Rules & policy
What logic decides outcomes, and who can change it?
Outcomes in regulated industries are decided by rules: who qualifies, what it costs, what gets approved, where it goes. The product question is less "what's the rule?" than "who owns it, and how fast can it change?"
What it is
Rules are the logic that decides outcomes. Some you set (your pricing), some your customers set (their approval thresholds), and some are imposed on you (a tax table, a carrier's content policy).
Who owns a rule matters more than how complex it is, because ownership decides who has to approve a change and how fast you can ship one.
Where you'll see it
| Industry | Rules that decide outcomes |
|---|---|
| Payroll | Tax tables, overtime rules, benefit eligibility |
| Telco | Carrier content policies, country sender rules, rate plans |
| Payments | Fee schedules, risk rules, card network rules |
| Healthcare | Coverage and eligibility rules, prior authorization |
| Insurance | Underwriting rules, rating tables |
Questions to ask in week one
- Which rules decide the outcomes customers care about most?
- For each one, who owns it: us, the customer, a counterparty or a regulator?
- How is a rule change requested, approved and rolled out?
- Are rules stored as configuration, or written into code?
- When a rule decides against a customer, can we explain why?
The trap
Hardcoding a rule you don't own. If someone outside your company can change it, it belongs in configuration with a date on it (see effective dating), not in a code deploy.
In the Field Guides
B2B payments: order to cash
Who sets a rule? All of them, in layers.
| Who sets | Rules that decide outcomes (as of Oct 2026) |
|---|---|
| Seller | Credit policy and approval authority, terms by segment, hold rules, dunning cadence, late fees, auto-write-off thresholds for small deductions (CRF median under $25 in 2012), accepted rails, card fees |
| Payer | Payment-run cadence, portal and remittance formats, deductions, compliance manuals, often its own terms (Net 60 to 90 or longer at large payers) |
| Insurers and lenders | Maximum terms and per-customer limits; eligibility, concentration and dilution limits |
| Card networks | Visa US: surcharge credit only, at most 3% and no more than the cost of acceptance, 30 days' notice, disclosure at entry and checkout. Mastercard: reported as the lower of 4% and the seller's discount rate |
| Rail operators | Nacha return windows and thresholds (0.5% unauthorized, 3% administrative, 15% overall); Payments Canada's Rule H1 for PADs |
| Law | Surcharges: banned in Connecticut and Massachusetts, capped at 2% in Colorado and 2.4% in Canada (since October 2022), banned on Quebec consumer sales. Terms: produce is due in 10 days unless agreed in writing (PACA); Ontario construction owners pay within 28 days of a proper invoice. Interest: US late charges need prior agreement; in Canada, a monthly rate without its yearly equivalent caps interest at 5% a year |
Sources: Visa surcharging requirements and Rules (April 2026), Nacha, CFIB, USDA, Ontario Construction Act primer, Interest Act. The Mastercard cap is from a law-firm summary, and the state map is moving.
Terms are a price. "2/10 net 30" means giving up 2% to be paid 20 days early, about 37% annualized; a longer term is an unbooked discount. The seller sets its terms only until a large payer, an insurer or a lender sets them instead, which is why sales and credit pull against each other.
The other big rule is who initiates. In a pull (ACH debit, PAD, card) the seller starts the payment and carries authorization and return risk; in a push (ACH credit, wire, RTP, FedNow, check) the payer carries fraud and misdirection risk. On card fees, the seller decides, the network caps, and state or provincial law can forbid.
Ask an expert: which of your credit rules are really set by your insurer or lender, and are late fees collected or quietly waived?
B2B payments: procure to pay
The buyer writes most of the rules, and others fence them in.
| Who sets | Rules that decide outcomes (as of Oct 2026) |
|---|---|
| Buyer | Approval matrix and delegation of authority; match tolerances; terms policy; payment-run calendar; rail policy ("ACH by default, card under a set amount"); bank-change verification; segregation of duties |
| Law | US Prompt Payment Act for federal buyers; Canada's federal construction prompt payment; 1099 and backup withholding; T4A; input tax credit documentation |
| Rail operators | Nacha's 2026 fraud monitoring for originators; the narrow ACH reversal grounds |
| Banks | Security procedures under UCC 4A, payment limits, Positive Pay terms |
| Card networks and issuers | Interchange tiers, surcharge rules, rebate schedules in the card contract |
| Suppliers | Which rails they accept, whether they surcharge, the terms on the invoice |
Segregation of duties is the core buyer rule: maintaining the vendor master, entering invoices, approving them and releasing payments should sit with different people (standard internal-control practice, tested under SOX 404 at US public companies).
The law steps in only where governments chose to protect suppliers. A US federal agency pays against "a proper and valid invoice", owes interest if it pays late (4.75% for July to December 2026) and may take a discount only inside the discount period (Fiscal Service). Canada's federal construction law, in force since December 9, 2023, makes the Crown pay within 28 days of a proper invoice and gives each subcontractor tier 7 days to pay the next. I found no general private-sector prompt-payment law in either country: terms are contractual.
