Embed Size (px)
Citation preview
Payments Legislative and
Regulatory Update
Merchant Advisory Group
2011 Annual Conference
Duncan Douglass
Partner, Retail & Corporate Payment Systems
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Agenda
• Implications of the Durbin Amendment/
Regulation II
– Background, Scope and Enforcement
– Interchange Fee Limitation
– Prohibitions on Network Exclusivity and
Routing Restrictions
• Impacts of FinCEN’s New “Prepaid
Access” Rule on Merchants
• Status of Federal Data Security
Legislative Initiatives
2
Background, Scope and
Enforcement of the Durbin
Amendment/Regulation II
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
4
Background
• Section 1075 of the Dodd-Frank Act created new 920 of the Electronic Fund Transfer Act (the Durbin Amendment)
• On December 16, 2010, the Federal Reserve Board (FRB) released proposed Regulation II for public comment (Proposed Rule)
• On June 29, 2011, the FRB released final Regulation II (Final Rule), after a two-month delay and review of 11,000 public comments
• On September 14, 2011, the FRB released FAQs to clarify certain aspects of Regulation II
• Regulation II consists of two key operative components:
– Interchange fee limitation
– Prohibitions on network exclusivity and routing restrictions
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Scope of Regulation II
• Applies to all debit cards and debit card
transactions, broadly defined to include:
– Traditional debit cards (access to a DDA),
regardless of authorization method (e.g.,
signature and PIN)
– Open-loop (network-branded) prepaid cards
(except for certain exemptions from the
interchange fee limitation) and semi-open
loop (RAN) prepaid cards
• Includes FSA/HRA cards and payroll cards
• Excludes closed-loop (single-retailer) gift cards
5
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Scope of Regulation II
• ATM transactions, transactions/cards on three-party systems, and cards that access bona fide trust accounts are not subject to the Final Rule
– ATM Transactions: The FRB excluded ATM transactions from coverage under the Final Rule because they do not involve payments for goods or services and issuers are not compensated for ATM transactions
– Three-Party Systems: The FRB excluded three-party systems (when the system operator is acting as both network and debit card issuer) from the Final Rule because three-party systems do not “route” transactions anywhere and so are not “payment card networks”
• The system operator and/or issuer does not also need to be the acquirer
• The same system may be a three-party system in some cases and a four-party network in other cases
– Bona Fide Trust Accounts: The FRB elected to exclude accounts established pursuant to bona fide trust arrangements from the definition of “accounts,” thereby excluding most health savings account (HSA)-linked cards from the Final Rule
6
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Rulemaking and Enforcement of
Regulation II
• Rulemaking authority under the Durbin Amendment (Regulation II) remains with the FRB, notwithstanding the transfer of many consumer protection responsibilities from the FRB to the CFPB as of July 21, 2011
• Enforcement of Regulation II is as follows:
– For regulated financial institutions, the financial institution’s applicable federal functional regulator has enforcement authority
– For other entities subject to Regulation II (e.g., payment card networks), the FTC has enforcement authority
• Regulation II does not allow for a private right of action – private entities may not sue for enforcement
7
Interchange Fee Limitation
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Interchange Fee Limitation
• Interchange fees for all regulated debit card transactions are capped at $.21 per transaction plus an ad valorem component of 5 basis points of the transaction value
• The $.21 per transaction limit is substantially higher than the flat $.12 per transaction cap included in the Proposed Rule, primarily due to the FRB’s inclusion of a much broader base of allowable costs in determining the interchange fee cap under the Final Rule, including:
– Network connectivity costs
– Costs of hardware, software and labor
– Network processing fees
– Transaction monitoring costs
9
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Interchange Fee Limitation
• Both the Final Rule and Proposed Rule pegged the interchange fee cap to the 80th percentile of issuer allowable costs based on the FRB’s survey of regulated issuers
• The 5-basis-point ad valorem component allows for fraud loss recovery, based on the average per-transaction fraud losses of the median issuer from the FRB survey of regulated issuers
• The FRB committed to periodically conduct surveys of regulated issuers and networks to reassess and potentially reset the interchange fee limitation
– On September 15, 2011, the FRB published for comment the content of four proposed surveys that the FRB proposes to use to collect data going forward
10
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
11
Interchange Fee Limitation –
