The Pulse blog
Industry analysis, product updates, and implementation playbooks for ISVs and software platforms embedding payments with Pulse.
Featured
Hand-picked reads
When a merchant is breached, the card networks hold its acquirer responsible for reporting, forensics and remediation. The deadlines in Visa's June 2026 What To Do If Compromised guide and Mastercard's account data compromise rules, what each can cost, and what a merchant-services team should have ready.
Kyle Hall
Visa and Mastercard both treat a missed dispute deadline as acceptance. How long the issuer has to raise a dispute, how long the acquirer has at each stage on each network, why processors give merchants a shorter window, and how to set up your own clocks.
Kyle Hall
The federal stablecoin law takes effect on 18 January 2027, and Treasury's offer-and-sale proposal is open for comment until 19 October. What the Act covers, where a payments business might fall under it, and what changes when a merchant takes stablecoins instead of cards.
Kyle Hall
Visa's April 2026 interchange tables removed Level 2 for corporate, purchasing and business cards, leaving Product 3 under the Commercial Enhanced Data Program as the only enhanced-data rate. What the rate tables show, what the 0.05% fee and validation mean, and what acquirers and ISOs should check.
Kyle Hall
S. 3623 would make the largest card issuers enable a second, unaffiliated network on credit cards and let merchants choose the route. As of October 2026 it has not left committee. What the bill text says, who it covers, how long it would take, and where acquirers and ISOs fit.
Kyle Hall
Nacha's account validation rule covers consumer WEB debits, not merchant settlement, and even where it applies it asks only whether an account is open. What prenotes, micro-entries and validation services actually prove, why ACH never checks the name, and what to put in your boarding and account-change policy.
Kyle Hall
Since October 2025 Mastercard's rules have required acquirers to echo its new Transaction Link Identifier on captures, reversals and refunds. From 23 October 2026, processors say it must also go on every subscription renewal and card-on-file charge. What the rules say, where the published enforcement dates disagree, and what an ISO should check.
Kyle Hall
The CFPB's amended Section 1071 rule excludes merchant cash advances from small business lending data collection, but declined to say MCAs are not credit under ECOA. What changed, what did not, and what an ISO that refers MCAs still answers to.
Kyle Hall
Congress replaced the 0.3 percent delta-9 test with total THC, a ban on synthesised cannabinoids and a 0.4 milligram per-container cap. Products outside the new definition are treated as marijuana, which puts them under the card networks' illegal-transaction rules. The dates, the statute and what an underwriting team should do.
Kyle Hall
California, Colorado and New York require acquirers to assign MCC 5723 to firearms merchants; about twenty states forbid it, and a House-passed federal bill would ban it and preempt both. What the statutes, Visa and Mastercard require of an onboarding team as of October 2026.
Kyle Hall
The merchant name keyed in at boarding becomes the line on every cardholder statement. Visa moved its merchant name rule into the Core Rules in September 2025, and Mastercard added an anti-impersonation requirement in June 2025. What both rulebooks require, and what an onboarding team should check.
Kyle Hall
An ISO works under its sponsor bank's card-network membership, and both Visa and Mastercard require that bank to register it before it sells. What the April 2026 Visa rules and June 2026 Mastercard Rules require of the bank and the ISO, from sub-ISOs and contract terms to change notices, and what Visa adds on 24 October 2026.
Kyle Hall
From 1 April 2027 Mastercard's GMAP replaces the Acquirer Chargeback Monitoring Program, adding a combined fraud-and-chargeback ratio for merchants and acquirers, separate measurement of each sub-merchant, and a lower Excessive Chargeback threshold each year to 2031. What the industry summaries of the bulletin agree on, and what to confirm with your acquirer.
Kyle Hall
The FCC voted on 30 September 2026 on an order that, in its published draft, lets callers designate an exclusive opt-out method and narrows the revoke-all rule. What the TCPA already requires of a merchant-services sales team that calls and texts owners' mobiles, what the draft changes, and what it leaves alone.
Kyle Hall
Settling to sub-merchants means receiving money and sending it on, which federal and state law call money transmission. What FinCEN's payment processor exemption and the states' agent-of-payee exemption require, where the state texts differ, and what they do not cover.
