Cuscal

Cuscal Limited is Australia's largest independent provider of payments and regulated data services outside the Big Four banks, founded in 1966 and listed on the ASX (ticker CCL). An Authorised Deposit-taking Institution regulated by APRA and ASIC, Cuscal supplies the connectivity and processing layer beneath hundreds of banks, mutuals, credit unions, fintechs, non-bank lenders and corporates - carrying scheme card issuing and acquiring, the New Payments Platform (NPP) with PayID and PayTo, Direct Entry, BPAY, RTGS, ATM services, AI-driven fraud monitoring, and Consumer Data Right (open banking) data-holder and accredited-data-recipient services. Its acquisitions of Indue and the Paymark/Strategic Payments Services businesses broadened its issuer-processor and acquiring reach. Cuscal's API posture is B2B and relationship-gated: it runs a public-facing Developer Hub (ReadMe-hosted) documenting CMS REST APIs for card issuing, card controls and PIN services with webhook notifications, but the full reference and any machine-readable OpenAPI definitions sit behind client onboarding rather than open self-serve signup.

Kin Score

This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.

How we profile Cuscal

Each block below is one kind of artifact we hold for Cuscal. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.

APIs 3

Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.

Individual APIs this provider publishes, each with its own machine-readable definition.

Cuscal Digital Card Issuance API

Part of Cuscal's CMS REST API family for card issuers. Enables instant digital card issuance and provisioning of cards into mobile and digital wallets (the 'Pays') for online an...

Cuscal Card Controls API

CMS REST API letting cardholders and back-office staff control and restrict card usage - locking and unlocking cards and blocking certain transaction types to reduce fraud. Docu...

Cuscal PIN Services API

CMS REST API providing self-service PIN set and change functionality that issuers can embed in mobile payment apps, removing reliance on PIN mailers. Documented on the Cuscal De...

Event Specifications 1

Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Cuscal Webhooks

ASYNCAPI

Security Posture 1

Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Cuscal Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Resources

Every other property we hold for Cuscal — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.

← All providers · Data indexed from github.com/api-evangelist/cuscal · machine-readable index on apis.io