Learn about the operational challenges and risks associated with compliance with payment networks like Visa and Mastercard and find out how to simplify this process and make it more manageable and efficient.

Scheme Compliance

The operations and compliance teams that live with scheme compliance understand the problem deeply. They know the workload. They know the risk. They know what a missed bulletin or an untracked penalty programme costs in time and accumulated exposure. What they rarely have is a framework for building a scheme compliance business case in the financial terms that move a board-level decision.

What executives look for in a scheme compliance business case

Scheme compliance teams already understand the operational importance of modernisation. They see the volume of scheme updates, the complexity of coordinating implementation across multiple functions, and the risks created by manual processes.

To secure investment, however, the business case must connect these operational realities to the financial measures used by management when prioritising initiatives. These typically include resource costs, financial exposure, revenue impact, operational efficiency, and time to value.

Workload and process complexity are important inputs, but they become more decision-relevant when translated into measurable business outcomes. Rather than focusing only on the number of bulletins received or the administrative effort involved, a strong business case explains what the current process costs, which risks it creates, which commercial opportunities may be missed, and how quickly those outcomes can be improved.

The most effective scheme compliance business cases therefore combine operational expertise with financial clarity. They give compliance, finance, operations, product, and management a common basis for evaluating the current state and deciding where modernisation can deliver the greatest value.

Four metrics that demonstrate the financial value of modernisation

 For an issuer monitoring updates across two or more major card networks, manual scheme compliance processes 

. This reflects only the time spent by the scheme compliance function. Each mandate or rule change typically involves additional stakeholders across product, operations, legal, technology, finance, and other functions, all of whom contribute time throughout the assessment and implementation process.

In high-wage markets such as Germany, the Netherlands, the UK, the US, Denmark, Norway, Finland, and Sweden, the fully loaded cost of a payments specialist represents a significant annual expense. This cost is not hypothetical; it is already being incurred. The key question is whether that investment is being used for manual administration or for higher-value work that applies specialist expertise to the business.

 Scheme non-compliance penalties often follow escalation structures in which initial violations may appear manageable, but the financial impact increases significantly if issues remain unresolved. For example, a penalty may start at $500 per month or per violation and escalate to as much as $100,000 per month as non-compliance persists.

Quantifying potential fine exposure based on the organisation’s current compliance posture gives management a clear financial measure that can support prioritisation and investment decisions. See our 

 for a more detailed explanation of how penalty programmes can escalate.

3. Revenue and fee optimisation opportunities.

 Payment networks continually expand their product and service portfolios and introduce changes to fees and interchange. Without a systematic process for reviewing these updates, issuers and acquirers may continue paying for unused scheme services or miss opportunities to optimise scheme fees.

Organisations that track these developments closely and act within relevant opt-out windows and implementation timelines are better positioned to avoid unnecessary costs and capture commercially beneficial changes.

 Every month of delay extends the period during which the organisation remains exposed to its current compliance gaps, associated penalties, and operational inefficiencies. The cost of delay is therefore both real and measurable.

A purpose-built scheme compliance platform that 

 can begin reducing these costs within a matter of weeks.

Every investment case needs a credible baseline. Before estimating the benefits of modernisation, the organisation should first quantify the cost, risk, and commercial impact of its current scheme compliance process.

The baseline should include the internal resources allocated to monitoring, assessing, distributing, implementing, and documenting scheme updates. It should also account for the time contributed by adjacent functions such as product, operations, legal, technology, finance, and risk.

In addition to resource costs, the analysis should identify current financial exposure. This may include known compliance gaps, open remediation activities, potential penalties, recurring manual controls, and any areas where the organisation lacks clear evidence of implementation.

The baseline should also consider commercial impact. Relevant questions include whether the organisation is paying for unused scheme services, whether fee changes are being identified and assessed consistently, and whether opt-out windows or revenue opportunities have previously been missed.

