Payment Network Rules

Payment network rules are the private rulebooks that card networks and other payment schemes require their participants to follow. They govern who may join the network, how cards or payments are issued and accepted, how transactions are authorised, cleared and settled, how disputes are resolved, who bears losses, what security standards apply and what fees are charged. For card networks, the best known are the Visa Core Rules and Visa Product and Service Rules and the Mastercard Rules; account-based systems have their own, such as the Nacha Operating Rules for US ACH payments and the European Payments Council's rulebooks for SEPA schemes.

Network rules are contracts rather than laws. They bind members directly, and members pass relevant obligations to merchants, processors and agents through their own agreements. They sit alongside public regulation, which can override them, and they have often been examined by competition authorities because the largest networks have significant market power.

A sports league has a rulebook that every club signs up to: how matches are played, how referees settle disputes, what happens if a club breaks the rules, and how television money is shared. Clubs cannot opt out of the rules they dislike while staying in the league.

Payment networks work like leagues. Banks that join Visa, Mastercard or an ACH scheme agree to the rulebook, and merchants and payment firms who use those banks inherit many of the same obligations. The rules are what make a card issued in one country work smoothly at a shop in another.

• Membership and licensing. Eligibility, capital or collateral requirements, and the registration of agents and processors.
• Acceptance. Rules on honouring all valid cards of a brand, treating cards equally, minimum purchase amounts and surcharging, subject to national law.
• Processing standards. Message formats, data elements, time limits for capture and clearing, and technical certification.
• Disputes. Reason codes, evidence requirements and deadlines for chargebacks and responses.
• Liability. Which party bears fraud losses in different circumstances.
• Security and brand. Data protection standards, such as the PCI DSS, and how logos may be shown.
• Fees. Interchange tables, scheme fees and fines for non-compliance.

In the four-party card model, the network contracts only with issuers and acquirers. The acquirer's merchant agreement then makes the merchant follow the relevant rules, and the acquirer is liable to the network if its merchants break them. In a three-party model, the network contracts with merchants and cardholders directly. Rules are updated regularly, often twice a year, and published in member bulletins; members must implement changes by set dates, sometimes after payment network certification of their systems. Enforcement and monitoring are discussed under card scheme compliance.

Bank transfer and direct debit schemes have rulebooks too, often with consumer protections built in. Under the Nacha Operating Rules, a consumer can generally have an unauthorised ACH debit returned if it is reported within 60 days of the statement showing it, and originators must meet data security and authorisation requirements. Under the European Payments Council's SEPA Core Direct Debit rulebook, a payer may demand a refund of an authorised debit within eight weeks without giving a reason, and of an unauthorised one within 13 months. Instant payment schemes, such as SEPA Instant and FedNow, set rules on availability, timeouts and fraud handling for payments that settle within seconds.

Networks use rules to push the industry towards safer technology. The best-known example is the EMV liability shift: from October 2015 in the United States, for most merchants, liability for counterfeit card fraud moved to whichever party, issuer or merchant, had not adopted chip technology. Similar shifts apply online: when a merchant authenticates a payment with 3-D Secure, liability for certain fraud disputes generally moves to the issuer. Such rules change incentives without any law being passed.

Because network rules affect prices and competition across the economy, they are frequently scrutinised. The European Commission has challenged interchange levels and cross-border acceptance rules, and the EU Interchange Fee Regulation limited the honour-all-cards rule so that merchants can decline some card categories, such as commercial cards. In the United States, the Durbin Amendment prohibited network exclusivity on debit cards, and in 2018 the Supreme Court upheld American Express's rules restricting merchants from steering customers to other cards, in Ohio v. American Express. Merchants have also pursued long-running class actions over interchange and acceptance rules. These cases are part of the wider field of antitrust law.

• Nacha
• European Payments Council