Brazil has one of the most structured financial systems in the world. That brings robustness, but it also demands a high level of compliance from any company that decides to issue cards. Before being a product, the card is a regulated operation.
Operating cards means entering the financial system
Issuing a card is opening a door into the financial system. It involves the Central Bank, card networks, issuers and a set of compliance rules that are not optional.
Every operation must be auditable, traceable and consistent. It is not enough for the product to work: it must prove, at any moment, that it operates within the rules.
KYC: where many operations start to fail
KYC (Know Your Customer) is often underestimated. A loose onboarding opens space for fraud; an overly strict flow destroys conversion.
The balance between security and experience is not defined once — it is adjusted continuously, as the operation grows and fraud patterns change.
AML: when the problem is not the user, but the usage pattern
If KYC validates identity, AML (Anti-Money Laundering) monitors behavior — a different level of complexity. Here the risk is not in who comes in, but in how the account is used over time.
This requires continuous analysis of suspicious patterns, risk rules and formal reporting obligations to the competent authorities.
Card networks: market access is not automatic
Connecting to Mastercard or Visa is not just a technical matter. It involves certifications, operational tests and compliance with international standards.
Certification timelines are frequently underestimated in the schedule and can delay the launch of a product that, technically, would already be ready.
Anti-fraud: the problem that evolves faster than the product
Fraud does not shrink: it evolves. Brazil records millions of fraud attempts per month, which makes anti-fraud an essential piece, not an optional feature.
A robust anti-fraud setup has a direct impact on cost and user experience. Calibrating it is permanent work, not a project with an end date.
Regulatory responsibility: the risk that does not show in the product
Operating in the financial system means taking on formal obligations: audits, oversight, adaptation to new rules and reporting of suspicious activity.
This is the risk that does not appear on the product screen, but defines the viability of the operation in the long run.
Where the complexity really lives
Issuing a card is hard because it requires operating several critical layers at once: technology, regulation, operation and risk. The question shifts from how to do it to how to structure it.
Building everything in-house means absorbing each of these layers. Using ready-made infrastructure redistributes part of that responsibility — and that is what lets you understand, from the start, where the complexity really lives.