Finally, the organisation should calculate the cost of delay. Each additional month spent operating under the current model extends existing costs and risks while postponing the benefits of improvement.

Together, these measures provide a realistic view of the current state. They also create a clear reference point against which the financial impact of modernisation can be assessed.

Once the current-state baseline has been established, the findings should be translated into a concise investment case that management can evaluate quickly.

Turning the analysis into a clear investment case

The objective is not to document every operational detail. It is to present the most important financial and strategic considerations in a structured format.

A strong investment case should summarise:

Where possible, the model should distinguish between direct, quantifiable benefits and broader strategic benefits. Direct benefits may include reduced manual effort, avoided fees, reduced penalties, and lower external support costs. Strategic benefits may include stronger oversight, improved auditability, greater implementation consistency, and better cross-functional coordination.

The final business case should make the comparison clear: the cost and risk of maintaining the current process versus the expected cost and value of modernisation.

This gives management the information needed to assess the initiative alongside other investment priorities.

Aligning compliance, finance, and management

A well-structured scheme compliance business case is more than an approval document. It creates a shared framework for compliance, finance, operations, product, technology, and management.

For compliance teams, it translates operational challenges into measurable business impact. For finance, it provides a clear view of cost, risk, and expected return. For management, it establishes the strategic rationale, implementation requirements, and expected time to value.

This shared framework also improves accountability after a decision has been made. The same metrics used to justify the investment can be used to measure its impact following implementation.

For example, the organisation can track reductions in manual effort, faster assessment times, improved implementation oversight, avoided fees, reduced financial exposure, and increased visibility across scheme obligations.

By agreeing on these outcomes in advance, the business case becomes a practical tool for both investment evaluation and performance measurement.

How Kajo supports measurable scheme compliance outcomes

 gives scheme compliance teams a structured view of card network updates, obligations, implementation timelines, financial exposure, and commercial opportunities.

Instead of relying on fragmented emails, spreadsheets, and manual tracking, teams can centralise relevant scheme information, assess its impact, assign responsibilities, and monitor implementation progress in one place.

This helps reduce the administrative effort associated with monitoring and coordinating scheme changes. It also gives stakeholders across compliance, product, operations, finance, and management greater visibility into upcoming obligations and their potential business impact.

By connecting scheme updates to deadlines, affected areas, financial implications, and implementation activities, Kajo helps organisations evaluate scheme compliance using shared and measurable criteria.

The result is not only a more efficient compliance process, but a stronger basis for managing risk, identifying cost and revenue opportunities, and demonstrating the value of scheme compliance modernisation.

Learn how to quantify the value of scheme compliance modernisation by evaluating operational costs, financial exposure, revenue opportunities, and time to value.

How to get your management to say yes to process modernisation.jpg

How to quantify the value of scheme compliance modernisation

In-depth guides, eBooks, and industry reports to help payments professionals navigate compliance, disputes, and what's next in card payments. Download and read at your own pace.

Guides & Reports

In the financial sector, particularly within card payment operations, the volume of scheme communication is accelerating faster than most teams can process it. With Visa and Mastercard publishing approximately 

, banks and issuers are working within an operational model that no longer fits the workload it was built for.

The implications go far beyond the compliance team. Manual portal pulls, spreadsheet tracking, and email distribution drive up costs, absorb skilled capacity, and leave organisations exposed to missed mandates, unnoticed fee changes, and audit findings. These are costs that ripple into product roadmaps, IT timelines, risk exposure, and customer operations.

the hidden cost of scheme compliance complexity

, drawing on insights from leading issuers and acquirers and real-world experience from the 

 platform. It helps banks and payment operations leaders understand the hidden costs they're already paying, why non-compliance is rarely one large visible event, and how the right operating model breaks the link between rising bulletin volumes and increasing staffing requirements.

