Key takeaway: Merchants and the software vendors that serve them should treat surcharging as a standing compliance function rather than a one-time setup. They must track both card-network updates and state law changes, since the patchwork of rules (and the lack of settled enforcement precedent) means liability can surface well after a surcharging program is already live.
Credit card surcharging compliance, once governed almost entirely by card-brand rules, has splintered into a state-by-state patchwork that is squeezing independent software vendors (ISVs) and their payments partners, according to Digital Transactions.
Card networks changed their rules in 2013 to permit surcharging on credit card transactions, and Tyler Kattre, president of Wind River Payments, told the outlet that between 30% and 40% of his company’s clients now surcharge credit card transactions. The complication, he said, is that a growing number of states layer their own surcharging regulations on top of the card-brand framework, creating a compliance matrix he compared to the state-by-state process of obtaining money-transmitter licenses.
Surcharging remains banned outright in Connecticut, Maine, Massachusetts, and Puerto Rico, according to a Stripe Inc. post cited in the article, and while most states otherwise follow the card-brand rules alone, there is no single directory that pulls every state’s rules together in one place.
Peter Michaud, chief payments officer at payments advisory firm TSG, said compliance ultimately falls on the merchant but splits into two separate tracks: state law and card-network rules. States change their laws periodically with some advance notice, he said, while the networks update their own rules roughly every six months.
Kattre added that ISVs often end up caught between software development demands and the merchant, who carries the ultimate compliance responsibility, calling their role in the chain that of “playing messenger.” Michaud also noted that enforcement patterns remain largely untested in public, leaving open questions about whether a violation would expose the merchant alone or also the processor, independent sales organization, or payment facilitator involved in the transaction.
Why it matters: Merchant risk teams and the ISVs that build their payment stacks now have to track two moving regulatory targets at once, card-network rule changes and an expanding list of state-level restrictions, with little public enforcement history to show where the real liability lands. That gap leaves merchants exposed to fines they may not see coming and gives software vendors a compliance workload that falls outside their usual product scope.
Source: Digital Transactions
