APAC Banks Rethink Legacy Issuing as Digital Payments Accelerate

Jonathan Lee, Partners and Alliances Director APAC at BPC, discusses how modern issuing platforms and disciplined migration are helping banks respond to changing payment behaviour and scale new card services across Asia Pacific.

In October 2025, a visitor from China could arrive in Thailand, open Alipay, UnionPay or WeChat Pay, and pay a local merchant by scanning a Thai QR code.

The Bank of Thailand said the launch expanded its cross-border QR payment connections to nine jurisdictions.

To the customer, the schemes, currency conversion and settlement process disappear behind a familiar mobile action.

That is the benchmark against which issuing is now judged: not how quickly plastic is produced, but how easily a payment credential works across wallets, channels and borders.

Regional demand is now visible in both strategy and transaction behaviour.

KPMG International’s 2026 survey of 500 banks and 500 retailers including 31% of banking and 40% of retail respondents from APAC found that retailers want capabilities such as tokenised payments, BNPL, stored-value wallets and better data access, while 53% of banks identified replacing outdated legacy systems as a reason to modernise.

Usage data reinforces the point: in the first half of 2025, Indonesia’s QRIS reached 6.05 billion transactions, 57 million users and 39.3 million merchants; Malaysia recorded three billion DuitNow QR transactions and two billion contactless payments during 2025; and digital payments accounted for 64.7% of Philippine retail payment volume in 2025. 

Issuing can no longer be organised around the physical card alone.

Banks need platforms that can manage credentials across cards, wallets, QR and other digital channels as customer behaviour shifts.

Legacy card management creates a challenger gap

Traditional card-management systems were designed around BINs, product codes, plastic production and batch operations.

Adding a wallet, virtual card, customer-controlled limit or real-time notification can require coordinated changes across the card system, switch, fraud platform, digital channel and servicing tools. 

That creates a gap with digital challengers. They can begin with API-led stacks and release narrowly targeted features in weeks; incumbents often face custom development, regression testing, scheme certification and limited release windows. 

Incumbents can close the gap by separating product configuration from transaction processing, exposing lifecycle services through APIs, making token and wallet support part of the design, and modernising in controlled modules or through managed services. 

Issuing has become a lifecycle business

A modern proposition is not static. A consumer may switch international transactions on for a holiday, change a limit before a major purchase or keep a card frozen until it is needed.

A business may issue a virtual card restricted to one supplier, amount or period. These are lifecycle events, not new card products.

Tokenisation adds another layer. An EMV payment token replaces the primary account number with an alternative value that can be restricted to a device, merchant or payment scenario, reducing the value of exposed payment information.

The issuer must therefore manage physical cards, wallet tokens, stored ecommerce credentials and virtual cards as connected representations of the same customer relationship.

Tokens need to be provisioned, monitored, suspended and renewed without unnecessarily breaking legitimate digital relationships when plastic expires or is replaced.

That requires a platform that understands the relationships among customers, accounts, cards, devices, tokens, limits and transactions, and can act on them in real time.

From product projects to a product factory

The case for a different operating model is measurable. In KPMG International’s 2026 survey of 500 banks, 31% of banking respondents were in APAC.

Across the global sample, 69% cited meeting customer demand and 69% cited security, resilience and fraud protection as leading reasons for payment modernisation; 47% pointed to competitive pressure and 44% to the ability to innovate.

A product factory is the practical response. Instead of treating every proposition as a separate technology project, the bank configures and reuses common capabilities such as pricing, limits, eligibility, rewards, repayment terms, token settings and channel permissions.

This also changes how the portfolio evolves. A proposition can be launched to a defined segment, measured using real behaviour and adjusted before wider rollout. 

The route to that model does not have to be a single, high-risk replacement. What matters is choosing a migration path that reflects product urgency, integration depth, portfolio complexity and the institution’s tolerance for operational change.

A bank may replace card management end to end, modernise individual components in phases, or introduce a modern platform alongside the legacy estate and migrate portfolios progressively. 