The shift underway redefines scheme compliance as a leadership decision about how the bank scales. Issuers that get ahead will decouple compliance capacity from staffing levels, while those that delay will keep paying a cost that grows quietly until a missed deadline makes it visible.

This white paper reframes scheme compliance as a leadership decision, quantifying the hidden costs of capacity drain, delivery drag, and missed mandates. It offers a maturity model and self-assessment to help banks turn compliance from a drag on the business into a source of advantage.

Hidden cost of scheme compliance complexity

Hidden cost of scheme compliance complexity.jpg

The hidden cost of scheme compliance complexity

Learn about the operational challenges and risks associated with the fraud & dispute process for banks and explore strategies and best practices benefitting both banks and their cardholders.

Fraud & Disputes

 (Issue 1298, published December 2025), card fraud cost the global payments industry $33.41 billion in 2024. The good news: as a share of total card volume, the fraud rate is trending down, dropping to 6.43¢ per $100 in 2024, continuing a multi-year decline. It's a sign that the industry's investments in fraud detection and prevention are paying off, even as transaction volume keeps climbing. 

But that’s only part of the story. Card volumes reached $51.92 trillion in 2024, and the Nilson Report now projects that they will climb to $70.73 trillion by 2030. Because of this relentless volume growth, absolute losses remain significant even as the fraud rate falls, with losses projected to reach $41.06 billion by 2030. For issuing banks, the financial and operational burden remains as heavy as ever.

Fraud isn't disappearing. Instead, it's evolving and shifting the pressure elsewhere.

The imbalance is especially clear in the United States. While cards issued in the US represent just 26% of global card volume, they account for nearly 42% of global fraud losses, which totalled $13.99 billion in 2024.

As chip-and-PIN technology locked down in-store transactions, fraud migrated online. And online, the US remains the most exposed market in the world, because of the highest credit lines, the deepest e-commerce penetration, and historically, lighter real-time authentication requirements.

The industry has responded with 3D Secure, tokenisation, authentication protocols, and AI-powered fraud detection, all of which now run on virtually every major card network. And it's working. For the first time in years, the losses-to-fraud trend line is heading downward.

Artificial intelligence has changed the fraud landscape on both sides. As highlighted in the Nilson Report, fraud fighters were the first group among payment card industry professionals to deploy artificial intelligence technology, and they continue to be the first adopters of every relevant AI iteration to counter emerging criminal tactics.

But so are the fraudsters; they have caught up quickly. AI now enables them to replicate merchant websites with near-perfect accuracy, launch large-scale phishing campaigns, and harvest card credentials.

Social engineering attacks have become sophisticated enough to bypass even the most hardened technical controls. Fraudsters build convincing storefronts, launch targeted phishing campaigns, and replicate legitimate platforms with near-perfect accuracy. The vulnerability has moved from the network to the account holder.

That shift is accelerating: our white paper, 

, examines how agentic commerce is impacting dispute scenarios and processes.

As technical defences have hardened, a different threat has grown in scale. First-party fraud, sometimes called friendly fraud, occurs when the account holder disputes a legitimate transaction. No stolen credentials, no compromised card, just a real customer, claiming they didn't make a purchase they did.

Unlike third-party fraud, it bypasses conventional detection entirely. It doesn't surface at login or authorisation, but shows up weeks later in dispute operations, where teams were never designed to carry that load.

The scale is now impossible to ignore. Industry findings published in the 

 reveal that first-party fraud remains the dominant threat layer globally, accounting for nearly two-in-five (38.3%) reported fraud cases. Because these specific cases are initiated by legitimate account holders utilising their actual transaction history and credentials, they remain virtually indistinguishable from genuine dispute claims until operations teams run a detailed investigation.

That's the core problem: fraud detection tools are built to catch anomalies at the point of transaction, and first-party fraud leaves none. The signal only emerges later, buried in dispute patterns, cardholder history, and behavioural data that most operations teams don't have the time or tools to piece together at scale.