Exemptions
• The Final Rule retained three specific exemptions to the interchange fee limitation from the Proposed Rule:
– Small Issuer: Any debit card issuer that, together with its affiliates, has total worldwide assets of less than $10 billion as of the end of the previous calendar year (excluding trust assets)
– Government Programs: Debit card transactions made pursuant to a government-administered payment program
– General-Use Reloadable Prepaid (GPR) Cards: General-use reloadable prepaid cards not marketed/labeled as gift cards if the prepaid card is the sole means of accessing the funds underlying the card (other than a cash-out transaction)
• Note also that these exemptions apply only to the interchange fee limitation and not to the prohibitions on network exclusivity and routing restrictions, which have no exemptions
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Interchange Fee Limitation –
Exemptions
• Small Issuer Exemption
– Issuer asset size is measured as of each December 31
– The FRB will publish annual lists of regulated and unregulated issuers based on asset size, which networks are permitted to rely on as conclusive proof of exempt/non-exempt status
• GPR Card Exemption
– If online bill payment services from a prepaid card are provided by the issuer or its agent, even using the card number, the card is not the only means of accessing the funds
– Cards associated with FSAs/HRAs that allow receipt-submission reimbursement are not eligible for the GPR card interchange fee exemption
– If an employer-sponsored payroll card allows a cardholder access to funds on the card as required by state law, the card can still be eligible for the interchange fee exemption
• Payment card networks are requiring regulated issuers to certify any BINs that qualify for product-specific exemptions (e.g., exempt government program and GPR cards)
12
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
13
Fraud Prevention Adjustment –
Interim Final Rule
• The FRB issued an Interim Final Rule, concurrently with the Final Rule, establishing an additional $0.01 per transaction fraud-prevention adjustment to allowable interchange fees available to issuers that comply with certain general standards outlined by the FRB
– The FRB adopted a non-prescriptive approach to the fraud prevention adjustment
– To qualify, an issuer must annually certify to its networks that it has adopted policies and procedures to identify and prevent fraud, monitor fraud losses, respond to suspicious activity, and secure data
• The $0.01 per transaction figure was computed based on the survey responses from regulated issuers
– The reported median issuer fraud-prevention cost was $.018 per transaction
– The FRB subtracted from this figure the median fraud-monitoring cost of $.007 per transaction (which was already included in calculating the $.21 interchange fee cap figure), and rounded to the nearest cent
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
14
Prohibition on Circumvention and
Evasion
• The Final Rule prohibits circumvention or
evasion of the interchange fee limitation
through the use of two tests:
– a general “facts and circumstances” test, under which
regulators have broad discretion to determine
whether circumvention or evasion has occurred
– a specific “net compensation” test, under which
issuers may not receive net compensation from
payment card networks, other than allowable
interchange fees, with respect to debit card
transactions or debit card-related activities
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Interchange Fee Limitation
• The interchange fee limitation and related requirements became effective on October 1, 2011
• The interchange fee limitation only regulates the relationship between a network and an issuer
– It does not regulate the relationship between a merchant and its acquirer or between a network and an acquirer
• Benefits to merchants of the interchange fee limitation, based on current rate structures announced by payment card networks depend greatly on average ticket size
– The smaller the ticket amount, the less beneficial current fixed-rate interchange fees are
– For small-ticket merchants, the current interchange fee schedules announced by payment card networks (which generally set interchange rates at the cap under Regulation II) may substantially increase the costs of debit card acceptance
15
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Interchange Fee Limitation
• Issuers are able to influence, somewhat, the interchange fees they receive by controlling the networks enabled on their debit cards – but this may change over time
• While Regulation II does not limit the card acceptance fees/discounts charged by three party systems, three party systems are susceptible to POS steering and/or loss of acceptance if their fees/discounts are out-of-line with market standards
• The prospects for substantive changes to the Durbin Amendment/Regulation II are limited in the near term
– The likelihood of success of a legal challenge to the FRB’s rulemaking are small – courts are very deferential to agency rulemakings
