Credit Card Act compliance guide for card issuers

The Credit Card Accountability Responsibility and Disclosure (CARD) Act of 2009 is an amendment to the Truth in Lending Act that fundamentally changed the rules for open-end credit. For card issuers, banks, credit unions, and fintechs launching credit card programs, CARD Act compliance is not optional. Violations carry regulatory enforcement risk and civil liability.

This guide covers the key CARD Act requirements, what they mean for card issuers in practice, and how modern credit platforms help you meet them by default.

What did the CARD Act change?

Before the CARD Act, card issuers had significant latitude to raise rates retroactively, charge fees without adequate notice, and market cards to college students without income verification. The CARD Act restricted all of these practices. It introduced mandatory advance notice for rate increases, limits on fees, new statement timing requirements, and protections for consumers under 21. For card issuers, it shifted the compliance burden from reactive to proactive — you now have to build disclosures, notice workflows, and fee structures into your product design from the start, not after the fact.

CARD Act Requirements

• Credit card issuers must give their card holders written advance notice of any increase in APR or any other “significant changes” to their account at least 45 days prior.
• In general, a creditor cannot change the terms for repaying an outstanding balance or increase any APR, fee, or finance charge to a credit card account outside of certain exceptions.
• Creditors are prohibited from practicing double-cycle billing or placing penalties for on-time payments.
• A consumer must opt-in to over-the-limit transactions before a creditor can allow such a transaction and charge an over-the-limit fee to the consumer.
• If a consumer makes payment over the required minimum amount, the creditor must allocate the excess of the payment in a specific manner.
• For any credit card plan that is generally offered to college students, the amount of fees can’t exceed 25% of the credit limit in effect at account opening (not including late payment, over-the-limit, or returned-payment fees) in the first year of the account.
• Card issuers must deliver a periodic statement at least 21 days before the payment is due, and the payment due date must be on the same date every month.
• Creditors can’t open or increase the limit of any credit card account unless they have considered the consumer’s ability to make the required payments.
• A creditor must provide consumers with a disclosure regarding details of the payoff timing and amounts for their balance, and the deadline after which a late payment will have a late fee, charge, or other penalty imposed.
• Credit cards and other open ended credit plans cannot be opened for consumers under the age of 21 unless the underage consumer has a cosigner or submits financial information that indicates an independent means of repaying any ensuing obligation.

LoanPro Solutions

Keeping in line with those requirements can be difficult on legacy systems, but LoanPro’s credit and loan management software has configurable, modern tools that can keep you compliant by default.

• LoanPro allows you to sort loan and line of credit accounts into portfolios based on specific criteria.
• Calculations will automatically prevent double-cycle billing from occurring.
• Notice and disclosure forms that follow safe harbor templates are available as custom form templates.
• Event and trigger based notifications can be used to automatically send any required written notices.
• The Payment Type feature allows lenders to customize the application of a payment to different parts of a loan.
• In LoanPro, you can use rules, agent walkthroughs, or both to ensure a customer is processed correctly if they are underage.

For a deeper look at common CARD Act violations, enforcement consequences, and how to build compliant systems, see our CARD Act compliance breakdown in the LoanPro Glossary.

FAQs

What does the CARD Act require for notifying cardholders of account changes?

Card issuers must provide written notice at least 45 days before any significant change to account terms, including APR increases, fee changes, or changes to the minimum payment calculation. During that window, cardholders have the right to reject the change and close the account at the current rate. The notice must be clear, conspicuous, and delivered before the change takes effect.

Does the CARD Act apply to business credit cards?

Generally no. The CARD Act protections apply to consumer credit card accounts. Business credit cards are largely exempt, meaning issuers are not required to provide the same advance notice, fee limits, or statement timing protections for business accounts. Some issuers voluntarily extend similar practices to business products, but it is not a legal requirement. Fintechs and banks launching business card programs should note that other consumer protection regulations and state laws may still impose requirements.

What are the consequences of CARD Act violations?

The CFPB is the primary enforcement body for CARD Act compliance and can impose civil penalties and require restitution to affected consumers. Consumers also have a private right of action for certain violations, meaning they can sue card issuers directly for damages and attorney's fees. For widespread violations, class action litigation is a real risk. Enforcement actions are also public, which creates reputational exposure beyond the financial penalties.

More resources

• FTC Statutes page. A brief summary of the CARD Act and links to the full text of the document.
• The CFPB’s Interactive Bureau Regulations for Reg Z. The CARD Act is implemented through Reg Z, the same regulation that implements the Truth in Lending Act.