Cardlytics: The Invisible Payments Infrastructure Giant
The Tolerated Extractor
Cardlytics occupies a strange position in the American payments infrastructure. It sees roughly half of every card swipe in the United States, some 170 million monthly active users representing 55 percent of domestic card spend, yet remains invisible to nearly all of them. There is no “Powered by Cardlytics” badge in the Bank of America app, no consumer brand to conjure loyalty or lock-in. The company exists as a thin layer of software and contractual relationships between the nation’s largest financial institutions and its biggest advertisers, extracting thirty-five cents from every dollar that passes through its platform while returning thirty cents to consumers and thirty-five cents to the banks.
This arrangement generates gross margins approaching 50 percent and produces measurable returns: advertisers see roughly five dollars in incremental spend for every dollar invested, consumers receive cash back, and banks harvest between $1.50 and $3.50 in retained deposits and reduced attrition for every dollar of revenue share. By any standard economic logic, this middleman should not exist. The banks own the data, the customer relationships, and the distribution channels. The advertisers possess the budgets and the products. Yet Cardlytics persists, having nearly failed twice before its 2018 IPO, then nearly failing again that summer until sequential partnerships with Wells Fargo and Chase validated its model.
The company survives not because it possesses unique data, every large bank holds identical transaction histories, but because it solved a specific regulatory and technical problem that prevented anyone else from aggregating that data across institutional firewalls. It persists because it captures only seven percent of the total value it creates, leaving sixty percent for banks and thirty percent for advertisers, pricing itself just cheaply enough that its partners tolerate its presence rather than reclaiming the economics. Cardlytics operates as a tolerated extractive layer in the financial stack, sustained by a proprietary architecture that keeps sensitive data behind bank firewalls while enabling external campaign management, yet perpetually vulnerable to the moment when a major bank calculates that building the capability internally costs less than renting it indefinitely.
Architecture as Regulation
The most durable competitive advantage Cardlytics possesses is not its data access, its advertiser relationships, or its scale, but a technical architecture designed to solve a governance problem that defeated Google, Facebook, and every other would-be competitor. The system operates as a cryptographic airlock: campaign specifications flow into the bank’s firewall from outside, execution occurs entirely within the bank’s core systems using the bank’s data, and only summary performance metrics, stripped of personally identifiable information, return to Cardlytics for optimization and billing.
This design emerged from necessity. Federal banking regulations and internal risk committees treat raw transaction data as among the most sensitive assets a financial institution holds. For years, technology companies attempted to convince banks to export this data to external clouds for analysis and targeting. All failed. The regulatory risk of data leakage, the operational complexity of maintaining compliance during bulk transfers, and the reputational hazard of appearing to “sell” customer data created insurmountable friction. Cardlytics’ founders, Scott Grimes and Lynne Laube, arrived from Capital One with an unusual combination of banking operations expertise and advertising technology experience. They understood that the data could not leave the building, and that any solution requiring banks to rebuild their core systems would die in committee.
Their solution inverted the typical SaaS model. Rather than pulling data into Cardlytics’ environment, they pushed lightweight software into the banks’ data centers, creating a sandbox where offer targeting and measurement could occur without exposing individual transaction histories. This required deep integration with legacy mainframe systems that predate the internet, navigating the Office of the Comptroller of the Currency’s restrictions on third-party relationships, and convincing risk officers that summary statistics carried zero re-identification risk. Competitors attempting to replicate this face a multi-year trust-building exercise with bank IT departments and regulatory compliance teams, followed by the technical challenge of writing software that runs on forty-year-old banking infrastructure while maintaining modern encryption standards.
The switching costs this creates are architectural, not merely contractual. Once Chase, Bank of America, Wells Fargo, and others integrated Cardlytics’ modules into their mobile banking applications, specifically the offer tiles that appear between account balances and transaction histories, replacing that infrastructure became a core system migration. Banks could theoretically build their own versions, but they cannot easily uninstall Cardlytics without rebuilding the campaign management layer, the measurement systems, and the advertiser-facing sales infrastructure. The moat is not the data; it is the specific manner in which the data is handled, which satisfies regulators while enabling functionality.
