FRB Finalizes Updates to Debit Card Transaction Board Rule
On October 3, 2022, the Federal Reserve Board (“FRB” or the “Board”) announced that it had finalized updates[1] to the Board’s rule amending Regulation II, concerning debt and credit card interchange transaction fees and routing, to provide clarification as to the rule’s requirements.
Background
On July 21, 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”) was enacted. Dodd-Frank amended the Electronic Fund Transfer Act (“EFTA”) to add section 920[2], under which the Board was required to issue regulations limiting the types of restrictions debit card issuers (“issuers”) and payment card networks (“networks”) may place on debit card transactions.
Specifically, under § 920(b)(1)(A), the regulation prohibited issuers or networks from entering into, “by contract, requirement, condition, penalty, or otherwise,” exclusivity arrangements in which the issuer would only utilize one network — or two networks which were “owned, controlled, or otherwise operated by (i) affiliated persons; or (ii) networks affiliated with such issuer” — to process debt card transactions.
Additionally, under § 920(b)(1)(B), issuers or networks were prohibited from directly or indirectly restricting a merchant, or the merchant’s depository institution (“acquirer”), from being able to exercise their routing preferences and choose amongst networks available to process a debit card transaction when deciding how to route the transaction. This preference override could leave merchants stuck with unfavorable terms, such as higher merchant fees or lesser fraud-prevention capabilities.
In light of these requirements, the Board promulgated Regulation II[3] on July 20, 2011.
Section 235.7(a)(2) of Regulation II, which implements EFTA section 920(b)(1)(A), provides that in order to comply with the prohibition on network exclusivity, an issuer must allow for processing on “at least two unaffiliated payment card networks,” that 1) does not restrict, by policy or practice, the network operations “to a limited geographic area, specific merchant, or particular type of merchant or transaction” and 2) “has taken steps reasonably designed to enable the network to” process the expected volume of transactions.
Section 235.7(b), implements and mirrors the requirements set forth in EFTA section 920(b)(1)(B).
“Taken together, § 235.7(a) and § 235.7(b) of Regulation II require an issuer to enable two unaffiliated networks to process a transaction performed with the issuer’s debit card and prohibit the issuer from inhibiting the merchant’s ability to route the debit card transaction over the merchant’s preferred network among those enabled by the issuer.” (emphasis added).
Basis for the Proposed Changes
At the time Regulation II was promulgated, the market had insufficient capabilities “to broadly support multiple networks over which merchants could route card-not-present debit card transactions. Now, however, such capabilities are accessible on “most single-message networks.”
Despite this technological evolution, data and information collected by the Board evidence that “some issuers are not enabling two unaffiliated networks to process card-not-present transactions, and as a result, merchants often can route card-not-present debit card transactions only over a single network.” Instead, merchants are often required to route these transactions over a dual-message network enabled by the issuer as the only available network.
Final Rule
“The final rule underscores that issuers should provide routing choice for card-not-present debit card transactions.”
A. Section 235.7 (Limitations on Payment Card Restrictions), Comment 235.7(a)-2 (Issuer’s Role), and Comment 235.7(a)-3 (Permitted Networks)
The Final Rule adopts amendments to § 235.7(a)(2) and the commentary to § 235.7(a) to require that an “an issuer satisfies the prohibition on network exclusivity only if the issuer enables at least two unaffiliated networks to process an electronic debit transaction, where such networks satisfy two requirements.”
These two requirements mirror those previously required under the provision, as outlined above. However, under the original rule, § 235.7(a)(2) was satisfied “only if” the two requirements are satisfied. Under the final rule, “only if” is removed, effectively enabling issuers to “satisfy the prohibition on network exclusivity by enabling networks whose operations are limited to, for example, a limited geographic area.”[4] As such, the Board states that “the final rule provides issuers greater flexibility in complying with the prohibition on network exclusivity.”
The Board states that the use of the word “enables” — as opposed to the previous requirement to “allow” at least two unaffiliated networks — is intended to “more accurately describe the role of the issuer in configuring its debit cards so that the issuer complies with the prohibition on network exclusivity.” The Board clarifies that this amendment is not intended to “expand” the coverage of the provision, only to “specify that existing requirements also apply to card-not-present transactions and emphasize that issuers have an active role to play in order to comply with the prohibition on network exclusivity.”
The Board acknowledges the concerns of many public commentors that an issuer would be required, under the reading of the amended language, “to affirmatively guarantee that all merchants will be able to route a transaction over two unaffiliated networks in every conceivable transaction context.” In response, the Board clarified that “these requirements do not require an issuer to ensure that two unaffiliated networks will actually be available to the merchant for every transaction.” All that is required of an issuer is to enable the compliant networks to process these transactions. New Comment 235.7(a)-2 clarifies that “it is sufficient for an issuer to configure each of its debit cards so that each electronic debit transaction performed with such card can be processed on at least two unaffiliated networks, even if the networks that are actually available to the merchant for a particular transaction are limited by, for example, the card acceptance technologies that a merchant adopts or the networks that the merchant accepts.”
Consistent with the original provision, in an issuer’s determination as to whether they have “enabled a combination of networks that avoids the impermissible outcomes [outlined in § 235.7(a)(2)],” issuers may “rely on [their] network rules or policies.”
Additionally, the notice clarifies “issuers may not disable capabilities of the enabled networks if doing so would result in fewer than two unaffiliated networks to process a debit card transaction.” This is intended to address commenter concerns that “certain issuers are actively disabling, or failing to enable, the card-not-present capabilities of one or more enabled networks, resulting in fewer than two unaffiliated networks to process such transactions.”
B. Comment 235.7(a)-1 (Scope of Restriction)
The Final Rule adopts amendments to comment 235.7(a)-1 to clarify that “§ 235.7(a) does not require an issuer to have two or more unaffiliated networks available for each method of cardholder authentication.”
The amended comment will also include “updated examples of cardholder authentication methods listed in the comment to better align with current industry practices.”
C. Comment 235.7(a)-8 (Application of Rule Regardless of Form)
The final rule adopts Comment 235.7(a)-8, which states “that the prohibition on network exclusivity applies to electronic debit transactions performed with any debit card as defined in § 235.2 of Regulation II, regardless of the form of such debit card.”
Under the comment, this requirement “applies to electronic debit transactions performed using, for example, a plastic card, a supplemental device such as a fob [(a term which was utilized in substitute of “token”, which the Board believes to be outdated)], information stored inside an e-wallet on a mobile phone or other device, or any other form of debit card, as defined in § 235.2, that may be developed in the future.” This updated application will also be implemented in current comment 235.7(b)-2(iii).
Enforcement
The Final Rule will be effective of July 1, 2023.
A statement by Governor Michelle W. Bowman, a member of the Board of Governors of the Federal Reserve System, provides concern for community banks in the implementation of this final rule. According to Bowman, community banks raised “substantial concerns” about the proposed amendments during the public comment period. The release of the final rule did not appear to ease these concerns as Bowman believes “that significant questions remain about how the rule will affect banks, and particularly community banks, with respect to both fraud and the cost of compliance.”
Despite this, the Board states in the issued notice “that many issuers, and especially most community bank issuers, are already compliant with the final rule because they have already enabled two unaffiliated networks to process card-not-present transactions performed with their debit cards.”
Therefore, “[a]s a practical matter, an issuer will first need to determine whether card-not-present transactions performed with its debit cards can already be processed on at least two unaffiliated networks.”
[1] chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20221003a1.pdf
[2] EFTA section 920 is codified at 15 U.S.C. 1693o-2.
[3] Regulation II, Debit Card Interchange Fees and Routing, codified at 12 CFR part 235.
[4] “Comment 235.7(a)-3 of the final rule provides examples of issuers satisfying the prohibition on network exclusivity by enabling networks whose operations are restricted to a limited geographic area and particular type of transaction.”