2022-21838. Debit Card Interchange Fees and Routing

AGENCY:

Board of Governors of the Federal Reserve System.

ACTION:

Final rule.

SUMMARY:

The Board of Governors is adopting a final rule that amends Regulation II to specify that the requirement that each debit card transaction must be able to be processed on at least two unaffiliated payment card networks applies to card-not-present transactions, clarify the requirement that debit card issuers ensure that at least two unaffiliated networks have been enabled to process a debit card transaction, and standardize and clarify the use of certain terminology.

DATES:

Effective July 1, 2023

FOR FURTHER INFORMATION CONTACT:

Jess Cheng, Senior Counsel (202-452-2309), or Cody Gaffney, Senior Attorney (202-452-2674), Legal Division; or Krzysztof Wozniak, Manager (202-452-3878), Elena Falcettoni, Economist (202-452-2528), or Larkin Turman, Financial Institution and Policy Analyst (202-452-2388), Division of Reserve Bank Operations and Payment Systems. For users of TTY-TRS, please call 711 from any telephone, anywhere in the United States.

SUPPLEMENTARY INFORMATION:

I. Background

A. Statutory Authority

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the Dodd-Frank Act) was enacted on July 21, 2010.^[1] Section 1075 of the Dodd-Frank Act amended the Electronic Fund Transfer Act (EFTA) (15 U.S.C. 1693 et seq. ) to add a new section 920 regarding interchange transaction fees for debit card transactions and rules for debit card and credit card transactions.^[2]

EFTA section 920(b)(1) directs the Board to prescribe regulations that limit the restrictions issuers and payment card networks (networks) may place on the processing of debit card transactions.^[3] A debit card transaction typically involves at least five parties: (i) a cardholder, (ii) the entity that issued the debit card to the cardholder (the issuer), (iii) a merchant, (iv) the merchant's depository institution (the acquirer), and (v) a network.^[4] EFTA section 920(b)(1) contains two provisions that apply to issuers and networks.

First, EFTA section 920(b)(1)(A) directs the Board to prescribe regulations to prohibit an issuer or network from imposing exclusivity arrangements with respect to the networks over which a debit card transaction may be processed. Specifically, the statute directs the Board to prescribe regulations that prohibit issuers and networks from restricting the number of such networks to fewer than two unaffiliated networks.^[5] Absent this prohibition, an issuer could enable only a single network, or only affiliated networks, to process a debit card transaction, thereby foreclosing the ability of the merchant or its acquirer to choose among competing networks to process the transaction.

Second, EFTA section 920(b)(1)(B) directs the Board to prescribe regulations to prohibit issuers or networks from restricting the ability of a merchant or its acquirer to choose among the networks enabled to process a debit card transaction when deciding how to route such transaction.^[6] Specifically, the statute requires the Board to prescribe regulations that prohibit issuers and networks from directly or indirectly inhibiting any person that accepts debit cards for payment from directing the routing of a debit card transaction over any network that may process that transaction. Absent this prohibition, issuers or networks could establish rules or other restrictions that override a merchant's routing preferences, thereby preventing the merchant or its acquirer from routing a debit card transaction over a network with lower merchant fees, better fraud-prevention capabilities, or otherwise more favorable terms from the merchant's perspective.

B. Regulation II

The Board promulgated a final rule implementing these provisions of the EFTA in July 2011.^[7] The routing provisions of Regulation II aim to ensure that merchants or their acquirers have the opportunity to choose from at least two unaffiliated networks when routing debit card transactions.

Section 235.7(a) of Regulation II implements the prohibition set out in EFTA section 920(b)(1)(A). Specifically, the provision prohibits an issuer or network from directly or indirectly restricting the number of networks on which a debit card transaction may be processed to fewer than two unaffiliated networks (the “prohibition on network exclusivity”). Current § 235.7(a) provides that to comply with the prohibition on network exclusivity, an issuer must allow a debit card transaction to be processed on at least two unaffiliated networks, (i) each of which does not, by rule or policy, restrict the operation of the network to a limited geographic area, specific merchant, or particular type of merchant or transaction, and (ii) each of which has taken steps reasonably designed to enable the network to process the debit card transactions that the network would reasonably expect will be routed to it, based on expected transaction volume. Therefore, when configuring its debit cards, an issuer must enable at least two unaffiliated networks, neither of which has rules or policies that restrict it from processing transactions in, for example, a particular geographic area.

Section 235.7(b) implements the prohibition set out in EFTA section 920(b)(1)(B). Specifically, current § 235.7(b) prohibits any issuer or network from directly or indirectly inhibiting the ability of any person that accepts or honors debit cards for payments (such as a merchant) to direct the routing of debit card transactions for processing over any network that may process such transactions. Taken together, § 235.7(a) and § 235.7(b) of Regulation II require an issuer to enable two unaffiliated networks to process a transaction performed with the issuer's debit card and prohibit the issuer from inhibiting the merchant's ability to route the debit card transaction over the merchant's preferred network among those enabled by the issuer.

C. Overview of Proposed Rule

On May 13, 2021, the Board published in the Federal Register a proposal to amend Regulation II's prohibition on network exclusivity to clarify that debit card issuers should enable at least two unaffiliated networks for card-not-present debit card transactions.^[8] Specifically, the Board proposed revisions to the Official Board Commentary on Regulation II to specify that the prohibition on network exclusivity applies to card-not-present debit card transactions by clarifying that card-not-present transactions are a particular type of debit card transaction for which two unaffiliated networks must be available.^[9] The Board proposed further revisions to the rule and commentary to clarify the issuer's responsibility to enable at least two unaffiliated networks to comply with the prohibition on network exclusivity. In addition to these changes, the Board proposed revisions to the commentary to § 235.7 to standardize and clarify the use of certain terminology.^[10]

As explained in the proposal, the Board proposed these revisions in light of data collected by the Board and information from debit card industry participants indicating that some issuers are not enabling two unaffiliated networks to process card-not-present transactions, and as a result, merchants often can route card-not-present debit card transactions only over a single network. When the Board promulgated Regulation II, the market had not yet developed solutions to broadly support multiple networks over which merchants could route card-not-present debit card transactions.^[11] At the time, many networks could not process such transactions at all, while others could do so only with technology that was not widely deployed in the marketplace. In particular, the lack of widely-deployed methods for online entry of PINs was an impediment for single-message networks that traditionally required PIN entry during transaction authorization. In the decade since the adoption of Regulation II, however, technology has evolved to address these barriers, and most networks have introduced capabilities to process card-not-present transactions. Recent data collected by the Board confirm that most single-message networks are now capable of processing card-not-present transactions.

Despite these developments, some issuers are not enabling two unaffiliated networks to process card-not-present transactions, like they currently do for card-present debit card transactions.^[12] As a consequence, merchants often do not have the opportunity to choose from at least two unaffiliated networks when routing card-not-present transactions. Instead, merchants often have no alternative but to route card-not-present transactions over the dual-message network that an issuer has enabled as the only network available to process card-not-present transactions performed with its debit cards.^[13]

II. Summary of Public Comments

The Board received slightly more than 2,750 comment letters in response to the proposal.^[14] Of these comment letters, approximately 1,700 were from debit card issuers (all of whom were depository institutions) and related trade associations, approximately 1,000 were from merchants and related trade associations, 5 were from networks, 3 were from federal agencies, 3 were from government officials, and around 40 were from other interested parties (including some consumers and consumer groups).^[15] Approximately 2,600 of the comment letters were one of 11 form letters.

Merchants and related trade associations, single-message networks, and federal agencies uniformly supported the proposal. These commenters generally expressed the view that the proposal is consistent with the intent of the statute and would appropriately clarify requirements that already apply to issuers. Some of these commenters suggested that the statute and current text of Regulation II are sufficiently clear that the Board should not have needed to propose revisions to address routing issues for card-not-present debit card transactions. Commenters that supported the proposal further argued that it would increase routing choice for debit card transactions and promote competition between networks, thereby reducing costs for merchants and ultimately prices for consumers.

By contrast, most issuers, related trade associations, and dual-message networks opposed the proposal, with several commenters urging the Board to withdraw the proposal. These commenters generally, but not unanimously, expressed the view that the proposal goes beyond mere clarification of existing requirements and instead represents a fundamental change to the regulation that would impose new obligations on issuers. Commenters that opposed the proposal further argued that it would impose significant compliance costs on issuers and result in increased debit card fraud, and that these consequences would ultimately harm consumers. At the same time, a small number of issuer commenters and one related trade association expressed the view that the proposed amendments were consistent with the intent of the statute and represent clarifications to existing obligations that already apply to issuers and with which many issuers already comply.

The remainder of this section provides a general overview of some of the major themes raised by commenters. Issues raised by commenters are additionally discussed in the Final Rule and Section-by-Section Analysis, infra section III, and the Regulatory Analyses, infra section IV, as appropriate.

A. Extent of Issuer's Obligation

The Board received numerous comment letters, primarily from merchants and related trade associations, but also from federal agencies and some community bank issuers, stating that the proposal would merely clarify requirements that already apply to issuers and with which issuers should already comply. In particular, these commenters argued that the prohibition on network exclusivity already requires issuers to enable two unaffiliated networks to process a debit card transaction, and there is no exemption from this requirement in either the statute or Regulation II for card-not-present transactions.

However, numerous other comment letters, primarily from issuers, related trade associations, and dual-message networks, characterized the proposal as an expansion of both the coverage and substantive requirements of the prohibition on network exclusivity. Some of these commenters stated that the proposal would expand the prohibition on network exclusivity to include card-not-present transactions, which the commenters believed had not previously been subject to that prohibition. Commenters also raised concerns that the proposal would transform the existing requirement that an issuer allow a debit card transaction to be processed on at least two unaffiliated networks into a broad new mandate requiring issuers to affirmatively guarantee that two unaffiliated networks would always be available to all merchants in every conceivable transaction context. Commenters raised a variety of concerns with this broad reading of the proposal, including that it is impractical, contrary to the statute, and overly burdensome, and would deter innovation in the debit card industry. Commenters' concerns, including the Board's analysis of these concerns and corresponding adjustments to the final rule, are discussed further in the Final Rule and Section-by-Section Analysis, infra section III.

B. Impact on Fraud

Various commenters, especially issuers, related trade associations, and dual-message networks, expressed the view that the proposal would, in practice, require most issuers to enable single-message networks to process card-not-present debit card transactions, which in turn may result in an increased level of fraud for card-not-present transactions. In particular, such commenters suggested that single-message networks would be likely to have higher levels of card-not-present fraud than dual-message networks because of single-message networks' limited experience in processing card-not-present transactions. These commenters further argued that the proposal casts doubt on whether an issuer could decline specific transactions for good-faith fraud concerns.

