On 1 October 2026, two parts of the Reserve Bank of Australia’s (RBA) review of merchant card payment costs took effect. Merchants can no longer surcharge card payments on the eftpos, Mastercard, and Visa networks, and the caps on interchange fees for domestic card transactions came down. More changes follow on 1 April 2027.<\/p>\n
These are significant changes to the economics of card acceptance. They are not changes to card-not-present (CNP) authentication. For merchants, acquirers, and payment gateways, it is worth being precise about the difference, because the obligations that decide when a transaction must be authenticated with EMV 3D Secure (3DS) come from a different source and have not moved.<\/p>\n
The RBA’s Payments System Board concluded that removing surcharging, reducing interchange fees, and increasing fee transparency would be in the public interest. Most of the package took effect on 1 October 2026:<\/p>\n
Two further measures arrive on 1 April 2027: an interchange cap on transactions using foreign-issued cards acquired in Australia, and some changes to the information shown on merchant statements.<\/p>\n
The RBA’s published decisions cover surcharging, interchange, and fee transparency. They do not set requirements for how CNP transactions are authenticated. So the following are unchanged by the reforms:<\/p>\n
For most Australian merchants, the main industry obligation is the Australian Payments Network’s (AusPayNet) CNP Fraud Mitigation Framework, enforced through AusPayNet’s Issuers and Acquirers Community code. The framework sets fraud thresholds for merchants and issuers, and only requires strong customer authentication (SCA) where those thresholds are breached.<\/p>\n
As published by acquirers, the merchant threshold is breached in a quarter when CNP fraud exceeds both AUD 50,000 and a fraud-to-sales ratio of 0.2 per cent. A merchant over the threshold for two consecutive quarters is required to apply SCA to its non-exempt CNP transactions until it falls back below the threshold. The framework also sets a separate threshold for issuers. In practice, EMV 3DS is the usual way merchants meet an SCA requirement for card payments.<\/p>\n
Merchants should confirm the current thresholds and their own position with their acquirer, which reports fraud figures to AusPayNet each quarter. Our guide to 3D Secure for Australian merchants<\/a> covers the framework in more detail.<\/p>\n Although the reforms do not change authentication rules, they change the setting in which authentication decisions are made.<\/p>\n Every lost checkout now costs the merchant more directly.<\/strong> Merchants that used to recover acceptance costs through a surcharge now absorb them. That puts more weight on the whole cost of a sale, including transactions abandoned at a challenge or declined after failed authentication. It is a reason to look closely at challenge rates and the data sent in authentication requests, not a reason to switch authentication off.<\/p>\n Fraud thresholds still apply quarter by quarter.<\/strong> Merchants under cost pressure may be tempted to reduce friction aggressively. A merchant that pushes its CNP fraud above the AusPayNet threshold for two quarters will face an SCA requirement anyway. Risk-based use of 3DS, with good data quality so issuers can approve more transactions frictionlessly, is the more durable answer.<\/p>\n Checkout changes need testing.<\/strong> Acquirers and gateways removing surcharge logic from payment pages and integrations are changing live checkout code. Any change to a checkout flow is a moment to confirm the 3DS integration still behaves correctly, including challenge handling, timeouts and error paths.<\/p>\n Cross-border costs change in two steps.<\/strong> Merchants with significant volumes on foreign-issued cards will see domestic interchange changes now and the foreign-card cap from April 2027. Authentication behaviour for international cards depends on the issuer’s own market rules, which these reforms do not affect.<\/p>\n Did the 1 October 2026 reforms change 3D Secure requirements in Australia?<\/strong><\/p>\n No. The RBA’s decisions cover surcharging, interchange, and fee transparency. They do not set CNP authentication requirements.<\/p>\n When does the interchange cap on foreign-issued cards start?<\/strong><\/p>\n 1 April 2027, alongside some changes to merchant statement information.<\/p>\n When do Australian merchants have to use strong customer authentication?<\/strong><\/p>\n Under AusPayNet’s CNP Fraud Mitigation Framework, as published by acquirers, a merchant over the fraud threshold (more than AUD 50,000 and a 0.2 per cent fraud-to-sales ratio in a quarter) for two consecutive quarters must apply SCA to non-exempt CNP transactions. Confirm current thresholds with your acquirer.<\/p>\n Should merchants reduce 3DS use to offset the loss of surcharge revenue?<\/strong><\/p>\n It is risky. Higher fraud can push a merchant over the AusPayNet threshold and trigger an SCA requirement anyway. Improving authentication data so more transactions are approved frictionlessly is usually the better lever.<\/p>\nIndirect Effects Worth Watching<\/h2>\n
What Acquirers and Gateways Should Check<\/h2>\n
\n
Frequently asked questions (FAQs)<\/h2>\n
How GPayments can help<\/h2>\n