How to Build a Financial Media Network Without Moving Data

Keep the ledger, consent store, audience engine and measurement inside the bank's perimeter; export only segment IDs, offer placements and aggregated reports. Start with card-linked offers, which transfer no data, add onsite media when the app has a shopping surface, and add offsite only through an owner-controlled bidder and a clean room. Every live bank network already works this way.

A bank media network has three boundaries that an auditor will test. Drawing them first makes every later decision easier.

Boundary 1: the cardholder data environment. The primary account number, expiry and authentication data live here under PCI DSS. Nothing in the media stack should touch them. Transactions reach the media stack as tokenized events with merchant, category, amount, date and a customer token. If the media stack can reverse the token, it is in PCI scope.

Boundary 2: the bank's data perimeter. Nonpublic personal information, in GLBA terms, includes any information a consumer provides to get a financial product and any information from a transaction (12 CFR 1016.10). Audience building, offer matching and purchase measurement happen inside this perimeter. The question for every component is whether it needs records or only counts.

Boundary 3: the advertiser interface. Advertisers and agencies see audience sizes, offer placements, campaign reports and, where overlap analysis is wanted, a clean room. They never see records. United states that "advertisers cannot access the personally identifiable information" of its customers and that segments are "aggregated and anonymized" (United, 7 June 2024); Marriott calls its platform "consent-based, with easy opt-out options" (Hospitality Net, 12 June 2025). A bank should be able to make the same two statements on day one.

The zones map to components a bank already has (core, consent, CRM) and components it must add (audience engine, offer engine, onsite decisioning, bidder, clean room, measurement). What differs from a retail stack is the strictness of the B–E boundary and the absence of a shared pixel or customer file. For how retailers do the same with loyalty data, see Shopper data monetization; for the clean room options, see Clean room architectures compared.

1. Map the legal bases. For US customers: Regulation P notice and opt-out status per customer, affiliate versus non-affiliate sharing, the §1016.13 exception and the contracts it requires, FTC Safeguards Rule controls for any processor. For EU and UK customers: GDPR lawful basis for marketing profiling (consent in practice), PSD2 Article 94 contractual consent for the payment service itself, ePrivacy and PECR for messaging. Output: a data-use register that says, per data element and per use, which basis applies. The rules in depth are in GLBA and advertising with bank data.
2. Classify the data. Three tiers: PCI data (never in the media stack), nonpublic personal information (inside the perimeter only), derived attributes (category spend bands, recency, merchant flags) that may feed segments. Decide which categories are excluded entirely: health, pharmacy, gambling, religious and political merchants, and any category a state law treats as sensitive. Pharmacy networks already exclude prescription data for this reason; see Ad tech compliance: PCI, HIPAA, SOC 2.
3. Build the consent store before the audience engine. One record per customer with: Reg P opt-out state and date, marketing opt-in for third-party offers, offsite advertising opt-in or opt-out, channel preferences, and the version of the notice shown. Revolut shows ads only in a dedicated section behind a third-party marketing opt-in (The Media Leader, 2023); that is the simplest pattern to audit.
4. Design segments with minimum sizes. Every segment has a floor (commonly 1,000 or more customers) below which it cannot be sold or reported, and a definition that uses derived attributes only. Keep a segment registry with owner, definition, floor, creation date and the consent flags it requires. This registry is what the regulator asks for.
5. Start with card-linked offers. Offers need a merchant sales motion, an eligibility engine and settlement, but no third-party data transfer: the merchant funds a cash-back amount, the bank matches the purchase in its own ledger and credits the customer. Chase charges only when a customer views and purchases (chase.com, accessed 17 October 2026); Mastercard's network uses the same unit and distributes through issuers such as Citi (Marketing Dive, 1 October 2025). Decide early whether to rent the merchant network (Mastercard, Kard, Cardlytics) while owning the decisioning and the data.
6. Add onsite media when there is a surface. Sponsored search and display earn only where customers browse. Klarna's $180 million of 2024 ad revenue came from a shopping surface inside its app, sold through a self-serve manager (Payments Dive, 19 March 2025). A bank without a marketplace or offers hub should not expect onsite revenue from a balance screen.
7. Add offsite only through owned bidding and a clean room. Offsite means sending a segment ID, never a transaction attribute, in bid requests from a bidder the bank controls, and measuring through a clean room where brand and bank each keep their records. PayPal runs offsite on its own transaction graph of more than 430 million accounts (PayPal, 17 September 2025) and is the only payments company doing so; most banks will treat offsite as phase three. For EU banks the bidder and clean room must also meet the residency and sovereignty tests in EU sovereign ad tech.
8. Measure with holdouts from day one. Closed-loop attribution is automatic for offers (the purchase is the billing event), so the question buyers will ask is incrementality. Build randomised holdout groups into the offer engine, report lift with confidence intervals, and align definitions with the IAB/MRC retail media guidelines of January 2024 even though they were written for retailers (IAB, January 2024). Chase sells incremental-lift reports as a product for this reason.

The direction of travel is down the table. Chase acquired Figg in 2022 and launched its own network in 2024 (Business Wire, 3 April 2024); Citi agreed to acquire Kard on 13 August 2026 (Citigroup, 13 August 2026); Cardlytics' disclosures show the platform model losing data access and its largest campaigns. The economics of each option, with editable assumptions, are in the commerce media business case template.