Other commenters, including commenters representing merchants and single-message networks, argued that the proposal would not increase card-not-present fraud and that single-message networks are as effective at mitigating fraud as dual-message networks. A few commenters suggested that sending all information relevant to the transaction in a single message gives single-message networks an inherent advantage over dual-message networks in preventing card-not-present fraud. Commenters' concerns related to fraud are discussed further in the EFTA Section 904(a) Analysis, infra section IV.A.

C. Other Comments

The Board received numerous comment letters that raised issues not specifically related to the proposed changes.^[16] Because these comments are not directly related to the proposal, the Board is not addressing them in this notice. The Board will continue to monitor developments in the debit card industry, including how these developments relate to the requirements of Regulation II.

III. Final Rule and Section-by-Section Analysis

The Board has considered all comments received and is adopting a final rule that is substantively consistent with the proposal, but with certain changes, as described below, to address issues raised by commenters, including changes clarifying that an issuer is not required to ensure that two or more unaffiliated networks will actually be available to the merchant to process every electronic debit transaction. The final rule underscores that issuers should provide routing choice for card-not-present debit card transactions. Under the final rule, a debit card issuer must configure each of its debit cards so that card-not-present transactions performed with such cards can be processed on at least two unaffiliated networks. As a practical matter, an issuer will first need to determine whether card-not-present transactions performed with its debit cards can already be processed on at least two unaffiliated networks; if the issuer is not already compliant with the final rule, the issuer will need to adjust its debit card processing arrangements to meet the final rule's requirements.

A. Section 235.7 (Limitations on Payment Card Restrictions), Comment 235.7(a)-2 (Issuer's Role), and Comment 235.7(a)-3 (Permitted Networks) ^[17]

1. Proposal

The Board proposed to amend § 235.7 of Regulation II to emphasize the issuer's role in configuring its debit cards to ensure that at least two unaffiliated networks have been enabled to comply with the prohibition on network exclusivity. Specifically, with the proposed amendments, § 235.7(a)(2) would provide that an issuer satisfies the requirements of § 235.7(a)(1) only if, for every geographic area, specific merchant, particular type of merchant, and particular type of transaction for which the issuer's debit card can be used to process an electronic debit transaction, the issuer has enabled at least two unaffiliated networks to process the transaction. Under the proposal, an issuer would not be able to restrict the capability of one or more enabled networks to process debit card transactions for a geographic area, specific merchant, particular type of merchant, or particular type of transaction if doing so would result in fewer than two unaffiliated networks being available for a particular geographic area, specific merchant, particular type of merchant, or particular type of transaction.

The Board also proposed revising current comment 235.7(a)-2, which clarifies the types of network arrangements that may be used to satisfy the prohibition on network exclusivity. Specifically, the Board proposed revisions to specify that, for purposes of the prohibition on network exclusivity, card-not-present transactions are a “particular type of transaction” for which an issuer must enable at least two unaffiliated networks. The Board stated in the proposal that it believes this amendment is necessary in light of information gathered by the Board suggesting that some issuers are enabling only one dual-message network to process card-not-present transactions, even though most single-message networks have introduced capabilities in recent years that allow them to process card-not-present transactions.

Finally, the Board proposed changes to the commentary to emphasize the choices available to issuers in complying with the prohibition on network exclusivity. In particular, the Board proposed to add a new comment 235.7(a)-2(iii) to clarify that an issuer need not enable the same two unaffiliated networks to process a debit card transaction for every geographic area, specific merchant, particular type of merchant, and particular type of transaction for which the issuer's debit card can be used. Rather, as long as the issuer has enabled at least two unaffiliated networks to process a debit card transaction for every geographic area, specific merchant, particular type of merchant, and particular type of transaction for which the issuer's debit card can be used, the issuer has satisfied the prohibition on network exclusivity. The proposed comment would provide clear examples of how an issuer could comply with the rule by enabling various combinations of networks so that two unaffiliated networks are available to process debit card transactions for every geographic area, specific merchant, particular type of merchant, and particular type of transaction. These examples would demonstrate that, under the proposal (and unlike under current § 235.7), an issuer could comply with the prohibition on network exclusivity by enabling a network that, for example, operates in a limited geographic area, as long as there are at least two unaffiliated networks to process debit card transactions for every geographic area for which the issuer's debit card can be used.

2. Summary of Public Comments

As described in the Summary of Public Comments, section II supra, the Board received numerous comments that supported proposed § 235.7(a)(2) as a clarification of requirements that already apply to issuers and with which issuers should already comply. The Board also received numerous comment letters, primarily from issuers, related trade associations, and dual-message networks, stating that the proposal would expand the prohibition on network exclusivity to include card-not-present transactions, which commenters believed were previously not subject to that prohibition. In addition, commenters argued that the proposal would transform the existing requirement that an issuer allow a debit card transaction to be processed on at least two unaffiliated networks into a broad new mandate requiring issuers to affirmatively guarantee that two unaffiliated networks would always be available to all merchants in every conceivable transaction context.^[18] These commenters raised a variety of concerns with this broad reading of the proposal.

First, commenters suggested that it would be impossible for issuers to affirmatively guarantee the availability of two unaffiliated networks to all merchants in all cases. Commenters raised a number of examples in which, for reasons outside an issuer's control, a merchant may not be able to choose between two unaffiliated networks when routing debit card transactions, even if the issuer had enabled two or more networks to process debit card transactions performed with the issuer's debit cards. In particular, a merchant may choose to contract with an acquirer or payment processor that does not support one of the networks that the issuer has enabled to process debit card transactions, with the result that the merchant can only route its transactions over the other enabled network(s). Similarly, a merchant's choice of card acceptance technologies could restrict the merchant's routing choice if these technologies are not compatible with some networks. Finally, a merchant may choose to enter into a commercial agreement (for example, with a franchisor or corporate parent) that restricts the networks over which the merchant may route transactions, resulting in a lack of routing choice even if the issuer has enabled two or more networks. Under some commenters' broad reading of the proposal, an issuer could be deemed non-compliant if a merchant could not choose between unaffiliated networks in these or similar scenarios, even though the merchant's lack of routing choice is the result of actions outside the issuer's control.

Second, several commenters argued that issuers cannot control, and may not even know, networks' coverage across all transactions, such as whether a network operates in a particular geographic area. As a result, these commenters argued that it may not be possible for an issuer to know whether the networks that the issuer has enabled are sufficient for the issuer to comply with the proposal's requirements. To address this concern, one commenter suggested that the Board publish lists of networks that can be used to satisfy the prohibition on network exclusivity for a geographic area or particular type of transaction. Other commenters argued that the Board should establish a presumption that a network operates, for example, for a geographic area (or is willing to expand its capabilities to operate for a geographic area) if the network does not by rule or policy limit its operation or expansion to such geographic area.

A third concern raised by commenters was the application of the proposal to innovative technologies and transactions. Specifically, commenters stated that, under the proposal, an issuer would not be permitted to configure its debit cards to support new technologies, such as technologies used to initiate or authenticate transactions, or to perform new types of transactions until at least two unaffiliated networks develop the capability to support the new technology. As a result, these commenters argued that the proposal would deter innovation, and potentially even require parties in the debit card industry to share proprietary technology with their competitors. Relatedly, some commenters identified examples of certain highly specific transaction contexts where commenters believe that only one network is desirable (for example, rapid throughput transactions, such as in public transit contexts) or even technically capable of processing debit card transactions (for example, airline cabin sales and other “offline” environments). These commenters suggested that, under the proposal, an issuer whose debit cards can be used to perform transactions that only one network is technically capable of processing would be in violation of the prohibition on network exclusivity. Other commenters, however, disputed the suggestion that only one network is capable of processing these specialized transactions.

Fourth, several issuer commenters criticized the proposal's use of the word “enable.” These commenters viewed this term as an expansion of the substantive requirements that issuers must meet to comply with the prohibition on network exclusivity.^[19] These commenters additionally argued that because the proposal does not define the term “enable,” it is not clear what steps issuers must take to comply with the proposal. Other commenters, in turn, argued that the term “enable” accurately reflects the role of the issuer in configuring its debit cards to comply with the prohibition on network exclusivity. In addition, merchant commenters argued that issuers should not be permitted to disable capabilities of the enabled networks if doing so would result in fewer than two unaffiliated networks that can process card-not-present debit card transactions.

Finally, the Board received several comment letters from issuers, merchants, and trade associations concerning the proposal's requirement that an issuer must enable at least two unaffiliated networks for every particular type of transaction for which the issuer's debit card can be used. In general, these comments argued that the meaning of “particular type of transaction” is not clear in the proposal. Many of these commenters recommended that the Board clarify what constitutes a “particular type of transaction” in the final rule. For example, one commenter representing merchants argued that “particular type of transaction” should refer to any substantial set of transactions. Some of these commenters stated that the Board should go further by enumerating additional examples of particular types of transactions beyond card-present and card-not-present transactions, potentially including automated fuel dispenser and low-value transactions. Other commenters, in turn, opposed enumerating additional types of transactions beyond card-present and card-not-present transactions.

The Board intended the proposal to clarify, but not expand, both the coverage and substantive requirements of the prohibition on network exclusivity.^[20] Current § 235.7(a)(2) generally provides that an issuer satisfies the prohibition on network exclusivity only if the issuer allows a debit card transaction to be processed on at least two unaffiliated networks, each of which does not, by rule or policy, restrict the operation of the network to a particular type of transaction (among other dimensions, such as type of merchant). The proposal emphasizes the role of the issuer in ensuring that at least two unaffiliated networks have been enabled for each type of transaction (among other dimensions) and specifies that card-not-present transactions are a particular type of transaction to which the prohibition on network exclusivity applies. The Board notes that numerous commenters, particularly issuers and dual-message network commenters, viewed the Board's proposal as an expansion of coverage of the prohibition of network exclusivity to include card-not-present transactions, and an expansion of the substantive requirements that apply to issuers. However, the Board did not intend to expand the regulation's substantive requirements, but rather intended to specify that existing requirements also apply to card-not-present transactions and emphasize that issuers have an active role to play in order to comply with the prohibition on network exclusivity.

3. Final Rule

The Board is adopting amendments to § 235.7(a)(2) and the commentary to § 235.7(a) that are substantively consistent with the proposal, but with certain changes to address issues raised by commenters. Specifically, § 235.7(a)(2) of the final rule provides that an issuer satisfies the prohibition on network exclusivity only if the issuer enables at least two unaffiliated networks to process an electronic debit transaction, where such networks satisfy two requirements. First, the enabled networks in combination must not, by their respective rules or policies, or by contract with or other restriction imposed by the issuer, result in the operation of only one network or only multiple affiliated networks for a geographic area, specific merchant, particular type of merchant, or particular type of transaction. Second, the enabled networks must have each taken steps reasonably designed to be able to process the electronic debit transactions that they would reasonably expect will be routed to them, based on expected transaction volume.

