The Question No-KYC Card Programs Can't Answer

8 minutes ago

5 min read

Starting 24 October 2026, Visa members in the US and Canada must tell Visa every BIN and account range each of their Third Party Agents uses, explicitly including programs aimed at end consumers. For cards sold as "no-KYC," that is the one question the structure exists to avoid.

The pitch of a no-KYC crypto card is that nobody needs to know who you are. That may be true of the cardholder. It has never been true of the card. The first six to eight digits of every card number identify the issuer, ride along in every authorization message, and were licensed by Visa for a specific program in a specific country.

What has been thinner is the next layer of the map: which agent runs which range, and what kind of customer that range serves. The October change asks issuers to draw that layer themselves, and to own it if it is wrong.

What changes on 24 October

The amendment sits in §1.9.8.6, Third Party Agent Registration Requirements, of the Visa Core Rules and Visa Product and Service Rules (18 April 2026 edition). Visa's own summary of changes lists it under the Canada and US regions only, effective 24 October 2026, and describes it as requiring members to provide all numerical identifiers associated with each of their Third Party Agents.

In practice, when a member registers a Third Party Agent through Visa's Program Request Management system, it must now disclose:

The issuing identifiers and Acquiring Identifiers the agent uses
Every BIN and applicable Account Range the agent uses
That coverage expressly includes end-consumer-facing and Merchant-facing programs

The member then has to keep that record current: annually, whenever something changes, and whenever Visa asks. The same rule leaves Visa free to deny or reject an agent's registration at any time, "with or without cause."

None of this asks issuers to collect anything new about cardholders. It asks them to put their own program map on file.

The gap it closes

A BIN has always pointed to its issuer. Under §1.2.1.1, a BIN may only be used for the programs and activities agreed with and authorized by Visa, in the country where it is authorized. Visa never needed outside help to know which bank sits behind a card number.

The weaker link has been the layer below the bank. Between a BIN and the person tapping a card, the chain can run through a program manager, a client company, a sub-vendor and a stablecoin on-ramp. Independent reporting shows how far outsiders can get anyway. Fintech Business Weekly reported tracing the BINs behind a set of no-KYC card services to five US institutions. On 12 October, The Banker reported tracing crypto card credentials to three US banks it did not name.

If a reporter with a sign-up and a BIN lookup can reach the bank, the October rule is not about discovery. It is about attestation. The issuer now states, on Visa's record, which ranges its agents use and whether those programs face consumers.

Note the overlap: the banks in both reports are US institutions, and the US Region is exactly where the new disclosure applies.

Why no-KYC cards wear business-card clothes

A card that works at most merchants worldwide needs a network, and a network needs an issuer. An issuer that onboards individuals has to identify each one. The workaround is to make the customer a company.

In a commercial or business card program, the bank's customer is the business. The bank runs KYB on the entity: its name, address, ownership and activity. The people holding cards are authorized users of the company's account. In a genuine expense program, the employer knows who they are and answers for their spending. That design is legitimate, and it is why it can be exploited.

The no-KYC version keeps the paperwork and swaps the people. On paper, the bank sees one corporate client issuing cards to its staff. In practice, large numbers of unrelated retail users load stablecoins and spend for personal purposes. Fintech Business Weekly described the pattern as a thin entity clearing the corporate check, then handing cards to anyone who deposits.

Seen from the issuer's side, this is not a KYC gap. It is a product mismatch: a commercial BIN serving consumers is not the program it was licensed to be.

That is exactly where the October disclosure bites. It does not ask who the cardholders are. It asks which programs each agent's BINs serve, and it names consumer-facing programs explicitly. A shell company can stand between the bank and the cardholder's face. It cannot stand between the bank and the registration form.

What the issuer already owed Visa

Two existing rules turn the new disclosure from paperwork into a statement that can be tested.

Cards on request (§1.1.6.7). Visa can ask for a working card associated with any BIN an issuer is licensed for or uses. The issuer has 30 calendar days from the written request to deliver it, personalized as Visa specifies. Visa does not need to wait for a card in the mail.
Liability stays with the member (§10.2.2.1). Approval of a Third Party Agent cannot rest solely on a contract that claims to limit the member's financial liability. And registering an agent does not mean Visa has confirmed the agent complies with any specific requirement.

Put together: after 24 October, an issuer that leaves a consumer-facing program off the record has made a statement Visa can check with a single card request. The contract with its program manager will not absorb the consequence.

What to check now

For issuers and BIN sponsors in the US and Canada:

Map every range to its real operator. Reconcile each BIN and Account Range against the agent that actually runs it, including ranges a program manager has passed to downstream partners.
State who the end user is, range by range. If a commercial range has cardholders who are not employees or agents of the client business, that is the finding, not a footnote.
Treat a new downstream partner as a change. Updates are due annually, on any change, and on Visa's request. A program manager adding a sub-vendor is a change.
Assume Visa will ask for a card. Confirm you could produce a working, personalized card from each range within 30 days.
Read agent contracts without the liability cap. Under §10.2.2.1, a contractual limit on your liability does not count toward approving the agent.

For program managers: expect your sponsor to ask for end-user composition by range, and expect "they are all employees" to need evidence behind it.

What this piece does not claim

Region. The §1.9.8.6 amendment applies to Canada Region and US Region members only. Programs issued elsewhere are outside this clause; Fintech Business Weekly found some no-KYC services using issuers outside the US.
Network. This analysis rests on Visa's public rules. Mastercard's rules were not reviewed here, and nothing above describes what they require.
Banks. We do not name institutions. The Banker did not name its three; where other outlets have named banks, appearing in a BIN range is not by itself evidence of wrongdoing.
Timing. We make no prediction about when or how Visa will act on what it receives.