Regulation II Interchange Fee Rules for AI-Initiated Debit Transactions

Regulation II governs debit card interchange fees and routing, and it does not apply the same way to every bank. That unevenness is the first thing to understand, because every question that follows about AI agents initiating payments depends on which side of the line a given institution sits on.

The rule traces back to Section 920 of the Electronic Fund Transfer Act, added by Section 1075 of the Dodd-Frank Act. That provision directs the Federal Reserve to set standards ensuring that interchange fees are reasonable and proportional to the cost an issuer incurs for a given transaction. Out of that mandate came the interchange cap familiar to anyone in payments: 21 cents as a base component, 0.05% of the transaction value as an ad valorem component, and an additional 1 cent fraud-prevention adjustment for issuers that qualify. That cap, though, only binds covered issuers, defined as banks and credit unions with total assets of $10 billion or more when combined with affiliates. Institutions below that threshold are exempt from the cap. Government-administered payment programs sit outside the cap too, and so do certain reloadable prepaid cards, no matter who issues them.

Separate from the cap sit the routing rules, and these apply to every issuer without regard to size. Every debit card has to work on at least two unaffiliated networks, and neither the issuer nor the network can block a merchant from choosing which eligible network handles a given transaction. A rule finalized October 3, 2022 and effective July 1, 2023 extended that two-network requirement to card-not-present transactions, closing a gap that had let most online debit activity slide past the requirement in practice.

The fraud-prevention adjustment adds a final layer. Covered issuers only get the extra 1 cent if they maintain qualifying fraud-prevention policies, certify compliance to their networks annually, and review and update those policies every year. That's a procedural obligation banks have to actively satisfy, not a box to check once and forget.

The "reasonable and proportional to cost" standard for AI-initiated transactions

The statutory language requiring interchange fees to be proportional to an issuer's "incremental cost with respect to the transaction" was written with a discrete, human-initiated card swipe in mind. One customer, one card, one transaction, one cost. Agentic AI breaks that model in ways the statute never anticipated.

The law directs the Fed to consider only incremental costs tied to authorizing, clearing, and settling a specific transaction, not fixed or shared costs spread across a bank's operations.

Picture an AI agent running a multi-step payment workflow: it triggers compliance checks, optimizes routing across available networks, monitors settlement, and handles exceptions as they come up. No guidance or rulemaking has addressed whether that kind of flow changes the cost-proportionality analysis, or whether issuers would need to disaggregate those costs to satisfy the standard.

The exposure here is practical rather than hypothetical. That's not a prediction that any bank is currently out of compliance, and it's a structural mismatch worth planning around before volumes make it expensive to fix.

The Corner Post litigation and the proposed rule, as of late 2026

Two federal courts have read this baseline in opposite directions, and the Fed has separately proposed to rewrite the cap altogether, so covered issuers and their vendors are building AI payment systems on shifting ground. By the time a typical AI deployment reaches full scale, the rule governing interchange today may look nothing like the one that governs it then.

Start with Corner Post. A federal district court in North Dakota vacated Regulation II in August 2025, because it found the Fed had exceeded its statutory authority. The court found two specific problems: the Fed had included a "third category" of costs that were transaction-specific but not incremental, and it had folded in fixed authorization, clearing, and settlement costs, network processing fees, transaction-monitoring costs, and fraud losses, costs the Durbin Amendment only permits the Fed to weigh as incremental ACS costs. The Fed appealed, the Eighth Circuit heard argument on May 13, 2026, and as of late September 2026 no ruling had come down.

A different court reached the opposite conclusion. On September 15, 2025, Judge Gregory Van Tatenhove of the Eastern District of Kentucky, ruling in the Linney's Pizza case, held that Regulation II is not contrary to law and not arbitrary or capricious, a decision now on appeal to the Sixth Circuit.

