be clear about where we come out. The network rules work. Visa and Mastercard require issuers and their program managers to know their cardholders, and programs that fail at KYC or KYB get shut down. The risk we describe sits in the gaps below the program manager, and that is where a sponsor bank can carry exposure it does not see.
What our research into “Card Issuing for AI Tokens” told us
One China-based operator we spoke with has run a small AI-subscription card business for about a year. At its peak, it handled low-six-figure monthly volume. He describes a market with thousands of competitors and little to distinguish them.
Some notable callouts from our conversations:
Only American cards work. AI providers decline his customers’ Chinese and Hong Kong cards. U.S.-issued cards go through, as do some issued in Singapore.
Almost nobody is first-hand. Most sellers he knows are two to four layers removed from the issuer. The better-connected ones buy from licensed program managers in Hong Kong, who supply U.S. BINs.
Ranges burn out overnight. His own upstream cut him off without warning. Bulk abusers, let in through thin vetting, had burned through a BIN range, and merchants flagged it.
Trust is the product. The first question every new customer asks is whether he will disappear with their money. His answer has been to refund failed cards out of his own pocket.
Labels hide the use case. Cards sold in this market are rarely described as top-up cards. They are typically framed as corporate or employee cards.
Put together, the money moves through four or five layers:
End users in China who want subscriptions or API credits.
Small resellers, often several layers deep, selling “U.S. cards” or top-up services.
Program managers in Hong Kong or Singapore, issuing what are framed as corporate or employee cards.
The BIN owner and processor, who see a business customer with a plausible use case.
The AI merchant, who sees a U.S. card and approves it.
Why your program review won’t catch it
On paper, nothing looks wrong. The program manager (PM) is licensed. The KYB file is clean. The use case says corporate spend.
The exposure sits below that line:
Nested distribution. Your PM’s customer is a reseller. The reseller’s customers are people you will never see.
Non-U.S. cardholders. The people actually spending are outside the program’s stated market footprint.
Crypto funding. Balances are loaded from stablecoins through offshore on-ramps, not bank accounts.
Thin vetting at the top. In one case we heard about, weak onboarding let bulk users in, and the BIN paid the price.
Use that is never checked. Employee-card framing passes onboarding, and actual spend rarely matches the stated use case.
Examiners have been asking partner banks about each of these since the 2024 wave of BaaS enforcement actions. Here they arrive together.
Getting Back on Track with KYC: What tightening will look like
This is no longer a niche corner of payments. Visa and Mastercard have opened network membership to licensed card issuing startups, and crypto-funded card programs are multiplying. The operator we spoke with put the number of similar sellers in China alone in the thousands.
Growth like that, followed by a mainstream investigation, usually means scrutiny is next. Mastercard has already said publicly that it prohibits reloadable no-KYC cards on its network. Expect the pressure to come from three directions:
Merchants blocking BIN ranges where abuse concentrates. When that happens, legitimate cardholders on the same range get declined too.
Networks asking issuers and sponsors harder questions about program oversight.
Bank examiners and regulators treating nested, offshore, crypto-funded programs as a known pattern rather than an edge case.
The banks (BIN sponsors) that do well here will be the ones that identify problems in their own books first.
Two questions worth asking this week
Do any of your program managers issue cards that end up with non-U.S. residents, directly or through their own customers?
What share of spend on your commercial and virtual programs goes to AI subscription and API merchants, and where are those devices and funding sources actually located?
If the honest answer to either is “we don’t know,” that is worth knowing now rather than later.
At CHAINTECH, we work on both ends of this chain: the Chinese demand side through our work in China and other Asian markets, and the U.S. issuing side through our lens here. That lets us help sponsor banks and issuing platforms with what is hard to do from the U.S.: understanding who a program manager’s customers really are and testing whether a program’s stated use matches its actual spend.
We are preparing a fuller study. In the meantime, if a confidential briefing would be useful, reach out to us directly.
J. Michael Bradley and Kevin Piao are Co-Founders of Chaintech Payments LLC. Mike previously served as VP & Managing Director at Visa/CyberSource Asia Pacific and SVP at Infinicept. Kevin built China’s first virtual card program and has worked with Mastercard for some 18 years.
Source: The Economist, “The AI boom meets a new kind of crypto scam,” Finance & Economics, September 29, 2026
Comments