> ## Documentation Index > Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # September 2026 Card Issuing and Processing Release Notes > Release notes for the Card Issuing and Processing platform in September 2026: new features, enhancements, fixed issues, deprecations, and notable documentation changes. To follow new Card Issuing and Processing release notes with RSS, subscribe to the current release notes feed: `https://www.marqeta.com/docs/developer-guides/release-notes/rss.xml` > [!NOTE] > > Marqeta rolls out Card Issuing and Processing platform releases in phases. > If you don't see a feature in your environment yet, you will after Marqeta updates your environment to the new version. > Platform release numbers, such as V.2026.8.31.0, identify the release, not the date it becomes available. **New features** ## New transaction type for processing BACS credit payments **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta now supports `BACS_CREDIT`, a new transaction type for processing Bankers' Automated Clearing System (BACS) credit payments. This transaction type is available for UK transactions only. UK banks use BACS to send credit payments in British pounds, commonly for salary payments and supplier payments. Unlike Clearing House Automated Payment System (CHAPS), BACS payments clear over three business days rather than settling the same day. ## New program-level control to route all account verifications to your JIT Funding gateway **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta now supports forwarding every \$0 account verification request to your JIT Funding gateway, including requests that don't include Address Verification Service (AVS) data. Previously, Marqeta forwarded an account verification request to your JIT Funding gateway only when the request included AVS data, such as a postal code or street address. Account verification requests without AVS data, such as contactless transit taps and recurring billing checks, were approved automatically without reaching your gateway. For programs that enable this feature, your JIT Funding gateway now receives every \$0 account verification request, whether or not AVS data is present, using the same webhook method (`pgfs.authorization.account_verification`) and payload structure already used for AVS-present requests. When AVS data isn't present, Marqeta omits the AVS address fields from the request rather than sending empty or null values. Use this to decline an account verification yourself instead of letting Marqeta approve it automatically, such as declining a transit fare check before the cardholder taps through and the merchant force-posts the fare. This applies to both dual-message and single-message account verification requests, across Visa, Mastercard, and PULSE. This feature requires additional activation steps. To learn about activating it for your program, contact your Marqeta representative. For more information, see [Gateway JIT Funding Messages](https://www.marqeta.com/docs/core-api/gateway-jit-funding-messages.md). ## New stop\_order\_token field on transactions declined by a stop order **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta now includes a `stop_order_token` field on transactions declined because they match an active stop order. Use this field to identify which stop order caused the decline, without having to separately look up the cardholder's active stop orders. Previously, a stop-order decline (response code `1949`) identified that a stop order blocked the transaction, but not which stop order. This field is included automatically in transaction API responses (including `GET /transactions`), JIT Funding requests, and webhook payloads, for transactions declined with response code `1949`. It's omitted for all other transactions. No action is required — this field is additive. For more information, see [Subscription Management](https://www.marqeta.com/docs/core-api/subscription-management) and [Transactions](https://www.marqeta.com/docs/core-api/transactions). ## Improved error handling for digital wallet token lifecycle operations **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 On activate, suspend, and terminate requests, Marqeta forwards your request to the token service provider (TSP). Previously, when the TSP returned an ambiguous error — for example, token not found or invalid data — Marqeta passed that error back to you unresolved. Marqeta now resolves these ambiguous errors before responding. If the TSP's error is ambiguous, Marqeta checks with the TSP directly for the token's actual state before responding. * **Terminate:** If you request termination and the TSP returns an error indicating the token is not found, invalid, missing data, or already terminated, Marqeta treats the token as terminated and returns success (`201`) instead of an error. No action is required from you. * **Activate or suspend:** If you request activation or suspension and the TSP returns an error indicating the token is not found, invalid, missing data, or terminated, Marqeta returns `422004` with both the Marqeta state and the TSP state. Transition the token to terminated on your side. > [!NOTE] > > Marqeta only returns `422004` when it finds a real state mismatch on an activate or suspend request. A terminate