Detection has never been better. But detection alone doesn't resolve a case, and resolution is where the cost is being felt. First-party fraud makes this harder still: it arrives in dispute queues dressed as a legitimate claim, invisible to the detection layer that was supposed to catch it.

For most issuing banks, what happens after a transaction is flagged determines the real cost of fraud. And right now, that process is under strain.

Case volumes are rising with transaction growth, but investigation processes weren't built to scale with them. Systems across fraud, disputes, and compliance teams remain fragmented, creating delays at every handoff. And regulatory expectations around KYC and KYB continue to tighten, adding compliance overhead to teams already stretched thin.

The pressure is showing up clearly in the data: according to 

, an overwhelming 67% of financial institutions and fintechs reported that fraud rates rose over the preceding year, with 22% losing over $5 million directly to these fraud tactics. This operational and financial strain proves that legacy frameworks are buckling under current transaction weights, well before the next wave of commercial volume fully arrives.

Why the next gains will come from operational scale

Looking ahead, the challenge becomes even clearer. According to the Nilson Report, global card volumes are projected to exceed $84.75 trillion by 2034, with fraud losses reaching $48.5 billion, which is a cumulative $407.6 billion in fraud losses over the next decade. 

Even as the industry successfully drives down the overall fraud rate, the sheer scale of transaction growth ensures that total losses, and the resulting dispute queues, will remain significant. For issuing banks, incremental improvements in detection will not be enough to offset this growth.

The next phase of fraud prevention will depend on the ability to scale operations effectively. That means:

Rethinking how fraud operations are built

This sets up the need for a more intelligent approach to fraud operations. 

Forward-thinking issuers are investing in platforms that streamline end-to-end management of fraud cases. The objective is not only to improve the customer experience for valid claims but also to reduce operational friction, improve investigator productivity, and ensure consistent outcomes across large volumes of cases.

Automated dispute workflows are already delivering on this in practice, cutting friendly fraud losses by 40-50% while compressing resolution timelines from weeks to a single day (see our analysis of 

, was built specifically to bring intelligence and automation to fraud and dispute operations. 

The impact of an intelligence fraud and dispute operation goes beyond efficiency. It directly affects loss reduction, customer experience, and an issuer’s ability to keep pace with evolving fraud threats. Without the right infrastructure, banks cannot turn case-level signals into scalable fraud intelligence.

Global card fraud losses are set to climb to $41 billion by 2030 even as fraud rates fall, driven by relentless transaction volume growth and the rise of first-party fraud. As AI strengthens both fraud detection and fraudster tactics, issuing banks face mounting pressure in dispute operations that weren't built to scale. This piece explores why the next wave of loss reduction will come from automating and modernising fraud and dispute workflows, not just better detection.

Why dispute management is the next frontier in fraud fighting

Why dispute management is the next frontier in fraud fighting.png

Most global industry coverage of Strong Customer Authentication (SCA) treats card issuers as passive components in an ecosystem, shaped by merchants and acquirers: who must support 3DS, which merchant categories cause the most step-up friction, and who carries liability when authentication fails.

This view is operationally incomplete. Issuers are decision-makers. They approve or reject an authentication request, accept or refuse a delegated SCA claim, and hold the scheme obligations that govern how all of this is configured. Right now, those obligations are mid-transition: some deadlines have already passed and are now a question of whether your bank is compliant, others arrive across the rest of 2026.

This is a structured account of both: the requirements you should already have in place, and the ones still coming.

Regulation sets the rule, Visa sets the implementation

SCA under PSD2 requires at least two of three factors: something the cardholder knows, has, or is.

What has changed is the scheme infrastructure Visa expects issuers to support to remain compliant: the programs they must participate in, the flows their Access Control Server (ACS) must process, and the certifications they must hold. The distinction matters because a bank can meet the PSD2 mandate while falling out of step with the Visa scheme rules that govern how that mandate is implemented. Compliance is never a static target. 

