# Compliance Source: https://paymentsandrisk.com/docs/compliance Last updated 23 October 2026. TL;DR - The rules you have to follow. Break them and you get fined, terminated, or both - At SMB scale it's three things: PCI, consumer protection law around refunds and subscriptions, and your card network's rules - Start with [Compliance Basics for SMBs](https://paymentsandrisk.com/docs/compliance/compliance-basics/) for the short version, then come back for the detail 12 min read Nobody reads compliance pages for fun. You're here because a processor asked you for something, or you're about to build something and you don't want to build it twice. * * * Running a booked service? [Can I charge a missed-appointment fee?](https://paymentsandrisk.com/docs/payments/appointment-fees/#can-i-charge-this-fee) ## Pick Your Mode New to Compliance? Start with [Compliance Basics for SMBs](https://paymentsandrisk.com/docs/compliance/compliance-basics/) - the 3-thing checklist that covers what actually matters at your size. [🔧 Operator What to fix this week. PCI-DSS and subscription rules.](https://paymentsandrisk.com/docs/compliance/pci-dss) [📊 Analyst Thresholds and monitoring. Network program tracking.](https://paymentsandrisk.com/docs/compliance/metrics) [📚 Reference Rules and requirements. Network rules, consumer protection.](https://paymentsandrisk.com/docs/compliance/network-rules) Popular [🔒 PCI-DSS Start Here Cardholder data security requirements](https://paymentsandrisk.com/docs/compliance/pci-dss) [📊 Dispute Monitoring Popular VAMP, ECM, BRAM thresholds](https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring) [🔁 Subscription Rules Recurring billing compliance](https://paymentsandrisk.com/docs/compliance/subscriptions) [🏛️ Reg E Debit card dispute requirements](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e) [📋 Network Rules Visa and Mastercard mandates](https://paymentsandrisk.com/docs/compliance/network-rules) * * * If You Only Have 2 Hours This Week 1. Check your chargeback ratio and count. If you're approaching your processor's written limit, act now. Check [network program conditions](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) separately. 2. Got subscriptions? Check that cancelling takes fewer than 3 clicks, and that renewal emails go out 7+ days ahead. 3. If you touch card numbers directly: confirm your SAQ is current and your PCI scan passed. That's it. Deep compliance audits can wait until something flags. Scale Matters **Under $100K/month:** Complete your PCI SAQ annually and track chargebacks against your processor's limit. Use the checklist above to confirm what applies to your checkout. **$100K-$1M/month:** If you bill recurring, subscription rules matter now. Review your cancellation flow and your renewal notices. Threshold monitoring turns into a weekly job. **Over $1M/month:** Formal compliance review annually. Know your PCI level, your acquirer's expectations, and whether PSD2/SCA affects your EU sales. **Over $10M/month:** Dedicated compliance function or outside counsel. Multiple network programs to track, potential for direct network relationships, and regulatory exposure across jurisdictions. * * * What Gets People in Trouble In order of how often I see it: 1️⃣ Chargeback Thresholds Check your processor's limit and the separate ratio and count conditions for Visa VAMP and Mastercard ECM. 2️⃣ Subscription Billing Violations Unclear cancellation, wrong renewal notices, failure to disclose terms 3️⃣ PCI Scope Creep Accidentally handling card data you didn't need to 4️⃣ Reg E Timing Violations Missing the 10-day provisional credit deadline (issuers) * * * By Domain [📡 Network Rules VAMP, ECM, BRAM, MATCH • Acquirers, merchants](https://paymentsandrisk.com/docs/compliance/network-rules) [🏛️ Consumer Protection Reg E, Reg Z, FCBA • Issuers](https://paymentsandrisk.com/docs/compliance/consumer-protection) [🔒 PCI DSS Cardholder data security • Everyone touching cards](https://paymentsandrisk.com/docs/compliance/pci-dss) [🇪🇺 PSD2 & SCA European authentication requirements • US merchants selling to EU](https://paymentsandrisk.com/docs/compliance/psd2-sca) [🔍 AML/KYC Customer verification, SAR filing • Banks, fintechs](https://paymentsandrisk.com/docs/compliance/aml-basics) [🔁 Subscriptions Recurring billing rules • Subscription merchants](https://paymentsandrisk.com/docs/compliance/subscriptions) * * * **By