Kyle HallVisa requires a direct acquirer agreement once a sponsored merchant passes US$1 million a year, and since October 2025 an existing one gets two years with no renewal trigger. Mastercard's line is US$10 million. Here is what each network's public rules require of a payment facilitator and its acquirer.
Kyle Hall
In September 2026 the FTC settled with Nuvei ($4.85 million) and Humboldt Merchant Services ($12 million) over merchants they boarded. The court orders set out screening, monitoring and sales-agent rules in detail, and a statement from the FTC's chairman and a commissioner says a processor is liable when it knew, should have known or looked away, measured against what card-network diligence would have found.
Kyle Hall
On 9 September 2026 OFAC replaced FAQ 5, its guidance on assessing sanctions-list matches. The old version ended with a call to the compliance hotline; the new one sets out six steps, says OFAC does not confirm matches or false positives, and expects a documented risk-based decision. What changed, how the 50 Percent Rule, the 10-business-day reports and the 10-year recordkeeping rule fit around it, and what the IMG Academy settlement adds for merchant onboarding.
Kyle Hall
Visa's rules sort decline codes into four categories: one bars any retry, and the other three allow up to 20 attempts in 30 days, up from 15 since May 2025. Mastercard steers retries with Merchant Advice Codes. What the rules say, what the fees are reported to be, and what an ISO or acquirer should check.
Kyle Hall
From 24 October 2026, Visa lets a merchant defend a 10.4 card-absent fraud dispute with a cardholder's earlier undisputed purchases at other merchants, not only its own, and in pre-arbitration the acquirer may submit only transaction data it processed itself. What CE3.0 requires today, what changes, and what an acquirer or ISO should check first.
Kyle Hall
Visa caps a credit surcharge at 3% and the pending settlement would loosen the brand rules further, but state law is untouched. Where New York, Connecticut, Massachusetts, Colorado and California part company with a one-size surcharge or cash discount program, as of September 2026.
Kyle HallTexas House Bill 700 added Chapter 398 to the Finance Code in September 2025, and the implementing rules took effect on 9 July 2026. Anyone who obtains or offers to obtain sales-based financing for a Texas merchant for compensation is a broker under the chapter, has to register with the Office of Consumer Credit Commissioner through NMLS by 31 December 2026, and is covered whether or not the business has a Texas address. Here is what the chapter requires and what to check before the deadline.
Kyle Hall
The Eighth Circuit threw out the FTC's amended Negative Option Rule in July 2025, days before its compliance date, and the Commission restarted the rulemaking with an advance notice in March 2026. None of that touched ROSCA, the Visa and Mastercard subscription rules, or the state auto-renewal laws, and the FTC has twice applied ROSCA to a payment company rather than the merchant. Here is what is in force, what the card rules require at the checkout and at the end of a trial, and what to check in a subscription portfolio, as of September 2026.
Kyle Hall
In August 2025 a North Dakota federal court held that the Federal Reserve's 21-cent debit interchange cap exceeds what the Durbin Amendment allows, then stayed its own vacatur so the market would not go unregulated. A Kentucky court upheld the same rule six weeks later. The Eighth Circuit heard argument in May 2026, the Sixth Circuit hears it on 22 October, and the Board's 2023 proposal to cut the cap to 14.4 cents is still unfinished. Here is what is in force, what is not, and what to check in a debit portfolio, as of September 2026.
Kyle Hall
Since June 2026 the OCC and FDIC are barred by their own rule from criticising a bank on the basis of reputation risk, and the FDIC has cut the term from the payment-processor guidance sponsor banks apply to ISOs and payment facilitators. The OCC, meanwhile, has named adult entertainment, firearms, tobacco and digital assets among the sectors the largest banks wrongly restricted. Here is what the rule binds, what it leaves alone, and what to change in an underwriting policy, as of September 2026.
Kyle Hall
In August 2026 the PCI Security Standards Council replaced FAQ 1331. A merchant assessed by Report on Compliance can no longer use an SAQ's eligibility criteria to narrow the assessment on its QSA's say-so; the approach has to be explicitly reviewed, discussed and agreed with the merchant's compliance-accepting entity. Visa and Mastercard both put that role on the acquirer. Here is what changed, who now has to decide, and what to record, as of September 2026.