The Seven Percent Prison
Yet this architectural advantage locks Cardlytics into a peculiar economic captivity. For every dollar an advertiser spends through the platform, approximately five dollars in total economic value is created: one dollar returns to the consumer as cash back, roughly three dollars accrues to the advertiser in incremental profit (above the five dollars in incremental spend), and the remaining value splits between bank retention benefits and Cardlytics’ fees. Cardlytics captures only thirty-five cents: oughly seven percent of the value created. Banks capture approximately sixty percent through reduced customer attrition and increased card usage, while advertisers retain the remainder as return on investment.
This distribution is not accidental; it is the price of admission. Banks tolerate Cardlytics because the revenue share represents only ten to twenty percent of the total economic benefit they receive. When Bank of America displays a Starbucks offer to a customer, the thirty-five cents of revenue share matters less than the three dollars in lifetime value preserved by keeping that customer engaged with the BofA app rather than migrating to Chase. This calculus creates low price sensitivity on the supply side. Cardlytics could theoretically raise its take rate, capturing forty or fifty cents per dollar instead of thirty-five, but doing so would alter the fundamental equation that keeps banks from insourcing the capability.
The constraint is structural and permanent. Cardlytics must remain cheap enough that banks view the thirty-five cent fee as trivial compared to the retention value, yet expensive enough to fund operations and generate profit. It cannot build consumer brand awareness to create demand-pull from users, dding “Powered by Cardlytics” branding would trigger regulatory scrutiny and consumer privacy concerns, transforming the service from a bank feature into a data-sharing arrangement with an unknown third party. It cannot expand margins significantly without triggering renegotiations. The company exists in a narrow band of permissible profitability, permanently underpricing its services to prevent its own obsolescence.
This creates a strange corporate psychology. Cardlytics must grow, adding more banks to increase reach and justify advertiser fixed costs, without becoming so profitable that its partners develop appetite for the remaining ninety-three percent of value. The summer of 2018 illustrated this dependency. When Cardlytics announced partnerships with Wells Fargo and Chase in quick succession, adding tens of millions of users to the platform, advertiser demand surged because the reach justified the management overhead of learning a new channel. The stock recovered from near-delisting. Yet that growth increased, rather than decreased, the vulnerability to bank defection, because the larger the network, the more tempted individual members might be to capture the economics themselves.
The Retention Arbitrage
Why do banks not simply build this? The question haunts every Cardlytics earnings call and keeps the valuation compressed despite the apparent moat. The answer lies in a specific calculation of fixed costs versus variable sharing, and in the peculiar economics of consumer retention in financial services.
A bank considering insourcing faces a diseconomy of scale problem. Advertisers incur significant fixed costs to utilize the Cardlytics channel: learning the interface, integrating measurement systems, designing creative specifically for the tiny tile format (typically just a logo, no copy), and optimizing campaigns through randomized controlled trials. These costs only amortize if the advertiser can reach sufficient scale. Cardlytics justifies these costs by aggregating demand across multiple banks, Chase, BofA, Wells Fargo, US Bank, Regions, creating a single audience of 170 million users. A single bank, even one as large as Chase with sixty million cardholders, represents only a fraction of that reach. An advertiser might not bother maintaining campaigns for a single bank’s audience, or might demand lower rates that eliminate the bank’s margin.
Furthermore, the technical build is more expensive than it appears. Banks would need to construct advertiser sales teams, campaign management platforms, and measurement infrastructure capable of running holdout experiments against transaction data. Most banks have tried and failed to build similar capabilities for merchant services or small business lending; the organizational capability to sell to advertisers differs fundamentally from the capability to manage deposits. Cardlytics exists partly because banks are structurally bad at selling advertising space, just as newspapers were bad at building classified websites.
Yet the protection is thinner than it looks. Banks currently receive thirty-five cents in revenue share but capture between $1.50 and $3.50 in total value from increased retention and card usage. If a bank were to internalize the platform, it would capture not just the thirty-five cents but the entire $1.00 to $2.00 in gross revenue per advertising dollar, plus the full retention benefit. The break-even math shifts as technology costs decline and as the model becomes proven. If Chase or Bank of America successfully builds an internal offer platform that achieves 80 percent of Cardlytics’ advertiser ROI while capturing all the economics, they signal to every other major bank that insourcing is viable. The network would fragment, destroying the aggregation benefit that justifies advertiser participation.