The Board believes that § 235.7(a)(2) of the final rule appropriately states that the obligation of the issuer is to “enable” at least two unaffiliated networks to process a debit card transaction, where such networks satisfy the rule's two requirements.^[21] Compared with the language in current § 235.7(a)(2)—which provides that an issuer must “allow” a debit card transaction to be processed on at least two unaffiliated networks—the Board believes that term “enable” more accurately describes the role of the issuer in configuring its debit cards so that the issuer complies with the prohibition on network exclusivity.

As described above, numerous commenters interpreted the proposal to require an issuer to affirmatively guarantee that all merchants will be able to route a transaction over two unaffiliated networks in every conceivable transaction context. To better reflect the Board's intent behind the proposal, and to foreclose the overly broad reading of the proposal put forward by many commenters, § 235.7(a)(2) of the final rule establishes discrete, objective requirements with which issuers must comply; these requirements do not require an issuer to ensure that two unaffiliated networks will actually be available to the merchant for every transaction. Specifically, under the final rule, to comply with the prohibition on network exclusivity, an issuer must enable at least two unaffiliated networks to process an electronic debit transaction, where such networks satisfy two requirements.

The first requirement provides, in part, that an issuer must enable a combination of networks that does not result in certain impermissible outcomes, namely only one network or only multiple affiliated networks for a geographic area, specific merchant, particular type of merchant, or particular type of transaction. The Board believes this reformulation of the proposed requirement in the final rule should address much of the confusion reflected in the comment letters, and alleviate the concerns of numerous issuer commenters in particular.

In determining whether an issuer has enabled a combination of networks that avoids the impermissible outcomes, the final rule allows issuers to rely on network rules or policies, consistent with the recommendations of some commenters. Specifically, the final rule provides that the combination of networks that an issuer enables to process a debit card transaction may not, by their respective rules or policies, result in the operation of only one network or only multiple affiliated networks for a geographic area, specific merchant, particular type of merchant, or particular type of transaction. Current § 235.7(a)(2) already permits issuers to rely on network rules or policies in determining whether a network may be used to satisfy the prohibition on network exclusivity.^[22] The final rule preserves the structure and wording of current § 235.7(a)(2) in this respect, thereby allowing issuers to rely on the same information sources that they currently use to determine whether they comply with the prohibition on network exclusivity.

In addition to permitting issuers to rely on network rules or policies in determining whether the networks enabled by an issuer may be used to satisfy the prohibition on network exclusivity, the final rule clarifies that issuers may not disable capabilities of the enabled networks if doing so would result in fewer than two unaffiliated networks to process a debit card transaction. Specifically, the final rule provides that the combination of networks that an issuer enables to process a debit card transaction may not, by contract with or other restriction imposed by the issuer, result in the operation of only one network or only multiple affiliated networks for a geographic area, specific merchant, particular type of merchant, or particular type of transaction. This addition—which makes more prominent a key aspect of the proposal's requirement that an issuer enable at least two unaffiliated networks to process a debit card transaction—is intended to directly address the cases that the Board described in connection with the proposal, and that were highlighted by many commenters, in which certain issuers are actively disabling, or failing to enable, the card-not-present capabilities of one or more enabled networks, resulting in fewer than two unaffiliated networks to process such transactions.^[23]

With respect to the second requirement related to expected transaction volume, the Board notes that this requirement is substantively unchanged from both current § 235.7(a)(2) and from the proposed rule.

To further clarify the scope of § 235.7(a) and address the confusion reflected in the views of numerous issuer and some dual-message network commenters, the Board is adopting new comment 235.7(a)-2, which was not included in the proposal. Comment 235.7(a)-2 of the final rule clarifies that § 235.7(a) does not require an issuer to ensure that two or more unaffiliated networks will actually be available to the merchant to process every electronic debit transaction. Rather, comment 235.7(a)-2 clarifies that, to comply with the requirement in § 235.7(a), it is sufficient for an issuer to configure each of its debit cards so that each electronic debit transaction performed with such card can be processed on at least two unaffiliated networks, even if the networks that are actually available to the merchant for a particular transaction are limited by, for example, the card acceptance technologies that a merchant adopts or the networks that the merchant accepts.

The Board is adopting proposed comment 235.7(a)-2 (now renumbered as comment 235.7(a)-3) substantially as proposed.^[24] The Board does not believe it is necessary to further define what constitutes a “particular type of transaction” because the prohibition on network exclusivity applies to each debit card transaction performed with a debit card. As stated clearly in comment 235.7(a)-1 of the final rule, § 235.7(a) requires an issuer to configure its debit cards so that each electronic debit transaction performed with such cards can be processed on at least two unaffiliated networks. In addition, because the Board issued the proposal to address the observed lack of routing choice for card-not-present transactions, the Board does not believe it is necessary at this time to provide additional examples of particular types of transactions beyond card-present and card-not-present transactions. Moreover, the Board is concerned that providing additional examples of particular types of transactions could create the misimpression that types of transactions not enumerated in the final rule are not subject to the prohibition on network exclusivity.

The Board notes that comment 235.7(a)-3 of the final rule makes clear that § 235.7(a)(2) of the final rule permits issuers to use more combinations of networks to satisfy the prohibition on network exclusivity than are permitted under current § 235.7(a)(2). Specifically, current § 235.7(a)(2) provides that an issuer satisfies the prohibition on network exclusivity only if the issuer allows an electronic debit transaction to be processed on at least two unaffiliated networks, each of which does not, by rule or policy, restrict the operation of the network to a limited geographic area, specific merchant, or particular type of merchant or transaction, among other requirements. Under the final rule, however, issuers may satisfy the prohibition on network exclusivity by enabling networks whose operations are limited to, for example, a limited geographic area, as long as the final rule's two requirements are met. Comment 235.7(a)-3 of the final rule provides examples of issuers satisfying the prohibition on network exclusivity by enabling networks whose operations are restricted to a limited geographic area and particular type of transaction. The combinations of networks in these examples are not permitted under current § 235.7(a)(2) but are permitted under the final rule, and thus, the final rule provides issuers greater flexibility in complying with the prohibition on network exclusivity.

Finally, the Board believes that it is unlikely that the final rule will deter innovation, as some commenters suggested. Current § 235.7(a)(2) generally provides that an issuer satisfies the prohibition on network exclusivity only if the issuer allows a debit card transaction to be processed on at least two unaffiliated networks, each of which does not, by rule or policy, restrict the operation of the network to a particular type of transaction (among other dimensions, such as type of merchant). Like the proposal, the final rule specifies that card-not-present debit card transactions are a particular type of transaction to which the prohibition on network exclusivity applies. In this respect, the final rule represents a modest clarification of existing requirements, and thus, the Board does not believe that the final rule will have a significant impact on innovation.

B. Comment 235.7(a)-1 (Scope of Restriction)

1. Proposal

The Board proposed additional revisions to comment 235.7(a)-1, which clarifies that §  235.7(a) does not require an issuer to have two or more unaffiliated networks available for each method of cardholder authentication. The Board proposed to update the examples of cardholder authentication methods listed in the comment to better align with current industry practices. Specifically, the Board proposed to add biometrics to the list of cardholder authentication methods in the commentary, which currently only includes signature and PIN authentication. The Board further proposed adding “or any other method of cardholder authentication that may be developed in the future” to capture cardholder authentication methods that do not yet exist. The Board also proposed revisions to recognize instances where no method of cardholder authentication is used.

2. Summary of Public Comments

The Board received few comments that specifically addressed proposed comment 235.7(a)-1. The comments that specifically addressed proposed comment 235.7(a)-1 generally supported the proposed amendments.

3. Final Rule

The Board is adopting amendments to comment 235.7(a)-1 substantially as proposed. Relative to the proposal, the final rule makes minor changes to comment 235.7(a)-1 to bring the comment in line with terminology used elsewhere in Regulation II. In particular, the final rule uses the term “perform,” rather than the terms “process” or “initiate” as proposed, to refer to the use of a debit card to perform a debit card transaction, consistent with the terminology used in other parts of Regulation II.^[25]

B. Comment 235.7(a)-8 (Application of Rule Regardless of Form)

1. Proposal

The Board proposed revising current comment 235.7(a)-7, which clarifies that the prohibition on network exclusivity applies regardless of “form factor.” The Board proposed to replace the term “form factor” with “means of access” to better align with current industry terminology. The revisions would also add, as an example of means of access, “information stored inside an e-wallet on a mobile phone or other device,” to capture recent technological developments. The Board further proposed adding “or another means of access that may be developed in the future” to capture means of access that do not yet exist but that would be captured by Regulation II if they were to be developed. The proposed revisions would further clarify that an issuer must enable at least two unaffiliated networks for each means of access that carries the debit card information, as required by the prohibition on network exclusivity. For example, if the issuer provides the cardholder with a fob in addition to a plastic card, the fob must allow transactions to be processed over at least two unaffiliated networks.

2. Summary of Public Comments

The Board received several comments from issuers, related trade associations, and a dual-message network expressing the view that because the term “means of access” is not defined in the proposal, the proposal would create ambiguity as to whether a particular technology is a means of access (for which the issuer must enable at least two unaffiliated networks) or, for example, a technology supporting a method of authentication (for which the issuer need not enable at least two unaffiliated networks). These commenters generally argued that the term “means of access” should be limited only to the hardware and software necessary to process the transaction, and thus, the term should exclude technologies supporting ancillary features related to authentication or security. Some of these commenters additionally stated that it was not necessary for the proposal to capture any means of access that may be developed in the future.

At least one merchant commenter also commented on the lack of definition of “means of access,” but instead argued for a definition that would capture any technology used to send the cardholder's debit card credentials through the merchant to the issuer. Other comment letters from merchants and related trade associations generally supported the proposal's clarification that the prohibition on network exclusivity applies to any means of access, including any means of access that may be developed in the future.

3. Final Rule

Current comment 235.7(a)-7 clarifies that the prohibition on network exclusivity applies to all types of debit cards. In proposing revisions to current comment 235.7(a)-7, the Board intended only to update the term “form factor” to align with current industry terminology. In light of the comments received, the Board has determined that adopting the undefined term “means of access” is unnecessary, would create confusion, and would undermine clarity. Instead, the Board is adopting a modified version of proposed comment 235.7(a)-7 (now renumbered as comment 235.7(a)-8) that states that the prohibition on network exclusivity applies to electronic debit transactions performed with any debit card as defined in § 235.2 of Regulation II, regardless of the form of such debit card. The final rule further states that the requirement applies to electronic debit transactions performed using, for example, a plastic card, a supplemental device such as a fob, information stored inside an e-wallet on a mobile phone or other device, or any other form of debit card, as defined in § 235.2, that may be developed in the future. The Board is also adopting conforming changes to current comment 235.7(b)-2(iii).

Importantly, while current comment 235.7(a)-7 refers to a token as an example of a form factor to which the prohibition on network exclusivity applies, the final rule (like the proposal) removes the term “token.” The Board believes that the use of the term “token” in the context of current comment 235.7(a)-7 is outdated. In particular, the term “token” was intended to be synonymous with “fob,” rather than refer to tokenized debit card numbers.^[26] Thus, as in the proposal, the final rule removes an outdated use of the term “token.”

Removal of the word “token” in the final rule is not intended to suggest that tokenized debit card numbers are not subject to the prohibition on network exclusivity. To the contrary, the Board is aware of a variety of different types of tokenization arrangements in the marketplace (many of which were described in comment letters) and believes that some tokenized debit card numbers qualify as debit cards as defined in § 235.2. Under the final rule, where a tokenized debit card number qualifies as a debit card, the prohibition on network exclusivity would apply, and the issuer would be required to enable two unaffiliated networks to process transactions performed with the tokenized debit card number.

D. Effective Date of Final Rule

For the reasons described below, the Board is adopting the final rule with an effective date of July 1, 2023.^[27]

The Board received numerous comments related to the timeline for implementing the proposal. In general, merchants argued that issuers should already be complying with the proposal's requirements with respect to card-not-present debit card transactions and, therefore, urged the Board to finalize the proposal as quickly as possible, with some merchants suggesting that the proposal should be effective before the 2021 holiday shopping season. In contrast, issuers argued for a much longer implementation time frame (for example, four or more years), stating that compliance with the proposal would require significant time and resources, which they would need to divert from other priorities.

The Board does not believe that the final rule requires either a very short or very long implementation timeline, as commenters variously argued.^[28] When § 235.7(a) was originally adopted in 2011, the Board gave issuers nine months to comply with the prohibition on network exclusivity, with limited exceptions.^[29] The final rule specifies that card-not-present debit card transactions are a particular type of transaction to which the prohibition on network exclusivity applies. The Board believes that, as when § 235.7(a) was originally adopted, approximately nine months is a sufficient amount of time for issuers to comply with the final rule. In addition, and as described in the Regulatory Analyses, infra section IV, the Board understands that many issuers, and especially most community bank issuers, are already compliant with the final rule because they have already enabled two unaffiliated networks to process card-not-present transactions performed with their debit cards.^[30]

IV. Regulatory Analyses

A. EFTA Section 904(a) Analysis

1. Statutory Requirement

Section 904(a)(2) of the EFTA requires the Board to prepare an economic analysis of the impact of the final rule that considers the costs and benefits to financial institutions, consumers, and other users of electronic fund transfers. The analysis must address the extent to which additional paperwork will be required, the effect upon competition in the provision of electronic fund transfer services among large and small financial institutions, and the availability of such services to different classes of consumers, particularly low-income consumers. The section also requires, to the extent practicable, the Board to demonstrate that the consumer protections of the proposed regulations outweigh the compliance costs imposed upon consumers and financial institutions.

EFTA section 904(a)(2) requires the Board to perform this economic analysis with respect to both proposed and final rules implementing EFTA section 920. The Board published a preliminary economic analysis in connection with the proposal. The Board received six comment letters from issuers and related trade associations and one additional comment letter that explicitly referenced the EFTA section 904(a)(2) economic analysis that was published with the proposal. In general, these commenters stated that the Board's economic analysis was insufficiently detailed and did not fully account for the economic impact of the proposal. In addition to these comments that directly referenced the EFTA section 904(a)(2) economic analysis, the Board received numerous comments discussing the proposed rule's impact on various debit card industry participants. Further discussion of these comments is provided in this section and in the Summary of Public Comments, supra section II, Final Rule and Section-by-Section Analysis, supra section III, and the Regulatory Flexibility Act Analysis, infra section IV.C.

2. Cost/Benefit Analysis

(a.) Effects on Merchants ^[31]

i. Comments Received

Many commenters, primarily merchants, but also some issuers, networks, federal agencies, and consumers, expressed the view that the proposal would result in merchants being able to choose from at least two unaffiliated networks for card-not-present debit card transactions. Many of these commenters suggested that such choice between multiple networks would benefit merchants through increased competition between networks for card-not-present transactions. Commenters suggested that merchants may benefit from being able to route debit card transactions over networks with lower interchange or network fees, better fraud-prevention capabilities, or otherwise better service. These commenters also widely expressed the view that merchants operating in competitive conditions would ultimately pass through such benefits to consumers in the form of lower prices and improved service.

Some commenters, mainly issuers, expressed the view that merchants would retain most of the benefits from increased routing choice for card-not-present debit card transactions rather than passing them to consumers, while others suggested that the benefits of the proposal would accrue primarily to large merchants. Some of these commenters also suggested that the proposal might result in increased fraud for card-not-present debit card transactions, with merchants bearing some of the higher fraud burden.

ii. Analysis

The Board believes that the primary way in which the final rule will benefit merchants will be by providing them the opportunity to choose to route card-not-present debit card transactions over competing networks, allowing the merchant to select a network with potentially lower fees, better fraud-prevention capabilities, or otherwise more favorable terms from the merchant's perspective. While such benefits will be greater for those merchants who accept more card-not-present payments and merchants who optimize their routing decisions, the Board believes merchants broadly will benefit from more network choices. In the long term, increased competition for card-not-present debit card transactions between networks should further increase benefits to merchants as networks improve their fraud-prevention capabilities and lower their fees. Finally, the Board expects that merchants in more competitive markets will pass a greater portion of the benefits to consumers, relative to those in less competitive markets.

Although a merchant may need to incur adjustment costs to take advantage of the opportunity to choose between competing networks when routing card-not-present debit card transactions, a merchant's decision to incur those costs is at the merchant's discretion.^[32] In particular, the final rule does not impose any obligations on merchants, and as such, merchants may continue to use their existing debit card processing arrangements without incurring any adjustment costs. Some merchants that choose not to incur adjustment costs may nevertheless experience increased routing choice through their existing arrangements as a result of the final rule. However, the Board expects some merchants to voluntarily adjust their debit card processing arrangements to capture benefits of the final rule, but only if such benefits outweigh the costs. These potential costs include modifying their ecommerce platforms, choosing to incur costs in switching processors or acquirers, or enhancing their fraud-prevention capabilities.

(b.) Effects on Issuers ^[33]

i. Comments Received

Many commenters, primarily issuers, expressed the view that the proposal may result in substantial costs and lost revenues for some issuers. In particular, these commenters suggested that issuers not already compliant with the proposed rule would bear implementation and compliance costs, and that such costs could be especially high for community bank issuers. The commenters also expressed the view that issuers would realize lower interchange fee revenues and greater fraud losses as a result of the proposed rule. Some commenters further suggested that such increased costs may force some issuers to pass on a portion of the costs to consumers in the form of higher fees and lower availability of free checking accounts and similar programs; a few commenters expressed the view that the inability to sufficiently offset the higher costs may threaten some issuers' survival. Other comments, primarily merchants, suggest that implementation and adoption costs for issuers to comply with the proposed rule would be limited because many issuers, and especially most community bank issuers, are already compliant with the proposal.

ii. Analysis

Board analysis suggests that the effect of the final rule on issuers will depend on four key factors. First, the effect will depend on the number of issuers not already compliant with the final rule because they have not already enabled at least two unaffiliated networks to process card-not-present debit card transactions; these issuers will need to make changes to their debit card programs to comply with the final rule. Both information received through the comment process and data collected by the Board suggest that those affected by the rule may differ by issuer size. In particular, some comment letters and Board data suggest that some large issuers will need to make changes to their debit card programs to come into compliance with the final rule.^[34] By contrast, several comment letters received in connection with the proposal suggest that many issuers, and especially most community bank issuers, are already in compliance with the final rule. In particular, a comment letter submitted by a major trade association representing community banks stated that the vast majority of community banks have already enabled two unaffiliated networks to process card-not-present transactions. Other comment letters from issuers and merchants stated that many or most community bank issuers are already compliant with the proposal.

Second, the effect of the final rule on issuers will depend on the costs that issuers not already in compliance with the rule will need to incur to come into compliance. The Board believes that the costs of coming into compliance with the rule are likely to differ between issuers. In particular, implementation and compliance costs are likely to depend on issuers' current debit card processing arrangements, and the new arrangements issuers choose to establish to become compliant with the rule. Importantly, the Board believes issuers will be able to choose between multiple solutions available today to become compliant with the rule, allowing them to select new arrangements that best suit them. Moreover, as described above, the final rule permits issuers to use more combinations of networks to satisfy the prohibition on network exclusivity than are permitted under current § 235.7(a)(2), which give issuers greater flexibility to choose how they combine multiple networks to comply with the final rule.

Third, the effect of the final rule on issuers will depend on the extent to which the rule will indirectly impact issuers' revenues in the form of lower interchange fee revenues or higher fraud losses for issuers with respect to card-not-present debit card transactions. As mentioned above, increased routing choice will allow merchants to route card-not-present transactions over networks with lower fees, better fraud prevention, and other terms that merchants may find desirable. To the extent that merchants take advantage of increased routing choice beyond what is already available for card-not-present transactions, merchants may choose to route a greater number of card-not-present transactions over networks with lower interchange fees. If these choices by merchants generate a substantial shift in card-not-present transaction volumes to networks with lower interchange fees, current interchange fee levels suggest that community bank issuers exempt from Regulation II's interchange fee standards that are not already compliant with the rule in particular may experience lower interchange fee revenues.^[35] Similarly, a change in the networks over which merchants route card-not-present transactions may generate a change in the composition of card-not-present fraud. In particular, fraud losses experienced by issuers may change depending on fraud-prevention capabilities and liability rules for networks whose share of card-not-present transactions increases as a result of the final rule.

Finally, the effect of the final rule on issuers will depend on the extent to which issuers can and do choose to pass on to their customers any implementation and compliance costs, and potential changes to their interchange fee revenues and fraud losses. In particular, issuers could adjust product terms and fees for their customers in a way that offsets some or most of the economic impact resulting from the final rule. The Board expects that issuers in more competitive markets will be less likely than those in less competitive markers to seek to offset the economic impact of the final rule in this way.