Published enforcement in this area is thin, so the practical test is the one the bank's own examiners and auditors apply. Expect questions on four things: whether the Reg P notice describes the advertising use and whether opt-outs are honored in the offer engine; whether any processor receives nonpublic personal information without a §1016.13 contract; whether card data is in the media stack's scope; and whether the bank can show, for a given customer, what was displayed and on what basis. The architecture above is designed so each question has a log behind it. For the finance-sector precedent on the compliance side of a programmatic deployment, see Case: finance ad tech compliance.

Do we need customer consent to show card-linked offers? In the US, offers shown in the bank's own channels on the bank's own data generally do not require sharing nonpublic personal information with a non-affiliated third party, so the Reg P opt-out is not triggered by the display itself; it is triggered if a processor or partner receives the data outside the §1016.13 exception (12 CFR 1016.10). In the EU, profiling payment data for marketing needs a GDPR basis separate from PSD2 (EDPB Guidelines 06/2020). Most live networks add an explicit marketing opt-in anyway.

Can we use a third-party platform without giving it our transaction feed? Yes, if the platform runs inside the bank's perimeter or receives only segment IDs. Cardlytics' 2025 10-K shows that newer bank partners already withhold user-level data, which is why it stopped reporting monthly active users (Cardlytics 10-K, FY2025). Put the data-access terms in the contract before the integration.

Is the card number ever used for targeting? No. Every live network targets on merchant, category, spend band and recency, and the media stack sits outside the PCI DSS cardholder data environment. PCI DSS v4.0.1's future-dated requirements have been mandatory since 31 March 2025 (usd AG, 2025).

Can we run offsite ads on bank data? Only through a bidder the bank controls, sending pseudonymous segment IDs with no transaction attributes, and measuring through a clean room. PayPal is the only payments company doing this at scale, in the US since 29 April 2025 and in Germany and the UK since 17 September 2025 (PayPal, 17 September 2025). Chase has chosen not to.

How long does a launch take? Chase launched Chase Media Solutions in April 2024, about two years after acquiring Figg in 2022 (Business Wire, 3 April 2024). A bank renting the merchant network and owning the decisioning can run a first offers campaign faster; the consent store and data-use register are the critical path, not the ad tech.

Use the commerce media guide to compare the related operating models, definitions and evidence before making this decision.

1. eCFR, 12 CFR 1016.10, Regulation P limits on disclosure of nonpublic personal information. https://www.ecfr.gov/current/title-12/chapter-X/part-1016/subpart-B/section-1016.10
2. eCFR, 12 CFR 1016.13, exception to opt-out requirements for service providers and joint marketing. https://www.ecfr.gov/current/title-12/chapter-X/part-1016/subpart-C/section-1016.13
3. usd AG, "PCI DSS v4.0.1: Are You Ready for the Future-dated Requirements?" (2025). https://www.usd.de/en/pci-dss-future-dated-requirements/
4. EDPB, Guidelines 06/2020 on the interplay of PSD2 and GDPR (final version, December 15, 2020). https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202006_psd2_afterpublicconsultation_en.pdf
5. Chase Media Solutions site (accessed 17 October 2026). https://www.chase.com/mediasolutions/home
6. Business Wire, "Chase launches Chase Media Solutions" (3 April 2024). https://www.businesswire.com/news/home/20240403664648/en/
7. Cardlytics, Form 10-K FY2025. https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm
8. Cardlytics, Q4 and FY2025 results (4 March 2026). https://www.businesswire.com/news/home/20260304946746/en/Cardlytics-Announces-Fourth-Quarter-and-Full-Year-2025-Financial-Results
9. Marketing Dive, Mastercard Commerce Media (1 October 2025). https://www.marketingdive.com/news/mastercard-bigger-grab-commerce-media-dollars-new-network/761568/
10. Citigroup, Kard acquisition (13 August 2026). https://www.citigroup.com/global/news/press-release/2026/citi-expands-customer-engagement-commerce-media-capabilities-kard-addition
11. PayPal Newsroom, Offsite Ads in Germany and the UK (17 September 2025). https://newsroom.paypal-corp.com/2025-09-17-PayPal-Expands-Offsite-Ads-to-Germany-and-the-UK
12. Payments Dive, Klarna F-1 advertising revenue (19 March 2025). https://www.paymentsdive.com/news/klarna-buy-now-pay-later-bnpl-merchant-advertising-revenue/742883/
13. United Airlines, Kinective Media launch (7 June 2024). https://united.mediaroom.com/2024-06-07-United-Launches-Airline-Industrys-First-Media-Network
14. Hospitality Net, Marriott Media launch (12 June 2025). https://www.hospitalitynet.org/news/4127669.html
15. The Media Leader, Revolut ad offering (2023). https://uk.themedialeader.com/fintech-challenger-revolut-ready-to-experiment-with-agencies-on-ad-offering/
16. IAB, final IAB/MRC Retail Media Measurement Guidelines (January 2024). https://www.iab.com/guidelines/final-iab-mrc-retail-media-measurement-guidelines-available-for-download/
17. eMarketer, "The State of Financial Media Networks 2026" (January 2026). https://www.emarketer.com/content/state-of-financial-media-networks-2026