A fund passed on us recently. The reasoning, close to verbatim: the value proposition is not unique enough to take on the incumbents. The incumbents they meant were Stripe, Square, and Adyen.
It was the politest version of a pass I have heard several times this year, and it is the reason this newsletter exists. Before I argue with it, here are the numbers.
$11.46 trillion went onto US-issued cards last year (Nilson Report).
Roughly two thirds of US card transactions still happen in person: 63.8 percent by count in the Federal Reserve’s latest payments study.
$228 billion is what Square processed in all of 2024, online business included (Block’s 10-K). That is about 2 percent of a year of US card volume.
18 percent of Adyen’s 2024 volume was in person: 233 billion euros, worldwide (Adyen H2 2024 results). Stripe processed $1.4 trillion and does not report an in-person number at all.
41 billion merchant transactions each is what JPMorgan Payments and Fiserv, the two largest US acquirers, handled in 2024 (Nilson Report). Square handled 5.2 billion.
Add it up. The companies investors call the incumbents hold a single-digit sliver of in-person card volume. The overwhelming majority of card-present payments still run through traditional acquirers and the channel that sells for them: banks, ISOs, agents, and the software vendors already embedded in merchants’ operations. In card present, Stripe, Square, and Adyen are not the incumbents. The channel is.
So the fund asked how we beat the incumbents. The better question: why do the online giants, with all their scale and all their engineers, still hold so little of the in-person market after a decade of trying?
Because card present is a different country, and it has border controls. To accept a tap in the physical world you need things online volume does not buy:
EMV certifications, per processor. The kernel that talks to the card gets certified at Level 1 and Level 2. Then every processor you want to reach requires its own Level 3 certification: a formal test project with a lab and an acquirer on the other side. Months each. No API call skips it.
PCI attestation for software terminals. Turning a phone into a terminal means proving, continuously, that a consumer device can be trusted with card data. A standing security program, not a checkbox.
Apple entitlements and contracts. Tap to Pay on iPhone runs on entitlements Apple grants and contracts Apple signs. Access to the NFC hardware is now open. Permission to process real cards through it is not.
Keys, and the custody of keys. PIN debit means encryption keys, key ceremonies, and hardware security modules. Keys follow liability: whoever holds them holds the risk, which is why this layer changes hands slowly.
Acquirer relationships. You cannot self-serve your way onto a processor’s production rails. Someone has to let you in, and they let in the parties they have certified.
Notice what is missing from that list: online market share. The incumbents built good card-present products, but they built them on their own processing rails, for their own merchants. The moment a bank, a platform, or an ISV needs acceptance on rails it chooses, that scale is not on offer. What matters then is who holds the certifications on your processor, who custodies the keys, who has the entitlements.
That is the moat question in card present. Not brand, not a beautiful API. A certification estate and key infrastructure, built one processor at a time, that determine what you are allowed to do, on which rails, starting today.
So when an investor asks how a card-present company beats Stripe, the honest answer is that it does not have to. The market the incumbents supposedly won is the one the data says they have barely entered. Different country, different map.
This newsletter is about that country. Every two weeks I will take one piece of it, the certifications, the keys, the economics of the terminal becoming software, and make it legible to people who allocate capital and build products on top of payments.
Signal
Apple opened iPhone NFC access to third parties in August 2024. Two years on, the queue did not disappear. It moved to the certification lab. Access was never the hard part; permission to process is.
Roughly seven in ten of the top US and European payment providers now market a SoftPOS product, and analysts still describe mainstream adoption as limited. Everyone has the brochure. Far fewer have transacting merchants.
Worldpay brought Tap to Pay to its small-business base in late 2025, years after Square. When a top-three acquirer moves on that clock, that is card present telling you what it costs to cross the border.
If you invest in payments, or you have passed on a card-present company because the deck did not look like Stripe’s, I want to hear the question you ask instead. Reply to this email. I read every one.
Sesie Bonsi is a co-founder of Koard. Koard builds processor-neutral in-person acceptance infrastructure.
Forwarded this? Subscribe to get the next issue. Found it useful? Send it to one investor who thinks payments is one market.