– The odds of a substantial adjustment by the FRB to the methodologies used in Regulation II (e.g., to compute the interchange fee cap) are also limited
– The most likely avenue for any change in the nearer term is through the FRB’s recurring surveys of issuer costs – that is, through adjustments to the interchange fee cap amount
16
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Interchange Fee Limitation
• The prospects for a legislative change to the Durbin Amendment or for regulation of credit card interchange rates are limited in the near term
– Tim Johnson (D-SD) is now chairman of the Senate Banking Committee
– Republicans control the House of Representatives
– This spring, a majority of the Senate voted in favor of the Tester Amendment (to delay and substantively modify the scope of the Durbin Amendment)
– The Durbin Amendment proved to be a political hot-potato for Congress that members will be loath to pick up again soon
17
Prohibitions on Network
Exclusivity and Routing
Restrictions
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Prohibition on Network Exclusivity
• The Final Rule’s prohibition on network exclusivity:
– requires an issuer to enable at least two unaffiliated networks on each debit card regardless of the authorization method that may be used by the cardholder, and
– prohibits networks from entering into exclusivity arrangements or otherwise limiting an issuer’s ability to contract with any other debit network
• The FRB loosened the qualifying network requirements in the Final Rule – networks can qualify as network enabled on a card if they:
– do not adopt a policy or rule that limits their scope of operations (by geography, merchant/merchant type or transaction type), and
– endeavor to be capable of processing reasonably anticipated transaction volume
19
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Prohibition on Routing Restrictions
• The Final Rule prohibits issuers and networks from requiring debit card transaction routing based on the card issuer’s or network’s preferences, and within certain limits, gives merchants and acquirers control over debit card transaction routing
– The Final Rule does not permit merchants to route transactions over a network that the issuer did not enable on the debit card
– Issuers may still control the number and identities of the network routing options available to merchants (subject to their obligation to satisfy the network diversity requirement of Regulation II)
20
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Prohibition on Routing Restrictions and
Network Exclusivity
• The prohibition on routing restrictions became effective October 1, 2011
• The prohibition on network exclusivity has rolling effective dates, as follows: – October 1, 2011, for payment card networks;
– April 1, 2012, for most debit card issuers and products;
– April 1, 2013, for certain health and other benefit cards subject to IRS rules;
– April 1, 2013 for general-use prepaid cards (whether or not reloadable) sold after this date, and for reloadable general-use prepaid cards sold and first reloaded prior to April 1, 2013
– For reloadable general-use prepaid cards sold prior to April 1, 2013 and first reloaded on/after April 1, 2013, effective date is 30 days after reload date
21
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Prohibition on Routing Restrictions and
Network Exclusivity
• The prohibitions on routing restrictions and network exclusivity do not regulate the relationship between a merchant and its acquirer
– The FRB left it to merchants and acquirers to determine routing decisioning between them; networks and issuers must abide by the routing decisions of the merchant or acquirer
• This affords merchants the opportunity to take advantage of least-cost routing across networks enabled on a particular debit card or to route based on network incentives
• It also affords acquirers the ability to route transactions according to their desires if merchants do not express a preference (including according to incentive arrangements between the acquirers and networks)
22
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Impacts and Implications of the
Prohibition on Routing Restrictions and
Network Exclusivity
• Based on current market practices, issuers that limit the networks enabled on their debit cards to one network per method of authorization (e.g., to 1 signature and 1 PIN network) will limit merchant routing choice in many instances
– Many merchants have not installed PIN-pads and so are only capable of accepting signature-authorized transactions
– Once a cardholder has elected a preferred authorization method, the merchant will have only a single routing option
• In the future, networks are likely to relax their authentication/authorization requirements to capture more transactions
– Signature networks may accept PIN-authorized transactions and PIN networks may accept signature-authorized (PINless) transactions
