HIGH-RISKINDUSTRY
The debanking rule is in force. It does not cover your merchant account
P
Payment Review Editorial Team
Payment Review Editorial Team
If you run a business in a category banks are nervous about — firearms, CBD, adult, digital assets, debt relief, nutraceuticals, cash-intensive retail — you have probably seen the headlines saying debanking is over. A federal rule now bars two of the banking regulators from using reputation risk against the institutions they supervise, and from leaning on those institutions to close a customer's account over politics or a lawful line of business.
The rule is real, it is in force, and it is a great deal narrower than the coverage suggests. It binds regulators. It does not bind your bank, it does not bind your payment processor, and the party that decides whether you are still taking cards next month is usually neither of those. Here is what changed, what did not, and what a merchant should actually do with the difference.
On 7 April 2026 the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation issued a joint final rule, Prohibition on the Use of Reputation Risk by Regulators. It was published in the Federal Register on 10 April 2026 at 91 FR 18279 and took effect on 9 June 2026.
It prohibits the two agencies from criticising or taking adverse action against a supervised institution on the basis of reputation risk. It also prohibits them from requiring, instructing or encouraging an institution to close an account, to refrain from providing one, or to modify or terminate a product or service on the basis of a person or entity's political, social, cultural or religious views or beliefs, constitutionally protected speech, or solely on the basis of a lawful but politically disfavoured business activity.
The preamble is unusually blunt about why. The agencies wrote that supervisors trying to anticipate public reaction produced assessments that were nearly impossible to quantify with accuracy, and that there is no clear evidence supervisory interference of that kind ever protected banks from losses or improved their performance.
The National Credit Union Administration followed with its own final rule, published on 25 June 2026 and effective 27 July 2026; it had already stopped examining for reputation risk on 25 September 2025. The Federal Reserve is the outlier. It dropped reputation risk from its examination programmes in June 2025 and issued a proposal to codify that on 23 February 2026, published in the Federal Register on 26 February with comments due 27 April, but as of September 2026 the Board has published no final rule. On 2 June 2026 the three banking agencies jointly removed the remaining references to reputation risk from their shared interagency documents.
All of it traces to Executive Order 14331, Guaranteeing Fair Banking for All Americans, signed on 7 August 2025. The order gave the federal banking regulators 180 days to strip reputation risk out of their guidance, 120 days to review supervised institutions for past or current politicised debanking and take remedial action, and 180 days to review supervisory data for unlawful religion-based debanking and refer what they found to the Attorney General. The Treasury Secretary was given 180 days to produce a debanking strategy.
The order names payment processing in exactly one place, and the reach of that paragraph is narrow. Within 60 days the SBA had to notify every financial institution whose loans it guarantees that, within 120 days, each of them must identify clients denied access to payment processing services through politicised or unlawful debanking — but only where the denial violated a statutory or regulatory requirement under section 7(a) of the Small Business Act, or a requirement in a Standard Operating Procedures Manual or Policy Notice of the SBA's Office of Capital Access — and notify each of them of the denial and the renewed option to take the service. It runs through SBA lending institutions, it is tied to SBA programme rules, and it is not a rule about merchant accounts.
Commenters asked the agencies to extend the rule to banks' own conduct — to stop a bank choosing, with no regulator anywhere near it, to drop a customer over reputational discomfort. Other commenters asked for language confirming that banks keep their discretion. The agencies declined both, on the ground that the rulemaking is solely focused on the actions of the agencies and not on controlling or addressing the actions of supervised entities or other private parties. Both as proposed and as adopted, they wrote, the rule constrains only agency action.
So a bank that does not want your business still does not have to take it. What the rule removed is an excuse — the examiner in the background — not the discretion. If your account went away because an acquirer's risk committee decided the category was not worth the loss rate, nothing here speaks to that at all.
A merchant account is not a bank account, and your contract is usually not with a bank. Stripe's acquirer disclosure states that Stripe, LLC is a payment facilitator of six US acquiring banks: Cross River Bank, Deutsche Bank Trust Company Americas, Fifth Third Bank, Pathward, PNC Bank and Stripe's own MALPB entity. Dharma Merchant Services describes itself as a registered ISO/MSP of Synovus Bank. In both shapes a supervised bank sits somewhere in the chain. In neither shape is it the party you signed with, the party that underwrote you, or the party that will send the email.
The rule reaches the bank. It does not reach the payment facilitator, the independent sales organisation, the ISO's underwriting desk, or the risk model that flagged your dispute ratio overnight. That is the layer that closes merchant accounts, and it is regulated as a contract, not as a bank. That is as true of an aggregator account with Stripe, Square or PayPal as it is of a dedicated merchant account through an ISO.
Card network rules do, and the networks never dropped reputation risk. Visa's Ecosystem Risk Programs Guide, the October 2024 document setting out the acceptance risk standards acquirers are measured against, makes it a mandatory control for an acquirer to underwrite merchants in high-risk categories to confirm creditworthiness and that the business model aligns with the acquirer's own defined risk tolerance. The acquirer's tolerance — not a regulator's, and not a floor anybody sets for it.
The same standards require an acquirer to check its internal declined and terminated lists and an external terminated merchant file before finalising a contract, and set out a registration regime for acquirers that want to process what Visa calls high integrity risk categories at all: an application, a fee, a tier, and control assessments that can be repeated annually at Visa's discretion. The risk statement attached to that programme names financial losses, reputational damage and regulatory noncompliance as the harms the controls exist to prevent. Reputational damage is still on the list. It was never the regulators' word alone.
In practice, four things decide whether you keep your merchant account, and the OCC and FDIC rule touches none of them:
Three things, all of them indirect, and none of them a guarantee.
The practical moves have not changed much, but the leverage has shifted slightly in your favour.
We judge providers on published evidence only, and the specialists that serve restricted categories vary widely on underwriting, funding and what they will put in a contract. Our reviews of PaymentCloud, Durango Merchant Services, Soar Payments, Easy Pay Direct and eMerchantBroker set out pricing, contract terms and what each one discloses about reserves and holds, and the guide to high-risk merchant accounts sets them side by side.
The rule is a genuine change in how banks are supervised, and over time a supervisory climate does travel down the chain. But the executive order behind it says in terms that it creates no right or benefit enforceable at law by any party, and the rule itself reaches only the agencies. It is not a right of access, you cannot invoke it against a processor, and it will not reverse a single termination on its own. Plan for the underwriting, not the headline.