request never returns `422004` — it either succeeds (`201`) or returns `422003`. This change applies to both Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES) token paths. For more information, see [Troubleshooting Digital Wallet Token Lifecycle Errors](https://www.marqeta.com/docs/developer-guides/troubleshooting-digital-wallet-token-lifecycle-errors.md), [Digital Wallets Management](https://www.marqeta.com/docs/core-api/digital-wallets-management), and [Errors](https://www.marqeta.com/docs/core-api/errors.md). **Bug fixes** ## Improved validation and error handling for POST /businesstransitions **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta fixed the following issues with `POST /businesstransitions`. * **Invalid reason\_code accepted:** Marqeta now rejects an empty string (`""`) for `reason_code` with error code `400001`, instead of storing it as a valid value. * **Idempotent replay returned an unexpected error:** Reusing a transition `token` with a different payload now returns the documented `409` (error code `409002`), instead of an unexpected `500`. Marqeta also changed the error message for an invalid `status` or `channel` value. The message no longer lists the accepted values; error code `400037` is unchanged. Rely on the `error_code` field, not the message text, to detect this error programmatically. For more information, see [Business Transitions](https://www.marqeta.com/docs/core-api/business-transitions) and [Errors](https://www.marqeta.com/docs/core-api/errors.md). ## Fixed: Omitting active on a gateway funding source update reactivated it **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta fixed an issue where `PUT /fundingsources/programgateway/{token}` reactivated a deactivated program gateway funding source whenever an update request omitted the `active` field. The `active` field now behaves like every other field on this endpoint: omitting it leaves the funding source's current active state unchanged. To change a funding source's activation state, include `active` explicitly in your request. For more information, see [Program Gateway Funding Sources](https://www.marqeta.com/docs/core-api/program-gateway-funding-sources). ## Fixed: Invalid fields or sort\_by value on GET /businesstransitions/business/{business_token} returned a 500 error **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Marqeta fixed an issue where `GET /businesstransitions/business/{business_token}` returned an unexpected `500` error when a request specified a `fields` or `sort_by` value that isn't valid for this resource. With this release, this endpoint returns the documented `400` (error code `400004`) for these requests instead. Marqeta also updated the `sort_by` parameter's documentation to list the exact fields it accepts. For more information, see [Business Transitions](https://www.marqeta.com/docs/core-api/business-transitions). **Documentation changes** ## API reference: consolidated error responses for migrated endpoints **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 Action required Marqeta has consolidated the error responses documented in the published API reference for a set of migrated endpoints, replacing individually listed `4xx` and `5xx` status codes with a single `default` error response with a typed body. This is a documentation change only — the status codes these endpoints return are unchanged. If you generate client code from the Marqeta OpenAPI spec, error handling for these endpoints now collapses from per-status branches to a single typed error model. Update your generated clients to branch on the error response body, rather than on the previously enumerated status codes. For more information, see [Errors](https://www.marqeta.com/docs/core-api/errors.md). ## API reference: corrected basic\_auth\_password length limit for program gateway funding sources **Platform release:** V.2026.8.17.0 **Sandbox release date:** September 30, 2026 **Production release date:** September 30, 2026 The API reference for creating and updating a program gateway funding source previously documented a maximum length of 100 characters for `basic_auth_password`. Marqeta has corrected this to the limit the server has always enforced: 20–50 characters, plus the complexity rule already documented for the field. This is a documentation correction only. Marqeta has never accepted a `basic_auth_password` outside this range. For more information, see [Program Gateway Funding Sources](https://www.marqeta.com/docs/core-api/program-gateway-funding-sources). ## Related topics - [September 2026 UX Toolkit Release Notes](https://www.marqeta.com/docs/developer-guides/ux-toolkit-release-notes/2026-09.md) - [April 2026 Card Issuing and Processing Release Notes](https://www.marqeta.com/docs/developer-guides/card-issuing-processing-release-notes/2026-04.md) - [May 2026 Card Issuing and Processing Release Notes](https://www.marqeta.com/docs/developer-guides/card-issuing-processing-release-notes/2026-05.md) - [June 2026 Card Issuing and Processing Release Notes](https://www.marqeta.com/docs/developer-guides/card-issuing-processing-release-notes/2026-06.md) - [July 2026 Card Issuing and Processing Release Notes](https://www.marqeta.com/docs/developer-guides/card-issuing-processing-release-notes/2026-07.md)