How instant payments work through Visa and Mastercard

Instant payments to cards are push-to-cards: a business sends money to a client, partner or merchant directly to a Visa/Mastercard. Technologically, this is implemented through Visa Direct and Mastercard Send (historically OCT: Original Credit Transaction). In a typical scenario, money comes in at 24/7, without waiting for a bank day, and the recipient only needs to have a valid card.

Basic terms and rails

AFT (Account Funding Transaction) - "pull" money from the card (for example, replenishment of the wallet).

OCT (Original Credit Transaction) - "push" money to the card (payment/withdrawal).

Visa Direct/Mastercard Send are grocery umbrellas that use the AFT/OCT + Fast Funds network from the issuer.

Fast Funds is a sign from the issuing bank to accept loans to the card in real time. If not supported, the payout takes longer (for example, T + 1).

💡 Short: AFT = Input, OCT = Output. For instant payout, it is important that the recipient's card and her bank support Fast Funds.

How it works: step-by-step flow (push-to-card)

1. Recipient ID

The recipient needs a PAN (card number) or token (via tokenization/card vault PSP).

2. Sender Checks (KYC/AML/RG Vertical)

The business is onboarding with PSP/bank: license, sources of funds, limits, sanctions and PEP screenings.

3. OCT initiation

Your provider forms a credit transaction in the Visa/Mastercard network with the amount, currency, MCC and references.

4. Network routing

The network delivers the request to the recipient's card issuing bank.

5. Issuer's decision

The issuer checks the card, limits, anti-fraud/compliance. When approved, credits and returns an authorization response.

6. Business notification

The PSP sends a "Paid/Settled" webhook. In the interface - the status is "Paid," the user has money on the card.

7. Clearing/Settlement

Interbank settlements are carried out according to the rules of the payment system, and finances and reports converge in the back office.

Typical speeds: seconds to several minutes with Fast Funds. In case of degradation or absence of Fast Funds - up to several hours/day (depending on the issuer, country and time of day).

Use cases

Marketplaces and gig economy: daily/instant payments to sellers, couriers, drivers.

Fintech wallets and brokers: cashout to card instead of slow bank transfer.

Insurance and e-commerce returns: quick compensatory payments to the client.

Games/iGaming and betting: quick withdrawal of winnings (resolution depends on the license/policies of the bank and the network).

P2P and B2C loyalty programs: instant prizes, cashback and rewards.

Business and user benefits

For user:

money "here and now" on a familiar card;
No IBAN/BSB and bank details binding;
operates 24/7 in most countries/banks.

For business:

higher NPS/hold due to fast outputs;
less support ("when will the money come? »);
global map coverage instead of local schemes;
simple reconciliation by network references.

Limitations and nuances

Issuer support. Not all banks accept OCT as Fast Funds; delays or failures are possible.

Limits. By amount/daily volume, by the number of transactions, by merchant categories (MCC).

Countries/currencies. Affordability and SLAs vary by region; conversion is possible.

MCC and network policy. Some industries (including gambling) have increased requirements and separate rules.

Returns and disputes. It's a credit to the card, the classic chargeback doesn't apply the same way to purchases; reverse OCT/adjustments and internal returns policy are used.

Safety and anti-fraud

Recipient verification. PAN/token format checks, bin classification (prepaid/debit/credit), issuer country.

Real-time risk assessment. Device-fingerprinting in the recipient's office, geo/behavioral signals, frequency limits.

Lists and rules. White/black lists of maps and BINs, velocity control, cross-border bans in sensitive jurisdictions.

Mule detecta and APP-scam. Algorithms against "translate yourself" and cash-schemes: limits on new cards, "cool-off," manual review of cases.

Card data protection. Tokenization, storage at a certified provider, minimizing PCI DSS perimeter.

💡 Important: 3-D Secure does not usually apply here - it is an outgoing loan, not a purchase. The main protection is sender/recipient risk scoring and limit policy.

Compliance and legal aspects

KYC/AML/CFT: identification of the sender and recipient, monitoring of suspicious transactions, reporting according to local rules.

PCI DSS: if you touch PAN - compliance is mandatory; or use PSP tokens.

Licenses and permitted activities: compliance with network rules and an agreement with an acquirer/PSP (especially for high-risk verticals).

Privacy: minimizing PII, controlling access to payment logs.

Integration architecture

Payout Service: accepts requests, checks limits/risk, routes to providers.

PSP/Acquirer: generates AFT/OCT, provides tokenization, sends to the network, returns status webhooks.

Ledger & Reconciliation: network references, idempotency keys, reconciliation with bank reports, alerts for discrepancies.

Observability: p95 boards of enrollment time, approve rate, BIN/country failures, proportion of retrays.

Financial Model: Fees and SLAs

Fees: fix +% for payment. Depends on the country of the card, volume, risk, currency.

SLA by speed: with Fast Funds - minutes; without it - up to T + 1/T + 2.

Limits on amount/frequency: at the level of the network, PSP and your internal policies.

Cross border and FX: additional charges/exchange rate differences are possible.

UX Best Practices

Show the expected enrollment window ("usually within minutes").

Confirm the last 4 digits of the card or token mask to avoid errors.

Keep a payment history with references and statuses.

Report deviation with clear reason and steps (other card, verification).

For large amounts - two-stage confirmation (PIN/2FA) and "pause-to-confirm."

Push-to-card launch checklist

1. Legal readiness: PSP/acquirer agreement, business model description, KYC/AML policy.

2. BIN tests: checking speeds and approvability by major issuing banks.

3. Limits and rules: daily/monthly thresholds, velocity, regional bans.

4. Tokenization: exclude PAN storage at home; use network tokens/PSP-vault.

5. Antifraud: behavioral scoring, lists, cooling for new recipients, manual moderation of anomalies.

6. Reconciliation and reporting: idempotency, daily reports, alerts for duplicates/timeouts.

7. Support and return policies: response templates, SLA, playbook for disputes/errors.

8. KPI monitoring: p95 enrollment time, approve rate, share of retrays, FPR/TPR anti-fraud, transaction cost.

Mini-FAQ

Do I need the recipient's card number?

Yes, PAN or token. Many PSPs only allow tokens to be stored.

Is it exactly "instant"?

With Fast Funds support, usually minutes. Otherwise - longer, depends on the recipient's bank.

Are there chargebacks like shopping?

OCT has a different logic: these are credit transactions. Returns are made by reverse entries/adjustments to the PSP and bank policies.

Is it possible to pay massively?

Yes, through batches/API-bulk with limit and scoring control.

Is it suitable for gambling?

Technically, yes, but only within the framework of the license and policies of the networks/banks. Enhanced KYC/AML and RG control are required.

Instant card payments through Visa Direct and Mastercard Send give businesses a fast, familiar and scalable withdrawal channel: minutes instead of days, global reach and clear UX. The success of the implementation rests on three pillars - support for Fast Funds from the issuer, a strict risk profile and clear operational discipline (reconciliation, limits, reporting). A properly configured push-to-card increases customer confidence and speeds up money flow while remaining compliant and secure.