The Hidden P&L of Legacy Debit

Most financial institutions know what their debit processor charges them. Far fewer know what that processor costs them.

The invoice is the easy part. It shows per-transaction fees, monthly minimums, implementation charges and support costs. But the real debit P&L is usually hiding somewhere else: in good transactions that get declined, in fraud rules that block real customers yet still miss bad actors, in operations teams that spend thousands of hours reconciling exceptions, and in the 18 months it takes to launch a feature a competitor shipped in weeks.

That matters because debit is not a side channel. It is a daily relationship. Federal Reserve data shows debit accounted for 30% of consumer payments by number in 2024, against 35% for credit and 14% for cash. PYMNTS Intelligence finds that on consumers’ last in-store non-grocery purchase, 39.8% used debit versus 29% who used credit.

That makes debit infrastructure a revenue system, a risk system and a retention system at once. Treating it as a back-office processor contract misses the point. The real question for most CFOs is not whether debit is evolving (they know it is) but whether the institution can see what legacy debit is already costing before deciding whether migration is worth the risk. The answer usually depends less on the processor invoice than on four hidden costs.

1. What Legacy Debit Actually Costs You

Debit produces data every second: authorizations, declines, reversals, holds, disputes, chargebacks, wallet-provisioning events, merchant categories, latency spikes and reason codes. Used well, that data becomes a live operating system for the card business. Used poorly, it becomes a daily tax. That tax falls into four cost pools, and only the tip of it appears on the invoice.

Figure 1. The processor invoice is the visible tip; the larger cost of legacy debit sits below the waterline.

Revenue leakage from authorization performance

Approval rate is a revenue metric, not just an operations metric. Every good transaction declined is lost interchange, lost trust and, often, lost card preference. Galileo’s debit-processing materials advise tracking authorization success, proper declines, processor and network errors, false declines, p95/p99 latency, timeout rates, fraud loss and reason-code analysis together, rather than viewing approval rate in isolation.

The math is simple. Take a portfolio of 10 million attempted debit transactions per month. If avoidable false declines equal 0.50 percentage points, that is 50,000 good transactions lost. Federal Reserve data shows 2023 debit interchange averaged $0.22 to $0.24 per regulation-covered transaction. Even at $0.24, that is $12,000 per month in direct interchange, before account attrition, call-center contacts or lost top-of-wallet status. For exempt issuers, co-brand programs and higher-value relationships, the economics are larger.

Operational drag

Legacy debit often creates a manual repair economy. Staff reconcile mismatched holds, investigate posting delays, resolve disputes, trace ACH returns and work card life-cycle failures. Galileo’s materials point to straight-through processing rate, exception volume by type and mean time to resolve as core measures of operational health. The CFO question is not “Can we reduce head count?” It is “What work are our people not doing because the stack keeps breaking?”

If a bank handles 25,000 debit-related exceptions per month at 12 minutes of loaded staff time each, that is 5,000 staff hours monthly. At $40 per loaded hour, that is $200,000 per month, or $2.4 million per year. Halving the exception rate does more than save labor; it releases people into product work, risk tuning and faster dispute resolution.

Opportunity cost

A legacy processor may still authorize transactions but prevent product teams from moving at market speed. When instant issuance, real-time card controls or merchant-category rules require long integration cycles, the cost is not just the project budget. It is the new accounts that never activate, the direct deposits that move elsewhere and the customers who try a competitor while the institution is still in queue.

Fraud economics

Legacy fraud tools fail in two expensive ways: they under-detect and absorb losses, or they over-decline and push away good spend. A sound scorecard includes fraud loss per $1,000 settled, false-positive ratio, fraud-review labor, dispute cycle time and complaint rate. Approving more fraud is not progress; blocking good customers is not progress either. The target is better decisioning at the transaction level.

2. What Modern Debit Infrastructure Makes Possible

Modern debit infrastructure matters not because it sounds better, but because it changes what a bank or brand can do every day.

Real-time authorization and configurable controls

In a modern stack, each transaction is evaluated with current balance data, current risk context and product rules that can change without a long release cycle, enabling dynamic spending limits, merchant-category controls, location-aware risk rules and instant customer controls. Galileo describes modern debit processing as API-first, with instant transaction approval, funds movement, account updates, RESTful APIs, webhook notifications and analytics, plus an Events API that notifies institutions of account changes, authorizations, settlements and transactions in real time.

That changes the operating model. Product teams no longer wait for batch files or release windows to test a control. Risk teams no longer choose between broad rules and manual reviews. Customer teams can give cardholders controls that work now, not tomorrow.

Instant issuance

Digital card issuance is an activation strategy, not just a convenience. A checking account that opens on Monday but waits seven days for plastic is at risk before it starts. A card provisioned into a mobile wallet during account opening can produce a first transaction while the customer is still engaged. Galileo identifies instant card issuance, mobile-wallet provisioning, real-time notifications and unified app experiences as table stakes for modern co-branded debit.