That's why one supplier can be paid in 10 days by one customer and 90 by another, both within the rules.
Ask an expert: what match tolerances are typical, and how much of a "touchless" rate is just wide tolerances?
B2B payments: spend management
The company writes the spend policy; five other parties fence it in.
| Who sets | Rules that decide outcomes (as of Oct 2026) |
|---|---|
| Card network | Product rules (a purchasing card must be credit); category codes; interchange qualification; dispute windows; zero-liability exclusions; payments by AI agents |
| Sponsor bank | Credit box, prohibited industries, KYB depth, collateral, final say on each card and transaction |
| Program manager | Underwriting inside the bank's policy, limits, rewards tiers, settlement terms |
| Company | Spend policy (categories, limits) and expense policy (receipts, per diem caps, approvals) |
| Tax law | US accountable plans and substantiation; per diem and mileage rates; 50% meals; Canada's reasonable allowances and tax credit documents |
| Employment law | State reimbursement laws; the FLSA floor; the Canada Labour Code |
The accountable plan. US reimbursements are tax-free only if the plan passes three tests: business connection, substantiation and return of any excess (Treas. Reg. 1.62-2). Paying whether or not the employee spends fails the first, so a flat car allowance with no log is wages. The safe harbor: advances no more than 30 days ahead, substantiation within 60 days, excess back within 120. Fail, and the amount goes on the W-2 with withholding and payroll taxes. Most employees can no longer deduct unreimbursed expenses themselves (made permanent in 2025), so the plan is the only tax-free route.
Law versus policy. US law requires a receipt for lodging and other expenses from $75; most policies ask for more. Illinois lets a written policy cut off late claims; California's rights can't be waived. Travel and client meals are 50% deductible, convenience meals 0% since 2026, so the GL needs separate codes. A Canadian kilometre allowance paid alongside a fuel card for the same use becomes taxable in full: a design error, not an employee's.
Canadian sales tax. Input tax credit evidence scales with the amount: under $100, supplier, date and total; from $100, the tax and the supplier's GST/HST number; from $500, also the buyer's name, a description and terms. Reimbursements can use a factor (4/104 for GST, 12/112 to 14/114 for HST) if 90% of the total bore one tax. Meals get half the credit. The company-card shortcut needs the cardholder to be "solely or jointly and severally liable", so a pure corporate-liability program may not qualify.
Sources: Treas. Reg. 1.62-2, Pub 463, Pub 15-B (2026), Notice 2026-10, CRA, RC4022, Memorandum 8.4 (its HTML still shows pre-2021 thresholds).
The company writes the policy, but the bank, the network, the tax code and labor law each hold a veto, and only the card controls act at the moment of purchase.
Ask an expert: which controls do customers keep after 90 days, and which do they switch off because of false declines?
Telco: numbers and senders
Most rules that decide outcomes here are written by carriers and industry bodies, and they change by memo.
The US baseline is CTIA's Messaging Principles and Best Practices (May 2023, still the latest):
- Consent scales with content: implied for conversational, express for informational, express written for promotional messages.
- One opt-in per campaign, not transferable; no rented or bought lists.
- Opt-out works in plain language, not only STOP, with one confirmation message.
- No public URL shorteners and no snowshoeing (spreading traffic across many numbers to dodge filters).
CTIA's short code handbook adds HELP and STOP wording and SHAFT rules (sex, hate, alcohol, firearms, tobacco: legal SHAFT content needs an age gate).
Throughput is a rule, not a capacity:
| Carrier | How 10DLC throughput is set |
|---|---|
| AT&T | Per campaign per minute, by vet score: 4,500 SMS (75-100), 2,400 (50-74), 240 (1-49); 75 for low-volume mixed; 15 for sole proprietors |
| T-Mobile | Per brand per day, shared by all its campaigns: 200,000 (75-100), 40,000 (50-74), 10,000 (25-49), 2,000 (1-24); 1,000 for sole proprietors |
| Verizon | No published numbers; relies on filtering |
Carriers don't publish these tiers; they come from provider documentation (secondary, as of Oct 2026). The lever is the vet score: a standard vet costs $41.50 at TCR, an enhanced one $101.50.
Rich channels bring their own rulebooks. Since April 9, 2025 Meta approves a WhatsApp "utility" template that reads like marketing as marketing (Meta). Google holds each RCS agent to the use case declared at launch: OTP, transactional, promotional or multi-use. Abroad, countries add content categories and quiet hours: India's P/S/T/G header suffixes, the UAE's "AD-" prefix with no promotions from 21:00 to 07:00 (per provider guides), Colombia's advertising window of weekdays 07:00-19:00 and Saturdays 08:00-15:00 (Ley 2300).
If an outside party can change a rule, it belongs in configuration with an effective date.
Ask an expert: how many rule changes a quarter arrive by carrier memo or provider notice rather than published policy, and how long does each take to reach configuration?
Field Guides are learning notes, not legal or compliance advice. Rules and fees change; check the cited primary sources before you act on anything here.