Visa and Mastercard rules are neither guidance nor an industry standard. They are a private body of obligations that a licensed member accepts by joining the scheme and passes down the chain by contract. The public edition of the Visa Core Rules and Visa Product and Service Rules dated 18 April 2026 runs to 923 pages; the Mastercard Rules are in force in the 2 June 2026 edition and the Security Rules and Procedures — Merchant Edition in the 4 August 2026 edition. No national regulator approves these texts, yet breaching them costs more than most administrative penalties and bites faster.
The rulebook does three jobs, and each generates its own layer of obligation. First, allocate the loss on a disputed transaction between issuer and acquirer: hence the dispute cycle, its deadlines and arbitration. Second, stop one participant from wrecking the economics for everyone else: hence monitoring programmes with thresholds in basis points and escalating penalty schedules. Third, price access: interchange, which the acquirer pays the issuer, and scheme fees, which both sides pay the scheme itself. The first layer is fully set by the rules, the second by the rules plus non-public guides, the third by the rules, competition law and sector regulation.
Who contracts with whom, who registers an intermediary and where licensing risk sits is covered in the breakdown of acquiring roles; whose licence and whose BIN stand behind issuing is covered in the card programme guide. What follows is the rulebook itself as a source of obligation: how dispute clocks are counted, who pays fees at each stage, where the 2026 monitoring thresholds sit, what survives of interchange regulation after the 2025–2026 decisions, and why 3-D Secure liability shift does not work everywhere.
The vocabulary the rules do not contain
Industry usage and rule text have drifted apart to the point of incompatibility. Across 923 pages of Visa rules the word chargeback appears six times — and all six sit inside the name of a single service, the Chargeback Reduction Service. The word representment appears not once. What the market calls a chargeback, Visa calls a Dispute: 2,187 occurrences. What the market calls a representment, Visa calls a Dispute Response. Mastercard kept the older language: chargeback, second presentment, arbitration chargeback.
The divergence is not cosmetic. A dispute-handling playbook written in market vocabulary does not map onto Visa's procedural stages: a representment and a Dispute Response have different deadlines, different counterparties and different consequences for missing them — and in two of Visa's four dispute categories the Dispute Response stage does not exist at all.
The penalty ladder is likewise two-tiered and rarely described that way. Under section 1.11.2.2, a breach of a Chapter 1 rule (the Visa Core Rules) escalates on Tier 1; everything else escalates on Tier 2. Both ladders open with a Compliance Case Fee of US$1,000 per violation, assessed immediately on notification, before any adjudication. Tier 1 then runs 25,000 → 50,000 → 75,000 → 100,000 → 125,000 → 150,000, plus US$25,000 each further month. Tier 2 is exactly five times cheaper: 5,000 → 10,000 → 20,000 → 30,000 → 40,000 → 50,000, plus US$10,000 a month. A separate schedule for "significant" violations (section 1.11.2.6) opens at US$50,000 and moves into a band of US$50,000 to US$1,000,000 per month. An appeal under section 1.11.2.7 must be filed within 30 calendar days and costs US$5,000, refundable if upheld.
Visa's dispute cycle: four categories, twenty-three conditions
Visa sorts disputes into four categories: 10 (Fraud), 11 (Authorization), 12 (Processing Errors) and 13 (Consumer Disputes). Within them sit 23 dispute conditions, from 10.1 (EMV Liability Shift Counterfeit Fraud) to 13.9 (Non-Receipt of Cash at an ATM). Condition 12.1 does not exist: late presentment was folded into 11.3 and the number was left vacant.
What secondary summaries lose is that the cycle differs by category, and differs fundamentally. For categories 10 and 11, Table 11-1 provides no Dispute Response stage at all: the acquirer moves straight to a pre-Arbitration attempt (30 calendar days from the Dispute Processing Date), the issuer responds within 30 days, and the acquirer files for arbitration — 10 calendar days from the processing date of the pre-Arbitration response. For categories 12 and 13 (Table 11-2) the cycle is longer and mirrored: acquirer Dispute Response (30 days) → issuer pre-Arbitration attempt (30 days) → acquirer pre-Arbitration response (30 days) → the issuer files for arbitration (10 days).
