5 Hidden Risks Threatening the Visa & Mastercard Duopoly
Get smarter on investing, business, and personal finance in 5 minutes.
Great businesses are often described as toll bridges, and there are no two companies that more closely resemble a toll bridge than Visa and Mastercard.
Together, the two businesses process over $25 trillion dollars in payment volume, and every year they process over $450 billion in transactions, taking a fee on every single one of those.
With operating margins of around 60%, they have the financial profile of a business that doesn't seem to be facing any competition.
These are businesses that have traditionally achieved a premium valuation, trading in the vicinity of 30-35x earnings.
So why have the businesses all of a sudden traded back down to about a 25x multiple?
Is the market suggesting that there's real risk to these business models?
In this week’s Five Minute Money, we are going to focus on the card network industry, both Visa and Mastercard, and get into the actual risks that present themselves that could potentially threaten their position.
Card Network Industry Overview.
Visa has revenues of about $43 billion and Mastercard has revenues of $34 billion.
Visa has operating profits of $26 billion versus Mastercard at $20 billion.
Visa's margins are around the low 60%, whereas Mastercard is in the high 50%.
Mastercard is growing quicker, though: revenue growth was 17%, with profits growing 22%.
Visa only grew 14%, with operating profits growing 10%.
The bigger factor has been Mastercard's value-added services segment, pertaining to fraud protection and cybersecurity.
They also package data they gather through card members and sell it to hedge funds and retail companies.
Visa has some similar, overlapping services, but Mastercard has focused on this more.
Most of the business, though, is what we could call card network revenue.
It's coming from two sources: a percent of payment volume, based off the total value of the transaction, plus a separate fixed fee based off the transaction itself.
Maybe it comes out to 15 basis points, plus another $0.10-0.30 fixed fee on every swipe.
The revenue breakdown for Mastercard is about 60-65% card network revenue, whereas that's 75% for Visa.
How the Card Network System Works.
Imagine five nodes: a merchant, the merchant acquirer, the card network, Visa or Mastercard, sitting in the middle, then the issuing bank, then a consumer.
American Express is an exception because they're technically also a bank.
Most cards say JPMorgan, Citi, or Bank of America, and then there's a Visa or Mastercard logo.
The bank on there is the issuing bank, the party responsible for giving you credit.
The Visa or Mastercard logo signifies the card network, where the transaction is routed.
If this merchant says this item's going to be $100, the consumer is giving the merchant $100.
There's going to be about a 3% fee the merchant pays to accept this payment, called a merchant discount rate.
So if the item was $100 and the merchant discount rate is 3%, the merchant is getting $97.
The $3 is then split between the merchant acquirer, the card network, and the issuing bank.
For example, let’s say the merchant discount rate is 2.75%, about 2% is interchange, about 65 basis points goes to the merchant acquirer, and the other 15 basis points is the network fee, called the assessment.
The card network collects all of the interchange fee as well as their own assessment fee, then passes off to the issuing bank almost all of that, keeping only the assessment fee.
A merchant may think it's Visa or Mastercard charging these high rates, but most of that money is going to the issuing bank.
The issuing bank funds rewards for consumers with it, to incentivize the customer to use their particular credit card.
Merchants don't like high interchange rates, so they push you to use cheaper alternatives like debit cards, where there's no rewards.
There's no rewards on debit cards because interchange fees are regulated down to very low levels.
So there used to be rewards on debit cards but no longer, after the Durbin Amendment.
Debit card is a worse business for everyone involved, and arguably worse for consumers too, since they're not getting rewards anymore.
Where countries have tried to legislate down these fees, the result is not cheaper prices, it's the rewards going away for the consumer.
It makes Visa and Mastercard a worse business, because they make more money from credit card transactions than from debit card transactions.
Visa and Mastercard are known as open loop networks, because you could sub in different banks to the networks.
Open Loop vs. Closed Loop: Visa and Mastercard vs. American Express.
American Express is a closed loop, because American Express is actually a bank.
They are the issuing bank and also have their own card network.
That's why American Express isn't accepted everywhere, since they charge a very high merchant discount rate.
The American Express model is basically: we have very wealthy customers, because customers pay $100-plus a year for an annual membership for the Platinum Card.
If you want access to our affluent customers, you need to accept American Express.
It's a closed network because there's no other bank that can ride on American Express's rails.
American Express is the bank in that transaction, always.
The only other credit card company that had their own network was Discover, acquired by Capital One.
There have been a lot of efforts to reduce payment fees on the merchant side.
The problem is consumers don't want to bear these fees themselves, and don't want to get rid of their rewards.