Debit as a loyalty and engagement rail

The Southwest–Galileo Rapid Rewards Visa debit card shows how debit can extend rewards to customers who prefer spending funds they already have, granting Rapid Rewards points on everyday purchases without a credit check. Galileo’s Bill Kennedy frames debit rewards as a different but still valuable economics model built around loyalty, repeat business and platform efficiency.

The idea extends well beyond travel:

• A gig platform can pay workers instantly after a shift and attach controls or rewards to spending.
• An employer can support earned-wage access without pushing employees into a separate third-party experience.
• A non-financial app can embed debit controls so a family, creator marketplace, travel club or benefits platform manages spend inside the experience users already know.

The common thread is control. Modern debit lets institutions decide faster, notify faster, pay faster and learn faster, driving direct engagement, reducing dependence on intermediaries and increasing customer lifetime value.

3. What Goes Wrong in Migrations, and How to Prevent It

Debit migrations fail in predictable ways. The risk is not that payments professionals don’t know migration is hard. The risk is that they know it is hard in general, but not where it breaks in practice.

Tokenization and wallet continuity

A customer with a debit card in Apple Pay or Google Wallet does not care that the issuer changed processors. They care only whether the card still works at the grocery store. EMVCo describes payment tokenization as replacing the primary account number with a payment token used from purchase through acquirer, network and issuer authorization. During migration, the institution needs a token inventory by wallet, network, BIN, token requestor and status, and a plan specifying whether tokens are mapped, reissued or kept alive through life-cycle management.

Cohort design

Do not migrate 500,000 cardholders at once, but do not migrate only the quietest accounts either, because that teaches little. A practical rollout starts with low-risk internal accounts, moves to low-volume customer cohorts, then tests high-usage, wallet-heavy and dispute-prone segments before broad conversion, sequenced by risk, volume, wallet penetration, fraud exposure, customer value and operational capacity.

BIN sponsor coordination

BIN sponsorship is not a checkbox. It is a critical path. Processor, issuer, sponsor bank and networks must align on BIN setup, routing, settlement, fraud responsibilities, compliance reporting, card art, tokenization, disputes and program controls. Dependencies discovered late can slip the calendar by months.

Parallel processing and rollback

Running old and new systems together sounds safe but can create confusion: which system is the source of truth, how holds are reconciled, how reversals are handled, what happens when latency differs. A sound parallel window includes shadow authorization testing, daily reconciliation, exception war rooms, rollback triggers and clear ownership. A practical range is 30 to 60 days, but the right answer is KPI stability, not a fixed date.

Declaring victory too early

“All cards migrated” is not done. Done means authorization rates are stable or better, false declines are not rising, fraud losses are controlled, exception volumes are down, complaint rates are flat or improving, wallet tokens are healthy and dispute handling meets regulatory timeframes. Under Regulation E, institutions generally must investigate reported electronic-fund-transfer errors within 10 business days, with longer windows available when requirements such as provisional credit are met. Migration success must include compliance operations, not just conversion volume.

The Readiness Diagnostic

The processor migration decision should not start with an RFP. It should start with a diagnostic. The question is not whether legacy debit is old, but whether the institution can quantify what the old stack is costing, and whether it is ready to move without breaking customer trust.

Score each question from 1 to 5. 1 = not measured or not available. 5 = measured, owned and actively managed.

• Can your current stack support real-time authorization decisioning using current balance, risk and customer context?
• Do you know your true debit authorization approval rate, separated by proper declines, fraud declines, processor errors, network errors, timeouts and false positives?
• Can you calculate the dollar value of avoidable declines using your own transaction contribution, not a generic industry average?
• What percentage of debit and deposit-account events flow straight through without manual repair?
• How many FTE hours per month are spent on debit exceptions, disputes, reconciliation, card life-cycle failures and posting delays?
• Can customers freeze cards, change controls, receive real-time alerts and provision cards into mobile wallets without contacting the call center?
• How long does it take to launch a new debit feature, from approved business case to production?
• Do you have a documented token migration plan for existing wallets, network tokens and card-on-file credentials?
• Is your BIN sponsor aligned to the modernization timeline, including certification, settlement, compliance and fraud responsibilities?
• What will prove the migration worked: better authorization rates, lower exception volumes, stable fraud performance, fewer complaints, faster activation, or all of the above?

A low score does not mean migration should wait. It means the business case is incomplete. A high score does not mean migration will be easy. It means the institution knows where the costs sit, where the risks are and what success has to look like.

^{Measurement note: The supplied materials do not include activation-lift, time-to-first-transaction or 30-day velocity data. A useful internal model compares digitally provisioned accounts with plastic-first accounts across first-transaction rate, days to first transaction, 30-day active rate, monthly transaction count and direct-deposit attachment.}

^{Source note: This Tracker follows the supplied three-section brief and uses the Galileo/PYMNTS Intelligence source packet for core debit economics, co-branded debit and deposit-churn framing. The sponsor materials support the KPI framework, real-time/API-first capabilities and co-branded debit examples, but do not provide aggregate anonymized pre-/post-migration authorization-rate, activation-rate or fraud-performance benchmarks. Figures marked illustrative use modeled math where aggregate data were not available.}