Card Scheme Mandate

What Is a Card Scheme Mandate?

A card scheme mandate is a binding rule or requirement issued by a card network (also called a card scheme) that participants in the payment ecosystem must follow by a specified deadline. Card networks such as Visa, Mastercard, American Express, and Discover publish operating regulations that govern how payments are processed, secured, and disputed. When a network introduces a new rule with an enforcement date and consequences for non-compliance, that rule is a mandate.

Mandates differ from voluntary best practices or optional programs. They carry specific penalties: financial fines, shifted liability for fraud losses, placement into monitoring programs, or removal from the network's participant registry. Every party in the four-party model (issuer, acquirer, processor, and merchant) can be subject to mandates, though acquirers typically bear primary enforcement responsibility for their merchant portfolios.

Card networks publish their rules in formal documents: Visa maintains the Visa Core Rules and Visa Product and Service Rules, while Mastercard publishes the Mastercard Rules manual. These documents are updated regularly, and changes with enforcement deadlines become mandates that ripple through the entire payment chain.

How It Works

Card scheme mandates follow a predictable lifecycle from announcement to enforcement:

1. The card network identifies a need: a security gap, a technology upgrade, or a market standardization requirement
2. The network publishes a rule change in its operating regulations with a compliance deadline, often 12 to 36 months in the future
3. Acquirers and processors receive bulletins and must communicate the requirement to their merchants
4. Participants implement the required changes (new hardware, software updates, process modifications)
5. After the deadline, the network begins enforcement through monitoring, fines, or liability shifts

The Acquirer as Enforcement Channel

Networks do not have direct relationships with most merchants. Instead, they enforce mandates through acquirers. When a network identifies a rule violation, it assesses a fine against the acquirer, who then passes the cost to the non-compliant merchant under the terms of their acquiring agreement. This pass-through is typically governed by an indemnification clause in the merchant services contract.

This structure means acquirers have strong incentives to ensure their merchants comply. An acquirer with a portfolio full of non-compliant merchants faces accumulating fines, heightened monitoring from the network, and potential restrictions on their ability to onboard new merchants.

Types of Enforcement

Card networks use several enforcement mechanisms, often applied in escalating stages:

• Liability shifts: the party that lacks the mandated technology absorbs fraud losses. This was the primary mechanism for the EMV chip migration
• Financial fines: monthly penalties assessed against the acquirer, ranging from a few thousand dollars for minor violations to over $100,000 per month for sustained PCI DSS non-compliance
• Monitoring programs: the acquirer or merchant is placed into a formal program with reporting requirements and escalating penalties
• Fee surcharges: additional per-transaction fees for payments that do not use the mandated technology, such as surcharges on card-on-file transactions processed without network tokens
• Registry removal: service providers or merchants that remain non-compliant may be removed from the network's approved registries, effectively barring them from processing payments

Notable Mandate Examples

EMV Chip Liability Shift

On October 1, 2015, Visa, Mastercard, and American Express activated a liability shift in the United States. Merchants that had not upgraded to EMV chip-capable terminals became liable for counterfeit card fraud that would previously have been absorbed by the issuer. This was not a fine: it was a reallocation of existing fraud costs to whichever party (issuer or merchant) had the less secure technology. Fuel dispensers received an extended deadline due to the cost and complexity of terminal upgrades.

PCI DSS Compliance

All four major card networks require merchants and service providers to comply with the Payment Card Industry Data Security Standard. While the PCI Security Standards Council maintains the standard itself, the card networks enforce compliance through their own programs. Version 4.0 of PCI DSS became mandatory in March 2024, with future-dated requirements taking full effect on April 1, 2025. Acquirers face escalating fines for merchants that fail to validate compliance or submit remediation plans.

3D Secure and Strong Customer Authentication

In Europe, the Payment Services Directive 2 (PSD2) required Strong Customer Authentication (SCA) for online card payments, enforced between 2020 and 2021 across the European Economic Area and the UK. 3D Secure 2.0 became the standard method for meeting this requirement in card-not-present transactions. The mandate requires two-factor authentication using at least two of three elements: something the customer knows (a PIN or password), something they possess (a phone or hardware token), or something they are (a fingerprint or facial scan).