The rewards are churn reduction, because they help people not leave them, and help acquire people.
If you regulate away these fees, the rewards disappear, and that money moves back to the merchants.
Why Card Networks Are Hard to Disrupt.
As the name suggests, there is a network effect here.
If you are a cardholder, you want your card accepted everywhere.
If you're a merchant, you want to accept all consumers' credit cards.
Who as a merchant wants to be on a card network with no consumers?
That's even a problem for American Express, even though widely accepted, it's still not accepted everywhere.
There have been initiatives where retailers band together and say, "We're going to start our own card network."
There's a famous example with Walmart.
It was called CurrentC, an app that would allow consumers to pay directly from their bank accounts to retailers, who wouldn't pay any fees.
It didn't work.
Why? Because you're not offering customers anything.
Who's going to switch payment methods just to save Walmart money?
On top of that, you're losing your rewards and your fraud protection.
That's why it's important whether usage is credit card versus debit card, since debit cards don't have rewards.
There's nothing locking customers into place anymore.
If we're thinking about their moats, you have this very big network effect, and trust.
You know that if there's a mistake, they're going to make it right, and that it's very widely accepted.
That's why American Express holders also feel they need a Visa or Mastercard, since Amex isn't accepted everywhere.
They don't charge that much relative to the total fee, if it's 2.5%, they're only charging 0.15% that.
You've got to disrupt the entire merchant side and the entire consumer side, and get enough mass scale to stitch them together.
It's very hard to do.
No one is really trying to replace them, they're trying to displace them, providing different payment methods with totally different payment rails.
The Historical Bull Case for Visa and Mastercard.
The reason people liked Visa and Mastercard for a long time is it's basically a bet on the economy.
As consumer spend increases, they take a fraction of that.
There's also the secular tailwind of cash to card, and growth in credit transactions, since credit cards offered rewards before regulation stepped in.
As economies grow and consumers shift to more card and digital methods, it benefits Mastercard and Visa.
Risks.
Now we are going to get into the five risks that could affect Visa and Mastercard.
Some of these risks could affect their international business, and international is still very important to their business, about 60% of revenue is outside of the US.
The five risks are:
1. Regulation and litigation
2. Government alternatives, RTP and A2A
3. Closed loop and closed network
4. Cryptocurrency and stablecoin
5. Agentic AI, BNPL, and data sovereignty risk.
Risk 1: Regulation and Litigation.
Since 2005, there's been litigation against Visa and Mastercard for anti-steering.
In short: if you accept one Visa card, you have to accept all Visa cards, and have no right to charge different fees for different cards.
There was also the accusation that banks were fixing interchange fees in an anti-competitive way.
This litigation has been going on for over two decades.
There's a preliminary settlement in the vicinity of $38 billion.
Merchants may get the ability to refuse certain cards with very high fees, and maybe surcharge certain cards.
It doesn't seem like this is going to be that big of a threat.
But it's a little bit of a crack: if merchants can charge higher fees for cards with higher fees, you're clearly paying for your rewards.
The EU regulated credit card fees like debit card fees.
In the US, debit card fees are regulated under the Durbin Amendment, but credit card fees really aren't.
In the EU, credit card interchange is now like 30 basis points, not enough to fund rewards, so rewards disappeared on credit cards.
Visa and Mastercard were able to increase their network fees and offset their side of it.
Without rewards, you're indifferent between payment methods.
There's talk of directly regulating Visa and Mastercard's fees, saying they're basically a utility.
Australia did the same thing earlier.
For some reason Amex was carved out, still allowed to charge higher rates and offer rewards, so Amex can potentially gain share.
Risk 2: Government Alternatives.
The second risk is government alternatives, coupling with the regulatory risk.
Once rewards go away, there's not a big difference between credit cards and other payment methods.
RTP is real-time processing, A2A is account-to-account.
Traditional payments take two to three days to settle.
A new payment rail would be instant and free.
Pix, in Brazil, forced the largest banks to adopt it and made it free.
Over 90% of people use Pix, and it entirely displaced Visa and Mastercard.
India did a similar thing with UPI, Unified Payment Interface.
Visa and Mastercard don't have a space in this country anymore.
They allowed RuPay, an Indian-native network, to connect to UPI, but not Visa and Mastercard.
In Europe, it's called SEPA Instant, and WERO on the consumer side.
It's harder in the EU, coordinating across many countries, and a similar attempt fell apart in the past.
No one is less sympathetic to a capitalist company taking fees than the EU.
In the US, people aren't going to give up their rewards as a favor.