Capital One’s Children
The specific human capital that created this fragile equilibrium came from an unusual source. Grimes and Laube built Cardlytics not from the advertising technology world, though they understood media, but from Capital One, the Virginia-based bank that pioneered data-driven credit marketing in the 1990s. This lineage matters economically because it determined the technical architecture and regulatory strategy that became the company’s primary defense.
Generalist technology entrepreneurs approaching bank data typically assume they can apply standard cloud architectures: extract, transform, load. They write business plans premised on algorithms running on AWS or Google Cloud, analyzing anonymized data sets shipped via API. They fail because banking regulators treat data location as a safety-and-soundness issue, and because bank risk committees view any external data movement as a potential breach. The Capital One background provided Grimes and Laube with fluency in mainframe operating systems, in the specific language of OCC guidance on third-party relationships, and in the political economy of bank IT departments, here projects die not from technical impossibility but from risk-off inertia.
This founder-market fit created the firewall architecture. A team from pure ad tech would have tried to centralize the data; a team from pure banking would have lacked the advertiser relationships to build the demand side. The hybrid produced a solution that satisfied both constituencies. When Cardlytics nearly failed in its early years, this specific expertise allowed them to navigate the integration complexities with Bank of America and later Chase, ntegrations that required rebuilding parts of the software to run on specific legacy hardware and satisfying security audits that generalist vendors could not pass. The economic value of the founders was not visionary leadership in the soft sense, but the specific capability to write code that runs inside a bank’s firewall without violating Gramm-Leach-Bliley provisions.
The Measurement Monopoly and Its Erosion
On the demand side, Cardlytics maintains advantage through a measurement capability that is structurally superior to digital advertising incumbents. Because the platform sees actual spending behavior, what a consumer bought, where, and for how much, it can conduct randomized controlled trials with perfect visibility into incremental lift. When Starbucks runs a campaign, Cardlytics can hold out a control group, measure actual spend behavior in both groups down to the penny, and report true incremental return rather than correlative attribution.
This contrasts with the probabilistic attribution models used by Google and Meta, which rely on tracking pixels, last-click attribution, and modeled conversions. Advertisers have grown skeptical of these methods, suspecting that much of reported ROI represents cannibalization of organic sales or misattributed touchpoints. Cardlytics offers something rare in digital media: certainty. The five-to-one return on investment that the platform typically delivers is measured, not modeled.
However, this advantage contains a fragility. The measurement is only valuable if advertisers trust it, and the platform’s claims are difficult to verify independently. If a major advertiser like Home Depot or Starbucks were to conduct their own analysis and discover that the five-to-one return included significant cannibalization of existing sales, or that the holdout methodology skewed toward high-spending users, trust would collapse quickly. The entire value proposition rests on the credibility of these RCTs. Conversely, if the measurement is accurate but advertisers remain skeptical due to generalized distrust of digital media metrics, the channel remains underutilized regardless of its actual efficacy.
Additionally, the current advertiser base remains concentrated in large consumer packaged goods and retail brands, ompanies with recognizable logos that work in the platform’s constrained UI format. The tiles display logos only, no promotional copy, assuming brand recognition. This excludes mid-market companies and local businesses that might benefit from the channel but lack the brand awareness to drive activation from a tiny icon. Expanding to these advertisers would require changing the user interface to include more information, descriptive text, richer creative, but doing so risks cluttering the banking app and reducing the engagement rates that produce the five-to-one returns. The format that enables high activation rates also limits the total addressable market, creating concentration risk if the large anchor advertisers saturate their audiences.
The Mobile Imperative
The consumption pattern that sustains this model has shifted decisively toward mobile banking. Despite representing only 40 percent of total banking activity, mobile applications generate 80 percent of offer engagement. Consumers check balances on their phones, see the offer tiles, and activate them in seconds. This channel dependence creates both strength and vulnerability.
The strength lies in attention economics. Mobile banking apps command high dwell time and trust, sers open them frequently, stay focused during interactions, and associate the space with financial security. This explains the high activation rates that advertisers value. However, if consumer behavior shifts away from mobile banking, toward voice interfaces, in-branch service revival, or decentralized finance applications, or if mobile banking engagement declines as the novelty of digital banking fades, the primary engagement channel collapses. Cardlytics has no direct consumer relationship to migrate users to a new interface; it exists only as a feature within the bank’s app.
