One map of the layered stack - consumer surfaces, merchant acceptance, card networks, instant rails, security infrastructure, and issuers - with the flows that connect them.
The stack at a glance
Modern digital payments are best understood as a six-layer system. The top layer is what consumers and merchants see; the bottom layers are the rails, standards, and balance sheets that make a tap, scan, or transfer settle.
The modern payments stack: consumer surfaces sit on top of merchant acceptance, which routes through card networks and instant rails, underpinned by security infrastructure and the banks that issue accounts and credentials.
How a card payment moves
The four-party model - cardholder, merchant, acquirer, network, issuer - still underpins most in-store and online card payments worldwide. An authorization decision typically completes in under two seconds.
Four-party model: authorization request flows from cardholder through merchant, acquirer, and card network to the issuer, then back along the same path within ~2 seconds.
FedNow, RTP, Pix, UPI, SEPA Instant, and FPS all share the same shape: a central switch routes ISO 20022 messages between banks, with final settlement in seconds, 24/7/365 and irrevocable on completion.
Instant payment rails clear and settle in seconds, around the clock, replacing batch ACH and wire windows with continuous gross settlement.
Compare specific rails in our FedNow and Pix deep-dives.
How tokenization protects the PAN
Every Apple Pay tap, Google Pay checkout, and saved card on file is a token, not the raw card number. The token vault - operated by the network or issuer - maps surrogate values back to the PAN inside an HSM-protected environment, removing merchants from PCI scope.
Tokenization replaces the PAN with a non-sensitive surrogate bound to a device, merchant, or channel. The original PAN never leaves the vault.