Debit routing after
Regulation II: what
changed for merchants
The Federal Reserve closed a routing loophole that let issuers skip dual-network competition on online debit transactions. Here is exactly what the rule requires, what it doesn't, and why it still matters for the rate on every debit sale you run.
Quick answer
Regulation II, the Federal Reserve rule implementing the Durbin Amendment, has required every debit card to be enabled on at least two unaffiliated payment networks since 2011 — but for years, many issuers only fully built that out for card-present, PIN-capable transactions. On October 3, 2022, the Fed finalized a rule clarifying that the two-network requirement applies to card-not-present debit transactions too, with a compliance deadline of July 1, 2023. Merchants didn't gain the right to pick a network transaction-by-transaction, but their processors and gateways gained more competing routing options on the online debit volume that had mostly defaulted to a single network before. For a merchant, the practical effect shows up as more routing flexibility on the back end, not a new checkbox on the front end.
Every debit card you run already touches Regulation II — it is the rule that caps regulated interchange and requires dual-network routing. What changed is narrower and more recent: the Fed closed the part of the rule that let issuers treat online debit differently from in-store debit, and most merchants never noticed because the change happened one layer below where a card-not-present transaction gets priced.
What Regulation II has required since 2011
Regulation II implements Section 1075 of the Dodd-Frank Act, commonly called the Durbin Amendment. Two things sit inside it. First, an interchange fee cap: debit card issuers with at least $10 billion in total assets are limited to a regulated interchange fee — a base amount plus a percentage of the transaction, plus an allowance for fraud-prevention costs — set by the Federal Reserve Board. Second, and separately, a routing-exclusivity ban: the Board must require that every debit card be enabled on at least two unaffiliated payment card networks, and issuers and networks cannot restrict which of those networks a merchant's transaction can be routed through by network rule.
The intent of the routing requirement was competition. Before Durbin, a single global network could effectively be the only option on a given debit card, leaving merchants and their acquirers with no leverage to route a transaction to a lower-cost or better-performing alternative. Requiring at least two unaffiliated networks per card was meant to give merchants' processors somewhere else to send the transaction.
The gap the 2023 amendment closed
The original 2011 rule and its implementation focused heavily on card-present transactions — the kind where a PIN could route a debit sale to a regional or national PIN-debit network as an alternative to the signature-debit rail. Card-not-present transactions — a card typed into a checkout page, stored on file for a subscription, or read from a mobile wallet without a PIN prompt — didn't have an equivalent, well-established second-network option in practice. Card-not-present transactions as a share of all debit transactions grew substantially over the 2010s, and much of that online debit volume defaulted to a single network by default, typically because only one of the two enabled networks had built out the tokenization and authentication infrastructure needed to actually process a remote debit transaction.
On October 3, 2022, the Federal Reserve Board finalized a rule specifying that the existing prohibition on network exclusivity applies to card-not-present electronic debit transactions, with a compliance deadline of July 1, 2023. The amendment didn't add a new dual-network requirement — it clarified that the requirement already on the books covered online debit the same way it covered swipe, tap, and chip debit, and it pushed issuers to actually enable a second, functioning network for that channel rather than leaving it available on paper only.
The rule didn't hand merchants a routing menu. It made sure the second network on the back of every debit card actually works when the card never touches a terminal.
What the amendment does not do
Two clarifications matter here, because they're easy to overstate. First, Regulation II requires the issuer to enable at least two unaffiliated networks on the card — it does not require that both networks be available for every single transaction with every merchant. A particular merchant's acquirer or gateway might only support one of the two enabled networks, which is a business decision on the acceptance side, not a violation of the rule. Second, the rule does not give the cardholder or the merchant a menu to pick a network at checkout. Routing decisions on a card-not-present debit transaction are made by the processor or gateway's routing logic, within whatever the card and the merchant's platform actually support — the same layer that already decides how a blended effective rate moves when the mix of debit, credit, and card-not-present volume shifts.
It's also worth separating routing from pricing. The interchange rate cap under Regulation II applies to "regulated" debit — cards issued by banks with $10 billion or more in assets. Cards from smaller issuers are exempt from the cap, which is why regulated and exempt debit interchange schedules diverge, sometimes significantly, and why two debit cards from two different banks can carry noticeably different interchange even on an identical transaction. The routing rule discussed in this post applies to all debit cards regardless of issuer size; the interchange cap does not.
