Regulation II & Durbin Amendment: 2027 Interchange Compliance

Debit [interchange](/blog/cash-vs-credit-rewards-optimization) has never been a sleepy backwater of payments compliance — but 2027 is shaping up to be the most consequential year for Regulation II since the Durbin Amendment first took effect in October 2011. The Federal Reserve's October 2023 proposed rule (finalized in mid-2024) lowered the base interchange cap from 21 cents to 14.4 cents per transaction, with the ad-valorem component trimmed from 5 basis points to 4 basis points, and the fraud-adjustment allowance reduced from 1 cent to 0.8 cents. Full compliance timelines for covered issuers ran through Q1 2027, and examiners are actively comparing routing data against the revised thresholds.\n\nIf you issue debit cards — and your institution holds more than $10 billion in total assets — this is not a rule you can read once and file away. The two-network routing requirement, in particular, is generating exam findings at institutions that believed they had solved it years ago. This guide walks through the cap mechanics, the routing rules, and the one carve-out that still matters for community banks and credit unions.\n\n## Why the Fed Moved on the Cap — Again\n\nThe original 21-cent cap was set in 2011 using cost data the Fed collected from 2009. By 2021, the Fed's own biennial cost survey showed that the average covered issuer's allowable transaction cost had fallen to roughly 3.9 cents — a gap of more than 17 cents between actual cost and the statutory ceiling. Consumer advocates, merchants, and the CFPB had been flagging this asymmetry for years.\n\nThe Federal Reserve published its proposed rule in October 2023, and the final rule locked in the new figures: 14.4 cents base + 4 basis points ad valorem + 0.8 cents fraud adjustment. The Fed also committed to updating the cap every two years using fresh cost data — a structural change that makes ongoing compliance modeling mandatory, not optional.\n\nFor a $45 average debit ticket, the old cap produced roughly 21.225 cents in allowable interchange. The new cap produces about 15.4 cents — a decline of approximately 27%. For large issuers processing millions of transactions monthly, that arithmetic is material at the income-statement level.\n\n## The Two-Network Routing Requirement: Still the Harder Problem\n\nSection 920 of the Electronic Fund Transfer Act (as amended by the Durbin Amendment) requires that every debit card transaction be capable of routing over at least two unaffiliated networks. The Fed's Regulation II implements this at 12 C.F.R. § 235.7. What tripped up issuers in 2024 and 2025 — and continues to generate examination findings — is the word capable.\n\nThe requirement is not merely that two network logos appear on the card. The issuer must ensure that merchants and their acquirers can actually initiate a transaction on either network without the issuer blocking or degrading the non-preferred path. Three specific failure modes keep surfacing in exam reports:\n\n1. Token provisioning gaps — An issuer enables Visa debit tokens for digital wallets but does not provision equivalent Mastercard or NYCE tokens, effectively making card-not-present (CNP) transactions single-network.\n2. PIN-bypass misconfiguration — The issuer's processing rules route all signature (no-PIN) CNP transactions exclusively to one network, eliminating merchant routing choice on e-commerce checkouts.\n3. Least-cost routing (LCR) suppression — The issuer's contract with Network A contains exclusivity provisions for CNP that technically violate § 235.7(b), even if the card physically displays Network B's mark.\n\nThe Federal Reserve's December 2024 supervisory letter (SR 24-14) made clear that CNP routing is in scope — settling a debate that had lingered since the 2022 guidance update. Issuers who had interpreted the earlier guidance narrowly are now on notice.\n\n> Compliance callout: If your debit program's CNP routing share for your secondary network is below 10–12%, that is a signal your routing capability may be theoretical rather than functional. Pull your acquirer-reported routing splits before your next exam cycle.\n\n### What "Unaffiliated" Actually Means\n\nThe two networks must be genuinely independent — not subsidiaries or joint ventures of the same parent. Visa and Interlink (a Visa subsidiary) do not satisfy the requirement. Visa and Star, Visa and NYCE, or Mastercard and Pulse do. The OCC and Fed have both emphasized in examination guidance that issuers bear the burden of verifying affiliate status, not just accepting network representations.\n\n## The Small-Issuer Exemption: What It Covers, What It Doesn't\n\nThe headline exemption in Regulation II applies to any debit card issuer with less than $10 billion in consolidated assets. If your institution falls below that threshold as of December 31 of the prior calendar year, the interchange cap does not apply to your program. You may negotiate bilateral interchange rates with networks and acquirers without reference to the 14.4-cent ceiling.\n\nThis matters enormously for community banks and credit unions. As of Q4 2026, the Federal Reserve's annual payment study estimated that roughly 11,200 U.S. depository institutions qualify for the exemption. Their interchange revenue per debit transaction averaged 43–46 cents — nearly three times the cap applicable to covered issuers.\n\nHere is what the small-issuer exemption does not cover:\n\n- Two-network routing — § 235.7 applies to all issuers regardless of asset size. A $2 billion community bank must still enable two unaffiliated networks on every debit card it issues.\n- Network exclusivity — The prohibition on network exclusivity at § 235.7(a) has no asset-size threshold. A small issuer cannot sign an exclusive agreement with a single network.