Card network rules merchants should know

Card networks such as Visa and Mastercard publish rules for the financial institutions that take part in their networks. Merchants are not usually party to those rules directly. The rules reach you through your acquirer or payment processor, in the agreement you accept to take card payments, and they shape what your website must show, how your business is classified and how your dispute and fraud levels are monitored.

You do not need to read the rulebooks cover to cover. It helps to know how the chain works and which rules most often touch an online merchant. This page covers that at a general level, using Visa's public rules and Stripe's documentation.

Who the rules apply to

Visa publishes the Visa Core Rules and Visa Product and Service Rules, which it says govern the participation of its financial institution clients in the Visa system. The public edition is redacted: Visa states that it omits proprietary and competitive information and certain network security details.

Visa's rules assign responsibility to its members. A writing convention in the rules explains that a sentence such as "A Merchant must" means that the acquirer must ensure its merchant does so. In practice, the acquirer is answerable to Visa for what its merchants do, and it passes those obligations on in its contracts.

Visa's support page points merchants to the same place, referring them to the acceptance agreement between the merchant and its acquirer for additional requirements.

How the rules reach you

Visa's rules require an acquirer to have a merchant agreement with each merchant that accepts Visa cards, and a payment facilitator to have one with each of its sponsored merchants. That agreement must require the merchant to, among other things:

• Perform its obligations in compliance with applicable laws and regulations.
• Comply with the Visa rules on use of Visa's marks, card acceptance, risk management and transaction processing.
• Not knowingly submit any transaction that is illegal or that the merchant should have known was illegal.

The agreement must also give Visa the right to limit or terminate the merchant relationship. So when you accept a processor's terms, you are also accepting obligations that come from the networks.

Before taking a merchant on, Visa's rules require the acquirer or payment facilitator to carry out an adequate due diligence review. The page on how payment processors review a merchant explains what that looks like.

Rules that show up on your website and checkout

Several network rules are visible to any buyer. Visa's public rules include these:

• Merchant website contents. An e-commerce merchant's website must include customer service contact details, such as an email address or telephone number, an address for cardholder correspondence and a policy for delivery of multiple shipments. It must also clearly show the merchant's country on the checkout screen or within the checkout pages. A link to a separate page does not meet that requirement.
• Return, refund and cancellation policies. A merchant that restricts returns or cancellations must disclose its policy before final checkout, with a click-to-accept or similar acknowledgement.
• Merchant name. The name used to identify a merchant must be the name it mainly uses with customers, shown on its website, and used consistently, including on receipts and in dispute records. This is one reason your statement descriptor should match the name on your site.
• Merchant category code. The acquirer must assign the merchant category code that most accurately describes the merchant's business. An accurate description of your business is what makes an accurate code possible.

The checkout copy checklist turns these into items you can check on your own site.

Monitoring programs

Networks also watch merchants' dispute and fraud levels. Stripe's documentation explains that, as part of a merchant's financial obligations to the card networks, disputes and fraud must stay at acceptable levels. If they exceed a network's thresholds, the network places the merchant in a monitoring program, where monthly fines and additional fees can apply until levels come down in a sustained way. Stripe warns that failing to meet a program's requirements in time can lead to the network refusing to process further payments for the merchant.

Stripe's documentation describes the main programs, including:

• Visa Acquirer Monitoring Program (VAMP). It monitors disputes and fraud together, counting both disputes and issuer fraud reports, and separately monitors card testing activity.
• Mastercard Excessive Chargeback Program. It has two levels, Excessive Chargeback Merchant and High Excessive Chargeback Merchant, based on chargeback counts and rates.
• Mastercard Excessive Fraud Merchant Compliance Program. It looks at fraud-related chargebacks alongside the use of 3D Secure.

Thresholds and fines are set by the networks and they change. Stripe's documentation lists the current figures and says it is a general guide, not a complete reference, so check the networks' own documentation for anything you rely on. Two points from Stripe's guidance are worth knowing regardless of the figures. Monitoring programs do not take refunds into account when counting disputes, and they do not consider dispute outcomes, so a dispute you win still counts. And Visa identifies an account partly by the fixed part of its statement descriptor, so Stripe recommends giving every descriptor you use the same fixed prefix, so that your activity is counted together.

Compliance disputes

Network rules can also be the basis of a dispute. Stripe's documentation describes Visa and Mastercard compliance disputes, which an issuer can raise when it believes a transaction did not conform to the network's rules. If the parties cannot resolve one, the network decides it for a fee. Stripe states that if you contest one of these, it collects 500 USD, or the local equivalent, in addition to its dispute fees, and refunds that amount if you win.

What this means for a research supplier

• Read your processor's agreement and the policies it refers to. That is where network obligations reach you.
• Describe your business to your processor exactly as it is, so your classification is accurate.
• Make your site meet the basic website and policy disclosure rules.
• Keep the business name consistent across your site, checkout, receipts and card statements.
• Track disputes and fraud warnings monthly, and fix causes rather than chasing wins. See reducing disputes: a checklist for research suppliers.

What this page cannot tell you

The network rulebooks are long, partly redacted and updated regularly, and your processor's agreement may add requirements of its own. This page is a general orientation, not a statement of what applies to your business. For questions about your obligations, ask your processor, and speak to a qualified lawyer about your business.