Why this still shows up in a merchant's rate
More competing, functioning networks on the card-not-present side gives acquirers and processors more room to route a transaction to whichever enabled network processes it most efficiently for that merchant, which is the mechanism the rule was designed to create. It does not change the debit versus credit gap merchants already see on a statement — MidPay's own benchmark figures run 1.49% debit versus 2.69% credit, against a typical flat-rate processor's blended 2.6% + 10¢ — and it does not change the card-not-present interchange premium covered in why the same card costs more online. What it changes is whether the routing layer underneath those rates has real competition on online debit the way it always has on in-store debit. On a merchant running $50,000/month at a 60% debit mix, the gap between a well-routed and poorly-routed debit-heavy processor still lands in the same range MidPay has documented elsewhere — on the order of $378/month, or $4,536/year — and dual-network routing on the online side is one more lever that determines which side of that gap a given transaction falls on.
What a merchant should actually check
- Ask your processor whether your gateway supports routing on more than one debit network for online transactions — not just in-store. This is a fair question to put directly to whoever runs your card-not-present volume.
- Don't confuse routing competition with a rate you negotiate — Regulation II governs what networks are available and how exclusivity is restricted; it does not set your processor's markup, which is a separate, negotiable layer covered in interchange-plus vs flat rate.
- Separate your debit and credit lines on your statement the way reading your merchant statement describes, so you can actually see whether your online debit rate looks competitive against the card-present debit rate on the same statement.
- Remember the routing rule applies to debit and general-use prepaid only — credit card routing and interchange are governed by each network's own rules, not by Regulation II.
- Re-check this periodically — the Federal Reserve has continued reviewing Regulation II's interchange cap parameters since 2023, and any future change to the cap (separate from the routing rule) would move regulated debit interchange, not the routing requirement itself.
Frequently asked questions
What did the 2023 Regulation II amendment actually change?
The Federal Reserve's October 2022 final rule, effective July 1, 2023, clarified that the existing requirement to enable at least two unaffiliated payment networks on every debit card applies to card-not-present transactions — online, phone, and mail-order — not just in-store swipe, tap, or chip transactions. Before this amendment, many issuers only fully enabled dual-network routing at the physical point of sale, leaving most online debit transactions defaulting to a single network, typically Visa or Mastercard's own signature-debit rails.
Does Regulation II mean a merchant can now choose which network processes every debit sale?
No. Regulation II requires the card-issuing bank to enable at least two unaffiliated networks on the card, and it requires that routing choice not be restricted to networks affiliated with a single global brand. It does not require that every network be available to every merchant on every transaction, and it does not hand routing control to the cardholder. In practice, the merchant's processor or gateway decides which of the enabled networks to route a given card-not-present transaction to, subject to what the card and the merchant's platform actually support.
Is regulated debit interchange capped under Regulation II, and did that change?
Yes, and the cap is separate from the routing rule discussed here. Issuers with at least $10 billion in assets are subject to a regulated debit interchange cap under Regulation II — a base amount plus a percentage of the transaction, plus a fraud-prevention adjustment. Smaller issuers are exempt from the cap, which is why regulated and exempt (unregulated) debit interchange schedules differ meaningfully, and why a merchant's blended debit rate depends heavily on whose cards their customers actually carry.
Does the routing rule apply to credit cards or only debit?
Regulation II and its dual-network routing requirement apply only to debit and general-use prepaid cards, not credit cards. Credit card interchange and routing are governed separately by each network's own rules and are not subject to the Durbin Amendment's network-exclusivity restrictions.
Key takeaways
- Regulation II has required two unaffiliated networks on every debit card since 2011, but card-not-present transactions weren't clearly covered until the Fed's October 2022 final rule, effective July 1, 2023.
- The amendment closed a gap where many issuers only fully built out dual-network routing for in-store, PIN-capable debit — leaving most online debit defaulting to one network.
- The rule governs network availability and exclusivity, not merchant-level routing choice or your processor's markup — those remain separate, negotiable layers.
- The regulated interchange cap (issuers ≥$10B in assets) is a distinct part of Regulation II from the routing requirement, and applies only to debit, not credit.
Sources & how to verify
Primary rule text and guidance: the Federal Reserve Board's Regulation II: Debit Card Interchange Fees and Routing compliance guide, and the Board's official Regulation II overview page. The 2022 final rule extending the dual-network requirement to card-not-present transactions, with its July 1, 2023 effective date, is analyzed in Consumer Finance Monitor's coverage of the October 2022 rule and in the U.S. Payments Forum's Regulation II clarification for debit routing summary. Background on the underlying Durbin Amendment interchange cap is available from the Congressional Research Service report on debit interchange fee regulation. Always verify current rule status against the Federal Reserve's own published guidance, since the Board has continued to review Regulation II's cap parameters since this rule took effect.
See how your debit volume is actually being routed
Send us a recent statement and we'll show you what's happening on your card-not-present debit line — and whether an itemized interchange-plus statement would show you something different.
Run my statement → Curious about pricing first? See MidPay's pricing.