In fraud disputes, in other words, the merchant's side escalates to arbitration; in consumer disputes the cardholder's side does. Secondary commentary describes a single ladder on which the merchant always escalates. No such ladder exists in the rules.
The window for the dispute itself is 120 calendar days from the transaction processing date under condition 10.4 and most others, with an outer limit of 540 calendar days for delayed delivery under conditions 13.1, 13.3 and their relatives. In the Europe Region a separate reporting clock applies on top: under section 7.3.11.1 the issuer must report a Dispute, and the acquirer a Dispute Response or pre-Arbitration, within 15 calendar days of the processing date. No equivalent requirement appears for other regions.
Brakes on serial filers are built directly into the definition of an invalid dispute. Under section 11.7.5.3 a condition 10.4 dispute is invalid if the issuer has filed more than 35 disputes on that account number in the preceding 120 calendar days. Separately, section 10.4.7.3 obliges an issuer whose cardholder has accumulated five or more category 10 disputes in 12 months to conduct a formal review for first-party fraud abuse.
Mastercard: a similar ladder on different clocks
Mastercard kept the linear cycle: first chargeback → second presentment → pre-arbitration → arbitration. The stages are set out in the Chargeback Guide and in Chargebacks Made Simple, which fix 30 calendar days for the acquirer's pre-arbitration response, 10 days to respond in arbitration (after which Mastercom rejects the case automatically) and 45 days to appeal a ruling.
One source discrepancy deserves recording. The public Merchant Edition of the Chargeback Guide is dated 13 May 2025, while the Mastercard Rules themselves were refreshed on 2 June 2026 and the SPME manual on 4 August 2026. The public dispute guide trails the rulebook by more than a year, and checking 2026 deadlines against it is unsafe.
| Stage | Visa, categories 10 and 11 | Visa, categories 12 and 13 | Mastercard |
|---|---|---|---|
| Name of the dispute | Dispute | Dispute | Chargeback |
| Filing window | 120 days from transaction processing date | 120 days, up to 540 for delayed delivery | 90 days (4808, 4834) or 120 days (4837, 4853, 4850, 4854) |
| Merchant-side response | No such stage | Dispute Response, 30 days | Second presentment, 45 days |
| Pre-arbitration | Acquirer pre-Arbitration attempt, 30 days | Issuer pre-Arbitration attempt, 30 days | Issuer pre-arbitration, 45 days; acquirer response 30 days |
| Who files arbitration | Acquirer, 10 days | Issuer, 10 days | Issuer; 10 days to respond |
| Appeal | New evidence and at least US$5,000 at stake; 60 days | New evidence and at least US$5,000 at stake; 60 days | 45 days after the ruling |
Who pays at each stage
The economics are built so that the losing side pays twice: the transaction amount and the review fee. Under section 1.10.2.3 Visa collects the review fee through the Visa Global Billing Platform from the responsible member, and either party may additionally be assessed for each technical violation of the rules. If Visa finds an arbitration request invalid it rejects the case and keeps the review fee (section 1.10.2.1). If a case is withdrawn before liability is assigned, the review fee is still collected (section 11.13.3).
The right of appeal is narrow. Under section 11.13.4 a decision of the Arbitration and Compliance Committee may be appealed only where two conditions hold together: there is new evidence that was not available when the case was filed, and the amount in dispute is at least US$5,000. The deadline is 60 calendar days from notification.
Neither Visa nor Mastercard publishes the review fee amount. The rates live in regional fee guides and inside Mastercom, accessible only to scheme members. The "US$500 per case" figures that circulate in commentary cannot be traced to rule text, and a dispute-operations budget cannot be built on them. The only publicly fixed tariffs in this area are Visa's US$1,000 Compliance Case Fee and its US$5,000 non-compliance appeal fee.
Monitoring: the 2026 thresholds
On 1 June 2025 Visa folded its separate dispute and fraud programmes into a single Visa Acquirer Monitoring Program. Under the VAMP fact sheet the ratio is the count of fraudulent (TC40) plus disputed (TC15) transactions divided by the count of settled transactions (TC05), card-not-present only. The advisory period closed on 30 September 2025, acquirer supervision at the above-standard level switched on from 1 January 2026, and on 1 April 2026 the merchant excessive threshold in the AP, Canada, Europe and US regions dropped from 220 to 150 basis points — the Merchant Risk Council confirms the lower threshold is live. An enrolled merchant pays US$8 per fraudulent or disputed transaction; a first breach in a rolling twelve months carries a three-month grace period.
