Federal credit card processing laws are not a single statute but a stack of them: the Truth in Lending Act and Regulation Z, the Credit CARD Act of 2009, the Fair Credit Billing Act, the Electronic Fund Transfer Act and Regulation E, the Durbin Amendment to Dodd-Frank, the Gramm-Leach-Bliley Act, the Fair and Accurate Credit Transactions Act, and the Bank Secrecy Act as expanded by the USA PATRIOT Act. Together they govern what card issuers must disclose, how much of a fraudulent charge you can be forced to pay, what merchants can and cannot do at checkout, how banks can price debit transactions, how customer data must be protected, and how processors must guard the system against financial crime.
Disclosure, Rate, and Billing Rules for Card Accounts
The Truth in Lending Act and Regulation Z set the baseline. Every credit card offer and account opening must state the annual percentage rate, any periodic fees, late payment charges, and the method the issuer uses to calculate the balance for finance charge purposes. 1Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z) Monthly statements must show the balance, the minimum payment, applicable interest rates, and any fees charged during the cycle. If an issuer changes account terms, Regulation Z generally requires 45 days’ advance written notice before the change takes effect.
The Credit CARD Act of 2009 layered further limits on top of TILA. Issuers generally cannot raise the interest rate on an existing balance. The exceptions are narrow: a promotional rate expiring on schedule, a variable rate moving with its underlying index, a cardholder more than 60 days late on a minimum payment, or the end of a hardship arrangement. 2Office of the Law Revision Counsel. 15 US Code 1666i-1 – Limits on Interest Rate, Fee, and Finance Charge Increases Applicable to Outstanding Balances Even after a 60-day delinquency increase, the issuer must reverse the increase once the cardholder makes six consecutive on-time minimum payments. For new transactions, rates can rise going forward but only after 45 days’ written notice that explains the reason and the right to cancel.
Penalty fees must be “reasonable and proportional” to the violation. 3Office of the Law Revision Counsel. 15 US Code 1665d – Reasonable Penalty Fees on Open End Consumer Credit Plans The CFPB sets annually adjusted safe harbor amounts. A 2024 CFPB rule that would have capped late fees at $8 for large issuers was vacated in court, so the standard safe harbors remain in force: $32 for a first late payment and $43 for a repeat violation of the same type within the next six billing cycles. 4Federal Register. Credit Card Penalty Fees (Regulation Z) Legislation to reinstate an $8 cap has been introduced but has not become law.
The Fair Credit Billing Act, implemented through Regulation Z, sets the process for disputing a charge. The cardholder must send written notice within 60 days after the statement containing the error was mailed. 5eCFR. 12 CFR Part 1026 – Truth in Lending (Regulation Z) The creditor must acknowledge receipt in writing within 30 days and then has two full billing cycles, capped at 90 days, to either correct the error or send a written explanation of why the charge is accurate. During the investigation, the creditor cannot report the disputed amount as delinquent or try to collect it. A creditor that fails to follow the procedures forfeits the right to collect the first $50 of the disputed amount, whether or not the underlying charge was valid.
Liability Caps for Unauthorized Transactions
Federal law treats stolen credit cards and stolen debit cards very differently, and processing rules track that split.
Under TILA, cardholder liability for unauthorized credit card charges tops out at $50, provided the issuer has given a way to report the loss and the unauthorized charges happened before notification. 6Office of the Law Revision Counsel. 15 US Code 1643 – Liability of Holder of Credit Card The major card networks impose zero-liability policies that go further, but $50 is the federal floor, and the burden falls on the issuer to prove that disputed charges were authorized. 7Consumer Financial Protection Bureau. 12 CFR 1026.12 – Special Credit Card Provisions
Debit card fraud is governed by the Electronic Fund Transfer Act and Regulation E, where the cap turns on reporting speed:
- Report within 2 business days: liability is capped at $50 or the actual unauthorized amount, whichever is less.
- Report between 2 and 60 days: liability can reach $500.
- Report after 60 days from the statement date: no cap on losses that occur after the 60-day window.
If extenuating circumstances such as a serious illness prevent timely reporting, the financial institution must extend these deadlines to a reasonable period. 8eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
What Merchants Can Do at Checkout
Federal law protects a merchant’s right to offer a cash discount. Under TILA, a seller can offer any discount for payment by cash, check, or similar means as long as the discount is available to all buyers and clearly disclosed. 9Office of the Law Revision Counsel. 15 US Code 1666f – Inducements to Cardholders by Sellers of Cash Discounts for Payments by Cash, Check, or Similar Means A discount structured this way is not treated as a finance charge and triggers no additional disclosure obligations. Card issuers cannot block merchants from offering it.
Surcharges are different. No federal statute directly regulates them. Rules come from state law and from Visa and Mastercard network policies. Several states prohibit or restrict surcharging, and where surcharges are allowed, network rules generally cap them and require point-of-sale disclosure. A business accepting cards should check both state law and its merchant agreement before adding a surcharge.