Thus, the effect of the final rule on issuers will depend on a variety of factors, including the number of issuers not already compliant with the final rule, the costs that issuers not already in compliance with the rule will need to incur to come into compliance with the final rule, the extent to which the rule will indirectly impact issuers' revenues, and the extent to which issuers pass on to their customers any potential costs and foregone revenue. Importantly, only those issuers not already compliant with the final rule will need to incur compliance costs and could potentially experience indirect impacts on their interchange fees revenues and fraud losses. Issuers that are already compliant with the final rule will not experience additional compliance costs or the effects of changes in merchant routing behavior.

(c) Effects on Consumers and Availability of Services to Different Classes of Consumers

i. Comments Received

Some commenters, primarily issuers and related trade associations, expressed the view that the proposal would harm consumers. In particular, commenters suggested that some issuers would pass incremental implementation and compliance costs associated with the proposal onto consumers through higher account fees and reduced availability of free checking accounts and similar programs, curtailing consumers' access to financial services. Such commenters further suggested that consumers could also be negatively impacted by higher fraud levels or increased consumer fraud liability associated with increased routing of card-not-present transactions over single-message networks. Finally, some commenters suggested that higher fees and fraud rates as a result of the proposal would harm consumers if they switch to financial services provided by nonbank institutions.

Other commenters, primarily merchants and related trade associations, but also some commenters representing consumers, expressed the view that the proposal would benefit consumers. In particular, commenters suggested that competition between merchants would result in merchants passing on some or most benefits associated with the proposal to consumers in the form of lower prices, greater payment method choice, or other service enhancements.

ii. Analysis

The effect of the final rule on consumers will depend on the behavior of various participants in the debit card industry. Increased choice for merchants and the resulting ability to route card-not-present transactions over networks with lower interchange or network fees could lead to a decrease in merchants' costs of debit card acceptance, which merchants could in turn pass on to consumers in the form of lower prices or foregone price increases. Merchants operating in highly competitive markets with low margins may pass the bulk of these savings on to consumers, while merchants operating in less competitive markets may retain a greater portion of the savings. Any such price reductions would benefit all consumers, not just those paying with debit cards. In addition, increased choice in how to route card-not-present transactions could provide merchants with a greater economic incentive to accept debit cards for card-not-present transactions, which would benefit consumers by increasing their ability to use debit cards.

At the same time, as noted above, issuers who are not already compliant with the rule may seek to offset any implementation and compliance costs, and potentially lower interchange fee revenues and any higher fraud losses, by setting higher fees for checking accounts or reducing availability of free checking accounts. The extent to which issuers are able to do this, however, will be limited by how sensitive consumers are to such fee increases and reduced benefits. In particular, attempts by some issuers to increase fees and lower benefits may push consumers to switch to issuers with more favorable pricing, including those issuers who are already compliant with the rule.

The effect of the rule could differ between particular classes of consumers in several ways. First, because the most common way to make card-not-present payments is to do so using a debit card, increasing the ability to make such payments would benefit consumers without access to credit cards.^[36] Second, issuers' choice to increase checking account fees or reduce the availability of free checking accounts would have a greater impact on consumers who are more sensitive to such fees, although competition between issuers could limit such fee changes.

(d) Additional Paperwork

The final rule does not alter the reporting and recordkeeping requirements that § 235.8 of Regulation II imposes on issuers, and the section imposes no reporting or recordkeeping requirements on consumers or merchants. The Board did not receive any comments in response to the proposal related to paperwork burden.

(e) Effect on Fraud

Although section 904(a)(2) of the EFTA does not require the Board to consider the impact of the final rule on fraud, the Board believes it is appropriate to address this topic in light of comments received in connection with the proposal.

i. Comments Received

As described in the Summary of Public Comments, supra section II, various commenters, especially issuers, related trade associations, and dual-message networks, expressed the view that the proposal would, in practice, require most issuers to enable single-message networks to process card-not-present debit card transactions, which in turn may result in increased level of fraud for card-not-present transactions. These commenters further argued that the proposal casts doubt on whether an issuer could decline specific transactions for good-faith fraud concerns. Other commenters, including commenters representing merchants and single-message networks, argued that the proposal would not increase card-not-present fraud and that single-message networks are as effective at mitigating fraud as dual-message networks. A few commenters stated that single-message networks have an inherent advantage in preventing card-not-present fraud over dual-message networks because single-message networks send all information relevant to the transaction in a single message.

ii. Analysis

EFTA section 920(b)(1)(A) directs the Board to prescribe regulations providing that an issuer or network shall not directly or indirectly restrict the number of networks on which a debit card transaction may be processed to fewer than two unaffiliated networks. In fulfilling this statutory mandate, the Board acknowledges that requiring issuers to enable two unaffiliated networks to process card-not-present transactions may alter the composition of card-not-present fraud if merchants choose to route card-not-present transactions over networks that are different from those they use today. In particular, the Board previously noted that, in 2019, single-message networks experienced significantly lower fraud losses relative to dual-message networks, but these lower fraud losses were partially driven by the fact that single-message networks were rarely used to process card-not-present transactions in 2019.^[37] Given this fact, and as a result of the final rule, the Board believes it is likely that the share of card-not-present fraud attributable to single-message networks will increase in the coming years relative to dual-message networks, as single-message networks become a more widespread alternative over which merchants can route card-not-present debit card transactions. In addition, the apportionment of fraud losses among various parties to debit card transactions may change to the extent that single-message networks' liability rules differ from those of dual-message networks.

Importantly, however, nothing in the final rule requires issuers to enable any particular network, such as a network with higher levels of fraud, to process card-not-present debit card transactions. Similarly, nothing in the final rule requires merchants to choose to route card-not-present debit card transactions over any particular network. In addition, even though the Board believes it is likely that the share of card-not-present fraud attributable to single-message networks will increase in the coming years relative to dual-message networks, the Board does not agree with commenters' suggestion that single-message networks have categorically weaker fraud-prevention capabilities compared with dual-message networks. In particular, data collected by the Board does not demonstrate that single-message networks have overall higher fraud rates or higher card-not-present fraud rates compared with dual-message networks, and there is nothing to suggest that card-not-present fraud rates between dual-message networks and single-message networks will diverge as a result of the final rule.^[38] To the contrary, increased adoption of card-not-present capabilities among single-message networks in recent years suggests that such networks have implemented fraud-prevention measures to combat card-not-present fraud that make them a viable alternative to dual-message networks. Finally, the Board believes that increased competition between networks for card-not-present transactions spurred by the final rule is likely to result in all networks improving their fraud-prevention capabilities, including fraud-prevention capabilities for card-not-present transactions.

The Board does not agree with commenters' interpretation that the proposal (or the final rule) casts doubt on the ability of an issuer to decline specific debit card transactions for good-faith fraud concerns. In particular, the final rule does not prohibit an issuer from declining a specific debit card transaction for such concerns; rather, it requires that the issuer enable at least two unaffiliated networks to process such debit card transactions.

(f) Effects Upon Competition in the Provision of Electronic Banking Services ^[39]

i. Comments Received

Some commenters, primarily merchants, single-message networks, and federal agencies, expressed the view that the proposal would promote greater competition between networks by ensuring at least two unaffiliated networks are available for card-not-present debit card transactions. These commenters noted that such a competitive landscape may be necessary for some of the networks currently in the market to remain competitive as more debit card transactions move into the card-not-present environment. At the same time, a few commenters expressed the view that the proposal is unnecessary because competitive forces within the debit card industry are strong enough to provide merchants with routing choice for card-not-present transactions.

ii. Analysis

The Board expects the final rule to increase competition between networks. By making it possible for merchants to route card-not-present debit card transactions over two or more unaffiliated networks, the final rule should encourage greater competition between networks for such transactions. There could be multiple benefits from such increased competition, including lower fees borne by merchants and enhanced fraud-prevention capabilities among networks. Importantly, both such effects could benefit not just merchants but also issuers (through lower fraud rates) and consumers (through lower prices and fraud rates). Moreover, the final rule gives issuers greater flexibility to combine multiple networks (including networks that may operate for a limited geographic area) to satisfy the rule's requirements. As a consequence, networks whose operations are limited in one or more dimensions could become more competitive in the marketplace as a result of the final rule.

In addition, the Board believes that the final rule could promote competition between issuers of different sizes. As described above, some comment letters and Board data suggest that several of the largest issuers have not enabled two unaffiliated networks to process card-not-present debit card transactions, but most community bank issuers have already done so. The final rule will thus level the playing field between issuers of all sizes by requiring all of them to consistently enable two unaffiliated networks to process card-not-present debit card transactions.

(g) Consumer Protections and Compliance Costs

As noted above, EFTA section 904(a)(2) requires that, to the extent practicable, the Board must demonstrate that the consumer protections of the proposed regulations outweigh the compliance costs imposed upon consumers and financial institutions. Based on the analysis above, the Board cannot, at this time, determine whether the benefits to consumers exceed the possible costs to financial institutions. In particular, the final rule may yield benefits for consumers; however, as described in the analysis above, the magnitude of these benefits will depend on the behavior of various participants in the debit card industry. The final rule may also impose compliance costs on financial institutions that have not already enabled at least two unaffiliated networks to process card-not-present debit card transactions; however, an individual financial institution's compliance costs, if any, will depend on its particular circumstances. The overall effects of the final rule on consumers and on financial institutions are dependent on a variety of factors, and the Board cannot predict the market response to the final rule.

B. EFTA Section 904(a) Interagency Consultation Requirement

In addition to the economic analysis provided above, EFTA section 904(a)(2) requires the Board to consult with the other agencies that have enforcement authority under the EFTA on any rulemakings related to EFTA section 920.^[40] The Board consulted with each of the relevant agencies prior to issuing this final rule.

C. Paperwork Reduction Act

In accordance with the Paperwork Reduction Act (PRA) of 1995 (44 U.S.C. 3506; 5 CFR part 1320, Appendix A.1), the Board may not conduct or sponsor, and a respondent is not required to respond to, an information collection unless it displays a valid Office of Management and Budget (OMB) control number. The Board reviewed the final rule under the authority delegated to the Board by the OMB and determined that it contains no collections of information under the PRA. Accordingly, there is no paperwork burden associated with the final rule.

D. Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) (5 U.S.C. 601 et seq.) requires an agency to consider whether its rules will have a significant economic impact on a substantial number of small entities. Under the RFA, in connection with a final rule, an agency is generally required to publish a final regulatory flexibility analysis (FRFA), unless the head of agency certifies that the rule will not have a significant economic impact on a substantial number of small entities and the agency publishes the factual basis supporting such certification. An FRFA must contain (i) a statement of the need for, and objectives of, the rule; (ii) a statement of the significant issues raised by the public comments in response to the initial regulatory flexibility analysis (IRFA) that was prepared in connection with the proposed rule, a statement of the assessment of the agency of such issues, and a statement of any changes made in the proposed rule as a result of such comments; (iii) the response of the agency to any comments filed by the Chief Counsel for Advocacy of the Small Business Administration (SBA) in response to the proposed rule, and a detailed statement of any change made to the proposed rule in the final rule as a result of the comments; (iv) a description of and an estimate of the number of small entities to which the rule will apply or an explanation of why no such estimate is available; (v) a description of the projected reporting, recordkeeping and other compliance requirements of the rule, including an estimate of the classes of small entities that will be subject to the requirement and the type of professional skills necessary for preparation of the report or record; and (vi) a description of the steps the agency has taken to minimize the significant economic impact on small entities consistent with the stated objectives of applicable statutes, including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.

The Board is providing an FRFA with respect to the final rule.

1. Need for and Objectives of the Rule

The first required element of an FRFA—a statement of the need for, and objectives of, the rule—is provided in the Background, supra section I.

2. Significant Issues Raised by Public Comments in Response to the IRFA

The Board received seven comment letters from issuers and related trade associations that explicitly referenced the IRFA that was published with the proposal. In general, these commenters summarily stated that the Board's IRFA was insufficiently detailed; a few commenters stated that it was not possible to evaluate the compliance burden that the proposal would impose on issuers based on the limited analysis in the Board's IRFA. However, none of these commenters provided detailed comments on the Board's IRFA. In addition to these comments that directly referenced the IRFA, the Board received numerous comments discussing the proposed rule's impact on entities of all sizes, including community bank issuers. Further discussion of these comments is provided in the Summary of Public Comments, supra section II, Final Rule and Section-by-Section Analysis, supra section III, and the EFTA Section 904(a) Analysis, supra section IV.A. As described in the Final Rule and Section-by-Section Analysis, the Board is adopting a final rule that is substantively consistent with the proposal, but with certain changes to address issues raised by commenters.

3. Response to Comments Filed by the Chief Counsel for Advocacy of the Small Business Administration

The Board transmitted a copy of the IRFA that was published with the proposal to the SBA's Chief Counsel for Advocacy, as required by statute. The Board did not receive any comments from the SBA's Chief Counsel for Advocacy in response to the proposal.

4. Estimate of the Number of Small Entities

The final rule applies to all debit card issuers; thus, the number of small entities to which the final rule will apply is the number of debit card issuers that are considered small entities. For this purpose, the SBA has adopted size standards that provide that card-issuing institutions with average assets of less than $750 million over the preceding year (based on the institution's four quarterly financial statements) are considered small entities.^[41]

Based on this size standard and Call Report data, the Board estimates that approximately 8,000 small entities will be subject to the final rule. The Board derived this estimate by (i) identifying those depository institutions that, together with their affiliates, had average assets of less than $750 million in 2021 based on the depository institutions' four quarterly Call Reports (that is, FFIEC 041 and NCUA 5300) and, where applicable, holding company financial reports (that is, FR Y-9C) in 2021, and (ii) determining the number of such depository institutions that reported the type of income that includes debit card interchange fees in 2021. Although the Board believes that 8,000 small entities is a reasonable estimate of the number of small entities that will be subject to the final rule, the Board notes that this estimate may represent an overcount because the line items in the Call Reports on which the Board's estimate is based aggregate several types of income, including income other than debit card interchange fee income, and thus, some of the depository institutions that report income on these lines may not in fact be debit card issuers.^[42] On the other hand, the Board's estimate may represent an undercount because it would not include debit card issuers that are not depository institutions that are required to file quarterly Call Reports.^[43]

5. Description of Reporting, Recordkeeping, and Other Compliance Requirements

The final rule does not alter the reporting requirements that § 235.8(b) of Regulation II imposes on issuers.

With respect to recordkeeping requirements, § 235.8(c) of Regulation II requires issuers to retain records to demonstrate compliance with the requirements of Regulation II for not less than five years after the end of the calendar year in which the debit card transaction occurred; if an issuer receives actual notice that it is subject to an investigation by an enforcement agency, the issuer must retain the records until final disposition of the matter. The final rule does not directly alter the requirements of § 235.8(c). However, as a result of the final rule, an issuer that is not already compliant with the final rule's requirements will need to retain records to demonstrate that the issuer has enabled two unaffiliated networks to process card-not-present transactions performed with the issuer's debit cards. The Board believes that this additional recordkeeping burden should not be significant because such issuers should already be retaining records to demonstrate that they are complying with the prohibition on network exclusivity under the current rule and can retain the same types of records to demonstrate that they are compliant with the requirements of the final rule with respect to card-not-present transactions. For the same reason, the additional professional skills necessary for the preparation of such records should not be significant. The Board did not receive any comments in response to the proposal related to paperwork burden.

With respect to other compliance requirements, the Board believes that the impact of the final rule on small entities will vary significantly depending on the small entity's operations and processing arrangements. In particular, the Board distinguishes between three classes of small entities subject to the final rule (that is, small issuers that process card-not-present transactions): (i) small entities that are already compliant with the final rule because they have already enabled at least two unaffiliated networks to process card-not-present transactions; (ii) small entities that have enabled only one network (or only multiple affiliated networks) to process card-not-present transactions, but that already contract with an unaffiliated network that is capable of processing card-not-present transactions; and (iii) small entities that have enabled only one network (or only multiple affiliated networks) to process card-not-present transactions, and that do not already contract with an unaffiliated network that is capable of processing card-not-present transactions.^[44]

Issuers in the first class of small entities subject to the final rule—small entities that are already complaint with the final rule because they have already enabled at least two unaffiliated networks to process card-not-present transactions—would not need to take any additional steps to comply with the final rule and thus should not bear any compliance costs associated with the rule. The Board is unable to estimate the number of small entities in this first class of small entities.^[45] However, in response to the proposal, the Board received multiple comment letters representing the interests of both merchants and issuers—including a comment letter from a major trade association representing community banks—that indicated that most community bank issuers are already compliant with the prohibition on network exclusivity for card-not-present transactions.^[46] For this reason, the Board believes that it is likely that there is already widespread compliance with the final rule among small entities subject to the final rule.

Issuers in the second class of small entities subject to the final rule—small entities that have enabled only one network (or only multiple affiliated networks) to process card-not-present transactions, but that already contract with an unaffiliated network that is capable of processing card-not-present transactions—may comply with the final rule by enabling one or more of its their existing networks to process card-not-present transactions. The Board has considered feedback provided by debit card industry participants, along with the Board's general understanding of the technical aspects of the debit card industry. Accordingly, the Board believes that while there are compliance costs associated with enabling an existing network to process card-not-present transactions, these costs are generally not significant.^[47]

Issuers in the third class of small entities subject to the final rule—small entities that have enabled only one network (or only multiple affiliated networks) to process card-not-present transactions, and that do not already contract with an unaffiliated network that is capable of processing card-not-present transactions—will need to enable a new unaffiliated network to process card-not-present transactions to comply with the final rule. The Board has considered feedback provided by debit card industry participants, along with the Board's general understanding of the technical aspects of the debit card industry. Accordingly, the Board believes that the compliance costs associated with this category of small entities could be significant and will likely vary substantially depending on a small entity's particular facts and circumstances. However, these small entities should be able to choose among alternative compliance arrangements to reduce compliance costs.^[48]

For the reasons described above, the Board also is unable to estimate the number of small entities in the second and third classes of small entities. However, based on the comments received in response to the proposal as noted above, the Board believes that there are significantly fewer small entities in the second and third classes of small entities compared with the first class of small entities.

6. Steps Taken To Minimize the Significant Economic Impact on Small Entities and Alternatives Considered

As stated in the Summary of Public Comments, supra section II, EFTA section 920(b)(1)(A) directs the Board to prescribe regulations providing that an issuer or network shall not directly or indirectly restrict the number of networks on which an electronic debit transaction may be processed to fewer than two unaffiliated networks. The statute does not exempt, and does not authorize the Board to exempt, small issuers from the two-network requirement. For this reason, the Board could not consider an alternative rule that would have allowed small entities subject to the final rule not to enable at least two unaffiliated networks to process card-not-present transactions.

Although the Board lacks the legal authority to exempt small entities from the final rule, the Board, partly in response to comments received in connection with the proposal, took other steps to minimize the economic impact of the final rule on issuers of all sizes, including small entities. First, as described in the Final Rule and Section-by-Section Analysis, supra section III, the final rule permits issuers to use more combinations of networks to satisfy the prohibition on network exclusivity than are permitted under current § 235.7(a)(2). The Board believes that allowing issuers to use more combinations of networks to satisfy the final rule will help issuers minimize compliance costs associated with the final rule because issuers can choose the lowest-cost combination of networks to comply with the final rule. Second, as described in the Final Rule and Section-by-Section Analysis, supra section III, the Board is adopting a final rule that preserves an issuer's ability to rely on network rules or policies in determining whether a network may be used to satisfy the prohibition on network exclusivity. The Board believes that allowing issuers to continue to rely on network rules or policies in determining whether a network may be used to satisfy the prohibition on network exclusivity (as is permitted under current § 235.7(a)(2)) will make it much easier for issuers to know when they have complied with the final rule and to demonstrate such compliance, as compared with the proposal. Finally, as described in the Final Rule and Section-by-Section Analysis, supra section III, the Board is giving small entities approximately nine months to comply with the final rule—which is the same amount of time the Board gave issuers to comply when § 235.7(a) was originally adopted in 2011. The Board believes that, as when § 235.7(a) was originally adopted, nine months is a sufficient amount of time for issuers to comply with the final rule.

E. Use of Plain Language

Section 722 of the Gramm-Leach-Bliley Act (Pub. L. 106-102, 113 Stat. 1338, 1471, 12 U.S.C. 4809) requires the federal banking agencies to use plain language in all proposed and final rules published after January 1, 2000. The Board has sought to present the final rule in a simple and straightforward manner.

List of Subjects in 12 CFR Part 235

• Banks, banking
• Debit card routing
• Electronic debit transactions
• Interchange transaction fees

Authority and Issuance

For the reasons set forth in the preamble, the Board is amending 12 CFR part 235 (Regulation II) as follows:

PART 235—DEBIT CARD INTERCHANGE FEES AND ROUTING (REGULATION II)

1. The authority citation for part 235 continues to read as follows:

Authority: 15 U.S.C. 1693o-2.

2. Section 235.7 is amended by revising paragraph (a)(2) to read as follows:

§ 235.7

Limitations on payment card restrictions.