The thresholds are not printed in the rules. Section 10.4.3.1 simply refers to the Visa Acquirer Monitoring Program Guide, which is not published. More striking, section 12.5.4 — "Dispute Monitoring Fees and Non-Compliance Assessments" — survives in the public edition as an empty heading with no text beneath it. The previously published dispute schedules moved into the closed guide in their entirety.
The mirror programme for issuers is barely discussed even though it is documented openly. Under section 10.4.7.1 the Visa Issuer Monitoring Program triggers at 750 disputes together with a 1% disputes-to-sales ratio, or at US$500,000 of reported fraud together with a 1% fraud-to-sales ratio, all card-absent. The first three months carry no assessment; months 4–6 cost US$25,000, months 7–9 US$50,000, months 10–12 US$100,000 (section 12.5.3.1). Exit requires three consecutive months below threshold.
| Programme | Who is measured | Threshold | Consequence |
|---|---|---|---|
| VAMP, acquirer | Acquirer portfolio, CNP | Above standard from 50 bps, excessive from 70 bps | Remediation, Visa-mandated controls, disconnection risk |
| VAMP, merchant | Merchant or sponsored merchant | 150 bps and at least 1,500 events a month (AP, Canada, EU, US, from 1 April 2026) | US$8 per event |
| VAMP Enumeration | Credential-testing traffic | From 2,000 bps and 300,000 attempts | Remediation under the VAMP Guide |
| VIMP, issuer | Issuer portfolio, CNP | 750 disputes and 1%, or US$500,000 fraud and 1% | US$25,000 / 50,000 / 100,000 a month from month 4 |
| Mastercard ECM | Merchant | 100–299 chargebacks and 1.50–2.99% | From US$1,000 in month 2 to US$100,000 from month 19 |
| Mastercard HECM | Merchant | From 300 chargebacks and from 3.00% | From US$1,000 to US$200,000, plus US$5 per chargeback above 300 |
| Mastercard EFM | Merchant, e-commerce | From 1,000 transactions, from EUR 50,000 fraud, from 50 bps, and 3-D Secure penetration below 50% (Europe) or 10% (US and Canada) | Up to US$100,000 a month from month 19; where both apply, only EFM assessments are levied |
| Mastercard BRAM | Merchant and acquirer | Illegal or brand-damaging content, transaction laundering | SPME section 8.8: investigation and assessment on the acquirer |
Mastercard computes its ratio differently from Visa, which breaks any direct comparison: current-month chargebacks are divided by prior-month sales. Where volume is growing fast the denominator lags and the ratio is inflated mechanically.
A separate line targets data manipulation. Under section 12.5.3.2, altering a merchant's name, data or performance to circumvent VAMP or VIRP draws US$25,000 per merchant per month and permanent disqualification of the merchant and its principals. Splitting volume across MIDs to stay under a threshold is exactly this.
Interchange: who sets it and where the caps run
Interchange is set neither by the issuer nor by the acquirer but by the scheme, as a multilateral default rate applied wherever banks have not agreed bilaterally. Hence its legal fragility: it is a horizontally agreed price, and competition authorities have treated it as such for twenty years.
In the EEA the caps come from Regulation (EU) 2015/751: Article 3 sets 0.2% for consumer debit, Article 4 sets 0.3% for consumer credit. Article 3(2) lets a member state instead permit a flat fee of no more than EUR 0.05 per transaction, or a combination, provided total scheme interchange stays within 0.2% of annual transaction value. More falls outside the caps than is generally assumed: Article 1(3) excludes commercial card transactions, ATM and over-the-counter cash withdrawals, and cards issued by three-party schemes from Chapter II altogether. Article 1(5) then reclassifies a three-party scheme as four-party the moment it licenses third-party issuers or acquirers, or issues cards with a co-branding partner or through an agent — which is why licensed Amex cards in the EU are capped while its proprietary cards are not.
The anti-circumvention rule in Article 5 treats as interchange "any agreed remuneration, including net compensation, with an equivalent object or effect" received by an issuer from the scheme, an acquirer or any other intermediary. It is the only IFR provision that formally reaches scheme fees, and it has never been applied to them directly.