The Insourcing Clock
Ultimately, Cardlytics faces a temporal constraint. The company exists because, at this particular moment in technology history, the fixed costs of building a compliant, scaled offer platform exceed the variable costs of paying Cardlytics thirty-five cents per dollar. But software gets cheaper, bank IT departments develop capabilities, and the revenue Cardlytics captures represents an ever-larger target as the platform scales.
If Chase were to internalize the capability, capturing the full thirty-five cent revenue share plus the underlying retention value, it would represent a pure transfer of wealth from Cardlytics to JPMorgan. The technical barrier, the firewall architecture, protects Cardlytics only as long as banks view the integration costs as higher than the ongoing revenue share. As cloud infrastructure penetrates deeper into banking and as APIs replace mainframe connections, that calculation shifts. A bank that develops the internal capability to run campaigns against its own transaction data without Cardlytics’ software would not need to replicate the multi-bank network immediately; it could start by capturing its own economics, then gradually build advertiser relationships.
The cascade risk is severe. Cardlytics’ network effects work in reverse. If one major bank defects, the remaining banks lose reach, making the platform less valuable to advertisers. Advertisers would reduce spend or demand lower rates, compressing margins and making the model less attractive for remaining banks. The aggregation that creates value also creates systemic fragility.
The Equilibrium Game
Cardlytics operates as a temporary equilibrium: solution to a coordination problem among banks that cannot easily share data with each other, and between banks and advertisers that cannot easily access bank data. The company extracts the minimum viable rent to survive, leaving the vast majority of value with its partners to discourage defection. It grows by adding banks to increase advertiser ROI, but each addition increases the incentive for the largest members to capture the economics themselves.
The endgame scenarios are limited. Cardlytics could attempt to raise take rates once scale is locked in, but doing so risks triggering the insourcing response it has carefully avoided. It could attempt to build consumer brand awareness to create defensible demand, but visibility invites regulation and bank resistance. It could expand into adjacent services, perhaps lending or deeper analytics, but these encroach on core banking businesses and invite competitive response.
Or the equilibrium holds. Banks could continue to find the thirty-five cent fee trivial compared to the retention value, preferring to outsource the complexity of advertiser management and measurement. Advertisers could continue to value the perfect RCTs and the aggregated reach. Cardlytics could remain the invisible infrastructure, capturing its modest share of the transaction flow indefinitely, a tolerated extractor in the financial plumbing, profitable but not dangerously so, essential but not irreplaceable: company that exists in the narrow space between what banks cannot build and what they will not tolerate being taken from them.
The measurement that sustains advertiser participation, those reported five-to-one returns, rests on a methodological foundation that is simultaneously robust and unverifiable. Cardlytics constructs its randomized controlled trials by partitioning the bank’s customer base into treatment and control groups at the individual level, using the bank’s own data to ensure identical pre-campaign spending patterns. The treatment group sees the offer; the control group does not. After the campaign period, Cardlytics compares actual spending behavior between the groups, measuring not just redemption of the specific offer but total category spending. This purportedly captures true incrementality: whether the Starbucks offer drove new coffee purchases or merely shifted existing spend from Dunkin’ Donuts.
The elegance of this approach masks a governance problem. Advertisers cannot independently audit these experiments. They receive summary reports showing lift percentages and confidence intervals, but they cannot access the underlying transaction data, hat remains trapped behind the bank firewall, accessible only to Cardlytics and the bank itself. If Cardlytics’ algorithms inadvertently skewed control group selection toward lower-activity accounts, or if the holdout methodology excluded high-value customers who would have generated the most organic spend, the reported five-to-one ratio could inflate systematically. The structural opacity that protects consumer privacy also protects the platform from scrutiny.
This creates a peculiar epistemic vulnerability. The digital advertising industry already suffers from a crisis of measurement credibility, itness the successive collapses of click-through rates, viewability metrics, and multi-touch attribution models. Cardlytics sells against this skepticism, promising “ground truth” derived from actual spending rather than proxy signals. Yet the promise requires faith in a black box. If Procter & Gamble or PepsiCo were to fund an independent analysis, hiring a firm like Nielsen or comScore to verify Cardlytics’ RCT methodology, they would hit the firewall architecture that defines the platform’s advantage. The data cannot leave the bank; therefore, the measurement cannot be independently validated.