Kyle Hall
A payment facilitator, ISO or software platform that originates ACH entries for its merchants through a sponsor bank is a Third-Party Sender under the Nacha Operating Rules. The label brings an origination agreement with prescribed terms, registration by the ODFI, a risk assessment and an annual audit that cannot be borrowed from anyone else, and the bank's own monitoring duties performed on its behalf. Here is what the rules require, as of September 2026.
Kyle Hall
The VIRP tier table and fee schedule are member-only, but the acquirer's obligations are not. The 18 April 2026 Visa Core Rules spell out the registration prerequisites, a 30-day baseline and daily monitoring standard, seven-day response clocks, the content prohibitions, and non-compliance assessments of up to USD 100,000 a month. Here is what they say, what the third-party guides get right, and where the reports of the fees contradict each other.
Kyle Hall
Mastercard's terminated-merchant file is now MATCH Pro, legacy access is being switched off, and from 15 October 2026 an inquiry returns a merchant risk score with the possible matches. Here is what Chapter 11 of Mastercard's rules requires of acquirers and payment facilitators, the five-day clock, the eleven reason codes, the 30-day response duty, where Visa's rules point at the same file, and where the guidance most teams work from is out of date.
Kyle Hall
The Illinois Interchange Fee Prohibition Act now takes effect 1 July 2027, is permanently enjoined as to national banks, out-of-state state banks, federal savings associations and the card networks, and still applies on paper to Illinois-chartered banks and credit unions. What the statute requires, what the OCC and the court did to it, and what an acquiring team should do before then.
Kyle Hall
Mastercard's Specialty Merchant Registration Program now costs acquirers $1,000 a year per registered merchant, $50,000 a year for the licence to acquire them at all, and two cents plus ten basis points on every purchase those merchants run. Here is what the bulletin and the current rules manual actually say, and what it changes for underwriting and pricing.
Kyle HallOn 9 June 2026 the court gave preliminary approval to the amended Visa and Mastercard rules settlement: a 10-basis-point cut to average credit interchange, a 125-basis-point cap on standard consumer cards, surcharging without regard to American Express, and the right to decline whole categories of cards. None of it is in force. Here is what the agreement actually says, what it keys each change to, and why the operational work lands on acquirers, ISOs and payment facilitators rather than merchants.
Kyle Hall
The One, Big, Beautiful Bill Act restored the $20,000 and 200-transaction 1099-K threshold — for third party settlement organizations only. Card acquiring never had one. Here is what acquirers and payment facilitators still file for calendar year 2026, the two tip boxes the form just grew, and the filing system that disappears after 1 January 2027.
Kyle Hall
A final rule effective 14 August 2026 permanently ended beneficial ownership reporting for U.S. companies under the Corporate Transparency Act. The Customer Due Diligence Rule that governs what your underwriting file has to contain was not touched. Here is the difference, and what to tell a merchant who thinks the requirement was repealed.
Kyle Hall
Two sets of revised Mastercard standards took effect in 2026: merchant scanning moved ahead of the first transaction on 1 January, and potential scam merchant monitoring put acquirers on a 72-hour investigation clock on 24 July. Here is what each requires, and which triggers apply to which merchants.
Kyle Hall
Nacha's fraud monitoring rules phased in on March 20 and June 19, 2026, and the second phase removed the volume threshold entirely. Every non-consumer Originator, Third-Party Service Provider and Third-Party Sender is now in scope — here is what the rules require, what they deliberately don't, and where the annual review catches people out.
Kyle Hall
Visa's Acquirer Monitoring Program cut the merchant threshold to 150 basis points on 1 April 2026, but much of the published guidance still quotes numbers Visa withdrew before launch. Here is the ratio, the thresholds in force, and what they change for underwriting and risk teams.
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle Hall
Kyle HallNewsletter
Industry analysis, product updates, and implementation playbooks for ISVs — in one short email. No spam, unsubscribe anytime.
More from Pulse
Explore the full Pulse feature catalog — onboarding, residuals, fraud, and more.
Learn moreSee how software platforms add payments and earn a revenue share with Pulse.
Learn moreWalk through Pulse with our team — tailored to your portfolio and processor mix.
Learn more