Inter-regional interchange — on cards issued outside the EEA — is not capped by the Regulation. It is capped by commitments Visa and Mastercard gave the European Commission on 29 April 2019 in cases AT.39398 and AT.40049: 0.2% and 0.3% card-present, 1.15% and 1.5% card-not-present. Those commitments were due to lapse in November 2024, but on the Commission's statement in July 2024 both schemes voluntarily extended the same levels to November 2029.
In the United States the only cap sits on large-issuer debit. Regulation II allows US$0.21 plus 0.05% of value plus a cent for fraud prevention, and issuers below US$10bn in assets are exempt. Its legal footing is unstable: a North Dakota district court vacated the standard in August 2025 and stayed its own ruling, the case moved to the Eighth Circuit, the Federal Reserve's reply brief was filed on 23 March 2026 and oral argument has not been scheduled. The cap holds because of the stay, not because it has been upheld.
In the United Kingdom the IFR survives as assimilated law, though the register flags it as revoked by Schedule 1 to the Financial Services and Markets Act 2023 — a revocation that bites only as regulator rules replace it. What matters more in practice is that the cross-border cap never arrived. After Brexit, Visa and Mastercard raised card-not-present UK–EEA interchange from 0.2% and 0.3% to 1.15% and 1.5%, multiples of 5.75 and 5. The PSR proposed a two-stage cap, then in October 2025 dropped the interim cap in favour of first building a methodology. The High Court on 15 January 2026 rejected the challenge by Visa, Mastercard and Revolut to the regulator's powers, but as at August 2026 neither the level nor the timing of any cap has been fixed.
Scheme fees: the second layer nobody capped
Scheme fees are not interchange. Interchange flows from acquirer to issuer; scheme fees flow from both sides to the scheme itself, for authorisation, clearing, licensing, service access, 3-D Secure, tokenisation and dozens of separate line items. They fall outside the IFR entirely, which is why attention shifted to them in the decade after the caps came in.
The evidence conflicts, and the conflict should not be smoothed over. The Copenhagen Economics study for the European Commission, on 2015–2017 data, recorded roughly EUR 550m a year of additional scheme revenue but stated plainly that it found no statistical evidence of schemes substituting reduced interchange with higher scheme fees. The CMSPI and Zephyre study commissioned by EuroCommerce, over a longer horizon, puts the cumulative annual increase in EU-28 scheme fees at EUR 1.46bn, of which EUR 1.06bn sits in line items outside the period the Commission reviewed. That is a consultant's estimate commissioned by trade associations, not a published tariff or a regulatory calculation.
Regulators landed somewhere more cautious than the market expected. In its final decision PS26/1 of July 2026 the PSR found that Visa and Mastercard face no competitive constraint and raise fees without transparent justification — and imposed no price cap. The outcome is two binding directions: Information, Transparency and Complexity, with twelve months to comply, and Pricing Governance, with four, plus a separate regulatory financial reporting track. A remedy requiring disclosure directly to merchants was rejected. The regulator itself is being wound up: the Treasury's consultation response of 21 April 2026 confirms the PSR's consolidation into the FCA, with the power to impose price controls carried across, once primary legislation passes.
A parallel antitrust track runs in the EU. The Commission began examining scheme fees in September 2024 after complaints from trade associations, surveyed retailers in April 2025, and in May 2025 widened its questionnaires to terminal providers and payment companies, asking for fee data covering 2017 to 2024. As at August 2026 no formal proceedings have been opened.
3-D Secure: where liability shift works and where it does not
The mechanism is simple: authenticate the transaction and the card-absent fraud dispute becomes invalid. Visa implements this through Table 11-28, the invalid-dispute table for condition 10.4. Protection attaches at ECI 5 — the issuer returned an Authentication Confirmation and the CAVV reached the authorisation request — and at the tokenised equivalent carrying a TAVV. It also attaches at ECI 6, an attempted authentication answered by Visa on the issuer's behalf, with one carve-out: not for non-reloadable prepaid cards.