The authentication landscape is undergoing its biggest revision since EMV 3D Secure. Visa's Digital Authentication Framework (DAF) 3DS program, which records an authenticated payment credential relationship between a card number and a registered merchant at the network level, requiring issuers to approve subsequent authentication requests for that combination without prompting the cardholder to re-authenticate, sunsets in September 2026.

This is a confirmed rulebook change. After that date no new participants will be accepted. Issuers with card ranges enrolled in DAF 3DS should confirm which ranges are affected, prepare to de-enrol those ranges ahead of the September 2026 close, and consider cardholder communication where cardholders have come to expect frictionless behaviour at enrolled merchants.

Only the current 3DS-based routing is ending. The Visa Token Service (VTS) DAF program is unaffected. The principal succession path Visa points issuers toward is the Visa Payment Passkey (VPP) service.

Visa Payment Passkey: Issuer participation requirements

Visa Payment Passkey (VPP) is a FIDO-based, device-bound authentication method built on public-key cryptography. The private key stays on the cardholder's device and is never transmitted across the network.

The relevant compliance point is the issuer participation requirement. Issuers are required to offer enrolment and management of passkeys through their own digital channels, which requires integration with 

, involving native enrolment, secure credential binding and lifecycle management (issuance, device binding, revocation) in your banking app, and an ACS updated to consume, validate, and store FIDO attestations inside the authorisation window.

The deadline is regional, and the two halves now sit on opposite sides of the line. VPP Support and Liability requirements take effect 18 April 2026 for the Europe Region and the AP Region (confirm the full exclusion list against your Visa Online agreement, as the definitive carve-outs are set out in the restricted implementation guides rather than the public rulebook), and 24 October 2026 for the Canada, CEMEA and LAC Regions (LAC excludes Chile). For Europe and AP issuers, this is now a current obligation to evidence, not a future one to prepare for.

Ingesting enriched risk telemetry via DCAP

DCAP and VPP were released as one rule pair (Visa Core Rules) on the same two effective dates: 18 April 2026 for Europe and AP, 24 October 2026 for Canada, CEMEA and LAC. DCAP also launched in the US on 18 April 2026.

Most coverage frames DCAP as a merchant program. The issuer angle is less visible but operationally important: DCAP passes enriched transaction signals through Visa's network to issuers during authorisation, so they can make more informed authorisation decisions in flows where no 3DS challenge has been triggered. The payload typically includes device identifiers, IP address, full billing address and email address.

For the issuer, the compliance and operational requirements are:

Eligibility governance for delegated authentication

Visa's Delegated Authentication program lets qualifying merchants run the primary SCA verification path themselves, under an explicit contractual agreement with the issuer. The merchant submits confirmation via the 3DS flow that SCA was performed, and the issuer accepts the claim. However, this delegation does not absolve the card-issuing bank from final security oversight.

To satisfy regulatory review, three structures must be formally documented and governed:

For issuers in Europe, the requirements carry additional regulatory weight given the PSD2 framework, but the Visa scheme obligations apply across all regions, and non-compliance carries the standard range of Visa enforcement consequences.

Visa periodically updates the test cases that issuers must certify against. Falling behind on certification can mean your ACS is processing authentication requests against outdated parameters, which is a compliance exposure even when the system looks like it is working.

How issuers miss deadlines they were notified about

. Yet issuers still miss effective dates and absorb non-compliance fees.

The failure mode is operational latency: a bulletin is received, acknowledged, and queued, then takes weeks of cross-department assessment just to identify which system is affected. By the time resources are assigned, the timeline has collapsed into last-minute configuration.

The surface is large. A VPP requirement needs input from digital banking, the ACS vendor, the risk-engine team and potentially core banking, yet the compliance team that spots the deadline is rarely the team that implements it. Issuers tracking bulletins through spreadsheets, email forwarding and shared inboxes run this with the most friction and the least auditability. It is the same gap that catches issuers out on 

A compliance checklist for issuer authentication obligations

Not exhaustive, but it covers the items most likely to be either live and unverified or still in progress. Treat the passed deadlines as items to evidence, the future ones as items to plan.

