Pasje - Card Issuing and Card Controls Ops Console
Card Operations Console for a Dutch Fintech
Designed and built a clickable ops console for an Amsterdam fintech's Visa debit cards: find any card, see why an authorisation was declined, freeze, block or replace a card, and work the dispute queue against scheme deadlines - without staff ever seeing a full card number.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, card search, card detail with 7 tabs, the live authorisation stream and the dispute queue with its dispute panel.
Card status, channel, merchant category, limits, balance, PIN, SCA and fraud score - each shown as passed or failed, so an agent sees which control made the decision.
Cards show only the last four digits, expiry and processor token. Search rejects a pasted 16-digit number and explains why.
18 customers, 4 business customers, 3 card programs, 37 authorisations, 10 wallet tokens and 14 disputes across every stage.
The Problem
Vondel Pay launched cards with the issuing processor's default dashboard and a support inbox. Customers could not freeze a lost card themselves, every limit change and "why was I declined?" question became a ticket, agents switched between the processor, card manufacturer and scheme dispute portals to answer one, and disputes were missing scheme deadlines because nobody owned the queue.
Our Solution
Pasje gives Vondel Pay's card operations and disputes staff one console across the card lifecycle: search any card without a full card number, read every authorisation with the control check that decided it, freeze, block, replace or reissue a card, change limits within the program maximum, and work disputes sorted by scheme deadline.
The Challenge: Cards Under Many Rulebooks
Vondel Pay is not a bank. It issues Visa debit cards under a BIN sponsorship with a DNB-licensed e-money institution, through an issuing processor, so every card action has to respect the sponsor's policies, the scheme's rules and EU payments law at once.
Declines Nobody Could Explain
A decline can come from a frozen card, a channel the cardholder turned off, a blocked merchant category, a limit, the balance, a wrong PIN, a failed 3-D Secure challenge or a fraud score. Agents saw a response code and had to guess which one.
Card Data That Must Never Be Seen
Under PCI DSS the full card number, CVV and PIN stay in the processor's certified vault. Support still has to find the right card fast, using only the last four digits, the expiry, token references and the customer.
Scheme Deadlines on Every Dispute
Visa sets reason codes, evidence rules and a deadline for each dispute stage, and PSD2 expects an unauthorised payment refunded by the end of the next business day. Missing either one costs money or breaks the rules.
Many Hands on the Same Controls
Cardholders, business admins and ops staff can all freeze cards or change limits and channels. Without a record of who changed what, support could not tell a customer's own setting from a decision made by ops.
Our Approach: From Card Rules to a Clickable Console
Spec and Rules Research
Mapped 9 roles across three audiences (cardholder app, business admin portal and ops console), 39 screens and the data model for programs, BIN ranges, cards, controls, wallet tokens, authorisations, transactions and disputes. Wrote down the rules the design must follow: PSD2 and the RTS on SCA, payer protection in the Dutch Civil Code, the Interchange Fee Regulation, the Cross-border Payments Regulation, PCI DSS, Visa dispute rules, the Wwft, GDPR and the UAVG.
Clickable Demo on a Production UI Kit
Built the ops console's 5 key screens on a production dashboard kit: the dashboard with approval rate by hour and the processor incident marked, card search, card detail with freeze, block, replace, reissue and edit limits actions, the authorisation stream with a live mode, and the dispute queue with provisional credit and scheme filing. Changes made on a card are appended to its controls history as you click.
What a Production Build Adds
Integration with the issuing processor (such as Marqeta, Adyen Issuing, Enfuce or Thredd) for card records, authorisations and the secure reveal, the 3-D Secure access control server, Visa Token Service, the card manufacturer and PostNL. Staff SSO with role-based permissions, an append-only audit log, and the remaining screens: the cardholder app, the business admin portal, card programs, production batches, scheme notifications, fees, reports and settings.
Why It Works: Every Decision Explained
Declines Show Their Reason
Every authorisation opens a panel with the raw fields, the SCA method or exemption, the latency and each control check with its result. The dashboard ranks today's decline reasons and clicks through to the matching authorisations.
Card Numbers Stay in the Vault
The console works with card ids, the last four digits, expiry and processor tokens only. There is no way to see a full card number, and the screen says so instead of hiding it.
Deadlines Drive the Queue
Disputes are sorted by scheme deadline, amber within 10 days and red within 5, with assignees and bulk assign. The sidebar counts disputes due within 5 days, so nothing waits unowned.
Controls Within Program Limits
Each limit is shown against its program maximum, every channel and category shows who changed it last, and blocking a card asks for a reason and whether to order a replacement.
Related case studies
View all: Banking & lending
Keelstone - Core Banking Back-Office Console with Maker-Checker
Designed and built a clickable back-office console for a Singapore bank's deposit operations: holds and blocks, limit changes, fee waivers, payment repairs and end-of-day, with every money-moving change going through maker-checker approval.
Keystep - Digital Bank Onboarding with ID, Liveness and Risk-Based Review
An onboarding platform for an Irish digital bank: applicants open a EUR current account from their phone with ID and selfie liveness checks, and a staff console lets onboarding and financial crime teams review the cases the rules cannot decide, through to an issued Irish IBAN.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab