The Card Network Rules Your Website Has to Meet Before It Can Take a Payment

Consider a fishing tackle shop in Westmeath. Thirty-odd years on the same street, a steady trade in rods, reels and fly-tying materials, and until this year a website that did little more than list the opening hours. The details are composite. The pattern is not.

The owner finally built a proper shop on the site, connected a payment provider, and took orders in the first week. Cards were charged. Confirmation emails went out. Parcels were packed.

Then the provider emailed. Account under review. Payouts held pending further information.

Nothing was wrong with the business. The stock existed, the orders were genuine, the customers were real. What triggered the review was the website, and the owner had no idea the website was ever part of the deal.

The review is of your website, not your business

Nobody explains this part when you switch payments on. Most providers let you start selling before underwriting is finished, then look properly at the account once money is actually moving. That is a commercial decision on their part, and it is why the problem always surfaces at the worst possible moment: after you have shipped goods and before you have been paid for them.

The review is not primarily about your accounts. It is about whether a stranger landing on your site can tell who they are buying from, what they are buying, and what happens if it goes wrong.

Stripe publishes its expectations openly, which is more than most do. Its website checklist asks for a description of what you are selling, the purchase currency, customer service contact information, your fulfilment policies covering refunds, shipping, returns and cancellations, any legal or export restrictions, a privacy policy, your business address, the terms of any promotions, and a clear statement about how card details are handled ^[1]. Stripe is explicit about the consequence, too. If a reviewer cannot work out what you sell, or cannot find a way to contact you, they will come back and ask.

So what does that mean at street level? It means the tackle shop's money sat with a payment provider for the better part of three weeks while suppliers were still expecting to be paid on their usual terms. Nobody had done anything wrong. The owner simply could not prove, from the website alone, that the shop was who it said it was.

What the card rules actually say has to be there

Your provider is not inventing this. It is passing on rules written by the card networks, and Visa publishes them in full.

Section 5.8.4.1 of the Visa Core Rules and Visa Product and Service Rules, in the edition dated 18 April 2026, states that an electronic commerce merchant website or application "must contain all of the following": a customer service contact including an email address or telephone number, a clear and prominent display of the country of the merchant outlet, the address for cardholder correspondence, and the policy for delivery of multiple shipments ^[2].

Two footnotes on that section apply specifically to the Europe Region, which is where an Irish shop sits, and both are easy to miss.

The first: where a merchant delivers goods or services outside its own country, "both a local and an internationally accessible telephone number must be provided". If you post to Britain or the continent, one Irish mobile number in the header is not enough. That is a small change with a real consequence, because a customer in Lyon who cannot ring you is a customer who rings their bank instead. It is worth reading alongside what a business phone number is actually doing on your website in the first place.

The second: in the Europe Region "a merchant or sponsored merchant must include the address of the merchant outlet". Not a PO box, not a contact form. An address.

That one lands hardest on people working from home, and it is worth being straight about why. The rules do contain a carve out for merchants operating primarily from a personal residence, but read where it applies: the AP, Canada, CEMEA, LAC and US regions. Europe is not on that list. An Irish trader running a shop from a spare room does not get to leave the address off, which is an uncomfortable answer, and the usual fix is a separate business address rather than a blank field.

The requirement almost every Irish shop gets wrong

Everything above is a content problem. The next one is a placement problem, and placement is where good-looking sites fail.

The country of your merchant outlet has to appear, in the words of the rule, either "on the same screen view as the checkout screen used to present the final Transaction amount" or "within the sequence of web pages that the Cardholder accesses during the checkout process". Then comes the sentence that catches almost everybody:

"A link to a separate web page does not meet this requirement."

Sit with that for a second. A tidy footer, present on every page of the site, containing the full trading address, still fails the test. The information has to be inside the checkout flow, not one click away from it. Most WordPress shops put it in the footer, because the footer is where every other legal detail lives, and the footer disappears the moment a customer is on a hosted payment page.

The practical version: your customer, mid-purchase, with their card in their hand, should be able to see what country they are buying from without going anywhere. That is the entire point of the rule. Cross-border card fraud thrives on ambiguity about who is being paid, and the networks decided the cheapest fix was to make the seller say so at the moment of payment.

Fixing it is not a redesign. It is a line of text near the order summary and, where your checkout supports it, in the confirmation step.

Your returns policy is not a footer link

The same logic runs through returns, and this is where a missing page stops being an administrative annoyance and starts costing money.

Section 5.4.2.5 deals with disclosure of return, refund and cancellation policies. If you restrict returns or cancellations in any way, the disclosure for an online shop must happen "during the sequence of pages before final checkout" and must "include a 'click to accept' button, checkbox, or other acknowledgement". A link to a separate page is allowed only where that link forms part of the click to accept acknowledgement and refers to the policy ^[2].

Linked is not the same as accepted. That distinction is the whole rule.

Now the part that matters when something goes wrong. One of Visa's dispute conditions for cancelled merchandise or services applies where the merchant "did not properly disclose or did disclose, but did not apply, a limited return or cancellation policy at the time of the Transaction". The same rule adds that in the Europe Region, distance selling contracts are "always subject to a 14-day cancellation period" ^[2].

Read that as a business owner rather than a compliance officer. A customer cancels. You point at your fourteen day window and your restocking terms. The issuer asks when the cardholder agreed to them. If the answer is that the terms were available in the footer, you are arguing from a weak position, and you will likely lose the money and the goods. The mechanics of how that fight actually runs are covered in more detail in what happens when a customer disputes a payment.

Agitation aside, the honest summary is short. The policy page protects you far more than it protects the customer, and only if it is acknowledged rather than published.

What the shop actually changed

The tackle shop's fix took an afternoon, which is the frustrating part. There was no development work in it.

They wrote the delivery terms out properly, including what happens when an order ships in two parcels because the reels are in stock and the waders are not. They wrote a returns policy in plain English and put a checkbox in front of it at checkout. They added the trading address and the country beside the order total instead of only in the footer. They added a second phone number for customers outside the State, and a monitored email address that a person actually reads. They wrote three or four sentences describing what a product is, rather than a manufacturer part code.

Then they replied to the provider with a link and a short note. The account came back. The pattern here is consistent: reviews resolve quickly once the information exists, and drag on while it does not.

If you are assembling those pages from scratch, most of them overlap with the set that Irish law asks for anyway, which is the sensible order to tackle them in. Regulation 7 of the European Communities (Directive 2000/31/EC) Regulations 2003 already requires your name, "the geographic address at which the service provider is established", and contact details allowing you to be "contacted rapidly and communicated with in a direct and effective manner" to be easily, directly and permanently accessible ^[3]. Our guide to the legal pages an Irish business website needs covers the statutory side in full.

One admission, since I am asking you to take my word on the sequencing. I once told an owner to switch payments on the afternoon their shop went live and to sort the policy pages the following week. The review email beat the policy pages by four days. I do not give that advice any more.

The other reason this is worth doing yourself is speed. When the review email lands, the difference between resolving it that afternoon and resolving it a fortnight later is usually whether you can edit your own site or have to book time with somebody who can. Being able to publish a returns policy the same day, on a site you control outright for sixty euro a year, turns a three week payout freeze into an inconvenience.

One thing this does not fix

Meeting every requirement on the list does not stop disputes. It changes what happens in them. You will still get the occasional customer who cancels late or claims a parcel never arrived, and the policy page does not make that go away. What it does is give you something to point at that the cardholder demonstrably agreed to, which is the difference between a dispute you can defend and one you cannot.

There is a second limitation worth knowing before you go looking for a definitive checklist. These are network rules interpreted by your acquirer, not statute, and two providers reading the same website can genuinely reach different conclusions about whether the description of your product is adequate. Where your provider publishes its own guidance, follow that rather than a generic list, because that is the document the person reviewing your account is working from.

Where none of this applies to you

Some of this is genuinely not your problem, and pretending otherwise would be a sales pitch rather than advice.

If you sell in person and take cards on a terminal, the electronic commerce rules above are not aimed at you. If you sell a modest number of items a year and would rather never think about a returns policy, selling through a large marketplace that acts as the merchant of record genuinely removes the obligation, because the marketplace carries it instead. You pay commission for that, and for a low volume seller the commission can be cheaper than the hours. That is a real trade, and for some businesses it is the right one.

The calculation changes when the volume grows, or when you want the customer relationship and the margin rather than a listing on somebody else's platform. At that point the obligations come back to you, and it is better to meet them on a site you own than to discover them during a payout freeze.

Conclusion

The tackle shop's website was not broken. It looked well, it loaded quickly, the products were listed properly. It simply never told a stranger the four or five things a payment provider is obliged to look for.

That is the useful lesson in it. The work is not technical and it is not expensive. It is an afternoon of writing plainly about who you are, where you are, how someone reaches you, and what happens if they change their mind, then putting those answers where a customer meets them rather than where a search engine files them.

Open your own checkout this week and go through it as a customer would. Whatever you cannot see from inside that flow is the part worth fixing first.

Frequently Asked Questions

Why did my payment provider put my account under review after I made sales?

Most providers let you start taking payments before underwriting is finished, then review the account once money is moving. The review covers your website as well as your business documents. Stripe publishes a website checklist listing what it expects to find, including a description of what you sell, the purchase currency, customer service contact details, fulfilment policies, a privacy policy and your business address. If a reviewer cannot find those things, the account can be held while they ask for them.

What do the card network rules require an online shop website to contain?

Section 5.8.4.1 of the Visa Core Rules requires an electronic commerce merchant website to contain a customer service contact including an email address or telephone number, a clear and prominent display of the merchant outlet country, the address for cardholder correspondence, and the policy for delivery of multiple shipments. In the Europe Region the rules add that the merchant must include the address of the merchant outlet, and that a merchant delivering outside its own country must provide both a local and an internationally accessible telephone number.

Is a link in my footer enough to show my business address and country?

Not for the country requirement. The Visa rules state that the merchant outlet country must appear either on the same screen view as the checkout screen showing the final transaction amount, or within the sequence of web pages the cardholder accesses during checkout, and that a link to a separate web page does not meet this requirement. A footer link on every page does not satisfy it, because the information is not inside the checkout sequence.

Does my returns policy have to be shown during checkout?

If you restrict returns or cancellations in any way, yes. Section 5.4.2.5 of the Visa rules requires disclosure during the sequence of pages before final checkout, with a click to accept button, checkbox or other acknowledgement. A link to a separate page is permitted only where that link forms part of the click to accept acknowledgement and refers to the return, refund or cancellation policy.

What happens in a chargeback if the policy was never properly disclosed?

It weakens your position. One of the Visa dispute conditions for cancelled merchandise or services applies where the merchant did not properly disclose, or disclosed but did not apply, a limited return or cancellation policy at the time of the transaction. The same rule notes that in the Europe Region an off-premises or distance selling contract is always subject to a fourteen day cancellation period. A policy the customer never acknowledged is difficult to rely on later.

Do these rules apply to a sole trader working from home?

The address requirement does. The Visa rules contain a carve out allowing a merchant that primarily operates from a personal residence to withhold the residence street address, but that carve out is written for the AP, Canada, CEMEA, LAC and US regions and does not extend to the Europe Region. Home based traders who would rather not publish a private address usually solve it with a separate business address rather than by leaving the field blank.

Is any of this the same as Irish law?

It overlaps heavily but the two are separate. Regulation 7 of the European Communities (Directive 2000/31/EC) Regulations 2003 already requires a service provider to make its name, the geographic address at which it is established, and contact details allowing rapid and direct communication easily, directly and permanently accessible. The card network rules are contractual rather than statutory, which in practice means they are enforced faster, because your provider can pause your money without going near a court.

Sources