– If authorization method no longer limits transaction routing, merchants will have increased routing choice even when issuers only enable two networks (1 PIN and 1 signature) on debit cards
23
Impacts of FinCEN’s New “Prepaid
Access” Rule on Merchants
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
25
Overview of Prepaid Access Rule
• On July 29, FinCEN released its final rule to amend
the Bank Secrecy Act regulations applicable to
Money Services Businesses (MSBs) with respect to
prepaid cards/stored value (now known as “prepaid
access”)
• Initially effective September 27, FinCEN recently
delayed effectiveness of most of the requirements
until March 31, 2012 (including all compliance and
enforcement actions)
• The rules impose new obligations on “providers”
and “sellers” of prepaid access – both become
subject to certain requirements of MSBs
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Overview of Prepaid Access Rule
• “Prepaid Access” = access to funds paid in advance that can be later retrieved or transferred through an electronic device or vehicle
– Excludes most closed-loop cards that cannot be associated with more than $2,000 in a day
– Excludes pre-tax flexible spending programs (FSA/HRA cards)
– Excludes payroll cards that can only be loaded by the employer and that do not work internationally
– Excludes open-loop (network-branded) cards that cannot carry or allow for use of more than $1,000 in a day, that do not work internationally and can only be loaded from depository sources (e.g., not cash)
• “Provider” = a person involved in a prepaid access program that agrees by contract with other program participants to serve as the principal conduit for FinCEN to access information about the program. If no one is designated as provider by contract, then FinCEN will designate one based on the facts and circumstances
• “Seller” = a person that receives funds or value in exchange for the initial or subsequent loading of value to a prepaid access device or vehicle in connection with a prepaid program or that sells prepaid access (including closed-loop) to funds in excess of $10,000 to a single person in a day without having implemented policies and procedures to prevent such sales
26
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Implications of the Prepaid Access
Rules
• Providers must register with FinCEN as MSBs and (i) implement an AML program, (ii) file SARs, and (iii) retain prepaid access transaction records
• Sellers must (i) implement an AML program, (ii) file SARs, and (iii) collect, verify and retain information regarding purchasers of prepaid access; no registration with FinCEN is required
– These are substantial new obligations for merchants that sell/reload open-loop prepaid cards or that sell closed-loop prepaid cards in high dollar values (>$2,000) or in bulk amounts in excess of $10,000
• FI issuers of prepaid access have no new, independent obligations under the Prepaid Access rules because FIs are already subject to BSA compliance
– FinCEN has excluded FIs from the definition of MSB
– If the FI is designated as the “provider” of prepaid access, no other person associated with the program must register or comply with the obligations of a “provider”
27
Status of Federal Data Security
Legislative Initiatives
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Review of Current Federal Data Security
Legislative Efforts
• In May 2011, the Obama Administration sent a legislative proposal to Congress that would establish a federal data protection and breach notification regime
• The Obama proposal has not been introduced as legislation in the House or Senate, but 17 data security/breach notification bills are currently pending in Congress (10 in the Senate, 7 in the House)
– On September 22, the Senate Judiciary Committee approved three data security bills for consideration by the full Senate
– All three bills (proposed by Democrats) passed on party line votes (Democrats in favor, Republicans opposed), limiting their likelihood of passing the full Senate
29
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
Prospects for Federal Data Security
Legislation
• None of the currently pending bills in Congress is likely to pass – each contains too many controversial provisions
• Certain key data security concepts are gaining bipartisan support
– Establishment of a federal breach notification standard (to preempt the 47 state breach notification laws currently in effect)
– Designation of a federal office (likely within DHS) dedicated to cyber security matters
• Recent and increasing frequency of high-profile data security breaches (Sony, Google, the Senate, the Pentagon) enhance the likelihood of federal legislative success
• Staffers for Senate Majority Leader Reid and Senate Minority Leader McConnell are working on a bipartisan data security bill – watch for this bill as it may have the best chance of passing
30
Pa
ym
en
ts L
eg
isla
tiv
ean
d
Re
gu
lato
ry U
pd
ate
31
Questions?
Duncan B. Douglass
Alston & Bird LLP
One Atlantic Center
1201 West Peachtree Street
Atlanta, GA 30309-3424
Telephone: (404) 881-7768
Fax: (404) 253-8297
Email: [email protected]