The second gap sits outside condition 10.4. Authentication closes a fraud dispute but does nothing for category 13: goods not received, not as described, cancelled subscription all pass through 3-D Secure untouched. The third is an express carve-out for crypto and NFTs: under Table 11-28 a dispute is invalid where the cardholder participated in a transaction acquiring non-fiat currency or an NFT and then claims to have been deceived into sending the asset to a fraudulent recipient. The scheme declines to adjudicate an authorised-push-payment scenario inside a card dispute.
In the EEA, mandatory strong customer authentication sits on top of scheme rules. The exemptions come from Commission Delegated Regulation (EU) 2018/389: Article 16 covers transactions up to EUR 30 with a cumulative ceiling of EUR 100 or five consecutive transactions; Article 18 covers transaction risk analysis, where the permitted transaction value is tied to the provider's own fraud rate. The Annex sets three steps: up to EUR 500 at a 0.01% fraud rate, up to EUR 250 at 0.06%, up to EUR 100 at 0.13%. Entitlement is confirmed by annual audit, and in the first year and at least every three years thereafter by an independent external auditor. The PSD3 and PSR package rewrites both the SCA regime and the allocation of fraud liability sitting above scheme rules — the timetable and substance of that reform are set out separately.
High-risk verticals and the new participant categories
High risk in the Visa rules is not a judgement call but a list of MCCs, defined by the Visa Integrity Risk Program Guide, plus a distinct regime for the acquirer. Under section 1.9.5.1, before submitting a single transaction from a high-integrity risk merchant, payment facilitator or ramp provider, the acquirer must file a registration application and be approved, undergo a financial review, hold the required equity capital, be investment grade or commit to compensating controls such as collateral, be in good standing across all Visa risk programmes, and where required complete an on-site Visa Acceptance Risk Standards review. Registration extends beyond merchants to the agents that solicit them.
The price of registration has risen. Per a review of European VIRP pricing, the high-risk merchant registration fee moved from US$500 to US$950 with effect from 1 January 2024, and from 1 April 2024 Europe added a US$0.02 per-transaction fee across four MCCs — direct marketing, financial institutions, non-financial institutions handling crypto assets, and dating services. Penalties for failing to register come straight from the rules: US$25,000 per month for each unregistered high-integrity risk payment facilitator, rising to US$100,000 per 30-day period after three violations in a calendar year (section 12.3.1.1); and US$100,000 a month for Tier 1 and Tier 2 merchants, US$25,000 for Tier 3, plus US$2,000 for each high-integrity risk merchant identified (section 12.5.5.1).
New participant categories entered the rules over two years. The Ramp Provider answers for its conversion affiliates; staged and stored-value digital wallet operators were split into different settlement regimes; and in April 2026 the rules gained Chapter 4.1.24, Agentic Platform Requirements. An Agentic neobank must enrol in the Visa Intelligent Commerce programme and register with Visa, directly or through an Agentic Payment Enabler; it may not undertake agentic transactions in a card-present environment and may not aggregate multiple agentic transactions into one. Before the first transaction it must obtain cardholder consent to tokenisation and to the payment instruction, state the instruction's expiry, and — as a separate item — obtain the cardholder's acknowledgement that they are responsible for actions taken by the agent. This is the first card rule to place the risk of an algorithm's conduct expressly on the consumer on whose behalf it acts.
The connecting thread through the 2024–2026 amendments is a ban on stacked intermediaries: payment facilitators, wallets and ramp providers may not contract with each other. The rules close structures in which two or more parties sit between the acquirer and the real seller, at which point monitoring loses sight of who actually receives the volume. How this slots into the rest of an operator's control environment is covered in the compliance stack.
Alternative rails: the price of having no chargeback
A2A and pay-by-bank economics look better than cards: no interchange, no scheme fees, a flat fee per transaction. What disappears alongside them is the dispute cycle — a bank transfer has no reason code, no representment window and no arbitration. Buyer protection migrates from private rules into statute, and there it bites the provider harder: in the United Kingdom mandatory reimbursement for authorised push payment fraud has applied since 7 October 2024, with a maximum of GBP 85,000 per claim and the loss split equally between the sending and receiving banks. Better for the merchant than a card dispute, worse for its bank, and the cost reappears in pricing. An operator in a high-risk vertical also has to keep the account open in the first place — what banks require for that is a separate exercise.
