By Adam Bucci and Bill M. Petti
Global Legal Law Firm
In a groundbreaking decision, the Federal Trade Commission approved a final consent order and agreement to enjoin certain practices and to provide for other relief to resolve the allegations in the FTC's draft complaint against leading payment network Mastercard. Specifically, the final order requires Mastercard to cease blocking the use of competing debit payment networks.
This final order was finalized following a 30-day public-comment period regarding the proposed order to resolve allegations that Mastercard's practice violated provisions of the Durbin Amendment to the Dodd-Frank Act and its implementing rule, Regulation II.
While this ruling primarily focuses on Mastercard, its legal implications extend beyond the network itself. So, why should you care? How does this affect the everyday business owner? As with anything in our ever-evolving world, we must look back before we can look forward.
In the wake of the 2007–2008 financial crisis, Congress enacted the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act to address the causes of the crisis and enhance financial regulation. Among the 2,300 pages and 400 new rules and mandates, the Durbin Amendment—named after its author, Senator Richard Durbin—and Regulation II, promulgated by the Federal Reserve, brought significant changes to the debit card industry, aiming to promote fairness and transparency in interchange fees. Merchants pay interchange fees to card issuers for transaction processing. These are contentious, mainly due to their lack of transparency and high costs. Initially, a cap was set for debit cards at a maximum of 21 cents per transaction, plus an additional percentage of transaction value. Banks and credit unions with assets less than $10 billion are exempt from this cap.
Within the Durbin Amendment and Regulation II, two sets of prohibitions command the floor. Both are designed to promote merchant and consumer savings associated with processing debit transactions. The first is aimed at prohibiting network exclusivity.
Congress addresses this with a three-pronged approach: prohibiting a card issuer or payment card network from directly or indirectly restricting the number of networks on which a debit transaction can be processed to less than two unaffiliated networks; requiring that a debit card issuer enable payment card networks that satisfy certain minimum standards; and prohibiting a payment card network from limiting an issuer's ability to contract with any other network.
The second prohibition is more revolutionary. It forbids an issuer or payment card network from directly or indirectly inhibiting a merchant's ability to choose which of the networks enabled for the debit card is used to process a given transaction.
Enter our main character, Mastercard. Mastercard's rules require a Mastercard-branded debit card be loaded into an ewallet and tokenized. Tokenization replaces a card's primary account number (PAN) with a unique alternate card number, or "token." Mastercard is also the token service provider (TSP) for nearly all Mastercard-branded debit cards used in ewallets.
When an ewallet transaction using a Mastercard-branded debit card is routed to Mastercard, Mastercard thus can perform the detokenization and process the transaction. Competing payment card networks, however, do not have access to Mastercard's token vault. To route a Mastercard-branded tokenized transaction to a competing network, a merchant's acquirer or the competing network therefore must ask Mastercard to detokenize the token.
Thus, merchants are dependent on Mastercard's detokenization to route ewallet transactions using Mastercard-branded debit cards to competing networks. Picture Charles Dickens's Oliver Twist asking the headmaster for more soup.
In the FTC's view, Mastercard's ewallet token policy doesn't allow card-not-present (CNP) debit transactions using ewallet tokens (i.e., debit cards) to be routed to competing debit networks. That is an impactful statement. CNP purchases are dominating the business world for both merchants and consumers. The invoices you pay online, recurring payments you set up for your credit card or insurance policy, retail therapy you engage in while sitting at your desk at work, literally any purchase where both the card and human being aren't present are CNPs. Until now, a merchant had only one option: Mastercard's network.
If we harken back to the Durbin/Regulation II prohibitions mentioned earlier in this article, the FTC has voiced its belief that Mastercard's policy strikes against prohibition number one. Accordingly, the FTC's proposed consent order and agreement was drafted to effectuate the remedial purposes of these laws.
The proposed consent order, and as approved in the final order, prevents Mastercard from prohibiting or inhibiting any person's efforts to serve as a TSP or provision payment tokens for Mastercard-branded debit cards. Not only that, it prevents Mastercard from taking other actions that would inhibit merchant routing choice in the context of tokenized transactions.
The final order also prohibits Mastercard from stopping a merchant who accepts debit cards to choose their own network which processes such transactions through legal means (that is, contracts, penalties, conditions, etc.) as doing so is in violation of Regulation II. The final order throws in a "catch all" that prevents Mastercard from taking other actions that would inhibit merchant routing choice. Remember that whole "fair market" thing?
Out of eleven comment letters, several industry giants, like Fiserv, Walmart and the Food Industry Association, weighed in on the FTC's proposed order. While some may roll their eyes at their opinions, there is no denying the importance of their stances on this. Both Fiserv and Walmart identified what they believe to be issues surrounding the cryptogram, an authentication to ensure that the device used for the purchase is the same as the device onto which the token was originally provisioned.
