Stand In Processing: When Visa Answers for the Issuer
Stand-in processing is Visa answering an authorization the issuer did not. It has a 10 second clock, issues real codes, and the issuer carries the risk.
By Jeffrey Anderson
- Table 7-1 in Section 7.3.4.1 (ID# 0004385) gives an issuer 10 seconds to answer a POS authorization in the US, 10 for Visa Direct and 25 for an ATM cash disbursement under MCC 6011. Europe is 5 seconds for all three.
- If Visa does not receive a response inside that limit it responds on the issuer's behalf using Stand-In Processing.
- A separate US rule (ID# 0004381) requires an issuer or its authorizing processor, including stand-in processing, to respond to all authorization requests in an average time not exceeding 5 seconds during each calendar month.
- The 15 second merchant timeout floor (ID# 0030580) exists so a stand-in answer can reach you before you abandon the sale. Timing out earlier loses approvals that were on their way.
- A stand-in approval carries a real authorization code built from the date, time and payment credential, and Section 7.3.2.1 (ID# 0005498) requires the acquirer to pass that code to the merchant.
- Section 1.4.4.3 (ID# 0004386) puts the risk with the issuer: an issuer is responsible for any transaction approved or declined by stand-in processing.
- Decline code 83, Fraud/Security, is reserved to Visa and signals a stand-in decline for high-risk conditions, so an 83 did not come from the cardholder's bank.
Stand-In Processing is Visa answering an authorization when the cardholder's bank does not. It has a published clock, it issues real authorization codes, and the liability for its decisions sits with the issuer rather than with you.
It is also the quiet mechanism behind several things merchants notice without being able to name: an approval that arrives after your terminal gave up, a decline code reserved to Visa, and refunds that now get answered even when an issuer's systems are down.
The issuer has 10 seconds, then Visa answers
Section 7.3.4.1 (ID# 0004385) publishes the limits in Table 7-1. For the US and most other regions:
| Transaction type | US and most regions | Europe |
|---|---|---|
| POS, including PIN at POS and unattended terminals where PIN is present | 10 seconds | 5 seconds |
| Visa Direct, meaning account funding and original credit transactions | 10 seconds | 5 seconds |
| ATM cash disbursement, MCC 6011 only | 25 seconds | 5 seconds |
Then the sentence that matters: if Visa does not receive an authorization response from the issuer within the limit, Visa "will respond on behalf of the Issuer, using Stand-In Processing."
There is a separate and stricter US requirement on top. Section 7.3.4.2's neighbouring rule (ID# 0004381) says an issuer or its authorizing processor, including Stand-In Processing, must respond to all authorization requests in an average time not exceeding 5 seconds during each calendar month. So the 10 second figure is a per-transaction ceiling and 5 seconds is a monthly average obligation.
Why your terminal must wait 15 seconds
A merchant or acquirer must not time out a POS transaction in less than 15 seconds (ID# 0030580). We covered that floor and its consequences in authorization reversals and the 24 hour rule.
Read the two numbers together and the design becomes obvious. The issuer gets 10 seconds. Visa needs time to notice the silence and answer in its place. Your 15 second floor exists so that the stand-in answer can reach you before you abandon the sale. Timing out at 8 seconds does not make you fast, it makes you miss an approval that was coming.
And if the approval lands after you gave up, the same rule requires you to submit an authorization reversal. That is the obligation most stacks miss, because the code path for a timed-out sale rarely expects a late success.
A stand-in approval is a real approval
Section 7.3.2.1 (ID# 0005498) is short and useful. If Visa approves a transaction in Stand-In Processing, Visa provides the acquirer with an authorization code based on the date, time and payment credential, and the acquirer must provide that code to the merchant.
So you get a genuine authorization code, and you are entitled to receive it. The rulebook's own glossary backs this up by defining an authorization code as one that an issuer, its VisaNet processor, a Visa scheme processor "or Stand-In Processing provides to indicate approval of a Transaction." There is no second-class category here.
Who carries the risk
This is the question worth knowing the answer to, and the rule is one sentence. Section 1.4.4.3 (ID# 0004386): "An Issuer is responsible for any Transaction approved or declined by Stand-In Processing (STIP)."
Approved or declined, both. So a stand-in approval is not a provisional thing you hold at your own risk because the bank never saw it. The issuer owns the outcome. That does not make the transaction undisputable, and ordinary dispute rights still apply, but the authorization decision itself is not yours to answer for.
Where you will actually meet it
Three places, all of which the rules name:
A decline you did not get from the bank. Code 83, Fraud/Security, is reserved to Visa and signals a transaction declined during stand-in processing for high-risk conditions. It joined the published categories on 25 July 2026. Our breakdown of decline codes and retry limits places it in Category 2, so reattempts are permitted.
Refund authorizations. From 1 April 2026 an issuer can meet the credit authorization requirements by participating in the Merchant Return Authorization on Behalf of Stand-in Processing Service, in which case Visa answers return authorizations for it.
Referrals. If an issuer sends a referral response, VisaNet processes the request according to that issuer's stand-in processing parameters instead.
What the issuer controls, and what it does not
Stand-in is not Visa guessing. Issuers set parameters, and the rules let them define account-level handling through the Account Screen Authorization File, a listing of cardholder accounts needing special treatment either during stand-in or always.
Visa Smarter Stand-In Processing is a further layer. An issuer participating in it is responsible for obtaining the necessary permissions and consents, and for setting its Smarter STIP parameters, which the rule says "in the event of a conflict will prevail over any other STIP parameters set by the Issuer" (ID# 0030746).
What a merchant controls is narrower: your timeout setting, and whether your stack handles a late approval correctly.
Frequently asked questions
What is Stand-In Processing?
Visa responding to an authorization request on an issuer's behalf when the issuer does not respond inside the published time limit, which is 10 seconds for POS in the US.
Is a stand-in approval safe to accept?
The issuer is responsible for any transaction approved or declined by stand-in processing under Section 1.4.4.3, and you receive a genuine authorization code that your acquirer is required to pass to you.
Why should my terminal wait 15 seconds?
Because the rule sets that as a floor and because the issuer's own limit is 10 seconds. Timing out earlier can lose an approval that stand-in processing was about to deliver.
What do I do if an approval arrives after I timed out?
Submit an authorization reversal. The rule requires it.
Which decline code means Visa declined it, not the bank?
Code 83, Fraud/Security, which is reserved to Visa use and indicates a stand-in decline for high-risk or fraudulent conditions.
Sources: Visa Core Rules and Visa Product and Service Rules, 18 April 2026, Sections 1.4.4.3, 7.3.2.1, 7.3.4.1 and 7.3.4.2 with Table 7-1.
Jeffrey Anderson, Merchant Placement Specialist
Merchant placement specialist at Gray Merchants. Jeffrey works directly with acquiring-bank underwriting teams across the firm’s 70+ banking relationships to place high-risk and hard-to-place businesses, structure multi-MID accounts, and keep flagged merchants processing. His writing draws on the placement files he works every week: what underwriters ask for, why accounts get declined, and what keeps an approved account open.