Scheme compliance: mandates, fines and the certification cycle

Scheme compliance is the obligation of every participant in a card scheme to follow the scheme rules, and it is enforced through mandates, fines, and certification. The scheme, which is Visa or Mastercard or another network, publishes a rulebook that covers everything from the interchange rates to the chargeback process to the security requirements, and every issuer, acquirer and processor must comply. The scheme also issues mandates, which are changes to the rules with a compliance deadline, and it runs a certification programme that tests whether a participant systems meet the standard. A participant that fails to comply can be fined, can be placed in a monitoring programme, and in extreme cases can lose its licence to participate. Why scheme compliance matters is that the scheme is the referee of the card system, and its rules are what make the system work. If an issuer does not follow the authorisation rules, transactions will fail. If an acquirer does not follow the chargeback rules, disputes will be decided against it. If a processor does not follow the security rules, cardholder data will be stolen. The scheme enforces compliance because a failure by one participant damages the trust of the whole system. The fines are not a revenue source for the scheme: they are a deterrent, and the scheme publishes its fines to warn other participants. The parties are the scheme, the issuer, the acquirer, the processor, and the certification body. The scheme publishes the rules and the mandates, and sets the compliance deadlines. The issuer, acquirer and processor must implement the mandates by the deadline and must certify their systems. The certification body, which is accredited by the scheme, tests the systems and issues a certificate. The scheme monitors compliance through reporting, through the chargeback ratio, and through audits. If a participant is non-compliant, the scheme issues a warning, then a fine, then a monitoring programme, and finally a suspension. In practice the compliance cycle runs like this. The scheme publishes a mandate, for example a change to the chargeback reason codes or a new security requirement, with a compliance deadline typically 12 to 18 months away. The participant assesses the impact, writes the requirements, develops the change, tests it, and certifies it with the scheme. The certification involves sending test transactions to the scheme and proving that the system handles them correctly. Once certified, the participant goes live before the deadline. The scheme then monitors compliance through the reporting: the chargeback ratio, the authorisation rate, and the security assessment. A participant that misses the deadline is fined, and the fine increases the longer the non-compliance continues. A worked example shows the cost of missing a mandate. Visa issues a mandate requiring all acquirers to support a new chargeback reason code by 1 October 2026. An acquirer estimates the change will take six months and cost GBP 200,000. It starts the work in January, but the project is delayed, and by September the change is not certified. The scheme fines the acquirer USD 25,000 per month from October until compliance, and places it in a monitoring programme. The acquirer also cannot process chargebacks with the new reason code, so it loses disputes it should have won. The total cost of the delay is the fine, the lost disputes, and the rush cost of completing the change under pressure, which is far more than the GBP 200,000 it would have cost to do it on time. What happens when a participant is placed in a monitoring programme is a period of intense scrutiny. The scheme requires weekly reporting, an action plan with deadlines, and regular reviews. The participant must also pay a monitoring fee, and its ability to board new merchants or launch new products may be restricted. If the participant does not improve, the scheme may suspend it, which means it cannot process card transactions at all. A suspension is a business-ending event for an acquirer, and it is the reason that scheme compliance is treated as a board-level risk. The operational and accounting implications are that the compliance team must track every mandate, the technology team must deliver the changes on time, and the finance team must budget for the certification cost. On the ledger, a scheme fine is a cost that must be recognised when it is levied, and the cost of the mandate implementation is a capital or operating expense depending on the accounting policy. The accounting team must also track the monitoring fees, which are a cost, and the lost dispute value, which is a loss. The risk team must report the compliance status to the board every month, because a non-compliant participant is a risk to the whole business. For a business analyst, scheme compliance is a tracking and delivery subject. You must specify the mandate register, the impact assessment, the requirements, the test cases, the certification process, and the go-live plan. You must also specify the reporting: the compliance status, the deadline, the owner, and the risk if the deadline is missed. A common gap is failing to specify the certification test cases, because the scheme will not certify a system that has not been tested, and the certification slot must be booked months in advance. Takeaway: scheme compliance is a deadline business, and the fine for missing a mandate is always larger than the cost of meeting it. Further reading: the Visa Core Rules for mandates and compliance; the Mastercard rules; the PCI Security Standards Council for certification. Last reviewed 7 November 2026. A compliance calendar that lists every mandate, its deadline and its owner is the cheapest insurance a scheme member can buy.