AdSovereign logo

    Ad Tech Compliance

    Financial Services Programmatic: Case Evidence Guide

    Published · Last updated
    Next scheduled review:

    By Art Kukharenko

    Financial Services Programmatic: Case Evidence Guide

    A financial advertising infrastructure case needs evidence of the institution’s data boundaries, applicable obligations, controls and operating results. The original customer evidence is unavailable for this page. Use the evaluation framework below to plan your own review; it does not establish that a bank achieved a compliance outcome.

    Key facts

    • The law sets the boundary, not the vendor. Regulation P lets a bank share nonpublic personal information with a non-affiliated third party only after notice and a reasonable opportunity to opt out, with a 30-day window by mail or after electronic acknowledgement (12 CFR 1016.10); the service-provider and joint-marketing exception requires a contract that limits the third party's use of the data (12 CFR 1016.13).
    • Card numbers stay out of the ad stack. PCI DSS v4.0.1's future-dated requirements became mandatory on 31 March 2025 (usd AG, 2025); every live network targets on merchant, category, spend and recency, never on the primary account number.
    • The biggest bank network exports nothing. Chase Media Solutions runs cash-back offers in Chase's own channels only, charges when a customer views and purchases, and reports 84 million customers and $11.2 billion of merchant spend driven in 2025 (chase.com, accessed 17 October 2026).
    • Banks are already restricting platform access. Cardlytics stopped reporting monthly active users on 1 January 2025 because newer bank partners do not provide equivalent user data, and Bank of America campaigns concluded in January 2026 (Cardlytics 10-K, FY2025; Cardlytics, 4 March 2026).
    • In the EU, marketing use of payment data needs its own consent. The EDPB's guidelines on PSD2 and GDPR distinguish PSD2's contractual consent from GDPR consent for further processing (EDPB Guidelines 06/2020, final version, December 15, 2020).
    • The category is growing fast enough to justify the build. US financial media network ad spend is forecast to rise from $680 million in 2025 to $3.15 billion in 2028 (eMarketer, January 2026).

    Definition

    Owned financial media network: a bank's or payments company's advertising business in which transaction records, consent state, audience construction and purchase matching all run on infrastructure the bank controls, and only segment identifiers, offer placements and aggregated reports leave that boundary.

    This is the pattern described for the live networks in Financial media networks explained and listed in the commerce media networks directory. The alternative, giving a platform the transaction feed, is the model banks are leaving.

    Evidence status

    Customer outcome not verified. Original client records, reporting periods and source data are unavailable. The historical result and customer narrative are withheld.

    Evaluate the workflow

    • Map data fields, recipients, purposes and applicable obligations.
    • Review access, retention, incident handling and control evidence with responsible owners.
    • Obtain the audit scope and findings before describing a compliance result.

    Read the current references

    Read the adtech compliance guide for the broader decision framework.

    FAQ

    Do we need customer consent to show card-linked offers? In the US, offers shown in the bank's own channels on the bank's own data generally do not require sharing nonpublic personal information with a non-affiliated third party, so the Reg P opt-out is not triggered by the display itself; it is triggered if a processor or partner receives the data outside the §1016.13 exception (12 CFR 1016.10). In the EU, profiling payment data for marketing needs a GDPR basis separate from PSD2 (EDPB Guidelines 06/2020). Most live networks add an explicit marketing opt-in anyway.

    Can we use a third-party platform without giving it our transaction feed? Yes, if the platform runs inside the bank's perimeter or receives only segment IDs. Cardlytics' 2025 10-K shows that newer bank partners already withhold user-level data, which is why it stopped reporting monthly active users (Cardlytics 10-K, FY2025). Put the data-access terms in the contract before the integration.

    Is the card number ever used for targeting? No. Every live network targets on merchant, category, spend band and recency, and the media stack sits outside the PCI DSS cardholder data environment. PCI DSS v4.0.1's future-dated requirements have been mandatory since 31 March 2025 (usd AG, 2025).

