Card Scheme Compliance

Card scheme compliance is the set of activities through which banks, payment companies and merchants make sure they follow the rules of the card schemes, such as Visa, Mastercard, American Express, Discover and domestic networks. The rules cover how cards are issued and accepted, how transactions are coded and processed, how card data is protected, how fraud and disputes are kept within limits, and how the brands may be displayed.

Compliance obligations flow through contracts. Card networks bind their member issuers and acquirers to their payment network rules; acquirers in turn pass the relevant requirements to merchants, payment facilitators and sales agents in their merchant agreements. Breaches can lead to fines, called non-compliance assessments, which the acquirer usually passes on, and ultimately to termination. Scheme compliance is separate from, but overlaps with, legal and regulatory compliance.

Think of a franchise brand such as a chain of cafés. Each café is independently owned, but to use the brand it must follow the chain's rulebook on signage, hygiene and prices, and inspectors check that it does. A café that breaks the rules can be fined or lose the right to use the name.

Card networks work the same way. Banks and merchants that use the Visa or Mastercard name must follow the network's rulebook. Acquiring banks act as the inspectors for merchants, because they are responsible to the network for the merchants they sign up.

• Issuers. Card design, authorisation behaviour, dispute handling and cardholder protections.
• Acquirers. Merchant due diligence, correct transaction coding, monitoring of fraud and disputes, and oversight of agents.
• Processors and third parties. Registration with the networks as service providers, and security and certification requirements.
• Merchants and payment facilitators. Acceptance practices, data security and staying below fraud and chargeback thresholds.

• Data security. Meeting the PCI DSS, with validation requirements that depend on transaction volume.
• Transaction data integrity. Using the correct merchant category code, a clear merchant descriptor and accurate indicators for card-not-present and stored-credential transactions. Miscoding to disguise a merchant's business, sometimes called transaction laundering, is a serious violation.
• Acceptance rules. Rules on honouring cards, minimum purchase amounts and surcharging, which also depend on national law.
• Authentication. Supporting 3-D Secure and other authentication methods where required.
• Brand use. Displaying marks correctly and not implying network endorsement.

Networks run programmes that track fraud and dispute rates at merchant and acquirer level. Merchants that exceed thresholds, often measured through the chargeback ratio or fraud-to-sales ratio, enter a monitoring programme with deadlines to fix the problem, followed by escalating fees. Visa consolidated its fraud and dispute monitoring into the Visa Acquirer Monitoring Program in 2025, and Mastercard operates excessive chargeback and fraud programmes. Networks also run integrity programmes for business types with higher legal or reputational risk, such as gambling, adult content and some online sales models, which require registration and enhanced oversight; these feed into merchant risk classification. Merchants terminated for serious breaches can be listed on shared databases, such as Mastercard's MATCH list, which other acquirers check during onboarding.

Acquirers and payment facilitators typically maintain a scheme compliance function that tracks rule changes, which the networks publish in regular bulletins, and translates them into policies and system changes. Core controls include underwriting and periodic reviews of merchants, website and content monitoring, transaction monitoring for unusual patterns, and registration of independent sales organisations and other agents. Systems changes must often pass payment network certification. Rule changes can have commercial impact, so compliance teams work closely with product and finance teams. The cost of compliance is a significant barrier to entry in card acquiring, and serious failures can lead networks to impose substantial fines on the acquirer or to restrict its ability to sign new merchants.

Scheme rules operate alongside national law and cannot override it. Where they conflict, the law prevails, and networks adapt their rules by region. Surcharging is a common example: some countries ban it, others cap it, and network rules on disclosure and maximum amounts apply only where surcharging is legal. In the European Union, the Interchange Fee Regulation limits certain scheme practices, and competition authorities have examined network rules on several occasions. In the United States, the Durbin Amendment requires debit cards to support at least two unaffiliated networks, overriding any exclusive routing arrangement. Compliance teams must therefore track both rulebooks and legislation in every market they serve.