Debit Interchange Under the Durbin Amendment
The Durbin Amendment, part of Dodd-Frank, regulates the interchange fees large banks charge merchants for processing debit card transactions. It applies only to financial institutions with $10 billion or more in assets; smaller issuers are exempt. 10Board of Governors of the Federal Reserve System. Regulation II – Debit Card Interchange Fees and Routing
For covered issuers, the fee cap is 21 cents per transaction plus 5 basis points (0.05%) of the transaction value. Issuers that meet specific fraud prevention standards may add another 1 cent per transaction. The Federal Reserve proposed lowering these caps in 2023, but the updated rule has not taken effect. In August 2025, a federal court vacated Regulation II in full but immediately stayed its own order pending appeal, so the existing caps remain in place for now. 11Cooley LLP. District Court Vacates Regulation IIs Debit Card Interchange Fee Standard The cap does not apply to credit card transactions, where interchange is set by the card networks.
The Durbin Amendment also requires debit card issuers to enable at least two unaffiliated payment networks for routing each transaction, giving merchants a choice of processing routes.
Data Security and Privacy Duties on Processors
The Gramm-Leach-Bliley Act governs how financial institutions collect, use, and protect personal financial information. Its reach is broader than banks alone, extending to companies engaged in financial activities, including many payment processors. 12Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
The Financial Privacy Rule requires a covered institution to provide a clear privacy notice before sharing nonpublic personal information with an unaffiliated third party. The notice must explain what information is collected, how it is shared, and the customer’s right to opt out. The institution must give a reasonable way to opt out (a return form, toll-free number, or online response) and generally must allow at least 30 days from the notice before sharing begins. 13eCFR. 16 CFR Part 313 – Privacy of Consumer Financial Information
The Safeguards Rule requires a written information security program with administrative, technical, and physical protections. It must designate a qualified individual to oversee security, include regular risk assessments, implement access controls and encryption, and monitor effectiveness over time. The obligation extends to third-party service providers: a processor that shares data with a vendor must ensure the vendor meets the same standards.
The Fair and Accurate Credit Transactions Act added the Disposal Rule. Any entity that possesses consumer information derived from a credit report must properly destroy it when no longer needed, in any format, whether paper files or electronic data, and including records on transferred equipment. 14eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
Identity Theft Prevention: The Red Flags Rule
Financial institutions and creditors that maintain “covered accounts” must develop a written identity theft prevention program. A covered account includes any account designed for multiple payments or transactions, such as a credit card account, and any account with a foreseeable risk of identity theft. 15eCFR. 16 CFR Part 681 – Identity Theft Rules
The program must identify warning signs relevant to the institution’s accounts, detect those warnings during account opening and ongoing activity, respond appropriately when a red flag appears, and update over time as risks evolve. The board of directors or senior management must approve the initial program and stay involved in oversight. A program on paper does not satisfy the rule if no one with authority is actively reviewing it.
Anti-Money Laundering and Bank Secrecy Act Compliance
The Bank Secrecy Act requires financial institutions in the payment chain to build compliance programs designed to detect and prevent money laundering, terrorism financing, and other financial crimes. 16FinCEN.gov. The Bank Secrecy Act The USA PATRIOT Act expanded those requirements after 2001. A compliant program must include internal controls, a designated compliance officer, independent testing, and ongoing employee training.
Banks must file a Suspicious Activity Report with FinCEN for any transaction or pattern of transactions involving $5,000 or more where the institution suspects a link to illegal activity, an intent to evade reporting requirements, or no apparent business purpose. 17eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions That obligation is separate from the Currency Transaction Report, which is filed for any cash transaction exceeding $10,000 regardless of whether anything looks suspicious.
Every bank must maintain a Customer Identification Program that collects, at minimum, a customer’s name, date of birth (for individuals), address, and an identification number such as a Social Security number or passport number, and verifies that information within a reasonable time after account opening using documents, non-documentary methods, or a combination. 18eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks
For electronic fund transfers of $3,000 or more, the “travel rule” requires financial institutions to pass along specific information about the sender and recipient to the next institution in the payment chain, so identifying details follow the money. 19Financial Crimes Enforcement Network. Funds Travel Regulations: Questions and Answers
When a Processor Must Register as a Money Services Business
Some payment processors qualify as money services businesses under federal law, which triggers a separate registration with the Treasury Department. A business falls into this category if it provides services like money transmission, check cashing, currency exchange, or the sale of money orders and traveler’s checks. With limited exceptions, every MSB must register with FinCEN within 180 days of starting operations and renew every two years. A copy of the registration and supporting documents must be kept at a U.S. location for five years. 20FinCEN.gov. Money Services Business (MSB) Registration
An entity acting solely as an agent of a registered MSB does not need to register separately. But an entity conducting its own MSB activities in addition to acting as an agent must file its own registration. Failing to register is a federal crime, so any business involved in payment processing should evaluate early whether its activities cross the MSB threshold.