Layered on top of the litigation is a pending rulemaking. The Fed's proposed rule from October 25, 2023 would cut the base component from 21 cents to 14.4 cents, trim the ad valorem component from 5 basis points to 4, raise the fraud-prevention adjustment from 1 cent to 1.3 cents, and link future caps automatically to biennial survey data. The Fed has not issued a final rule. In December 2025, nine bank and credit union trade groups asked the Fed to withdraw the proposal until the courts settle these questions.

Why does any of this matter for a bank deciding how to deploy AI payment agents today? Banks locking in AI payment architecture now are making a bet on a regulatory outcome that hasn't been decided yet.

Regulation E's authorization rules and the liability layer when an AI agent initiates the debit

A bank has to be able to show the transaction was authorized in the first place before Regulation II's interchange cap even becomes relevant. When an AI agent initiates the debit rather than the human cardholder, that showing gets harder to make, and the issuer bears the liability for failing to make it.

Regulation E defines an unauthorized electronic fund transfer as one "initiated by a person other than the consumer without actual authority to initiate such transfer." No U.S. rule currently spells out how an AI agent should document or demonstrate the consumer's intent at the exact moment it initiates a transaction. Revised model risk guidance states that generative and agentic AI are novel and rapidly evolving, and places them outside the guidance's current scope, with the agencies signaling plans to issue a request for information on how banks are actually using AI.

The liability consequence is concrete. If a transaction gets deemed unauthorized under Regulation E after the fact, and an AI agent initiated it, the issuer bears the liability, even though the interchange fee it collected was calculated as though the transaction were perfectly valid.

That produces an asymmetry a traditional card swipe never presented. In an AI-mediated transaction, consent has to be documented, auditable, and defensible on its own, ready to be produced in a regulatory examination with no physical act to point to as proof.

The routing obligation that applies to every issuer (and why AI network selection can violate it)

No matter its asset size, every issuer has to meet the merchant-choice routing requirement, so it's the one Regulation II obligation that touches every AI deployment. It's also the one an AI agent can breach without a single human noticing.

The October 3, 2022 rule, effective July 1, 2023, extended this requirement to card-not-present transactions, the exact category that covers most AI-initiated or voice-initiated payment flows.

If an AI agent optimizes for lowest cost or fastest settlement, it may autonomously pick a network path that overrides the merchant's stated routing preference. The violation happens in the outcome, the moment the merchant's eligible network choice gets bypassed by an optimization the agent decided was smarter.

Credit unions and community banks deploying AI payment agents need to pay close attention here. A small-issuer AI deployment carries no exemption on this front.

Operationally, any AI agent that touches network selection needs routing logic that treats merchant-choice compliance as a hard constraint, not a variable to optimize around. Industry architecture is already moving this way: rules-based authorization boundaries accept structured payment instructions from an AI agent only when those instructions satisfy verifiable policy constraints, and they reject or return anything that doesn't. So this design turns routing compliance into a non-negotiable gate, not just a hope.

Fraud-prevention obligations under Regulation II become an active system requirement, not a policy checkbox

Covered issuers qualify for the one-cent fraud-prevention adjustment if they maintain and annually review policies that actively identify, monitor, and respond to fraudulent transactions. AI-initiated debit volumes, executing at machine speed, raise the bar for what "active" monitoring actually has to mean.

These are procedural obligations an issuer certifies to its networks every year. Fraud prevention has to extend upstream to the instruction layer itself, not stop at the transaction layer where older policies were built to operate.

The explainability standard taking shape in regulatory practice reinforces all of this. For fraud-prevention certification, if a system's decisions can't be traced back to specific rules and specific data points, you can't certify it honestly.

The compliance gap across large banks, community banks, and credit unions

Because of Regulation II's two-tier structure, agentic AI deployment doesn't create one compliance problem. It creates three, and a bank has to diagnose which one it's facing before it can design the right controls.

Large covered issuers, those with assets above $10 billion, face all three Regulation II obligations at once: the interchange cap and its cost-proportionality test, the fraud-prevention certification, and the routing rules. If the Eighth Circuit affirms, interchange economics would have to be recalibrated against a narrower per-transaction incremental cost standard, and at AI-driven transaction volumes, even small per-transaction shifts add up fast. These institutions also have to document AI-initiated transaction authorization under Regulation E in a way that survives examination, since their scale makes a systematic authorization gap an obvious examination priority.