\n- Fraud-adjustment standards — If a small issuer voluntarily chooses to claim the fraud-adjustment allowance (should they ever become covered), they must satisfy the fraud-prevention standards at § 235.6.\n\nThe practical risk for small issuers is complacency on routing. Because the cap doesn't apply, compliance teams sometimes de-prioritize Regulation II entirely — and then discover during a merger, acquisition, or organic growth event that they crossed $10 billion and had a routing infrastructure that was never properly built.\n\n## Modeling the Revenue Impact: A Worked Example\n\nConsider a mid-size regional bank with $18 billion in assets, 680,000 active debit cards, and an average of 22 transactions per card per month. That's approximately 14.96 million transactions per month.\n\nUnder the old cap (21 cents + 5 bps on a $42 average ticket + 1 cent fraud):\n- Per-transaction allowable: 21 + 2.1 + 1 = 24.1 cents\n- Monthly interchange revenue (at a blended effective rate of ~22 cents after merchant category and network adjustments): $3.29 million\n- Annual: $39.5 million\n\nUnder the new cap (14.4 cents + 4 bps on a $42 average ticket + 0.8 cents fraud):\n- Per-transaction allowable: 14.4 + 1.68 + 0.8 = 16.88 cents\n- Monthly revenue (blended ~15.5 cents effective): $2.32 million\n- Annual: $27.8 million\n\nThat's a $11.7 million annual reduction — before any secondary effects on rewards program funding or debit card acquisition economics. Institutions in this range are restructuring their debit product economics, trimming rewards tiers, and in some cases repricing demand deposit account fees to offset the gap.\n\n## Exam Priorities and Enforcement Signals in 2027\n\nFederal Reserve examiners and OCC staff have both communicated — through published examination procedures and informal supervisory letters — that their 2027 debit review focus areas include:\n\n- Verification that CNP transactions have functional (not just theoretical) dual-network routing capability\n- Review of network contracts for exclusivity provisions, including most-favored-nation clauses that effectively suppress routing choice\n- Reconciliation of interchange revenue against the new cap, with particular attention to the fraud-adjustment claim process\n- For institutions near the $10 billion threshold: documentation of how asset size is monitored and how the institution will operationalize cap compliance if it crosses the line mid-year\n\nThe CFPB has also flagged debit routing practices in its supervisory highlights as an area where consumer harm can result from issuers steering transactions to networks that impose higher merchant fees — costs that can ultimately be passed to consumers at the point of sale.\n\nEnforcement under Regulation II has historically been light, but the combination of a material cap reduction and renewed regulatory focus on CNP routing changes that calculus. At least three consent orders issued in 2025–2026 included Regulation II routing findings as contributing factors, according to publicly available enforcement action documents on the Federal Reserve's website.\n\n## What Issuers Should Do Before Year-End 2027\n\nCompliance teams should run through this checklist before their next examination window:\n\n- Audit token inventory — Confirm that both networks on every card have been provisioned for NFC/digital wallet token use. Check Apple Pay, Google Pay, and Samsung Wallet separately.\n- Pull CNP routing reports — Request 90-day routing split data from your processors. If one network is handling more than 90% of CNP volume, investigate why.\n- Review network contracts — Have outside counsel flag any exclusivity, incentive, or volume-commitment clause that could be read as routing suppression.\n- Model the new cap — If you're a covered issuer, rebuild your interchange revenue forecast using 14.4 + 4 bps + 0.8 cents and stress-test at 90% and 85% of the theoretical maximum.\n- Monitor asset-size trajectory — If you are between $8 billion and $10 billion in assets, set a formal trigger process for compliance activation.\n- Document fraud-prevention standards — If you claim the fraud adjustment, your written fraud-prevention program must meet the Fed's standards at § 235.6. Get that documentation current.\n\nFor institutions building or rebuilding debit infrastructure, the routing requirement is a design constraint, not an afterthought. It needs to be embedded in processor selection, token service provider agreements, and network certification from day one.\n\n## How AtlasForge Financial Can Help\n\nRegulation II compliance is ultimately a data problem: you need clean, real-time visibility into transaction routing, interchange calculations, and network splits — and you need it to be auditable. The AtlasForge Financial API is built to surface exactly that kind of ledger-level data for fintech issuers and program managers who need routing transparency without rebuilding their core processor integration.\n\nFor institutions managing debit card program economics alongside broader consumer deposit products, Safe to Spend 365 gives your account holders a real-time picture of their spendable balance — one that accounts for pending debit authorizations, routing-based holds, and network settlement timing differences that can otherwise erode trust in your debit product. And if you want to understand how your interchange revenue sits relative to your operating cost structure at the program level, our Ember360 analytics layer was designed for exactly that kind of product-level P&L modeling.\n\nRegulation II compliance in 2027 rewards issuers who treat it as an infrastructure investment, not a line-item audit. If your team wants to walk through how the new cap and routing rules interact with your specific program architecture, reach out to our compliance team — we're happy to run through the numbers with you.

Further reading

• Instant Payments vs Cards at Checkout: 2027 Reality Check