In the US, FedNow, launched by the Federal Reserve, has only had adoption on B2B payments, since banks have zero incentive, they'd be giving up their own interchange fees.
Brazil and India never had built-up payment infrastructure, making it easier to institute new rails.
It's harder where a system already exists, like the US and the EU.
Risk 3: Closed Loop and Closed Network.
Chase has their own payment network, and got Visa to build it for them and basically not pay Visa.
Chase has Chase Net, since JPMorgan Chase has a very large merchant banking business and a big consumer card business, so they own both banking relationships.
They told Visa, "We're not going to do that anymore, otherwise we're going to build our own network."
This routes transactions between Chase customers and Chase merchants without paying Visa.
Other banks can't do this because very few have both a large consumer business and a large business banking business.
There is also the risk that the other closed loop card networks (Capital One Discover and American Express) gain more share.
The more volume that goes to Capital One Discover and American Express, the less goes through Visa and Mastercard, since they have their own card networks.
The Risk of a New Closed Loop: WeChat Pay, Square, and Apple.
The real risk is someone else creating a new closed loop.
This happened in China with Alipay and WeChat Pay, where consumers and small businesses both use the same wallet.
Square, with the Cash App and merchants using Square devices, was in a good position to do this, but didn’t execute well.
Apple could potentially do this too, with all the consumer devices and Apple Pay widely accepted, but doesn't seem interested, since they could just charge a few basis points.
If any app gets consumers and merchants both locked onto it, they'd have that option.
But it seems like that boat has sailed for most companies.
Risk 4: Crypto and Stablecoin.
A proponent of crypto and stablecoins would say, “We don't need banks, and shouldn't be paying fees.”
Stablecoins are pegged to fiat currency, so they don't fluctuate wildly in price.
It goes back to the same issue as Walmart: there's no benefit to the consumer.
Most consumers won't give up their credit card and rewards to save a merchant money.
After the Genius Act gave regulations to stablecoins, it's become more of a legitimate way to pay.
The risk is maybe Amazon offers its own stablecoin with 2% off, only on Amazon spending.
That helps create a stickier relationship, but it's not the most formidable threat, in my opinion.
The question is the benefit to the consumer and the merchant.
The benefit to the merchant is lower fees and faster settlement.
To the consumer, not so clear.
With crypto, you don't have fraud protection or support you can call, and transactions are irreversible.
Not a big risk, in my opinion, and you could use a Visa or Mastercard stablecoin-connected card, taking a small fee if used in person.
Cross-border is a big business for them, but this happens on the business side, not consumers paying by stablecoin.
Risk 5: Agentic AI, BNPL, and Data Sovereignty.
The fifth risk is a catch-all bucket: agentic AI, BNPL, and data sovereignty.
Agentic AI.
Agentic AI is the idea of an AI agent doing commerce for us online.
I don't know why this is brought up as a threat, since you still need to pay through a payment method.
As long as one of those cards is Visa and Mastercard, it doesn't really matter.
They're using tokenized credentials for AI agents already.
Buy Now, Pay Later (BNPL).
BNPL is a growing payment method where a user buys a product now and pays for that item in 4 installments over time.
BNPL transactions usually use a debit card or checking account, subverting the Visa and Mastercard rails.
Klarna and Affirm are pretty big and growing.
The risk is that BNPL grows as a large portion of payments and since BNPL uses a debit card or checking account, that means less revenues for the card networks.
However, Visa and Mastercard are not sitting still in this aspect.
Both have made a series of partnerships and acquisitions.
Data and Payment Sovereignty.
Countries watched what happened with Russia, where sanctions meant Visa and Mastercard weren't allowed to operate.
As a result, Russia built up their own alternative, called MNP.
Even the EU wants their own payment infrastructure that they control.
India said all transaction data needs to be housed in India.
Mastercard even got banned from issuing cards in India for a year.
The real risk is payment sovereignty: countries wanting to control their own payment architecture, as happened with Pix, UPI, and now beginning in the EU.
Valuation.
Those are the bigger risks facing Visa and Mastercard.
There's always the risk of spend falling and recessions, but those are the more existential ones I'd worry about.
At 25x earnings, an investor needs to ask, “To what extent are these risks priced in?”
Is the market correct that there's real risk to these business models?
Will Visa and Mastercard be displaced by a new payment method?
Ultimately, it is up to the investor to decide for themselves whether or not they want to take that bet.
For more on Visa & Mastercard, check out this video below.
Nothing in this newsletter is investment advice nor should be construed as such. Contributors to the newsletter may own securities discussed. Furthermore, accounts contributors advise on may also have positions in companies discussed. Please see our full disclaimers here.