Whichever route is selected, the programme should map dependencies, protect daily processing, test reconciliation and peak capacity, establish rollback points and keep old and new environments aligned until cutover is proven.

BPC’s Modernisation Without Disruption guide sets out four migration models and practical considerations for choosing among them.

What modernisation looks like across APAC

APAC institutions are applying these routes at very different scales and for different business goals. The common thread is a platform that can keep changing after go-live.

In Vietnam, PVcomBank migrated from legacy infrastructure to modular SmartVista card management with API connections across components.

It now manages more than 1.1 million debit, credit and prepaid cards and processes about seven million card transactions a month, while adding fraud management and 3DS 2.2 as volumes and security needs evolved.

In Cambodia, ACLEDA Bank used a phased migration to expand issuing across domestic and international schemes.

Its debit-card base rose to more than two million in couple years while virtual-card transactions increased almost sixfold.

Also in Cambodia, BIDC replaced fragmented legacy systems with one card-management environment for domestic CSS and Visa portfolios.

It added EMV contactless issuing and acquiring, virtual cards, 3D Secure and in-app card servicing while consolidating operational control.

A different route suited Chinese Hong Kong-based Payful. Using Card Management as a Service, it established a cloud-native issuing business within a year and configured six virtual Visa charge-card products for purchasing, travel and corporate credit without custom coding.

In Sri Lanka, HNB extended an existing modernisation programme by enabling debit cards in Google Wallet.

The bank manages around 2.5 million cards on a unified platform; its card portfolio grew 21% year on year, demonstrating how a modern foundation can support both scale and the next customer-facing service.

Reduction in false positives matter

As issuing becomes more digital, fraud management cannot remain detached from the card lifecycle.

A customer may use the same account through a physical card, mobile wallet, ecommerce token and virtual credential.

Assessing each transaction without understanding these relationships gives the issuer an incomplete view of behaviour.

Modern fraud controls should evaluate transactions in real time while considering customer history, device activity, channel behaviour and how a credential is being used. 

Fraud management should therefore develop alongside the issuing environment.

Changes to customer controlled limits should be reflected immediately in transaction monitoring.

A wallet token should be recognised as part of the customer’s wider relationship, while a virtual card restricted to a particular purpose should be monitored according to those conditions. 

The stronger the connection between issuing data and fraud intelligence, the more precisely the bank can respond while reducing unnecessary friction for legitimate customers.

For instance, in Malaysia, Co-opbank Pertama (CBP) deployed modern SmartVista Fraud Management, introducing real-time monitoring, analytics and a consolidated view of fraud activity across customer touchpoints.

Leveraging ML module, CPB easily tracks and analyses historical fraudulent data and continuously refine detection mechanisms, adding precision to the its channels defenses.

In fact, legacy authorisation and legacy fraud systems built around static rules often mistake legitimate customer behaviour for suspicious activity, turning false positives into false declines.

BPC offers an illustrative model in its new guide, a mid-sized issuer processing 10 million debit attempts a month could incorrectly reject 50,000 genuine transactions, representing around $1.5 million in lost approved spending every month.

The cost extends beyond interchange to customer dissatisfaction, manual reviews, operational inefficiency and lost future business.

Modern platforms can assess transactions using real-time behavioural data, wider customer context and continuously updated risk models.

This allows financial institutions to detect genuine fraud more accurately while approving more legitimate payments.

Modernisation therefore strengthens fraud protection while reducing authorisation leakage, protecting revenue and improving the customer experience.

For banks, the question is no longer whether to modernise issuing, but how long they can afford to delay it.

Every year spent on a rigid platform widens the gap in product speed, customer relevance and revenue performance.

Read BPC’s Modernisation Without Disruption guide to explore practical considerations and examples from banking and payment modernisation programmes around the world.

Featured image: Edited by Fintech News Singapore, based on image by ImageFlow via Magnific