(a) * * *

(2) Permitted arrangements. An issuer satisfies the requirements of paragraph (a)(1) of this section only if the issuer enables at least two unaffiliated payment card networks to process an electronic debit transaction—

(i) Where such networks in combination do not, by their respective rules or policies or by contract with or other restriction imposed by the issuer, result in the operation of only one network or only multiple affiliated networks for a geographic area, specific merchant, particular type of merchant, or particular type of transaction, and

(ii) Where each of these networks has taken steps reasonably designed to be able to process the electronic debit transactions that it would reasonably expect will be routed to it, based on expected transaction volume.

* * * * *

3. Appendix A to part 235 is amended under “Section 235.7 Limitations on Payment Card Restrictions” by revising paragraphs 7(a), 7(b)1 and 2, and 7(b)5 to read as follows:

Appendix A to Part 235—Official Board Commentary on Regulation II

* * * * *

Section 235.7 Limitations on Payment Card Restrictions

* * * * *

7(a) Prohibition on Network Exclusivity

1. Scope of restriction. Section 235.7(a) requires an issuer to configure each of its debit cards so that each electronic debit transaction performed with such card can be processed on at least two unaffiliated payment card networks. In particular, § 235.7(a) requires this condition to be satisfied for each geographic area, specific merchant, particular type of merchant, and particular type of transaction for which the issuer's debit card can be used to perform an electronic debit transaction. As long as the condition is satisfied for each such case, § 235.7(a) does not require the condition to be satisfied for each method of cardholder authentication ( e.g., signature, PIN, biometrics, any other method of cardholder authentication that may be developed in the future, or the lack of a method of cardholder authentication). For example, it is sufficient for an issuer to issue a debit card that can perform signature-authenticated transactions only over one payment card network and PIN-authenticated transactions only over another payment card network, as long as the two payment card networks are not affiliated and each network can be used to process electronic debit transactions for every geographic area, specific merchant, particular type of merchant, and particular type of transaction for which the issuer's debit card can be used to perform an electronic debit transaction.

2. Issuer's role. Section 235.7(a) does not require an issuer to ensure that two or more unaffiliated payment card networks will actually be available to the merchant to process every electronic debit transaction. To comply with the requirement in § 235.7(a), it is sufficient for an issuer to configure each of its debit cards so that each electronic debit transaction performed with such card can be processed on at least two unaffiliated payment card networks, even if the networks that are actually available to the merchant for a particular transaction are limited by, for example, the card acceptance technologies that a merchant adopts, or the networks that the merchant accepts.

3. Permitted networks.

i. Network volume capabilities. A payment card network could be used to satisfy the requirement that an issuer enable two unaffiliated payment card networks for each electronic debit transaction if the network was either (a) capable of processing the volume of electronic debit transactions that it would reasonably expect to be routed to it or (b) willing to expand its capabilities to meet such expected transaction volume. If, however, the network's policy or practice is to limit such expansion, it would not qualify as one of the two unaffiliated payment card networks.

ii. Reasonable volume expectations. One of the steps a payment card network can take to form a reasonable expectation of its transaction volume is to consider factors such as the number of cards expected to be issued that are enabled by an issuer on the network and expected card usage patterns.

iii. Examples of permitted arrangements. For each geographic area ( e.g., New York State), specific merchant ( e.g., a specific fast food restaurant chain), particular type of merchant ( e.g., fast food restaurants), and particular type of transaction ( e.g., card-not-present transaction) for which the issuer's debit card can be used to perform an electronic debit transaction, an issuer must enable at least two unaffiliated payment card networks, but those payment card networks do not necessarily have to be the same two payment card networks for every transaction.

A. Geographic area: An issuer complies with the rule only if, for each geographic area in which the issuer's debit card can be used to perform an electronic debit transaction, the issuer enables at least two unaffiliated payment card networks. For example, an issuer could comply with the rule by enabling two unaffiliated payment card networks that can each process transactions in all 50 U.S. states. Alternatively, the issuer could comply with the rule by enabling three unaffiliated payment card networks, A, B, and C, where network A can process transactions in all 50 U.S. states, network B can process transactions in the 48 contiguous United States, and network C can process transactions in Alaska and Hawaii.

B. Particular type of transaction: An issuer complies with the rule only if, for each particular type of transaction for which the issuer's debit card can be used to perform an electronic debit transaction, the issuer enables at least two unaffiliated payment card networks. For example, an issuer could comply with the rule by enabling two unaffiliated payment card networks that can each process both card-present and card-not-present transactions. Alternatively, the issuer could comply with the rule by enabling three unaffiliated payment card networks, A, B, and C, where network A can process both card-present and card-not-present transactions, network B can process card-present transactions, and network C can process card-not-present transactions.

4. Examples of prohibited network restrictions on an issuer's ability to contract with other payment card networks. The following are examples of prohibited network restrictions on an issuer's ability to contract with other payment card networks:

i. Network rules or contract provisions limiting or otherwise restricting the other payment card networks that an issuer may enable on a particular debit card, or network rules or contract provisions that specify the other networks that an issuer may enable on a particular debit card.

ii. Network rules or guidelines that allow only that payment card network's (or its affiliated networks') brand, mark, or logo to be displayed on a particular debit card, or that otherwise limit the ability of brands, marks, or logos of other payment card networks to appear on the debit card.

5. Network logos or symbols on card not required. Section 235.7(a) does not require that a debit card display the brand, mark, or logo of each payment card network over which an electronic debit transaction may be processed. For example, the rule does not require a debit card that an issuer enables on two or more unaffiliated payment card networks to bear the brand, mark, or logo of each such payment card network.

6. Voluntary exclusivity arrangements prohibited. Section 235.7(a) requires that an issuer enable at least two unaffiliated payment card networks to process an electronic debit transaction, even if the issuer is not subject to any rule of, or contract or other agreement with, a payment card network requiring that all or a specified minimum percentage of electronic debit transactions be processed on the network or its affiliated networks.

7. Affiliated payment card networks. Section 235.7(a) does not prohibit an issuer from enabling two affiliated payment card networks among the networks on a particular debit card, as long as at least two of the networks that can be used to process each electronic debit transaction are unaffiliated.

8. Application of rule regardless of form. The network exclusivity provisions in § 235.7(a) apply to electronic debit transactions performed with any debit card as defined in § 235.2, regardless of the form of such debit card. For example, the requirement applies to electronic debit transactions performed using a plastic card, a supplemental device such as a fob, information stored inside an e-wallet on a mobile phone or other device, or any other form of debit card, as defined in § 235.2, that may be developed in the future.

7(b) Prohibition on Routing Restrictions

1. Relationship to the network exclusivity restrictions. An issuer or payment card network is prohibited from inhibiting a merchant's ability to direct the routing of an electronic debit transaction over any of the payment card networks that the issuer has enabled to process electronic debit transactions performed with a particular debit card. The rule does not require that an issuer allow a merchant to route a transaction over a payment card network that the issuer did not enable to process transactions performed with that debit card.

2. Examples of prohibited merchant restrictions. The following are examples of issuer or network practices that would inhibit a merchant's ability to direct the routing of an electronic debit transaction and that are therefore prohibited under § 235.7(b):

i. Prohibiting a merchant from encouraging or discouraging a cardholder's use of a particular method of cardholder authentication, for example prohibiting merchants from favoring a cardholder's use of one cardholder authentication method over another, or from discouraging the cardholder's use of any given cardholder authentication method, as further described in comment 7(a)-1.

ii. Establishing network rules or designating issuer priorities directing the processing of an electronic debit transaction on a specified payment card network or its affiliated networks, or directing the processing of the transaction away from a specified payment card network or its affiliates, except as:

(A) A default rule in the event the merchant, or its acquirer or processor, does not designate a routing preference; or

(B) If required by state law.

iii. Requiring a specific payment card network to be used based on the form of debit card presented by the cardholder to the merchant ( e.g., plastic card, payment code, or any other form of debit card as defined in § 235.2).

* * * * *

5. No effect on network rules governing the routing of subsequent transactions. Section 235.7 does not supersede a payment card network rule that requires a chargeback or return of an electronic debit transaction to be processed on the same network that processed the original transaction.

* * * * *

By order of the Board of Governors of the Federal Reserve System.

Ann E. Misback,

Secretary of the Board.

Footnotes

1.  Public Law 111-203, 124 Stat. 1376 (2010).

2.  EFTA section 920 is codified at 15 U.S.C. 1693o-2. Most of EFTA section 920's requirements relate to debit card transactions—referred to in the statute and in Regulation II as “electronic debit transactions”—which are defined in EFTA section 920(c)(5) as “transaction[s] in which a person uses a debit card.” This notice uses the term “debit card transaction” interchangeably with “electronic debit transaction.”

3.  EFTA section 920(c)(9) defines “issuer” as “any person who issues a debit card, or credit card, or the agent of such person with respect to such card.” EFTA section 920(c)(11) defines “payment card network” as “an entity that directly, or through licensed members, processors, or agents, provides the proprietary services, infrastructure, and software that route information and data to conduct debit card or credit card transaction authorization, clearance, and settlement, and that a person uses in order to accept as a form of payment a brand of debit card, credit card or other device that may be used to carry out debit or credit transactions.”

4.  The issuer provides the cardholder with a debit card. The issuer enables various networks to process debit card transactions performed with such card. The cardholder can perform a debit card transaction at a merchant that accepts at least one of the enabled networks. If the merchant accepts more than one of the enabled networks, the merchant can choose to route the transaction over its preferred network. One or more of these parties may act through third-party vendors, such as payment processors.

5.  For this purpose, two networks are considered to be affiliated if they are owned, controlled, or otherwise operated by affiliated persons. EFTA section 920(c)(1) defines the term “affiliate” to mean any company that controls, is controlled by, or is under common control with another company.

6.  The merchant's choice of network is typically implemented by its acquirer or processor. The acquirer can incorporate a merchant's preferences when determining how to route a transaction, given the available networks.

7.  Regulation II, Debit Card Interchange Fees and Routing, codified at 12 CFR part 235. Regulation II also implements a separate provision of EFTA section 920 regarding debit card interchange fees.

8.  86 FR 26189 (May 13, 2021). The original proposal requested public comment by July 12, 2021, but the Board later extended the comment period an additional 30 days to August 11, 2021. 86 FR 34644 (June 30, 2021).

