Who owns compliance in a sponsored card program gets asked constantly and answered badly.
It usually gets answered as a contractual matter. The contract determines who is liable to whom. It does not determine who notices.
Compliance in a sponsored program isn't one responsibility. It's four, and in almost every arrangement they sit with different parties.
What are the four parts of compliance in a sponsored program?
Awareness. Someone reads the announcement, judges whether it applies to this BIN, this product, this program, and routes it. That usually sits with the sponsor, because the sponsor holds the license and the portal credentials.
Implementation. Someone makes the change. Usually the program manager, the processor, or both. A common failure is that neither has the source document and both are working from a forwarded summary.
Evidence. Someone can show the network, an examiner or an auditor what was done, when, by whom and on what authority. This is the one that gets discovered missing rather than assigned.
Financial liability. Someone pays. That's the sponsor, because the network bills the license holder. The sponsor pays it first and then tries to recover it from the programs that generated it, which is a separate exercise with its own success rate.
Line those up and the failure mode is obvious. It isn't that a component is unowned. It's that liability sits with the party furthest from awareness and implementation.
The sponsor carries the network relationship, the standing and the invoice, while the decisions creating the exposure are made inside a partner's engineering backlog it can't see. The program manager can see its own implementation but has no line of sight into what it was never told about. Both parties can be acting in good faith and the gap still opens.
Where a sponsor holds the license, receives the announcements and hasn't built the visibility to manage the exposure, the failure is structural. It belongs to the party that owns the structure.
Four components. Awareness, implementation, evidence, financial liability. The carousel has them with who each one usually lands on, and a blank grid to fill in for one of your programs.
Test it on one program. Name the party against each of the four. If awareness and implementation land on the program manager while evidence and liability land on you, you have exposure regardless of how well anyone is executing.
From a briefing we've written with Rivero on what network compliance actually costs. You can download it here.
Related reading: why Visa and Mastercard scheme communications create hidden operational risk, and why network fee pass-through is harder than it seems for BIN sponsors, acquirers, and ISOs.