Debit & Credit Card Authorization — impact tolerance ≤ 30 minutes — ITOL

Impact tolerance: ≤ 30 minutes — any time, for > 2% of authorization volume (illustrative default — trace the derivation, then replace with your own harm analysis)

Definition: Real-time authorization of debit and credit card transactions at point-of-sale, ATM, and card-not-present channels via Visa/Mastercard networks.

Why it is designated: Card authorization does not go fully dark when the issuer host does. The networks switch to stand-in processing (STIP): Visa and Mastercard approve on the bank's behalf, within parameters the bank set in advance. Stand-in is mandatory for network members, not an optional service. The cost of downtime is therefore two-sided. Inside stand-in, approvals run balance-blind, so fraud and credit exposure accumulates every hour the host is dark. Outside the stand-in parameters, transactions decline at the point of sale — visible, non-recoverable customer harm. The networks also enforce SLA (service-level agreement) penalties for issuer availability.