9.  Card-not-present transactions are those in which a cardholder performs payment without physically presenting a debit card to a merchant. Card-not-present transactions typically involve remote commerce, such as internet, telephone, or mail-order purchases. According to the Board's most recent biennial data collection (required under EFTA section 920(a)(3)(B)), card-not-present transactions have become an increasingly significant type of debit card transaction, comprising almost 23 percent of all debit card transactions in 2019 (up from slightly less than 10 percent in 2009). See Federal Reserve Board, 2019 Interchange Fee Revenue, Covered Issuer Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit Card Transactions (May 2021) at p. 3, available at https://www.federalreserve.gov/​paymentsystems/​regii-data-collections.htm [hereinafter 2019 Data Report]. In addition, data from the Federal Reserve Payments Study document that, in response to the COVID-19 pandemic, growth in card-not-present transactions accelerated in 2020. See Federal Reserve Board, Developments in Noncash Payments for 2019 and 2020: Findings from the Federal Reserve Payments Study, available at https://www.federalreserve.gov/​paymentsystems/​december-2021-findings-from-the-federal-reserve-payments-study.htm.

10.  The proposal did not concern other parts of Regulation II that directly address interchange fees for certain debit card transactions. As stated in the proposal, the Board will continue to review the regulation in light of the most recent data collected by the Board and may propose additional revisions in the future.

11.  Issuers typically enable one or more single-message networks and one dual-message network to process debit card transactions performed with the issuer's debit card. Single-message networks, which developed from automated teller machine networks, typically authorize and clear a transaction through a single message and have traditionally processed transactions that are authenticated using a cardholder's personal identification number (PIN). In contrast, dual-message networks, which developed from credit card systems, typically authorize and clear a transaction through two separate messages and have traditionally processed signature-authenticated transactions. Today, transactions over dual-message networks may no longer require signature authentication or may use PIN authentication. Similarly, transactions over single-message networks may no longer require PIN authentication. In addition, some networks have developed capabilities that depart from their primary messaging approach. In general, the interchange fees that issuers receive in connection with transactions routed over single-message networks are lower than for transactions routed over dual-message networks. See Average Debit Card Interchange Fee by Payment Card Network, available at https://www.federalreserve.gov/​paymentsystems/​regii-average-interchange-fee.htm.

12.  According to the Board's most recent biennial data collection, almost a quarter of issuers with consolidated assets over $10 billion, representing slightly more than 50 percent of the total number and value of all debit card transactions subject to Regulation II's interchange fee standards in 2019, did not process any card-not-present debit card transactions over single-message networks.

13.  Data collected by the Board indicate that single-message networks processed only 6 percent of all card-not-present debit card transactions in 2019. The single-message networks' low aggregate share of card-not-present debit card transactions contrasts sharply with their share of card-present debit card transactions, which exceeded 40 percent in 2019. See 2019 Data Report at p. 25.

14.  These figures include a number of comment letters received after the close of the comment period. The Board also accepted and considered these late-filed comment letters. In general, these late-filed comment letters addressed the extent to which issuers are already compliant with the requirements of the proposal.

15.  Although the Board received numerous comment letters from individuals, most of these comment letters clearly represented the interests of either issuers or merchants (rather than, for example, the interests of the individual as a consumer). The Board has classified such comment letters from individuals as comment letters from either issuers or merchants, as appropriate, even where the individual did not specifically identify a particular issuer or merchant in the comment letter.

16.  These comment letters generally raised issues related to other provisions in Regulation II. For example, numerous comment letters, primarily from merchants and related trade associations, requested that the Board address various practices that these commenters believe issuers and payment card networks could use, or are allegedly already using, to restrict merchant routing choice, even where the issuer has complied with the prohibition on network exclusivity. In addition, numerous commenters, mostly merchants and related trade associations, urged the Board to act quickly to lower the interchange fee cap in section 235.3 of Regulation II.

17.  The Board is combining its discussion of section 235.7(a)(2) and comments 235.7(a)-2 and -3 of the final rule in this notice for ease of reference and due to the substantial overlap in the issues presented with respect to each of these portions of the final rule.

18.  Moreover, a few commenters stated that the proposal could be interpreted even more broadly to require issuers to enable networks at the merchant's demand.

19.  By comparison, EFTA section 920(b)(1)(A) prohibits an issuer from directly or indirectly restricting the number of networks on which a debit card transaction may be processed to fewer than two unaffiliated networks. Current section 235.7(a)(2) of Regulation II, which implements this statutory provision, states than issuer must allow an electronic debit transaction to be processed on at least two unaffiliated networks.

20.   See86 FR 26189, 26192 (May 13, 2021).

21.  The Board notes that the term “enable” is already used in the current commentary to section 235.7(a) to describe the obligation of the issuer.

22.  The proposal would have eliminated the relevant language in current section 235.7(a)(2). The Board believes that the omission of this language in the proposal, which is retained in the final rule, contributed significantly to the broad reading of the proposal put forward by many issuer and dual-message network commenters, who interpreted the proposal as requiring an issuer to ensure that two unaffiliated networks will actually be available to the merchant for every debit card transaction.

23.  86 FR 26189, 26191-92.

24.  The final rule specifies that card-not-present debit card transactions are a “particular type of transaction” for purposes of Regulation II's prohibition on network exclusivity as applied to debit card issuers in section 235.7(a)(2). The Board emphasizes that card-not-present debit card transactions are “electronic debit transactions” for other Regulation II purposes, including Regulation II's prohibition on network exclusivity as applied to networks in section 235.7(a)(3), and prohibition on routing restrictions in section 235.7(b).

25.  Relative to the proposal, the final rule makes other non-substantive changes to terminology outside of comment 235.7(a)-1, including in the commentary to 235.7(b).

26.  Tokenization is a process whereby the primary account number associated with a debit card is converted into substitute credentials (a “tokenized debit card number” or “token”), usually to improve security and decrease fraud associated with debit card transactions.

27.  Section 302 of the Riegle Community Development and Regulatory Improvement Act, Pub. L. 103-325, requires that amendments to regulations prescribed by a federal banking agency that impose additional requirements on insured depository institutions must take effect on the first day of a calendar quarter that begins on or after the date of publication in the Federal Register . 12 U.S.C. 4802. Consistent with this requirement, the effective date of the final rule is July 1, 2023.

28.  The Board believes that some commenters' requests for a very long implementation timeline largely stemmed from their broad reading of the proposal. As described above, the final rule includes changes (relative to the proposal) to foreclose the overly broad reading of the proposal put forward by many commenters.

29.  Specifically, section 235.7 was promulgated on July 20, 2011. The general compliance date for issuers for section 235.7(a) was April 1, 2012, but the compliance date was extended for certain types of debit cards. 76 FR 43393 (July 20, 2011).

30.  As a practical matter, an issuer will first need to determine (potentially by consulting its payment processor) whether card-not-present transactions performed with its debit cards can already be processed on at least two unaffiliated networks. If the issuer confirms that is the case, no further action is required for the issuer to comply with the final rule.

31.  The Board interprets “other users of electronic fund transfer services” in EFTA section 904(a)(2) to refer primarily to merchants.

32.  To extent to which a merchant may be able to realize the benefits of the final rule, and any costs it may incur, could depend on decisions of the merchant's acquirer or payment processor, among other things.

33.  The Board interprets “financial institutions” in EFTA section 904(a)(2) to refer primarily to issuers of debit cards.

34.  As noted previously, according to the Board's most recent biennial data collection, almost a quarter of issuers with consolidated assets over $10 billion, representing slightly more than 50 percent of the total number and value of all debit card transactions subject to Regulation II's interchange fee standards in 2019, did not process any card-not-present debit card transactions over single-message networks.

35.  By contrast, interchange fees for issuers subject to Regulation II's interchange fee standards currently exhibit less variation across networks, suggesting that merchant routing decisions will have less impact on interchange fees received by those issuers. See Average Debit Card Interchange Fee by Payment Card Network, available at https://www.federalreserve.gov/​paymentsystems/​regii-average-interchange-fee.htm. Nevertheless, increased merchant routing choice could place downward pressure on those fees or other fees charged by networks (for example, network switch fees).

36.  Federal Reserve Board, Developments in Noncash Payments for 2019 and 2020: Findings from the Federal Reserve Payments Study, available at https://www.federalreserve.gov/​paymentsystems/​december-2021-findings-from-the-federal-reserve-payments-study.htm.

37.   See 2019 Data Report at p. 17.

38.   See 2019 Data Report at p. 28.

39.  Although EFTA section 904(a)(2) requires the Board to consider “the effects upon competition in the provision of electronic banking services among large and small financial institutions,” the Board is considering the impact of the final rule on competition generally, including competition between large and small financial institutions.

40.  These agencies include the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Department of Transportation, the Securities and Exchange Commission, the Consumer Financial Protection Bureau, and the Federal Trade Commission. See EFTA section 918.

41.  13 CFR 121.201 (sector 522210). Although this size standard applies to credit card-issuing institutions, the Board believes that the same size standard should apply to debit card-issuing institutions. Consistent with the General Principles of Affiliation in 13 CFR 121.103, the Board counts the assets of all domestic and foreign affiliates when determining whether to classify an institution as a small entity.

42.  The Board considered using other, more specific line items in the Call Reports as the basis for its estimate. However, the Board recognizes that different reporting practices among depository institutions may affect the accuracy and consistency of information for those more specific line items. For this reason, the Board determined that it would be more appropriate to use the line items that aggregate several types of income, including debit card interchange fee income.

43.  At this time, the Board is not aware of any debit card issuers that are not depository institutions.

44.  As stated previously, an issuer may need to consult with its payment processor to determine whether card-not-present transactions performed with its debit cards can already be processed on at least two unaffiliated networks.

45.  Pursuant to its authority in section 235.8(b) of Regulation II, the Board collects data on an annual or biennial basis only from payment card networks and “covered issuers” with consolidated assets exceeding $10 billion. Thus, the Board does not collect data from small entities subject to the final rule.

46.  The Board notes that these comment letters were likely not describing the extent of compliance among small entities as defined for RFA purposes (that is, issuers with average assets of less than $750 million over the preceding year), but rather were likely describing the extent of compliance among issuers exempt from Regulation II's interchange fee standards (that is, issuers with consolidated assets of less than $10 billion).

47.  For example, an issuer that begins to accept card-not-present transactions routed over an existing network may need to update its internal systems to ensure that the issuer can accept payment messages associated with card-not-present transactions and may need to update its fraud-prevention processes to account for this new type of transaction. However, such an issuer should not need to take much more costly steps, such as adding or changing networks or reissuing its debit cards.

48.  For example, an issuer that enables a new network to process card-not-present transactions by directly connecting with the new network would likely need to make significant updates to its internal systems in order to accept transactions routed over the new network and may need to reissue its debit cards to comply with the new network's technical and branding requirements. Alternatively, the issuer may be able to reduce compliance costs by enabling a new network to process card-not-present transactions by indirectly connecting to such network through one of its existing networks, which may not require card reissuance.