ISO Industry Update: Regulations & Compliance

The Payment Card Industry Data Security Standard has undergone a significant philosophical shift with version 4.0 (and the 4.0.1 revision published in June 2024), whose future-dated requirements became mandatory on March 31, 2025. The traditional model of annual assessment and point-in-time compliance has given way to an expectation of continuous monitoring — organizations are now expected to demonstrate ongoing compliance posture rather than passing a periodic audit.

Multi-factor authentication requirements have been expanded under the new standard, now applying to a broader set of access scenarios including non-console administrative access and remote access to cardholder data environments. Organizations that relied on legacy single-factor authentication for certain privileged access scenarios will need to remediate those configurations.

In the absence of comprehensive federal privacy legislation, a growing number of US states have enacted their own consumer data privacy laws. As of mid-2025, 19 states have comprehensive privacy statutes in effect or taking effect imminently. While many of these laws share structural similarities with the California Consumer Privacy Act, there are meaningful differences in scope, exemptions, and enforcement mechanisms.

For payment processors and ISOs that handle consumer data across multiple states, the patchwork creates operational complexity. A single compliance program designed around the most stringent requirements provides the simplest path forward, but organizations must verify that their approach actually satisfies each state's specific requirements rather than assuming uniformity.

Anti-money laundering compliance has been strengthened significantly with the implementation of the Corporate Transparency Act and enhanced know-your-business (KYB) requirements. The CTA requires most US companies to report beneficial ownership information to FinCEN, creating new onboarding data requirements for payment processors and ISOs that must verify this information as part of their compliance programs.

Enhanced KYB standards require more thorough verification of business customers at onboarding — going beyond basic entity verification to confirm ownership structure, beneficial owners, and the nature of the business activity. For ISOs with large merchant portfolios, updating onboarding workflows to meet these requirements is a significant operational undertaking.

The FinCEN Beneficial Ownership Registry, established under the Corporate Transparency Act, represents a significant new data resource for AML compliance. Payment processors and ISOs that previously struggled to verify ownership structures through publicly available sources can now access the registry as part of their customer due diligence processes.

Integration with the registry — whether directly or through compliance data providers — should be a near-term priority for organizations that conduct KYB on business customers. The registry is not a silver bullet for KYB, but it substantially improves the reliability of beneficial ownership verification compared with relying solely on self-reported information.

Surcharging rules and Durbin Amendment interpretations have continued to evolve in 2025, with ongoing litigation and regulatory guidance creating uncertainty in some areas. The basic framework — ISOs and merchants can apply surcharges for credit card acceptance subject to card-brand rules and state law restrictions — remains in place, but the specific compliance requirements vary meaningfully by jurisdiction and card type.

The Durbin Amendment's routing mandate for debit transactions has been the subject of new guidance, particularly around card-present and card-not-present transaction routing. ISOs advising merchants on surcharging programs should ensure they are working from current guidance rather than assumptions based on older interpretations.

The common thread across these regulatory developments is the increasing expectation of continuous, automated compliance rather than periodic manual review. Organizations that have invested in compliance automation — automated KYB workflows, continuous PCI monitoring, real-time transaction screening — are better positioned to absorb regulatory changes without proportional increases in compliance cost.

ISOs and payment professionals should engage qualified compliance counsel to assess their current posture against the specific requirements described in this update. The cost of proactive compliance investment is consistently lower than the cost of remediation after a finding or enforcement action.