Mastercard has extended 3DS data requirements further: as of July 2026, merchants must include additional fields in every 3D Secure authentication request, such as cardholder name, billing address, a contact method, and a device identifier. Transactions missing this data may lose liability-shift protection.

Network Tokenization

Both Visa and Mastercard are mandating the adoption of network tokenization for card-on-file and e-commerce transactions. Mastercard requires credential-on-file transactions in Europe to use network tokens starting October 2026, with later phases extending through 2030. Visa has announced that its Credential Enrichment Service will be enabled for all card-on-file token requestors by October 2026. Networks are incentivizing adoption with lower interchange rates for tokenized transactions and penalizing non-tokenized transactions with per-transaction surcharges.

Visa Acquirer Monitoring Program (VAMP)

Effective April 2025, Visa consolidated five existing fraud and dispute monitoring programs into the Visa Acquirer Monitoring Program (VAMP). This program tracks a combined fraud and dispute ratio at both the acquirer and merchant level. Acquirers that exceed a 0.7% threshold face escalating penalties and potential merchant offboarding requirements. Merchants exceeding 1.5% (as of April 2026 in most regions) enter the "Excessive" tier with direct financial consequences.

Use Cases

Driving Technology Adoption at Scale

Mandates are the primary mechanism through which card networks standardize technology across millions of merchants and thousands of financial institutions. Without mandates, the EMV chip migration would have taken far longer, as individual merchants had little incentive to invest in terminal upgrades without a coordinated industry push. The liability shift created a clear financial incentive: upgrade or absorb fraud costs.

Reducing Fraud Across the Ecosystem

Mandates like 3D Secure authentication and PCI DSS compliance target specific fraud vectors. Visa reported that its liability shift for EMV significantly reduced counterfeit fraud chargebacks within the first year of enforcement. Monitoring programs like VAMP set explicit thresholds that force acquirers to manage portfolio-level fraud risk rather than tolerating high-fraud merchants.

Standardizing the Payment Experience

Contactless acceptance mandates and contactless payment requirements ensure consistent experiences for cardholders across different merchants and geographies. When a network mandates contactless acceptance, every terminal in the affected market must support NFC payments, creating the infrastructure density that makes tap-to-pay practical for consumers.

How Mandates Relate to Alternative Payment Rails

Card scheme mandates impose significant compliance costs on merchants and processors: terminal upgrades, software changes, annual PCI audits, monitoring fees, and the ongoing risk of fines. These costs are baked into the economics of card-present and card-not-present transactions but are absent from alternative payment rails.

Stablecoin payment systems, blockchain-based settlement, and account-to-account payment rails operate outside the card network mandate framework entirely. Merchants accepting stablecoin payments do not face EMV liability shifts, PCI DSS fines, or VAMP monitoring thresholds. This structural difference is one factor driving merchant interest in alternative payment methods, particularly for cross-border transactions where card scheme fees and mandate compliance add layers of cost and complexity.

Risks and Considerations

Compliance Cost Burden

Mandates impose real costs on businesses of all sizes. A small merchant upgrading terminals for EMV or implementing 3D Secure faces the same technical requirements as a large retailer, often without the same engineering resources. The ongoing cost of maintaining PCI compliance (annual assessments, quarterly scans, penetration testing) can be disproportionate for smaller businesses.

Cascading Deadlines

Multiple mandates often overlap. A payment processor in 2026 may simultaneously face PCI DSS 4.0 requirements, Mastercard 3DS data mandates, network tokenization deadlines, and VAMP threshold monitoring. Each mandate has its own timeline, regional variations, and exemptions, creating significant operational complexity for acquiring banks and processors that operate across multiple markets.

Uneven Enforcement

Card networks may grant extensions or waivers in markets where infrastructure readiness lags behind mandate timelines. This creates uneven competitive dynamics: merchants in markets with strict enforcement bear compliance costs that competitors in markets with waivers do not. The EMV liability shift, for example, saw significant regional variation in adoption rates due to differences in enforcement timing and terminal certification backlogs.

Acquirer Concentration Risk

Because fines flow through acquirers, a single high-risk merchant can trigger portfolio-level consequences for an acquirer. Under VAMP, an acquirer's overall fraud ratio includes all merchants in their portfolio. This creates incentives for acquirers to de-risk aggressively, potentially cutting off legitimate businesses that operate in higher-risk categories.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.