Stablecoin acquiring works the same way: settlement is final, there is no reversal at the rail layer, and the scheme uses the token as a settlement instrument between itself and the acquirer without changing the cardholder dispute rules at all. Visa launched USDC settlement in the United States on 16 December 2025 and extended the programme to nine blockchains on 29 April 2026 at an annualised run rate of roughly US$7bn. The legal treatment of the tokens themselves is covered under stablecoins, and the broader pattern of obligation shifting from the rail onto its operator under regulatory perimeter trends.
Common mistakes
| Mistake | Why it fails |
|---|---|
| Writing the dispute playbook around "chargeback — representment — arbitration" | Visa uses none of those words: chargeback appears six times and only inside a service name, representment zero. Dispute Response and pre-Arbitration have different deadlines and different counterparties, and in categories 10 and 11 no merchant-response stage exists at all |
| Assuming the merchant side always escalates to arbitration | Under Table 11-1 the acquirer files arbitration in categories 10 and 11; under Table 11-2 the issuer files in categories 12 and 13. A playbook built on one ladder breaks on the first fraud dispute |
| Budgeting dispute operations on "US$500 per arbitration" | Neither Visa nor Mastercard publishes the review fee in its public rules; the rates sit in regional fee guides. The only publicly fixed figures are the US$1,000 Compliance Case Fee and the US$5,000 appeal fee |
| Treating 3-D Secure as an unconditional liability shift | In the US, section 5.8.4.6 disables condition 10.4 protection for seven MCCs including 6051 and 7995. No ECI value closes a category 13 dispute, and for crypto and NFTs the rules declare the dispute invalid where the cardholder participated in the transaction |
| Splitting volume across MIDs to stay under a monitoring threshold | Section 12.5.3.2 treats altering a merchant's name, data or performance to circumvent VAMP or VIRP as a violation in its own right: US$25,000 per merchant per month and permanent disqualification of the principals |
| Comparing Visa and Mastercard ratios directly | Visa divides fraud and disputes by settled transactions in the same period; Mastercard divides this month's chargebacks by last month's sales. With growing volume the Mastercard ratio is inflated mechanically |
| Treating the US swipe-fee settlement as in force | What was granted on 9 June 2026 was preliminary approval. Final approval follows class notice and objections, with no hearing date set; repapering acquirer contracts around 1.25% is premature |
| Relying on a UK cross-border interchange cap | There is no cap. The PSR abandoned the interim remedy in October 2025 and, having won in the High Court on 15 January 2026, is still determining level and timing. UK–EEA rates remain 1.15% and 1.5% |
Scenarios
Taking a subscription business onto card rails in the EU and US
The load falls on category 13 rather than fraud: cancelled subscriptions and services-not-rendered are not closed by authentication. Priorities follow: a 30-day Dispute Response clock at Visa against a 45-day second presentment at Mastercard, separate service levels per network, and preparation for cross-merchant CE3.0 from 24 October 2026 — login records, full delivery address, IP address and one device identifier, but not two.
Key risk: the 150 basis point VAMP threshold trips before a representment track record accumulates, adding US$8 per event.
Launching a crypto on-ramp that accepts cards
MCC 6051 makes the seller high-integrity risk: the acquirer must complete registration under section 1.9.5.1 with a financial review and collateral, and the VIRP merchant registration fee is US$950. MCC 6051 also sits in the group of seven for which US 3-D Secure liability shift is disabled, and the scenario of a deceived cardholder sending an asset onward is expressly an invalid dispute.
Key risk: fraud stays with the merchant on a fully authenticated flow, while non-registration costs the acquirer US$25,000 a month.
Moving part of the volume to pay-by-bank
The interchange and scheme-fee saving is easy to model; the flip side is no reason code, no representment window and no arbitration. Disputes move into consumer law and reimbursement regimes: in the UK, mandatory APP fraud reimbursement capped at GBP 85,000 with the loss split between banks. Better for the merchant, dearer for the banks in the chain, and the cost returns through pricing.
Key risk: a mixed checkout requires two incompatible dispute playbooks in parallel, and they cannot be merged into one process.
