What payment networks do to help acquirers meet compliance rules

Payment networks—Visa, Mastercard, American Express, Discover—set the rules that merchants and their banks must follow, then provide tools and documentation to make compliance possible. They publish detailed requirements, offer training programs, maintain compliance monitoring systems, and issue alerts when standards change. An acquirer (the bank that processes payments for a merchant) relies on these network resources to keep their merchants from violating rules that could result in fines, chargebacks, or processing privileges being revoked.

The networks do not police compliance for free. They charge acquirers for access to compliance resources, and they expect acquirers to pass that responsibility down to merchants. But the infrastructure exists: operating guides, certification programs, data security standards, and dispute resolution processes. Understanding what the network provides—and what it does not—helps you know what your acquirer should be doing on your behalf.

Key Takeaways

  • Payment networks publish operating guides and compliance manuals that define what merchants and acquirers must do; these documents are the source of truth for rules around data handling, transaction reporting, and dispute management.
  • Networks require acquirers to monitor merchants for compliance violations and to remove merchants who repeatedly break rules, shifting the enforcement burden to the bank rather than the network itself.
  • Compliance certifications like PCI DSS (for data security) and network-specific training programs are offered by networks or their approved vendors, and acquirers typically require merchants to complete them.
  • Networks maintain dispute and chargeback systems that define how transactions are challenged and resolved; acquirers use these systems to help merchants understand why chargebacks occur and how to prevent them.
  • When a network changes its rules, it notifies acquirers through bulletins and effective dates; acquirers then have a window to communicate changes to merchants before enforcement begins.

Operating guides and compliance manuals as the rule source

Each payment network publishes an operating guide—sometimes called a rulebook or compliance manual—that defines what merchants and acquirers must do. Visa's Visa Operating Regulations, Mastercard's Rules and Procedures, and American Express's Merchant Compliance Guide are the actual documents that govern how transactions are processed, how data is handled, and what happens when things go wrong. These are not marketing materials; they are the legal framework that acquirers contractually agree to enforce.

The guides cover transaction reporting (what information must be sent with each payment), data security (how cardholder data can be stored and transmitted), dispute procedures (how chargebacks are filed and defended), and merchant conduct (what merchants are prohibited from doing). An acquirer's compliance team reads these documents and builds systems around them. If a merchant violates a rule in the operating guide, the acquirer is the one responsible for catching it and correcting it—or terminating the merchant relationship.

These guides are updated regularly, sometimes several times per year. Networks announce changes through compliance bulletins and set effective dates. Acquirers must then update their systems and notify merchants of new requirements. The lag between announcement and enforcement is usually 30 to 90 days, giving acquirers time to prepare.

Compliance monitoring systems that track merchant behavior

Payment networks operate monitoring systems that track merchant activity in real time or near-real time. These systems flag unusual patterns: a sudden spike in chargebacks, a high rate of declined transactions, unusual geographic activity, or repeated violations of specific rules. The network reports these flags to the acquirer, not directly to the merchant.

The acquirer then investigates. If a merchant is processing an unusually high volume of transactions in a high-risk category (like gambling or adult services), the network may require the acquirer to place the merchant in a higher-risk program with additional monitoring and reporting requirements. If a merchant has a chargeback rate above the network's threshold—typically 1% to 1.5% of transaction volume—the network may require the acquirer to place the merchant on a remediation plan or terminate the relationship.

Networks also maintain lists of merchants that have been terminated by other acquirers for fraud or compliance violations. These are called terminated merchant files or TMFs. An acquirer must check these lists before onboarding a new merchant to avoid processing for someone who has already been kicked off the network. If an acquirer knowingly processes for a merchant on the TMF, the network can fine the acquirer or revoke their processing rights.

Data security standards and certification requirements

The Payment Card Industry Data Security Standard, or PCI DSS, is the compliance framework that governs how merchants, acquirers, and payment processors handle cardholder data. It is maintained by the PCI Security Standards Council, a consortium created by the major networks. PCI DSS defines 12 core requirements: firewalls, encryption, access controls, regular security testing, and incident response procedures, among others.

Merchants do not have to be PCI certified themselves, but they must be PCI compliant—meaning they follow the standard. Acquirers are responsible for ensuring their merchants comply. For merchants that store, process, or transmit cardholder data, acquirers typically require annual PCI assessments conducted by a may have access to security assessor. For merchants that do not handle raw card data (because they use a payment processor or gateway), the compliance burden is lighter.

Networks also offer or require training programs on compliance topics. Visa has the Visa Compliance Academy, which offers online courses on topics like fraud prevention, data security, and dispute management. Mastercard offers similar training through its Mastercard Risk Management Services. Acquirers often require merchants to complete these courses as a condition of processing, and they track completion rates as part of their compliance monitoring.

Dispute and chargeback systems that define resolution processes

When a cardholder disputes a transaction, the dispute flows through a network-defined process. Visa calls this the Visa Dispute Resolution system; Mastercard calls it Mastercard Chargeback Guide. These systems define what counts as a valid dispute, what evidence a merchant can submit to defend the transaction, what timeline applies, and who makes the final decision.

The network does not decide individual disputes; the acquirer and the card-issuing bank do. But the network sets the rules for how the dispute is conducted. For example, Visa defines specific reason codes for chargebacks: "Cardholder Does Not Recognize," "Fraudulent Transaction," "Goods or Services Not Received," and dozens of others. Each reason code has its own evidence requirements and timelines. A merchant cannot argue against a chargeback unless they understand which reason code applies and what evidence the network requires.

Acquirers provide merchants with chargeback reports that show which reason codes are most common, which merchants have the highest chargeback rates, and what evidence was submitted in disputes. This data helps merchants understand where they are losing disputes and what they need to change. Networks also publish best practices for reducing chargebacks in specific industries—for example, subscription merchants should send clear billing descriptors and renewal notices to reduce "Cardholder Does Not Recognize" disputes.

Compliance bulletins and rule change communication

Payment networks announce rule changes through compliance bulletins, which are sent to acquirers and posted on the networks' compliance portals. These bulletins specify what is changing, why, and when the change takes effect. An acquirer receives the bulletin, updates its systems and policies, and then communicates the change to merchants through email, portal updates, or direct outreach.

The timeline between announcement and enforcement varies. Some changes take effect immediately; others have a 30-, 60-, or 90-day grace period. During the grace period, acquirers are expected to educate merchants and update systems. After the effective date, the network begins enforcing the new rule, and acquirers are responsible for ensuring their merchants comply.

Common examples of rule changes include new data security requirements (like requiring tokenization for recurring payments), new dispute procedures (like shortened timelines for submitting evidence), or new merchant categories (like adding restrictions on certain high-risk industries). Acquirers that fail to communicate these changes to merchants often end up with merchants who unknowingly violate the new rules, resulting in chargebacks or fines.

Risk management programs and merchant categorization

Payment networks categorize merchants by risk level based on industry, transaction volume, chargeback rate, and compliance history. A low-risk merchant (like a grocery store with a stable customer base and low chargebacks) operates under standard rules. A high-risk merchant (like a travel agency, subscription service, or merchant with a history of chargebacks) may be placed in an enhanced monitoring program with additional reporting requirements, higher reserve requirements, or mandatory fraud prevention tools.

Networks publish lists of high-risk merchant categories. These typically include travel, gambling, adult services, money transfer, and cryptocurrency. Acquirers must have specific risk management programs in place for merchants in these categories. The programs may require the merchant to use specific payment processors, maintain higher cash reserves, submit monthly compliance reports, or implement specific fraud prevention tools.

If a merchant's risk profile changes—for example, if chargebacks spike or the merchant starts processing in a new high-risk category—the network may require the acquirer to move the merchant to a different risk tier. This can result in higher processing fees, additional compliance requirements, or termination of the relationship.

Frequently Asked Questions

What happens if an acquirer does not enforce network compliance rules?

The network can fine the acquirer, require them to terminate specific merchants, or revoke their processing rights entirely. Networks also conduct audits of acquirers to verify they are monitoring merchants and enforcing rules. An acquirer that repeatedly fails to enforce compliance can lose the ability to process transactions on that network.

Can a merchant appeal a chargeback decision made by the network?

The network does not make the chargeback decision; the card-issuing bank does. A merchant can submit evidence to defend the transaction, but the final decision rests with the bank. If the bank rules against the merchant, the merchant cannot appeal to the network. The merchant's only recourse is to work with their acquirer to understand why the dispute was lost and prevent similar disputes in the future.

Do all payment networks have the same compliance rules?

No. While the major networks (Visa, Mastercard, American Express, Discover) have similar frameworks, they differ in specific requirements, timelines, and enforcement procedures. A merchant processing on multiple networks must comply with each network's rules. Acquirers typically manage this by implementing the strictest requirement across all networks.

How often do payment networks update their compliance rules?

Networks update rules multiple times per year, though not all updates are major. Some are clarifications or technical adjustments; others are significant changes to data security or dispute procedures. Acquirers monitor compliance bulletins continuously and communicate changes to merchants as they occur.

What is the difference between PCI compliance and network compliance?

PCI compliance is a data security standard that applies to anyone handling cardholder data. Network compliance refers to the broader set of rules each payment network enforces, including dispute procedures, merchant conduct, and reporting requirements. A merchant can be PCI compliant but still violate network rules (for example, by processing transactions in a prohibited category).