MQ · CIK 0001522540
What Marqeta, Inc. told the SEC could break it.
Marqeta is concentrated at both ends of its card-issuing business. On the demand side, a single customer dominates: Block, the parent of Cash App, accounted for 45% of net revenue in 2025 (down from 47% and 68% in the prior two years), so a further repricing, strategic shift or non-renewal by Block would be catastrophic. On the supply side, because it holds no bank charter, it depends on issuing banks and the card networks to actually issue cards and settle transactions — and that too is concentrated, with 64% of its total processing volume settling through a single bank, Sutton Bank. Wrapping both is a heavy, regulated-by-proxy regime: through its banks, customers and networks it is subject to CFPB, BSA/AML, OFAC, money-transmitter licensing and PCI rules, where heightened scrutiny of bank-fintech arrangements could raise costs or jeopardize those partnerships.
3 self-disclosed vulnerabilities, pulled from its own filings — each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Customer concentration
- Block (Cash App) = ~45% of net revenue (47% in 2024, 68% in 2023) — extreme single-customer dependencehigh
Marqeta has one of the most extreme single-customer concentrations among public fintechs: Block (Cash App's parent) accounted for 45%, 47% and 68% of net revenue in 2025, 2024 and 2023 respectively. The decline reflects the August 2023 Block Amendment (less favorable terms) plus growth in other customers, but Block still drives ~half of revenue and a significant share of receivables. Loss of, a further repricing by, or a strategic shift at Block — or a failure to renew the Block Agreement — would have a catastrophic impact. The relationship is captured as an edge; this risk records the existential dependence severity. A top-tier customer-concentration risk.
“Block accounted for 45%, 47%, and 68% of our net revenue, respectively.”
SEC filing →As of 2026
Regulatory & policy
- Rapidly evolving payments/banking regulation — Dodd-Frank/CFPB consumer protection, BSA/AML, OFAC sanctions, money-transmitter licensing, card-network rules and PCI DSS, directly and via Issuing Banksmedium
Marqeta is subject — directly and indirectly through its Issuing Banks, customers and Card Networks — to a rapidly evolving and extensive regulatory regime: Dodd-Frank/CFPB consumer-protection rules, Bank Secrecy Act/USA PATRIOT Act AML requirements, OFAC and equivalent sanctions screening, state money-transmitter licensing, payment-services rules, privacy/data-protection, export controls, and industry standards such as PCI DSS. Heightened scrutiny of bank-fintech 'sponsor bank' arrangements, new CFPB rules, or sanctions/AML enforcement could raise compliance costs, constrain product design, or jeopardize issuing-bank partnerships. A business-central, multi-layer regulatory exposure for a regulated-by-proxy payments platform.
“We are subject, directly, or indirectly through our relationships with our Issuing Banks, customers, or Card Networks, to a number of laws and regulations.”
SEC filing →As of 2026
Supplier concentration
- Dependence on Issuing Banks and Card Networks — 64% of Total Processing Volume settles through a single bank (Sutton Bank); cannot operate without sponsor banks and Visa/Mastercardmedium
As a card-issuing platform, Marqeta does not hold a bank charter and depends on Issuing Banks and Card Networks to actually issue cards, settle transactions and access payment rails. This dependence is concentrated: 64% of its Total Processing Volume settled through a single issuing bank, Sutton Bank, in 2025 (down from 76% in 2023). It states it relies on these relationships and that loss of them would adversely affect the business; some vendors are also a sole or limited source of services. Loss of a key issuing-bank relationship, a network rule change, or a sponsor-bank regulatory action could disrupt card programs with limited near-term alternatives. A concentrated sponsor-bank / network sole-source dependence (Sutton Bank captured as an edge).
“We rely on our relationships with Issuing Banks and Card Networks, and if we are unable to maintain these relationships, our business may be adversely affected.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings — including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its customers
“For our previous card program (the “Legacy Card Program”), launched in 2020, we rely on a single third-party vendor, Marqeta, for the Expensify Card, who also manages the relationship with the card's issuing bank, Sutton Bank, and the card network, Visa.”
Cited →“We generated 45% and 47% of our net revenue from our largest customer, Block, during the years ended December 31, 2025 and 2024, respectively.”
Cited →
Its suppliers
Sutton Bank
“For the years ended December 31, 2025, 2024 and 2023, 64 %, 70 % and 76 % of Total Processing Volume was settled through Sutton Bank, respectively.”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch