If your business accepts credit cards, you are operating under three overlapping bodies of credit card processing laws for merchants: federal statutes like Dodd-Frank, the Fair Credit Billing Act, and the Fair and Accurate Credit Transactions Act; the contractual rules imposed by Visa, Mastercard, and other card networks; and state consumer protection laws that cover surcharges, disclosures, and data breach response. Getting any of these wrong can bring network fines, state attorney general enforcement, or class-action exposure.
Surcharges and Cash Discounts
You can add a surcharge on credit card payments in most of the country, but a handful of states still prohibit the practice outright, so confirm your state’s current law before setting one up. Where surcharging is allowed, the cap depends on the network. Visa limits surcharges to the lesser of your merchant discount rate or 3% of the transaction.1Visa. U.S. Merchant Surcharge Q and A Mastercard permits up to 4%. You cannot surcharge more than your actual cost of acceptance regardless of the ceiling, and some states impose lower caps of their own.
Surcharges apply only to credit card transactions. You cannot surcharge a debit card or prepaid card, even when the terminal lets the customer select “credit” as the routing option. That selection controls signature versus PIN, not whether the card itself is a credit product.1Visa. U.S. Merchant Surcharge Q and A
If your state bans surcharging, or if you want to sidestep the compliance work, offering a cash discount is the standard alternative and is legal in every state. The legal difference turns on framing: a surcharge penalizes credit card use, while a cash discount rewards cash payment. Your posted shelf price has to reflect the credit card price, and you apply the discount at the register when the customer pays cash. Reverse the framing by posting a cash price and adding a fee for card users, and regulators and networks will treat it as a surcharge. You also cannot run a cash discount and a surcharge program at the same location.
Minimum Purchase Amounts
Federal law lets you require a minimum purchase of up to $10 for credit card transactions. The provision was added by Dodd-Frank and blocks card networks from prohibiting reasonable minimums in your merchant agreement.2Office of the Law Revision Counsel. 15 USC 1693o-2 – Reasonable Fees and Rules for Payment Card Transactions Two conditions apply: the minimum has to be the same across every credit card brand you accept, and it cannot exceed $10.
This authority covers credit cards only. The statute does not extend the same right to debit cards, so network rules prohibiting debit card minimums still apply. If you set a $10 minimum, your staff and point-of-sale system need to distinguish credit from debit. Turning away a $5 debit customer can put you in breach of your merchant agreement.
Debit Card Interchange Fees and Routing
The Durbin Amendment, codified at 15 U.S.C. § 1693o-2 and implemented through the Federal Reserve’s Regulation II, caps the interchange fees large banks can charge on debit transactions. The fees have to be reasonable and proportional to the issuer’s actual processing cost.3eCFR. 12 CFR Part 235 – Debit Card Interchange Fees and Routing In practice, the Federal Reserve set the cap at 21 cents plus 0.05% of the transaction, with an additional 1-cent adjustment for issuers meeting specific fraud-prevention standards.4Federal Reserve. Regulation II: Average Debit Card Interchange Fee by Payment Card Network The cap applies to banks holding more than $10 billion in consolidated assets. Smaller banks and credit unions are exempt, which is why interchange on their debit cards runs higher.
The routing side of the Durbin Amendment is where a lot of merchants leave money on the table. Every debit card has to be enabled on at least two unaffiliated networks, and no issuer or network can stop you from routing a transaction to the cheaper option.5Federal Reserve. Regulation II: Debit Card Interchange Fees and Routing If your processor defaults to the primary network branded on the card, you are probably paying more than you need to.
Disclosure Requirements at Checkout
If you surcharge, both network rules and state law require you to tell the customer before they commit to paying. Visa’s rules are representative: post notice at the entrance, display the surcharge amount at the point of sale, and print it as a separate line item on the receipt.1Visa. U.S. Merchant Surcharge Q and A Several states go further and require the total price with the surcharge to appear before the customer reaches the register, not as a surprise line item at checkout.
Online, the same principle applies in a different format. Disclose the surcharge before the customer enters payment information, not on a confirmation screen after submission. The amount has to appear as a distinct line item during checkout, and the customer needs to see the total, inclusive of the fee, before clicking pay. Regulators treat undisclosed surcharges as potentially deceptive.