Role (specific requirements for Merchants, Acquirers, and Issuers)** 🏪 Merchants - [Network thresholds](https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM fines - [Subscription rules](https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing) - FTC, state laws - [PSD2 & SCA](https://paymentsandrisk.com/docs/compliance/psd2-sca) - EU authentication requirements - [PCI DSS](https://paymentsandrisk.com/docs/compliance/pci-dss) - Right SAQ annually - [Surcharging](https://paymentsandrisk.com/docs/compliance/network-rules/surcharging) - Caps and state laws 🏦 Acquirers - [Merchant monitoring](https://paymentsandrisk.com/docs/compliance/network-rules) - Portfolio ratios - [High-risk registration](https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring) - BRAM, VIRP - [MATCH/VMSS](https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring) - Check and report 💳 Issuers - [Reg E](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e) - Debit provisional credits - [Reg Z](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z) - Credit card rules - [TC40/SAFE](https://paymentsandrisk.com/docs/compliance/network-rules) - Fraud reporting * * * **What Regulators Actually Look At (hard vs. soft requirements)** There's a difference between "technically required" and "what triggers enforcement." **Hard requirements (will get you fined/terminated):** - Missing chargeback thresholds for consecutive months - PCI breach after not completing SAQ - Reg E timing violations with documented customer complaints - Subscription billing without proper disclosure (FTC is active here) **Soft requirements (matters in audits or after incidents):** - Perfect documentation of every decision - Formal policies for every edge case - Complete training records Focus your limited time on the hard requirements. The soft stuff matters when you're big enough for formal audits. * * * Tax Is Not Covered Here Sales tax and VAT compliance is jurisdictional chaos. This site doesn't provide tax guidance. **What you need to know:** - **Nexus matters.** You owe tax where you've got a presence, physical or economic - **Economic thresholds.** Plenty of states trigger nexus at $100K+ sales - **When to automate.** Multi-state or international, look at Avalara, TaxJar, or processor-native tools like Stripe Tax - **Talk to your accountant.** Before you decide anything on tax, get real advice This is a payments site, not a tax site. It's here because checkout and invoicing touch tax whether you want them to or not. * * * ## Next Steps New to compliance? 1. [PCI-DSS](https://paymentsandrisk.com/docs/compliance/pci-dss) - Start here if you touch cards 2. [Network Rules](https://paymentsandrisk.com/docs/compliance/network-rules) - Monitoring programs 3. [Subscription Rules](https://paymentsandrisk.com/docs/compliance/subscriptions) - If recurring billing Approaching thresholds? 1. [Dispute Monitoring](https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring) - Know your numbers 2. [Reduce Chargebacks Fast](https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast) - Emergency 3. [Chargeback Prevention](https://paymentsandrisk.com/docs/chargebacks/prevention) - Long-term * * * ## See Also [🛡️ Chargeback Prevention](https://paymentsandrisk.com/docs/chargebacks/prevention)[🔍 Fraud Prevention](https://paymentsandrisk.com/docs/fraud/prevention)[📊 Network Programs](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs)[🔒 3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds) - [Chargeback Metrics](https://paymentsandrisk.com/docs/chargebacks/metrics/) - Tracking dispute rates - [Fraud Metrics](https://paymentsandrisk.com/docs/fraud/metrics/) - Measuring fraud performance - [Risk Scoring](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring/) - Transaction scoring - [Processor Management](https://paymentsandrisk.com/docs/operations/processor-management/) - Acquirer relationships - [Subscriptions & Recurring](https://paymentsandrisk.com/docs/payments/subscriptions-recurring/) - Recurring billing rules - [Money Held or Frozen](https://paymentsandrisk.com/docs/operations/holds-and-reserves/) - Program consequences - [Chargeback Ratio Crisis](https://paymentsandrisk.com/docs/chargebacks/zero-point-nine-panic/) - Emergency response - [Reduce Chargebacks Fast](https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast/) - Crisis playbook