🇪🇺Card Scheme Rules: Chargebacks, Interchange and Merchant Monitoring

Visa and Mastercard rules are neither guidance nor an industry standard. They are a private body of obligations that a licensed member accepts by joining the scheme and passes down the chain by contract. The public edition of the Visa Core Rules and Visa Product and Service Rules dated 18 April 2026 runs to 923 pages; the Mastercard Rules are in force in the 2 June 2026 edition and the Security Rules and Procedures — Merchant Edition in the 4 August 2026 edition. No national regulator approves these texts, yet breaching them costs more than most administrative penalties and bites faster.

The rulebook does three jobs, and each generates its own layer of obligation. First, allocate the loss on a disputed transaction between issuer and acquirer: hence the dispute cycle, its deadlines and arbitration. Second, stop one participant from wrecking the economics for everyone else: hence monitoring programmes with thresholds in basis points and escalating penalty schedules. Third, price access: interchange, which the acquirer pays the issuer, and scheme fees, which both sides pay the scheme itself. The first layer is fully set by the rules, the second by the rules plus non-public guides, the third by the rules, competition law and sector regulation.

Who contracts with whom, who registers an intermediary and where licensing risk sits is covered in the breakdown of acquiring roles; whose licence and whose BIN stand behind issuing is covered in the card programme guide. What follows is the rulebook itself as a source of obligation: how dispute clocks are counted, who pays fees at each stage, where the 2026 monitoring thresholds sit, what survives of interchange regulation after the 2025–2026 decisions, and why 3-D Secure liability shift does not work everywhere.

The vocabulary the rules do not contain

Industry usage and rule text have drifted apart to the point of incompatibility. Across 923 pages of Visa rules the word chargeback appears six times — and all six sit inside the name of a single service, the Chargeback Reduction Service. The word representment appears not once. What the market calls a chargeback, Visa calls a Dispute: 2,187 occurrences. What the market calls a representment, Visa calls a Dispute Response. Mastercard kept the older language: chargeback, second presentment, arbitration chargeback.

The divergence is not cosmetic. A dispute-handling playbook written in market vocabulary does not map onto Visa's procedural stages: a representment and a Dispute Response have different deadlines, different counterparties and different consequences for missing them — and in two of Visa's four dispute categories the Dispute Response stage does not exist at all.

The penalty ladder is likewise two-tiered and rarely described that way. Under section 1.11.2.2, a breach of a Chapter 1 rule (the Visa Core Rules) escalates on Tier 1; everything else escalates on Tier 2. Both ladders open with a Compliance Case Fee of US$1,000 per violation, assessed immediately on notification, before any adjudication. From there the two ladders diverge: at the first level Tier 1 is five times Tier 2, and by the sixth level three times.

A third schedule sits above these two. The schedule for "significant" violations (section 1.11.2.6) opens at US$50,000 and moves into a band of US$50,000 to US$1,000,000 per month. An appeal under section 1.11.2.7 must be filed within 30 calendar days and costs US$5,000, refundable if upheld.

Key parameters

Visa's dispute cycle: four categories, twenty-three conditions

Visa sorts disputes into four categories: 10 (Fraud), 11 (Authorization), 12 (Processing Errors) and 13 (Consumer Disputes). Within them sit 23 dispute conditions, from 10.1 (EMV Liability Shift Counterfeit Fraud) to 13.9 (Non-Receipt of Cash at an ATM). Condition 12.1 does not exist: late presentment was folded into 11.3 and the number was left vacant.

Stages and clocks by category

What secondary summaries lose is that the cycle differs by category, and differs fundamentally. For categories 10 and 11, Table 11-1 provides no Dispute Response stage at all: the acquirer moves straight to a pre-Arbitration attempt (30 calendar days from the Dispute Processing Date), the issuer responds within 30 days, and the acquirer files for arbitration — 10 calendar days from the processing date of the pre-Arbitration response. For categories 12 and 13 (Table 11-2) the cycle is longer and mirrored: acquirer Dispute Response (30 days) → issuer pre-Arbitration attempt (30 days) → acquirer pre-Arbitration response (30 days) → the issuer files for arbitration (10 days).

In fraud disputes, in other words, the merchant's side escalates to arbitration; in consumer disputes the cardholder's side does. Secondary commentary describes a single ladder on which the merchant always escalates. No such ladder exists in the rules.

The window for the dispute itself is 120 calendar days from the transaction processing date under condition 10.4 and most others, with an outer limit of 540 calendar days for delayed delivery under conditions 13.1, 13.3 and their relatives. In the Europe Region a separate reporting clock applies on top: under section 7.3.11.1 the issuer must report a Dispute, and the acquirer a Dispute Response or pre-Arbitration, within 15 calendar days of the processing date. No equivalent requirement appears for other regions.

Brakes on serial filers

Brakes on serial filers are built directly into the definition of an invalid dispute. Under section 11.7.5.3 a condition 10.4 dispute is invalid if the issuer has filed more than 35 disputes on that account number in the preceding 120 calendar days. Separately, section 10.4.7.3 obliges an issuer whose cardholder has accumulated five or more category 10 disputes in 12 months to conduct a formal review for first-party fraud abuse.

Mastercard: a similar ladder on different clocks

Mastercard kept the linear cycle: first chargeback → second presentment → pre-arbitration → arbitration. The stages are set out in the Chargeback Guide and in Chargebacks Made Simple, which fix 30 calendar days for the acquirer's pre-arbitration response, 10 days to respond in arbitration (after which Mastercom rejects the case automatically) and 45 days to appeal a ruling.

One source discrepancy deserves recording. The public Merchant Edition of the Chargeback Guide is dated 13 May 2025, while the Mastercard Rules themselves were refreshed on 2 June 2026 and the SPME manual on 4 August 2026. The public dispute guide trails the rulebook by more than a year, and checking 2026 deadlines against it is unsafe.

Who pays at each stage

The economics are built so that the losing side pays twice: the transaction amount and the review fee. Under section 1.10.2.3 Visa collects the review fee through the Visa Global Billing Platform from the responsible member, and either party may additionally be assessed for each technical violation of the rules. If Visa finds an arbitration request invalid it rejects the case and keeps the review fee (section 1.10.2.1). If a case is withdrawn before liability is assigned, the review fee is still collected (section 11.13.3).

The right of appeal is narrow. Under section 11.13.4 a decision of the Arbitration and Compliance Committee may be appealed only where two conditions hold together: there is new evidence that was not available when the case was filed, and the amount in dispute is at least US$5,000. The deadline is 60 calendar days from notification.

Neither Visa nor Mastercard publishes the review fee amount. The rates live in regional fee guides and inside Mastercom, accessible only to scheme members. The "US$500 per case" figures that circulate in commentary cannot be traced to rule text, and a dispute-operations budget cannot be built on them. The only publicly fixed tariffs in this area are Visa's US$1,000 Compliance Case Fee and its US$5,000 non-compliance appeal fee.

Monitoring: the 2026 thresholds

On 1 June 2025 Visa folded its separate dispute and fraud programmes into a single Visa Acquirer Monitoring Program. Under the VAMP fact sheet the ratio is the count of fraudulent (TC40) plus disputed (TC15) transactions divided by the count of settled transactions (TC05), card-not-present only. The advisory period closed on 30 September 2025, and on 1 April 2026 the merchant excessive threshold in the AP, Canada, Europe and US regions dropped from 220 to 150 basis points, with a minimum of 1,500 fraud and dispute events a month. What an identified merchant's acquirer pays is not public: the fee schedule sits in the VAMP Guide.

The thresholds are not printed in the rules. Section 10.4.3.1 simply refers to the Visa Acquirer Monitoring Program Guide, which is not published. More striking, section 12.5.4 — "Dispute Monitoring Fees and Non-Compliance Assessments" — survives in the public edition as an empty heading with no text beneath it. The previously published dispute schedules moved into the closed guide in their entirety.

The mirror programme for issuers is barely discussed even though it is documented openly. Under section 10.4.7.1 the Visa Issuer Monitoring Program triggers at 750 disputes together with a 1% disputes-to-sales ratio, or at US$500,000 of reported fraud together with a 1% fraud-to-sales ratio, all card-absent. The first three months carry no assessment; months 4–6 cost US$25,000, months 7–9 US$50,000, months 10–12 US$100,000 (section 12.5.3.1). Exit requires three consecutive months below threshold.

Mastercard computes its ratio differently from Visa, which breaks any direct comparison: under SPME section 8.3.1 a merchant's chargebacks in a calendar month are divided by its Mastercard transactions in the preceding month. Where volume is growing fast the denominator lags and the ratio is inflated mechanically.

A separate line targets data manipulation. Under section 12.5.3.2, altering a merchant's name, data or performance to circumvent VAMP or VIRP draws US$25,000 per merchant per month and permanent disqualification of the merchant and its principals. Splitting volume across MIDs to stay under a threshold is exactly this.

Interchange: who sets it and where the caps run

Interchange is set neither by the issuer nor by the acquirer but by the scheme, as a multilateral default rate applied wherever banks have not agreed bilaterally. Hence its legal fragility: it is a horizontally agreed price, and competition authorities have treated it as such for twenty years.

EEA: the IFR caps and their carve-outs

In the EEA the caps come from Regulation (EU) 2015/751: Article 3 sets 0.2% for consumer debit, Article 4 sets 0.3% for consumer credit. Article 3(2) lets a member state instead permit a flat fee of no more than EUR 0.05 per transaction, or a combination, provided total scheme interchange stays within 0.2% of annual transaction value. More falls outside the caps than is generally assumed: Article 1(3) excludes commercial card transactions, ATM and over-the-counter cash withdrawals, and cards issued by three-party schemes from Chapter II altogether. Article 1(5) then reclassifies a three-party scheme as four-party the moment it licenses third-party issuers or acquirers, or issues cards with a co-branding partner or through an agent — which is why licensed Amex cards in the EU are capped while its proprietary cards are not.

The anti-circumvention rule in Article 5 treats as interchange "any agreed remuneration, including net compensation, with an equivalent object or effect" received by an issuer from the scheme, an acquirer or any other intermediary. It is the only IFR provision that formally reaches scheme fees, and it has never been applied to them directly.

Inter-regional interchange — on cards issued outside the EEA — is not capped by the Regulation. It was capped by commitments Visa and Mastercard gave the European Commission on 29 April 2019 in cases AT.39398 and AT.40049: 0.2% and 0.3% card-present, 1.15% and 1.5% card-not-present, for five years and six months.

United States: Regulation II

In the United States the only cap sits on large-issuer debit. Regulation II allows US$0.21 plus 0.05% of value plus a cent for fraud prevention, and issuers with assets below US$10bn are exempt. Its legal footing is contested: a challenge to the fee standard, Corner Post v. Board of Governors, is before the Eighth Circuit (No. 25-3000), and as at September 2026 the cap remains in the regulation.

United Kingdom: no cross-border cap

In the United Kingdom the IFR survives as assimilated law, though the register flags it as revoked by Schedule 1 to the Financial Services and Markets Act 2023 — a revocation that bites only as regulator rules replace it. What matters more in practice is that the cross-border cap never arrived. After Brexit, Visa and Mastercard raised card-not-present UK–EEA interchange from 0.2% and 0.3% to 1.15% and 1.5%, multiples of 5.75 and 5. The PSR proposed a two-stage cap, then in October 2025 dropped the interim cap in favour of first building a methodology. The High Court on 15 January 2026 rejected the challenge by Visa, Mastercard and Revolut to the regulator's powers, but as at September 2026 neither the level nor the timing of any cap has been fixed: the PSR plans to set the level through a Merchant Indifference Test using a survey of UK merchants run by IFF Research, whose draft questionnaire it put out for comment in February 2026.

Scheme fees: the second layer nobody capped

Scheme fees are not interchange. Interchange flows from acquirer to issuer; scheme fees flow from both sides to the scheme itself, for authorisation, clearing, licensing, service access, 3-D Secure, tokenisation and dozens of separate line items. They fall outside the IFR entirely, which is why attention shifted to them in the decade after the caps came in.

Regulators landed somewhere more cautious than the market expected. In its final decision PS26/1 of July 2026 the PSR relied on its finding that Visa and Mastercard face ineffective competitive constraints on the acquiring side and that their scheme and processing fees rose substantially without clear information to acquirers — and imposed no price cap. The outcome is two binding directions: Information, Transparency and Complexity, with twelve months to comply, and Pricing Governance, with four, plus a separate regulatory financial reporting track. The regulator itself is being wound up: the Treasury's consultation response of 21 April 2026 confirms the PSR's consolidation into the FCA, with the power to impose price controls carried across, once primary legislation passes.

3-D Secure: where liability shift works and where it does not

The mechanism is simple: authenticate the transaction and the card-absent fraud dispute becomes invalid. Visa implements this through Table 11-28, the invalid-dispute table for condition 10.4. Protection attaches at ECI 5 — the issuer returned an Authentication Confirmation and the CAVV reached the authorisation request — and at the tokenised equivalent carrying a TAVV. It also attaches at ECI 6, an attempted authentication answered by Visa on the issuer's behalf, with one carve-out: not for non-reloadable prepaid cards.

The second gap sits outside condition 10.4. Authentication closes a fraud dispute but does nothing for category 13: goods not received, not as described, cancelled subscription all pass through 3-D Secure untouched. The third is an express carve-out for crypto and NFTs: under Table 11-28 a dispute is invalid where the cardholder participated in a transaction acquiring non-fiat currency or an NFT and then claims to have been deceived into sending the asset to a fraudulent recipient. The scheme declines to adjudicate an authorised-push-payment scenario inside a card dispute.

In the EEA, mandatory strong customer authentication sits on top of scheme rules. The exemptions come from Commission Delegated Regulation (EU) 2018/389: Article 16 covers transactions up to EUR 30 with a cumulative ceiling of EUR 100 or five consecutive transactions; Article 18 covers transaction risk analysis, where the permitted transaction value is tied to the provider's own fraud rate. The Annex sets three steps: up to EUR 500 at a 0.01% fraud rate, up to EUR 250 at 0.06%, up to EUR 100 at 0.13%. Entitlement is confirmed by annual audit, and in the first year and at least every three years thereafter by an independent external auditor. The PSD3 and PSR package rewrites both the SCA regime and the allocation of fraud liability sitting above scheme rules — the timetable and substance of that reform are set out separately.

High-risk verticals and the new participant categories

High risk in the Visa rules is not a judgement call but a list of MCCs, defined by the Visa Integrity Risk Program Guide, plus a distinct regime for the acquirer. Under section 1.9.5.1, before submitting a single transaction from a high-integrity risk merchant, payment facilitator or ramp provider, the acquirer must file a registration application and be approved, undergo a financial review, hold the required equity capital, be investment grade or commit to compensating controls such as collateral, be in good standing across all Visa risk programmes, and where required complete an on-site Visa Acceptance Risk Standards review. Registration extends beyond merchants to the agents that solicit them.

Registration penalties

Penalties for failing to register come straight from the rules: US$25,000 per month for each unregistered high-integrity risk payment facilitator, rising to US$100,000 per 30-day period after three violations in a calendar year (section 12.3.1.1); and US$100,000 a month for Tier 1 and Tier 2 merchants, US$25,000 for Tier 3, plus US$2,000 for each high-integrity risk merchant identified (section 12.5.5.1).

Ramps, wallets and agentic platforms

New participant categories have entered the rules. A Ramp Provider is responsible and financially liable for each transaction processed on behalf of its conversion affiliates, and Chapter 4.1.24, Agentic Platform Requirements, was extended in the April 2026 edition to digital wallets used in agentic transactions. An Agentic Payment Provider must enrol in the Visa Intelligent Commerce programme and register with Visa, directly or through an Agentic Payment Enabler; it may not undertake agentic transactions in a card-present environment and may not aggregate multiple agentic transactions into one. Before the first transaction it must obtain cardholder consent to tokenisation and to the payment instruction, state the instruction's expiry, and — as a separate item — obtain the cardholder's acknowledgement that they are responsible for actions taken by the agent. This is the first card rule to place the risk of an algorithm's conduct expressly on the consumer on whose behalf it acts.

The rules also limit stacked intermediaries: under Table 1-10 a payment facilitator may not submit deposits on behalf of another payment facilitator, a staged digital wallet operator running person-to-person or money-transfer programmes, or a ramp provider. This keeps a second intermediary from sitting between the acquirer and the real seller, where monitoring would lose sight of who actually receives the volume. How this slots into the rest of an operator's control environment is covered in the compliance stack.

Alternative rails: the price of having no chargeback

A2A and pay-by-bank economics look better than cards: no interchange, no scheme fees, a flat fee per transaction. What disappears alongside them is the dispute cycle — a bank transfer has no reason code, no representment window and no arbitration. Buyer protection migrates from private rules into statute, and there it bites the provider harder: in the United Kingdom mandatory reimbursement for authorised push payment fraud has applied since 7 October 2024, with a maximum of GBP 85,000 per claim. Better for the merchant than a card dispute, worse for the banks, and the cost reappears in pricing. An operator in a high-risk vertical also has to keep the account open in the first place — what banks require for that is a separate exercise.

Stablecoin acquiring works the same way: settlement is final, there is no reversal at the rail layer, and the scheme uses the token as a settlement instrument between itself and the acquirer without changing the cardholder dispute rules at all. Visa launched USDC settlement in the United States on 16 December 2025 and extended the programme to nine blockchains on 29 April 2026 at an annualised run rate of roughly US$7bn. The legal treatment of the tokens themselves is covered under stablecoins, and the broader pattern of obligation shifting from the rail onto its operator under embedded finance.

Common mistakes

Scenarios

Scheme rules are a private code, but the obligations they create bite harder and faster than most public ones: a US$1,000 Compliance Case Fee is charged on notification alone, the Core Rules ladder reaches US$150,000 a month, and "significant" violations run to a million. Visa's dispute cycle is asymmetric — in fraud disputes there is no merchant-response stage and the acquirer files arbitration; in consumer disputes the issuer does — and the words chargeback and representment are effectively absent from the rulebook.

Monitoring in 2026 sits at 150 basis points for a Visa merchant, while the VAMP fee schedule sits in a non-public guide and section 12.5.4 remains an empty heading; Mastercard keeps its chargeback thresholds outside the public security rules.

Interchange is capped in the EEA at 0.2% and 0.3% with wide Article 1(3) carve-outs, is contested in the US before the Eighth Circuit, and has no cross-border cap at all in the UK, where UK–EEA rates remain 1.15% and 1.5%. Scheme fees remain uncapped: the PSR settled for transparency and governance in July 2026.