CARD Act · 2009
Fair billing rules
Rate limits, fee disclosure, payment timing. Applies to
all issuers regardless of size.
[1]
Durbin / Dodd-Frank · 2010
Interchange cap (debit)
Credit cards are exempt, but this set the political template for ongoing reform debates.
[2]
OCC · Fed · FDIC · CFPB
Prudential oversight
Larger banks face Basel III capital rules, stress testing, and direct CFPB exam authority.
01 The critical threshold
$10 billion in assets The dividing line
Above this: direct CFPB supervision under Dodd-Frank Section 1025, plus Basel III capital requirements. Below: lighter OCC or state-charter oversight.[3] This single number shapes a partner's compliance costs, product flexibility, and how hard they'll negotiate.
Large bank issuers
Chase · Citi · Amex · BofA · Barclays
Assets > $10B · CFPB-supervised · Basel III
>$10BAsset floor
CFPBDirect examiner
>80%Retail card issuance
Key obligations
CFPB direct exams, enforcement actions and real-time complaints review.
Basel III capital buffers, tighter credit risk limits per co-brand program.
Reg Z / UDAAP, universal rules; CFPB enforcement is fastest at this tier.
Network contracts, Visa and Mastercard rules apply. Amex runs proprietary economics.
Smaller bank issuers
Celtic · WebBank · First Electronic · Coastal
Assets < $10B · OCC or state charter · Lighter burden
<$10BAsset cap
OCC/StatePrimary regulator
FlexibleProgram structure
Key obligations
CFPB indirect, rules apply; exams run through OCC or state, not CFPB directly.
Lower capital reqs, fewer stress tests, more balance sheet flexibility.
Specialty charters, ILC, Utah, or Nevada structures enable non-standard products.
BaaS prevalence, often the infrastructure-layer bank behind a fintech program.
03 Merchant decision matrix
What you gain, and what you give up
Four dimensions every merchant should evaluate before signing an issuer agreement
Large bank partner
Massive existing cardholder base for day-one reach.
One of dozens of programs. Rigid templates, slow decisions.
Built-in underwriting, fraud ops, and servicing at scale.
Interchange terms favor the bank. Volume minimums sting.
"Chase-backed" or "Amex co-brand" drives consumer trust.
Bank owns spend data. Your access is limited by contract.
Strongest CFPB compliance posture, lowest regulatory risk.
New earn category or feature: expect 12 - 18 months to ship.
Smaller bank partner
Real negotiating leverage. You're a meaningful partner.
Smaller balance sheet limits credit lines and approval rates.
Faster to market. Custom earn rates and redemptions achievable.
BaaS intermediary layers add complexity and counterparty risk.
Spend-level data returned to merchant. Loyalty integration viable.
Lighter oversight: if the bank falters, your program is exposed.
Loyalty-native programs, like Bilt's 2026 move off Wells Fargo, show the model working.
[4]Low issuer brand recognition can hurt point-of-sale conversion.
Treat this as a snapshot of conditions as of August 2026, not a settled map. Issuer relationships, regulatory thresholds, and program economics shift with negotiation and rulemaking.
Choose large if…
Volume runs above $500M, national brand trust matters, and you can absorb slower product cycles. Think airlines, major hotel chains, national retailers.
Choose smaller if…
You're an emerging brand, loyalty-first, or you need flexibility and data access. Especially relevant in travel, hospitality, and fintech adjacents.
I write about this from the payments side of the issuer relationship, 15+ years across American Express, Fidelity, Starwood, and Wyndham. Let's talk. I'm always open to consulting projects, contract work, or Senior Management/Director level roles in travel and payments, and to advisory discussions on programs navigating topics like this.
Long description: co-brand credit card regulation infographic
Infographic by Spencer Allen (spencerdavidallen.com), August 2026. Title: "Co-brand cards: who regulates whom." Subtitle: U.S. credit card regulatory tiers and what they mean when choosing an issuer partner.
Regulatory framework (3 cards)
- CARD Act 2009: fair billing rules on rate limits, fee disclosure, and payment timing. Applies to all issuers regardless of size.
- Durbin/Dodd-Frank 2010: interchange cap on debit cards only. Credit cards are exempt but this set the template for ongoing reform.
- OCC/Fed/FDIC/CFPB: prudential oversight. Larger banks face Basel III capital requirements, stress testing, and direct CFPB exam authority.
Critical threshold
$10 billion in assets is the dividing line, per Dodd-Frank Section 1025. Above: direct CFPB supervision and Basel III capital requirements. Below: lighter OCC or state-charter oversight.
Large bank issuers (Chase, Citi, Amex, BofA, Barclays)
Assets above $10B. CFPB-supervised. Four large banks issue more than 80% of retail credit cards, per CFPB research. Obligations: CFPB direct exams; Basel III capital buffers; Reg Z/UDAAP with fast enforcement; Visa/Mastercard network contracts; Amex proprietary economics.
Smaller bank issuers (Celtic Bank, WebBank, First Electronic Bank, Coastal Community Bank)
Assets below $10B. OCC or state charter. Flexible program structure. Obligations: CFPB rules apply but exams run through OCC or state; lower capital requirements; specialty charters (ILC, Utah, Nevada); prevalence of BaaS infrastructure models.
Merchant decision matrix
Large bank pros: massive cardholder base; built-in underwriting, fraud, and servicing; consumer brand trust; strong compliance posture. Large bank cons: rigid templates and slow decisions; interchange terms favor the bank; bank owns spend data; 12 to 18 month product cycles.
Smaller bank pros: real negotiating leverage; faster to market with custom earn rates; spend data returned to merchant; loyalty-native programs like Bilt's 2026 move off Wells Fargo show the model working. Smaller bank cons: smaller balance sheet limits approvals; BaaS intermediary layers add risk; lighter oversight creates bank stability exposure; low issuer brand recognition at point of sale.
Strategic guidance
Choose large if: volume runs above $500M, national brand trust matters, and slower product cycles are acceptable (airlines, major hotels, national retailers). Choose smaller if: emerging brand, loyalty-first model, or data access and flexibility are priorities (travel, hospitality, fintech adjacents).