Digital Commerce Authentication Program (DCAP)

Digital Authentication Framework (DAF) sunset and Visa Secure / CE3.0

PSD3 is still moving through the EU legislative process, with application not expected before 2027 at the earliest. The direction of travel is clear: stronger authentication, higher data-quality standards, and more specific issuer obligations. The changes Visa is making now (passkeys, DCAP, the DAF sunset) are the scheme infrastructure that will underpin it. Issuers behind on this wave will face a compounding catch-up problem as PSD3 lands.

To remove this structural latency and protect your operations from unexpected fees, you have to address the root causes: manual checks of payment network updates, spreadsheet tracking, and emailing stakeholders for feedback.

 gives issuing banks an automated way to manage scheme compliance obligations as they arrive, converting Visa, Mastercard, and other primary networks' bulletins into actionable internal tasks, routing them to the right stakeholders while maintaining a clear audit trail. It ingests, filters, and interprets weekly updates, surfacing the bulletins that affect your specific portfolio.

See how card issuers use Kajo to minimise oversights, streamline bulletin coordination, and secure audit readiness across every mandate.

Mapping Visa's scheme rules to functional network operations: the DAF 3DS sunset, Visa Payment Passkey, DCAP data consumption, Delegated Authentication governance, and CE3.0.

SCA and Delegated Authentication issuer compliance check for 2026

SCA and Delegated Authentication issuer compliance check for 2026.jpg

SCA and Delegated Authentication: An issuer compliance check for 2026

In the financial sector, particularly within card payment operations, the pace of structural change is accelerating faster than most back offices can adapt. With global chargeback volumes projected to reach 324 million by 2028  (Source: 

)  and AI agents poised to reshape how payments are initiated, banks and card issuers are facing a fundamentally new kind of operational pressure.

The implications go far beyond managing today's dispute volumes. Manual processes and fragmented transaction data drive up costs, slow resolution times, and leave issuers exposed to an entirely new taxonomy of machine-initiated disputes that existing reason codes simply weren't built to handle.

Our experts have developed the white paper on navigating 

, drawing on insights from leading issuers and real-world performance data from the Amiko platform. It helps banks and issuers understand what's changing, what it will cost them if they don't act, and how autonomous dispute management can break the link between rising volumes and increasing resource demands.

The shift underway redefines how disputes are generated, interpreted, and resolved. Institutions that adapt early will decouple operational scale from staffing levels, while those that delay will find their cost base expanding faster than their control over it.

As AI agents begin transacting on behalf of consumers, issuer dispute operations face a structural break. Learn how agentic commerce is reshaping chargeback volumes, evidence standards, and back-office economics, and what it takes to keep pace.

Disputes in the age of agentic commerce.jpg

White paper: Disputes in the age of agentic commerce

See how leading card issuers leveraged Rivero's solutions to automate scheme compliance and dispute management. Customer success stories from banks and fintechs that have simplified their payment operations.

Success Stories

 MultiSafepay, a leading European payment service provider (PSP) and acquirer offering an all-in-one, end-to-end payment solution for online and in-person businesses. 

 Managing a growing volume of payment network mandates across multiple schemes, with updates spread across hundreds of bulletins and a need for greater structure, visibility, and ownership across the compliance function.

 as a centralised compliance intelligence platform brought all scheme knowledge into one place, ensuring accuracy in fee estimations and filing. Thanks to automated filtering, Kajo became the digital repository for all scheme knowledge, task history, and audit trails of who reviewed what and why. 

 Greater governance, reduced key-person dependency, simpler onboarding, and a structured compliance function built to scale with growing mandate volumes.

