Uncovering the Impact of FRB Regulation II on Card Not Present Fraud for Credit Unions l Allied Solutions 2023

The CU Lab with NAFCU Services

Credit unions must configure each of their debit cards so that card-not-present transactions performed with such cards can be processed on at least two unaffiliated networks. As a practical matter, a credit union will first need to determine whether card-not-present transactions performed with its debit cards can already be processed on at least two unaffiliated networks; if the credit union is not already compliant with the final rule, it will need to adjust its debit card processing arrangements to meet the final rule’s requirements by July 1, 2023. Importantly, the final rule notes that credit unions do not need to affirmatively guarantee that two unaffiliated networks will always be available to all merchants in every conceivable transaction context but instead that credit unions configure their debit cards so that transactions performed with the card can be processed on at least two unaffiliated networks. This rule clarifies that the requirement for at least two unaffiliated payment networks to be enabled, which has applied to debit card transactions in general since 2011, now explicitly applies to card-not-present transactions. The final rule clarifies that an issuer is not required to ensure that two or more unaffiliated networks will actually be available to the merchant to process every electronic debit transaction, rather that issuers must enable routing choice for card-not-present debit card transactions. The final rule considers the requirement satisfied if: 1) the issuer has enabled a combination of networks that avoids network exclusivity; and 2) the networks have each taken steps reasonably designed to be able to process electronic debit transactions. The final rule does not alter interchange fees. The final rule does not alter the Regulation II exemption from interchange fee limitations for financial institutions with less than $10 billion in assets.