The risk compounds because the incentives for optimistic measurement align across all parties. Banks want to show high engagement and strong advertiser ROI to justify the prominence of offer tiles in their apps. Cardlytics needs the five-to-one narrative to justify its thirty-five cent take rate. Advertisers’ internal marketing teams need to report strong performance to justify experimental budget allocation. In this triangular alignment, no party has immediate incentive to puncture the balloon. Only later, when an advertiser saturates their audience and sees returns decay, might someone commission a holdout study using proprietary credit card panel data, resources available to only the largest CPG companies, to compare against Cardlytics’ claims. If that study showed three-to-one or two-to-one instead of five-to-one, the channel’s economic justification would recalculate instantly. Advertisers paying thirty-five cents per dollar of spend require five-to-one returns to justify the fixed costs of campaign management; at two-to-one, many would exit.
Consider the specific mechanics of the 2018 inflection point, when Cardlytics transitioned from near-bankruptcy to viable platform. Prior to that summer, the company operated primarily through Bank of America, with limited reach and advertiser skepticism. The platform struggled to justify the learning costs required by major brands. Advertisers saw Cardlytics as a niche channel, nteresting for testing, insufficient for scaled campaigns. Then came the sequential announcements: Wells Fargo in May, Chase in July. The addition of these two giants transformed the reach equation suddenly. An advertiser could now access not forty million users but one hundred seventy million, covering the majority of American households. The fixed costs of learning the interface, training media buyers, and designing creative for the tiny tile format suddenly amortized across sufficient scale to justify serious budget allocation.
But this salvation story contains a darker reading. Chase and Wells Fargo did not join the network because Cardlytics offered superior technology; they joined because they observed Bank of America’s retention metrics and recognized that outsourcing the capability carried lower risk than building it internally. However, the participation of these mega-banks changed the power dynamics within the consortium. With three of the four largest American banks now sharing a common advertising platform, each began calculating the value of the others’ participation differently. Chase derives value from Wells Fargo’s presence because it makes the channel more attractive to advertisers; yet Chase also recognizes that if it were to withdraw and internalize, it would devastate the remaining network while potentially retaining advertiser relationships built during the consortium phase.
The mathematics of defection become increasingly favorable as the technology matures. Assume Chase spends approximately $50 million annually on Cardlytics revenue shares (based on disclosed volumes and typical splits). Over five years, that represents $250 million in payments to an intermediary. Building an internal platform would require $100-150 million in initial development, plus $20 million annually in maintenance and advertiser sales staff. On a five-year horizon, the internal build breaks even; on a ten-year horizon, it generates $100 million in savings. These are notional figures, but they illustrate the trajectory. As the platform proves the model, the case for renting versus owning deteriorates.
Furthermore, the specific UI constraint that Cardlytics accepted to secure bank placement, the logo-only tile format, creates a ceiling on advertiser diversity that reinforces concentration risk. The current interface displays offers as small rectangular tiles, typically showing only the merchant’s logo against a colored background. There is no space for promotional copy (“20% off your purchase”), no dynamic pricing, no rich media. This design choice reflects bank requirements: the offers must not resemble advertising, must not clutter the sanctity of the banking experience, and must appear as benefits or rewards rather than commercial intrusion.
For Starbucks, Target, or Home Depot, brands with near-universal recognition and established brand equity, this format suffices. Consumers see the green mermaid or the red bullseye and understand the value proposition immediately. But for mid-market retailers, regional chains, or direct-to-consumer brands without iconic logos, the format fails. A tile displaying the logo of a lesser-known home goods startup or a regional grocery chain generates no activation because consumers cannot parse the value proposition from a symbol alone. Cardlytics could solve this by expanding the tile size to include text descriptions or promotional details, but doing so would violate the bank constraints that keep the channel positioned as “rewards” rather than “advertising.”
This creates a structural cap on total addressable market. The platform can serve perhaps three hundred major national brands effectively. Below that tier, activation rates plummet because the creative format assumes brand recognition. Yet the large national brands, the current core clientele, face saturation effects. Once Starbucks has targeted every coffee drinker in the Chase ecosystem who does not currently visit Starbucks regularly, incremental returns decline. The advertiser hits a wall where the five-to-one returns compress to three-to-one or two-to-one as they scrape the bottom of the conversion funnel. Without a viable mid-market tier to replace the large brands as they saturate, Cardlytics faces revenue stagnation or forced price reductions.