The Challenge: Scaling scheme compliance in a fast-growing business

For a payment service provider operating at MultiSafepay's scale, staying on top of scheme compliance is a strategic priority. Every month, Visa, Mastercard, and other payment networks publish dozens of bulletins containing technical updates, fee changes, and regulatory mandates. As transaction volumes grow, so does the complexity of tracking and implementing those updates accurately and on time.

For the team responsible for keeping up, scheme bulletins were coming in from multiple networks, and keeping pace with the volume while maintaining accuracy was becoming increasingly difficult.

"Before Kajo, keeping pace meant regularly reviewing scheme bulletins and relying on direct Mastercard and Visa touchpoints to surface the most relevant updates, a process that became harder to sustain as volumes and mandate complexity grew."

As volumes grew, so did the need for a more structured approach, one with clearer ownership, continuity, and a single source of truth for the whole team.

As MultiSafepay's acquiring business grew, expanding its merchant portfolio and processing volumes, the compliance workload grew with it. More schemes, more bulletins, more regions.

The team recognised that they needed a platform-driven approach, one that would give them better visibility, clearer ownership, and the ability to scale with the business.

The Solution: One platform, full visibility

, the first and most immediate benefit was the most impactful: all Visa and Mastercard bulletins, in one place.

"With Kajo, we have all bulletins from payment networks in one platform. We can filter what's relevant, track where things stand, and assign tasks to the right people."

Kajo gave the compliance team a centralised dashboard where every payment network update could be filtered, tracked, and followed through to completion. Tasks could be assigned to specific users, and the status of every mandate was transparent, not just to the person working on it, but to managers and cross-functional stakeholders.

Kajo has also changed the paradigm of MultiSafepay's compliance function. Where the team once had to piece together mandate status across multiple sources, they now operate ahead of the curve, identifying relevant updates early, assigning them to the right people, and tracking them through to implementation.

In the early days, there was a learning curve with Kajo. But with consistent support from the Rivero team, adoption deepened over time. 

"We received a lot of assistance from the Rivero team. By using and consulting the Kajo platform more often, we got comfortable with it. Right now, it's much easier to allocate users to tasks, to manage and follow up on everything."

The Results: Scalability, control & confidence

The impact of Kajo has been both operational and strategic. The most tangible result is a compliance function that operates with clarity and control. Automated filtering and task assignment have significantly reduced the need for manual follow-up across the team.

Where updates were once difficult to oversee at scale, every mandate is now assigned, monitored, and audited end-to-end, giving both the compliance team and management full visibility into what has been reviewed, by whom, and when.

As mandate volumes continue to rise, the platform proves its value as a force multiplier, keeping the compliance function firmly ahead of the curve. 

"Without Kajo, we would have needed significantly more people to control everything across each scheme and follow changes through until the moment they are technically implemented."

The platform removes the linear relationship between regulatory volume and staffing. MultiSafepay can now absorb a growing mandate load without proportional team expansion, turning compliance into a function built to scale with the business.

Discover how MultiSafepay centralised 100% of Visa and Mastercard bulletins into a single platform using Kajo, establishing end-to-end mandate ownership and audit transparency, and enabling their compliance function to scale with business growth.

How MultiSafepay turned scheme compliance into growth multiplier with Kajo

How MultiSafepay turned scheme compliance into growth multiplier with Kajo.jpg

How MultiSafepay turned scheme compliance into a growth multiplier with Kajo

Payment scheme fees rarely arrive with a warning, instead appearing as a line item weeks or even months after the bulletin that announced them. By then, the operational window to intervene has long closed. The decision that triggered the charge happened in a previous quarter. And your next billing cycle is already accumulating the same exposure.

This is the structural issue with scheme compliance: the financial consequences of oversights are almost always visible after the fact.

Payment networks use a range of monitoring programs to manage network integrity and incentivise compliance across their members. Two of the most financially consequential are the 

. Both share a defining feature: the billing lag.

