Rules and risks

How the rules work

Reg E and the Prepaid Rule. Debit cards have long been under Reg E; the CFPB's Prepaid Rule brought prepaid accounts in from April 1, 2019, including payroll and benefit cards and wallets that hold funds, while gift cards are mostly outside it. It requires a short-form fee disclosure before the customer gets the card, statements or a free alternative (balance by phone, 12 months of history online), limited liability and error resolution, and filing account agreements with the CFPB within 30 days of a change. Overdraft or credit on a prepaid card has to be a separate credit feature under Reg Z.

Sponsor-bank orders. Regulators issued a wave of consent orders in 2024, and in 2025-2026 several ended.

New orders slowed and older ones are ending, but money-laundering findings keep coming. An order at your bank tends to mean an onboarding freeze or prior approval for anything new, re-verification of existing cardholders, lookbacks, daily reconciliation with the bank's access to the ledger, and an exit plan. How those checks work is in Identity and trust.

Direction of travel. On September 11, 2026 the US bank regulators proposed replacing the 2023 guidance on managing partners like fintechs (comments are due November 10, 2026), and the FDIC's custodial-account rule hasn't moved since 2024. The CFPB's funding was capped at about $467 million for fiscal 2026 and it planned fewer than 70 exams that year. Reg E itself hasn't changed, and I'd expect enforcement to come more from banks' own regulators, states and private lawsuits. The UK went the other way and wrote daily safeguarding reconciliation into its rules from May 7, 2026.

Earned wage access. Relevant to the payroll platform: in a December 23, 2025 advisory opinion, the CFPB said employer-integrated wage access isn't credit under Reg Z when it's repaid only through payroll deduction, with no recourse against the worker and no credit check. About a dozen states regulate it anyway, with fee caps like Connecticut's $4 per advance.

Canada. No statute caps interchange; the federal government's voluntary commitments with Visa and Mastercard cover consumer credit only. The revised Code of Conduct for the Payment Card Industry now binds issuers too, mostly on clear disclosures and complaint handling, under FCAC's supervision. Since June 1, 2021, FINTRAC has required prepaid issuers to identify holders, report suspicious transactions and keep records for accounts that can take C$1,000 or more in 24 hours. Federally regulated issuers follow the Prepaid Payment Products Regulations, which require a fee box and a statement when funds aren't CDIC-insured.

What mistakes cost

• The wrong bank. A bank that crosses $10 billion in assets cuts debit interchange by more than half within months, and a bank under order freezes your roadmap. Either can force a migration that takes most of a year.
• A ledger the bank can't read. In the worst case users lose access to their money and the program loses its bank, as Synapse's users found out.
• Low spend per card. Minimums, card costs and fixed compliance costs can exceed interchange for a year or more, and gift, payout and secondary cards feel it soonest.
• Card production delays. Custom plastic slips by weeks, and a shortage by months. Programs that launch on stock or virtual cards barely notice.
• Network and design missteps. Visa's assessments for an unregistered agent started at $10,000 per agent per client in its 2016 schedule.
• Credit enhancement that fails. For credit programs, the partner's guarantee is only as good as the partner, and the bank tightens everyone's collateral afterwards.