Receipt Truncation Under FACTA
The Fair and Accurate Credit Transactions Act imposes a simple rule that has driven a lot of litigation: any electronically printed receipt you give a customer can show no more than the last five digits of the card number, and cannot print the expiration date at all.6Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports It applies to every receipt generated by a register, terminal, or kiosk. Handwritten receipts and physical card imprints are exempt.
Willful violations carry statutory damages of $100 to $1,000 per receipt, plus potential punitive damages and attorney’s fees. A brief equipment malfunction that prints full card numbers on a few hundred receipts can create serious class-action exposure. If you recently upgraded your point-of-sale hardware or switched processors, verify that your receipts comply.
Courts have split on whether truncation extends to receipts sent electronically, such as emailed or texted receipts from online orders. Until that is settled, applying the same truncation standard to digital receipts is the safer path.
Chargebacks and Billing Disputes
The Fair Credit Billing Act, at 15 U.S.C. § 1666, establishes the federal framework underneath the chargeback process. A consumer has 60 days from the date the billing statement is mailed to notify the card issuer of a billing error in writing. The issuer has to acknowledge the dispute within 30 days, and it then has two full billing cycles, capped at 90 days, to investigate and resolve.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The issuer cannot collect the disputed amount or report it as delinquent during the investigation.
For you as the merchant, the practical takeaway is documentation. When a chargeback lands, your response window is tight, and the network’s internal deadlines are often shorter than the statutory maximums. Keep signed receipts, delivery confirmations, refund policies acknowledged at checkout, and any communication with the customer. A clearly posted refund policy the customer saw before completing the transaction is your strongest defense when someone disputes a charge claiming they expected a refund you never offered.
Form 1099-K Tax Reporting
Payment processors report your gross card receipts to the IRS on Form 1099-K. For the 2026 tax year, a third-party settlement organization must issue a 1099-K when a merchant’s gross payment volume exceeds $20,000 and the number of transactions exceeds 200.8Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill; Dollar Limit Reverts to $20,000 Both conditions have to be met before reporting is triggered. Recent legislation reinstated this threshold after several years during which a much lower $600 floor was proposed but never took effect.
The 1099-K reports gross volume, not profit. It includes refunds, returns, and chargebacks in the total. Reconcile it against your actual net income at tax time. If your 1099-K shows $150,000 in gross card payments but you processed $12,000 in refunds, your books need to reflect the difference so you are not paying tax on revenue you returned.
Data Security and Record Disposal
Every state has a data breach notification law that applies to businesses holding consumer financial information. The specifics vary, but the framework is consistent: if your systems are compromised and unencrypted cardholder data is accessed by an unauthorized person, you have to notify affected individuals within a state-set timeframe, and many states also require notice to the state attorney general. The triggering data typically includes a consumer’s name combined with an account number, credit or debit card number, and any associated security code or PIN.9National Association of Attorneys General. Data Breaches Beyond fines, you may be liable for credit monitoring costs and litigation expenses that can exceed the original penalty.
Separate from state law, the card networks require compliance with the Payment Card Industry Data Security Standard. PCI DSS is not a government regulation, but violating it exposes you to fines from your acquiring bank, higher processing fees, and potential loss of your ability to accept cards. Requirements scale with transaction volume: merchants processing over six million transactions annually face on-site audits by qualified security assessors, while smaller merchants generally satisfy the standard through an annual self-assessment questionnaire and quarterly network scans.
Disposing of Old Records and Equipment
Under the FTC’s Disposal Rule, any business that holds consumer financial information has to destroy it in a way that prevents reconstruction. Paper records have to be burned, pulverized, or shredded. Electronic media like hard drives or USB devices have to be destroyed or thoroughly erased so the data cannot be recovered.10eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
This trips up businesses that upgrade equipment without thinking about what is stored on it. An old point-of-sale terminal still contains transaction data until it is wiped. Tossing it in a dumpster or donating it without clearing the memory creates the same legal exposure as a breach. If you hire a third-party disposal company, the rule expects you to vet them and monitor their compliance, not just hand over a box.