Under VAMP, which tightened its fraud-to-sales ratio threshold from 2.2% to 1.5% in April 2026, 

 per qualified card-not-present (CNP) fraud or dispute notification once a portfolio crosses that line. EFM fines start at $500 per month but escalate to $100,000 per month as violations continue. The activity triggering these charges typically precedes the invoice by one to three months.

For a compliance team managing dozens of active bulletins, this is a fundamental information architecture challenge, and the organisation is being held financially accountable for decisions made months before the consequences surfaced.

Scheme rules are updated continuously. Visa and Mastercard publish bulletins throughout the year: amendments, clarifications, new program criteria, threshold adjustments. Each bulletin may contain fee schedules, eligibility changes, opt-in/out or compliance windows that directly affect your exposure. See our 

 covering how to structure the process of operationalising bulletin updates at scale.

The challenge is not access to these bulletins, as most compliance teams receive them. The challenge is operationalising them. Knowing that a threshold has changed is not the same as understanding what that change means for your current portfolio, and surfacing the information to the people who need to act on it in time before the deadline.

The time between a bulletin publication and a compliance team analysing its financial implications and sharing it with the impacted teams can stretch into weeks. In a process where the billing lag can run on a one to three month cycle, that is a margin that rarely gets compressed.

Consider what happens when a compliance team receives an unexpected compliance penalty or network charge. The first response is investigation: which transactions qualified, under which program, during which period. That period is often six to ten weeks prior. Operational decisions have already been made or not made. The data is historical. The fees, regardless of what the investigation reveals, have been assessed.

Some issuers or acquirers respond by building manual early-warning systems: spreadsheets tracking dispute rates by merchant, periodic sampling of transaction volumes, and monthly reviews designed to approximate what scheme monitoring programs already know. These systems are better than nothing. However, they are also resource-intensive, difficult to maintain, and dependent on individual knowledge rather than on the organisation as a whole.

The more sustainable response is to close the information gap before it becomes a billing event, which requires knowing, close to the moment a rule changes or a new mandate is published, what that change means for your specific portfolio.

There is a tendency across the industry to treat non-compliance costs as a cost of doing business: necessary, unavoidable, and primarily reactive. Fines and fees are built into budgets, audit cycles are scheduled in advance, and remediation plans are typically developed only after charges have been assessed.

The financial logic of that model is increasingly difficult to justify. When EFM escalations reach $100,000 per month, and VAMP charges compound across a high-volume CNP portfolio, reactive compliance does not reduce costs, it merely defers the discovery of costs.

Tools that surface the financial impact of a bulletin at the point of publication rather than at the point of invoice shift the operational model. When a compliance team can see, in the week a bulletin is released, what a new threshold means for their current dispute rate, they have an actual decision window. Not a retrospective one.

 surfaces bulletin-level financial impact alerts as each new scheme publication is released, including opt-in/opt-out fee exposure alongside the underlying compliance requirement so the question of "What does this cost us?" gets answered before the billing cycle closes.

Scheme fees are not arbitrary. They result from a defined set of conditions that can be understood and anticipated. The relevant thresholds are publicly available, billing cycles are clearly documented, and the monitoring programs are designed to operate with transparency.

What is your current lag between a scheme rule change and your team detecting its financial exposure for your portfolio? If the answer is measured in weeks, the billing window may already be closing.

Payment scheme fees arrive months after the violation and get absorbed as processing costs. Here's why issuers miss them – and what proactive looks like.

The scheme fees you are not tracking are already costing you

The scheme fees you are not tracking are already costing you.jpg

The cost of a dispute does not go down when your team gets better at handling it. That sentence contains the CFO and CEO problem with dispute management.

Dispute management costs grow with your portfolio, no matter how good your team gets. Learn how zero-touch automation cuts friendly fraud losses by 40–50%, compresses resolution timelines, and breaks the linear relationship between card volume and headcount.

Blog