Fiserv believes this order is not enough to encourage the competitive network away from Mastercard's grip. Fiserv reasoned in its comment letter that the proposed order failed to remedy Mastercard's conduct in that it didn't require Mastercard to verify the cryptogram or to inform the competitive network whether the transaction complied with the token domain restrictions established by the issuer.
Fiserv also commented that competing networks will be left with a Hobson's choice: either reject all CNP transactions and send them back to the merchant or send the CNP transactions to the issuer solely with the PAN to see whether the transactions are ultimately authorized.
Lamenting that, in the United States, the payment card system is "broken and lacks the fundamentals of a competitive market," Walmart pointed out two components of the proposed order that allow Mastercard to continue to use network tokenization to circumvent Regulation II.
First, the proposed order requires translating the token back into a PAN but doesn't require Mastercard to provide the results of the critical cryptogram and domain control validations when detokenization is requested by a competing network or third party.
Second, Walmart commented that, as written, the proposed order requires Mastercard to provide the FTC with 60-days' notice if it planned to launch a new debit product that "requires Merchants to Route Electronic Debit Transactions only to Mastercard." Walmart's advice to the FTC was to include the word "may" in this provision.
FMI commented that the "FTC is correct to take enforcement actions against Mastercard to require the immediate change of its operating rules to allow merchants access to a second network for ecommerce tokenized transactions."
FMI put the spotlight on Mastercard's co-star, Visa, and its practice of not sending the full payment card information out for authorization. FMI reasoned this could result in a greater likelihood that the bank will reject the transaction as suspicious or high risk. Ultimately, FMI, along with Fiserv and Walmart, is loudly pushing the FTC to continue investigating the global card network rules and business practices.
For as long as the payment processing industry has existed, the sheer lack of regulation dictating such a heavily used form of commerce is remarkable. Anti-competitive practices have long ruled the day (for example, network-blocking, exclusivity rules). However, the FTC's final order signifies a shift toward dismantling such practices and fostering a more competitive landscape.
The FTC's final order against Mastercard sets a precedent for increased scrutiny of anti-competitive behavior within the industry. Other major players may now face heightened regulatory scrutiny and potential legal action if they engage in similar practices that restrict competition and consumer choice.
Legal challenges to the FTC's authority and specific provision of the order could shape future interpretations of antitrust and competition laws within the payment processing sector and beyond. These challenges could come from payment networks, industry associations or even merchants organized as a class action. We won't say Pandora's box, but maybe Pandora's wallet.
What could be fodder for a separate, standalone article is the final order's requirement of network neutrality, which imposes restrictions on Mastercard's ability to favor its own network over competitors. Legal interpretations of network neutrality within the industry may evolve further as more cases arise. Anyone have eyes on Ajit?
The FTC's final order should act as motivation for new, emerging payment networks to compete on what could be a more level playing field. The next few years could present a new group of Mavericks willing to throw their hat into the ring. As the great Irish poet William Yeats said, "Do not wait to strike till the iron is hot; but make it hot by striking."
To avoid legal scrutiny and potential consequences, payment networks may now collaborate and adopt compliance measures that promote fair competition. This shift could lead to industry-wide changes, including revised rules and policies that embrace a more open, competitive ecosystem.
The far-reaching impact of the FTC's final order against Mastercard won't be fully understood for some time.
However, it clearly signifies the anti-competitive practices of the industry have finally caught Congress's attention.
One can only hope this will lead to a broader, more competitive arena. Of course, with change come growing pains. This final order and resulting actions will face increased regulatory scrutiny, legal challenges and a call for collaboration among payment networks. The landscape has, once again, changed, and will likely change the trajectory of the payment processing industry as a whole. 
Before joining Global Legal Law Firm as an associate attorney, Adam Bucci spent four years as a deputy district attorney prosecuting numerous misdemeanor and felony cases. At the DA's office, Adam's work centered primarily on crimes of child abuse and domestic violence. Since joining Global Legal, Adam has employed his trial experience by focusing on civil litigation and MATCH cases. Bill M. Petti is an associate attorney at Global Legal Law Firm. Prior to joining Global, Bill clerked for the United States Attorney's Office, a subagency of the Justice Department, in both the Affirmative Civil Enforcement Division and Civil Litigation Division. Bill also interned for the United States Securities and Exchange Commission during his second year of law school and assisted with several high-profile investment adviser examinations. Contact Adam at abucci@attorneygl.com, and Bill at bpetti@attorneygl.com.
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
Prev Next