The regulatory fragility operates along a similar axis of visibility. Currently, Cardlytics maintains near-perfect invisibility to consumers and regulators. Consumers perceive the offers as coming from their bank, “Chase gave me a Starbucks reward”, rather than from a third-party advertising platform analyzing their transaction history. This perceptual veil protects the company from the privacy scrutiny that has damaged ad-tech companies like Facebook or data brokers like Equifax. However, the veil is thinning. As states implement comprehensive privacy laws modeled on California’s CCPA, and as the Federal Trade Commission intensifies scrutiny of “dark patterns” and financial surveillance, the specific arrangement, whereby a third-party company analyzes transaction data to target commercial offers, may attract regulatory attention.
If regulators were to classify Cardlytics’ data processing as “sale” of personal information under privacy statutes, or if they required explicit consumer consent for the use of transaction data in advertising algorithms, the friction would increase dramatically. Banks would need to add consent layers to their mobile apps, likely reducing participation rates. More dangerously, regulatory attention could force disclosure of Cardlytics’ role, equiring “Powered by” attribution or explicit statements that “Cardlytics analyzes your purchases to show you these offers.” Such transparency would likely trigger consumer backlash and bank nervousness simultaneously. The entire model depends on consumers not thinking too hard about why their bank knows they might want a Starbucks coffee; making the data analysis explicit destroys the illusion of serendipity.
The temporal pressure manifests in the company’s strategic options. Cardlytics could attempt to expand internationally, replicating the bank partnership model in the UK, Canada, or Australia. However, international banking markets have different regulatory structures, pen banking regulations in the UK actually reduce the data governance advantage by mandating standardized APIs, potentially allowing competitors to access bank data more easily than in the US closed-banking environment. Alternatively, Cardlytics could pivot toward deeper integration with merchant point-of-sale systems, attempting to close the loop by connecting digital offers to in-store redemption through direct POS integration rather than card-linked methods. But this encroaches on territory dominated by Square, Toast, and other payment processors, inviting direct competition from entities with their own data advantages.
The most likely path remains the current equilibrium, continued existence as the tolerated middleman, yet this equilibrium requires constant reinforcement. Cardlytics must continue adding smaller banks and credit unions to the network, not because these institutions drive significant volume, but because their presence signals to the major banks that the network remains valuable and that defection would strand them without the aggregation benefits. It must maintain the thirty-five cent take rate even as its own technology costs decline, resisting the temptation to expand margins that would trigger renegotiation. And it must pray that the five-to-one ROI metric remains unchallenged by independent verification long enough for the channel to become entrenched in advertiser media plans as a “must buy” alongside Google and Meta, rather than remaining an experimental line item vulnerable to cuts during budget contractions.
Ultimately, Cardlytics represents a specific historical artifact: he moment when banking data became sufficiently digitized to enable targeted advertising, but before banks developed the internal capabilities to execute that targeting themselves. The company captures value by solving a coordination problem: no single bank has sufficient reach to justify advertiser fixed costs, and banks cannot easily share data to create a consortium without a trusted intermediary. Yet coordination problems are solved permanently once the coordinating mechanism becomes obvious. As the model proves itself, the incentive for the largest banks to internalize grows daily. Cardlytics’ continued existence depends on the major banks continuing to view the thirty-five cent fee as trivial protection money against the complexity of building internal ad tech, even as the technical barriers to such builds erode.
The company sits at the center of a delicate tripartite balance: consumers who want cash back and do not care who provides it; advertisers who want measurable returns and do not care who provides the measurement; and banks who want retention and will tolerate any extractor who delivers it cheaply enough. It is a business built on the temporary inconvenience of its partners, extracting rent from their organizational sclerosis. When that sclerosis clears, as it eventually must in competitive markets, the extractor becomes expendable. Until then, Cardlytics remains the invisible hand in your banking app, taking its modest cut while hoping no one asks too many questions about the math, the data, or the inevitable day when the banks decide to keep the full five dollars for themselves.