I’ve spent 25 years in the payments industry. I’ve watched Visa and Mastercard roll out programs, enforce them halfheartedly, and eventually crack down hard when the losses became too large to ignore. That pattern is exactly what I’m watching play out right now with CEDP.
For those catching up: Visa’s Commercial Enhanced Data Program requires businesses processing B2B credit card transactions to pass granular invoice-level data to qualify for Level 2 and Level 3 interchange discounts. The idea is straightforward: Visa wants real data attached to commercial transactions, not placeholder fields.
The problem is that processors and gateways had been passing fabricated or auto-filled data to claim those discounts without doing any of the actual work. When CEDP enforcement began, Visa deployed an AI-assisted auditing tool to detect exactly that. It worked. Some merchants saw processing fees jump six figures in a single month.
Merchants were then sorted by Visa’s audit process as either Verified or Unverified. Verified merchants would receive Level 2 and 3 (now Product 3) rates immediately. Unverified merchants would pay higher rates and receive a credit the following month on compliant transactions.
Then Visa stopped the verification process.
Not long after CEDP rolled out, Visa paused its AI-based merchant verification process. After two and a half decades in this business, I know what a strategic pause looks like. This is not Visa backing down. This is Visa reloading.
The processors celebrating should think carefully about what they’re celebrating. Every month they continue submitting fabricated data, they’re building an audit trail. When verification comes back — and I believe strongly it will — it’s going to be more sophisticated.
The fraud is structural
What makes this unusual is that the data manipulation isn’t happening at the merchant level; oftentimes merchants have no idea it’s occurring. It’s embedded in how some processors and gateways have set up their data pipelines. When a transaction flows from a business’s ERP through a gateway to a processor, the gateway often auto-populates required CEDP fields rather than pulling actual invoice data. The merchant gets the discount. The processor keeps the merchant happy. Visa gets garbage data.
The merchants most exposed aren’t willfully cheating. They’re the ones who trusted their processor to handle compliance and never asked questions. That trust is going to get expensive.
What genuine compliance actually looks like
For CEDP to work as designed, the data flowing through each transaction has to originate from the merchant’s actual ERP or accounting system and not auto-filled placeholders. That requires a middleware layer bridging the ERP and gateway, translating real invoice data into CEDP-compliant payloads. Most processors haven’t been willing to do that work because their auto-fill approach was generating the same benefit for far less effort.
Merchants that want to protect themselves should take a close look at whether they are passing real data or placeholders. If they don’t know the answer, they’re at risk.
The broader signal
Visa built CEDP because the existing discount system had become a game, one where the house was losing. The AI screener was a declaration that the game was over. The pause in merchant verification is tactical, not philosophical.
When Visa comes back, the businesses absorbing the penalty fees won’t be the processors. They’ll be the merchants that trusted the wrong people to keep them compliant.
Twenty-five years in, that’s the part that bothers me most.
About the author: Jeremy Layton is CEO of Verisave, a merchant account optimization firm that helps businesses reduce credit card processing fees without switching processors. Learn more at verisave.com.