What the FTC's debit-routing crackdown on Mastercard means for rivals

When Mastercard was blindsided in the final weeks of the year by a proposed consent order with the Federal Trade Commission around violations of debit-routing rules, a key question was how Visa and several large issuers involved in similar business practices escaped censure.

The FTC hasn't said whether other enforcement actions are in the works, but public comments due Feb. 13 could shed light on why the FTC singled out Mastercard. The relatively short 30-day comment window suggests the FTC won't wait long before finalizing its latest action, leaving room for other potential disciplinary moves.

So far Mastercard appears to be taking sole blame for the effects on debit-routing of widespread industry practices around tokenizing, or encoding card numbers for security and streamlined processing. Merchants say tokenizing thwarts their ability to route online debit transactions to lower-cost debit networks, a requirement of Regulation II under the Durbin amendment, part of the Dodd-Frank Act.

Merchants' inability to easily detokenize debit transactions for routing to Visa or Mastercard alternatives means that only about 6% of online debit transactions flowed through competing networks as of 2019, according to the Federal Reserve.

Andrew Harrer/Bloomberg

The Fed first pointed out unfairness in online debit transaction routing in a 2021 proposed clarification to Reg II, finalizing its rule in October 2022 to emphasize the requirement for online and in-store transactions to have equal dual-routing options.

In the first official enforcement by any agency of the Fed's recently clarified rule, the FTC on Dec. 23 said Mastercard has used illegal business tactics to force merchants to route debit networks through its network. Mastercard denies wrongdoing. Visa has declined to comment on the situation.

Observers find it difficult to separate Visa from these practices, noting that both Visa and Mastercard for years have widely promoted the use of tokenization for all online transactions.

Visa and Mastercard are the dominant Token Service Providers for mobile wallets, pre-enrolled card-on-file, subscription and in-app payments, and thus they execute virtually all tokenized transactions, especially debit transactions, according to Richard Crone, a principal with Crone Consulting. 

"The processing rails are essentially hard-wired to route online debit transactions through Visa and Mastercard, making them the ultimate gatekeepers for all tokenized transactions," Crone said. He noted that during the pandemic all categories of online transactions surged, and their growth continues to outpace in-store debit transactions.

As part of the consent order, the FTC ordered Mastercard to start providing competing networks with customer account information they need to process debit networks. 

Merchants are optimistic about the potential for the FTC to eventually ensure all card networks comply similarly with the Fed's clarified debit-routing rules, along with any banks enabling the large card networks to thwart online debit-routing rules.

"We're feeling very positive with respect to the FTC taking this action, and we'll certainly file public comments encouraging processes to finally get the card networks to follow regulations that have been in place for more than a decade," said Doug Kantor, general counsel at the National Association of Convenience Stores. 

Certain large issuers are complicit in Visa and Mastercard's efforts to frustrate alternative debit network routing through tokenization, according to Kantor.

"The problems are more than just issues around detokenization. The Fed had to clarify its rules because there was a concerted effort by the card networks and large issuing banks to block competition in spite of regulations," Kantor said.

In its clarification of debit-routing rules last year, the Fed noted that most community banks issuing cards are already compliant with the final rule because they have enabled two unaffiliated networks to process card-not-present transactions performed with their debit cards. 

Payments

FTC orders Mastercard to open tokens to rival debit networks

December 23, 2022 2:42 PM

Most independent debit networks are reluctant to comment on the issue, and many are weighing whether they will file public comments or what they will say. 

Competing debit networks include the FIS-owned NYCE (including the Armed Forces Financial Network and CO-OP); the Fiserv-owned STAR and Accel; Discover Financial Services' Pulse; Presto, from the supermarket chain Publix; U.S. Bank's MoneyPass Network; and Shazam.

There is wide variability in how payments industry participants have managed to comply with the Durbin amendment in recent years, said Dan Kramer, executive vice president of government and community affairs at Shazam, a Des Moines, Iowa-based independent debit card network. 

"Not every processor or retailer has the same capability or technology to detokenize transactions, and many have begun doing so only in the last two years," Kramer said. 

While the proportion of online debit transactions grew steadily over the last decade, the pandemic triggered an avalanche of growth in debit transactions through new digital commerce channels, he said.

"If the last several years have taught us anything, it's that payments is a full-blown regulated business now. First we had the Durbin amendment creating rules for debit routing for the first time, and in recent months the Fed stepped in to clarify those rules, and now we have the FTC getting involved, so this is not going away," Kramer said.