Q/A
How does a Dispute Response differ from a representment, and why does it matter
A Dispute Response is the acquirer's response stage in Visa categories 12 (processing errors) and 13 (consumer disputes), with 30 calendar days from the dispute processing date. In categories 10 (fraud) and 11 (authorization) that stage does not exist: the acquirer files a pre-Arbitration attempt directly, also within 30 days. The word representment does not appear in the Visa rules at all, and chargeback appears six times, only inside the name Chargeback Reduction Service. Mastercard retained second presentment on a 45-day clock. A playbook written in a single market vocabulary therefore produces different deadlines across the two networks and a non-existent stage in half of Visa's disputes.
Which monitoring thresholds apply in 2026
Under VAMP an acquirer is above standard from 50 basis points and excessive from 70; above-standard supervision switched on from 1 January 2026. A merchant in the AP, Canada, Europe and US regions enrols at 150 basis points with at least 1,500 events a month — down from 220 on 1 April 2026 — and pays US$8 per fraudulent or disputed transaction. The ratio is TC40 plus TC15 over settled transactions, card-not-present only. At Mastercard, ECM starts at 100 chargebacks with a 1.50% ratio and HECM at 300 with 3.00%, on a schedule running from US$1,000 in month two to US$100,000 and US$200,000 from month nineteen. The VAMP thresholds are not printed in the public rules: section 10.4.3.1 refers to a non-public guide, and section 12.5.4 remains an empty heading.
What exactly caps interchange in the EU, and what falls outside
Regulation (EU) 2015/751 sets 0.2% for consumer debit (Article 3) and 0.3% for consumer credit (Article 4). Article 1(3) takes commercial card transactions, cash withdrawals and three-party scheme cards outside Chapter II entirely. Under Article 1(5) a three-party scheme becomes four-party, and therefore capped, as soon as it licenses third-party issuers or acquirers or issues cards with a co-branding partner or through an agent. Inter-regional interchange is not capped by the Regulation at all; it is held by the 2019 commitments to the European Commission, extended to November 2029: 0.2% and 0.3% card-present, 1.15% and 1.5% card-not-present. Scheme fees fall outside the IFR altogether; the only provision that could formally reach them is the Article 5 anti-circumvention rule on net compensation.
Does 3-D Secure actually protect against chargebacks
Not always and not against everything. Authentication invalidates a card-absent fraud dispute at ECI 5 with a CAVV, or the tokenised equivalent with a TAVV, and also at ECI 6 — attempted authentication — except on non-reloadable prepaid cards. It has no effect on category 13 disputes: not received, not as described and cancelled subscription pass through unimpeded. In the United States, section 5.8.4.6 of the Visa rules disables protection outright for seven MCCs — money transfers, adult content, crypto, stored value load, licensed casinos, racing and betting. In the EEA, mandatory SCA sits on top, with exemptions under Articles 16 and 18 of Regulation 2018/389 where transaction risk analysis entitlement is tied to the provider's fraud rate: up to EUR 500 at 0.01%, EUR 250 at 0.06%, EUR 100 at 0.13%.
Who pays fees at each stage of a dispute, and can a decision be appealed
The losing side pays the transaction amount plus the review fee, which Visa collects through the Visa Global Billing Platform, and either party may be assessed for technical violations on top. An invalid arbitration request is rejected but the review fee is retained; withdrawing a case still triggers collection. An Arbitration and Compliance Committee decision may be appealed only where there is genuinely new evidence and at least US$5,000 is at stake, within 60 calendar days. Appealing a non-compliance assessment is a separate route: 30 calendar days and US$5,000, refundable if the appeal succeeds. Neither scheme discloses review fee amounts in its public rules.
What changed in scheme rules across 2025 and 2026
A single VAMP took effect on 1 June 2025; acquirer supervision at above standard began on 1 January 2026 and the merchant threshold fell to 150 basis points on 1 April 2026. From 18 April 2026 Visa tightened the CVV2-based invalid-dispute rules and added Chapter 4.1.24 on agentic payment platforms, and from 9 April the AP region gained the Merchant Elevated Risk Program on a US$25,000 and US$50,000 schedule. From 24 October 2026 Compelling Evidence 3.0 extends to cross-merchant history while device ID and device fingerprint collapse into a single evidentiary element. On the regulatory side: the PSR closed its scheme-fee review in July 2026 without a price cap, the US swipe-fee settlement obtained preliminary approval on 9 June 2026, and Regulation II survives on a stay of a district court judgment.