Doesn't matter if you have 500 microservices if only one or two take part in card authorization (as it should be if microservices were architected correctly).

There's ton of logic on non-critical path that can be extracted to other microservices and called asynchronously - settlements, refunds, rewards, all management and reporting functionalities - to name just a few.