Community banks under $10 billion in assets sit differently. They're fully subject to the routing rules, including the 2023 card-not-present extension. Any AI agent they deploy to select network paths has to honor merchant routing choice just the same. They also carry the same unresolved Regulation E authorization question as their larger peers, on every AI-initiated transaction.

Credit unions mostly fall below the $10 billion threshold too, so most are exempt from the cap and instead get whatever market-rate interchange their networks set for exempt cards. But the routing rule still applies to them, and so does the consent documentation burden underneath Regulation E.

Building a governance architecture that satisfies Reg II obligations as AI agents execute at scale

Meeting Regulation II's obligations when AI agents are the ones executing debit transactions means designing compliance into the system architecture before deployment, not bolting it on as an audit layer afterward. The institutions getting this right treat regulatory requirements as hard constraints on what the agent is allowed to do, not soft guidelines it's free to interpret.

One model gaining traction is the rules-based authorization boundary: a compliance layer that accepts structured payment instructions from an AI agent only when those instructions satisfy verifiable policy constraints and regulatory checks, before the transaction ever gets submitted for execution. Authorization documentation needs to be generated the moment an instruction is accepted, capturing the consumer's consent scope, the agent's specific mandate, and the exact transaction it's initiating. That's the audit record Regulation E requires and the one examiners will ask to see.

An explainability standard should govern every AI-initiated transaction touching a Regulation II obligation: a human-readable record of which rule triggered, what data the agent evaluated, what conclusion it reached, and under what authorization it acted. And when an agentic payment system fails, causing financial loss, customer harm, or legal exposure, that failure belongs in the bank's operational-risk profile, routed through the same escalation and reporting mechanisms as any other payment processing failure.

Production examples are already appearing. FIS introduced a Financial Crimes AI Agent in 2026, with general availability planned for the second half of the year. Fiserv launched agentOS, an operating system for agentic AI in banking that supports risk management, regulatory reporting, deposit operations, and back-office reconciliation. Both point toward compliance built into agentic architecture from the start, not added after deployment. Institutions building on established banking rails hold a structural advantage here too: transaction data, authorization records, and routing logs already flow through existing compliance infrastructure, giving AI agents deployed on those rails a foundation of audit trail and reporting capabilities to inherit.

Steps banks should take now given regulatory uncertainty and accelerating AI deployment

The right response to Regulation II's instability isn't pausing AI payment deployments until the courts settle everything. You design deployments that satisfy today's rule but leave room to absorb a revised cap or new routing guidance without a rebuild.

On the litigation, the North Dakota court's stay keeps the current cap in effect. Banks should keep operating against the existing structure, 21 cents, 0.05%, 1 cent, until a ruling actually changes it, while modeling the economics of the proposed alternative (14.4 cents, 4 basis points, 1.3 cents) to understand the revenue impact if that rule is ever finalized.

On routing, the card-not-present two-network requirement has been in effect since July 1, 2023. If an AI agent touches network selection for online or voice-initiated transactions, it has to honor merchant-choice routing today. That is not a future obligation waiting to arrive.

On authorization documentation, banks should apply the highest defensible standard of consent documentation to AI-initiated transactions now, even when there's no specific AI rule to point to. Examiners are starting to ask about AI governance, and retrofitting authorization records into a system already in production costs far more than building them in from the beginning.

McKinsey's 2026 AI Trust Maturity Survey found that only about one-third of organizations say their agentic AI governance is mature enough, even as deployments keep accelerating. Banks that build governance architecture ahead of that curve will be in better shape when examiners start applying formal AI guidance.

The institutions that navigate this well are the ones treating Regulation II compliance as a design specification rather than a constraint bolted on after the fact, configuring agent behavior, routing logic, authorization documentation, and fraud-prevention policy as system requirements before the first live transaction ever runs.