    Can we run offsite ads on bank data? Only through a bidder the bank controls, sending pseudonymous segment IDs with no transaction attributes, and measuring through a clean room. PayPal is the only payments company doing this at scale, in the US since 29 April 2025 and in Germany and the UK since 17 September 2025 (PayPal, 17 September 2025). Chase has chosen not to.

    How long does a launch take? Chase launched Chase Media Solutions in April 2024, about two years after acquiring Figg in 2022 (Business Wire, 3 April 2024). A bank renting the merchant network and owning the decisioning can run a first offers campaign faster; the consent store and data-use register are the critical path, not the ad tech.

    How this works on owned infrastructure

    AdSovereign provides an enterprise RTB stack for deployment inside a customer’s own infrastructure. Use the architecture to map the relevant components, the security controls to evaluate access and data boundaries, and the pilot to define a bounded evaluation. Compare the operating responsibilities and commercial terms against your own requirements. Infrastructure control does not establish demand access, legal permission or a measured performance improvement on its own.

    Sources

    1. eCFR, 12 CFR 1016.10, Regulation P limits on disclosure of nonpublic personal information. https://www.ecfr.gov/current/title-12/chapter-X/part-1016/subpart-B/section-1016.10
    2. eCFR, 12 CFR 1016.13, exception to opt-out requirements for service providers and joint marketing. https://www.ecfr.gov/current/title-12/chapter-X/part-1016/subpart-C/section-1016.13
    3. usd AG, "PCI DSS v4.0.1: Are You Ready for the Future-dated Requirements?" (2025). https://www.usd.de/en/pci-dss-future-dated-requirements/
    4. EDPB, Guidelines 06/2020 on the interplay of PSD2 and GDPR (final version, December 15, 2020). https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202006_psd2_afterpublicconsultation_en.pdf
    5. Chase Media Solutions site (accessed 17 October 2026). https://www.chase.com/mediasolutions/home
    6. Business Wire, "Chase launches Chase Media Solutions" (3 April 2024). https://www.businesswire.com/news/home/20240403664648/en/
    7. Cardlytics, Form 10-K FY2025. https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm
    8. Cardlytics, Q4 and FY2025 results (4 March 2026). https://www.businesswire.com/news/home/20260304946746/en/Cardlytics-Announces-Fourth-Quarter-and-Full-Year-2025-Financial-Results
    9. Marketing Dive, Mastercard Commerce Media (1 October 2025). https://www.marketingdive.com/news/mastercard-bigger-grab-commerce-media-dollars-new-network/761568/
    10. Citigroup, Kard acquisition (13 August 2026). https://www.citigroup.com/global/news/press-release/2026/citi-expands-customer-engagement-commerce-media-capabilities-kard-addition
    11. PayPal Newsroom, Offsite Ads in Germany and the UK (17 September 2025). https://newsroom.paypal-corp.com/2025-09-17-PayPal-Expands-Offsite-Ads-to-Germany-and-the-UK
    12. Payments Dive, Klarna F-1 advertising revenue (19 March 2025). https://www.paymentsdive.com/news/klarna-buy-now-pay-later-bnpl-merchant-advertising-revenue/742883/
    13. United Airlines, Kinective Media launch (7 June 2024). https://united.mediaroom.com/2024-06-07-United-Launches-Airline-Industrys-First-Media-Network
    14. Hospitality Net, Marriott Media launch (12 June 2025). https://www.hospitalitynet.org/news/4127669.html
    15. The Media Leader, Revolut ad offering (2023). https://uk.themedialeader.com/fintech-challenger-revolut-ready-to-experiment-with-agencies-on-ad-offering/
    16. IAB, final IAB/MRC Retail Media Measurement Guidelines (January 2024). https://www.iab.com/guidelines/final-iab-mrc-retail-media-measurement-guidelines-available-for-download/
    17. eMarketer, "The State of Financial Media Networks 2026" (January 2026). https://www.emarketer.com/content/state-of-financial-media-networks-2026

    Changelog

    • October 17, 2026: updated search phrasing, source-linked reference context, author and dates. Withheld numerical claims without inline sources.

    What to read next

    Continue with the ad tech compliance reference guide.