RBA Payment Reforms 2026 Australia: A Payments Compliance Checklist
Most Australian payment professionals can now recite the headlines. Surcharging goes on 1 October 2026. Interchange caps come down. Foreign cards get capped for the first time. Transparency rules tighten.
Knowing the headlines is not the same as being ready for them. There is a real gap between "we are aware of the reforms" and "we have mapped what they change across our payment stack, assigned the work to the right internal functions, and built a plan against the timeline." Most organisations currently sit in that gap, and it is a more exposed position than it feels, because the first hard date is closer than the size of the change suggests.
The RBA card payment reforms of 2026 are the most significant change to payment regulation Australia has seen in a decade, and the most significant structural change to Australian payment economics in that time. They touch pricing, technology, customer communications, contracts, reporting and margin all at once. Unlike a single regulatory obligation with a single owner, the implications are distributed across treasury, technology, legal, commercial and compliance. That distribution is precisely why so many organisations are aware of the reforms and yet unready for them. Awareness sits with one team; the work belongs to five.
This is the practitioner's view of the RBA payment reforms 2026 Australia has been absorbing since the March Conclusions Paper. It is a framework rather than a summary. It sets out what the reforms actually require operationally, which internal functions need to act, and how to build a payments-compliance readiness plan against the full payment reform timeline. That plan has to serve both merchant compliance and institutional compliance, and it has to avoid the last-minute scramble that the six-month domestic implementation window is otherwise likely to produce.
What the reforms actually are, precisely
Getting the detail right matters here, because compliance planning built on the headline version will miss things. The following reflects the RBA's Conclusions Paper of 31 March 2026 and the Payments System Board's confirmed decisions.
Surcharging removal in Australia. From 1 October 2026 the RBA lifts its prohibition on "no-surcharge" rules across the designated eftpos, Mastercard and Visa networks, for debit, prepaid and credit cards. In practice the card networks are then expected to impose their own no-surcharge rules shortly afterwards, so the operational reality for merchants is that surcharging designated-network cards must stop. It amounts to an effective surcharge ban in all but name. The RBA has also signalled that if surcharging persists contrary to the intent of the reform, it could recommend the Government legislate a ban.
Interchange caps in 2026, domestic. Also from 1 October 2026, the caps on domestic-issued card interchange fall. Debit and prepaid cards are capped at 8 cents per transaction, or 0.16 per cent on an ad-valorem basis. Consumer credit card interchange is capped at 0.3 per cent, down from 0.8 per cent, and the weighted-average benchmark that previously applied across credit is abolished. Commercial credit cards retain their 0.8 per cent cap, deliberately, to preserve competition between three-party and four-party networks.
Interchange caps, foreign. From 1 April 2027, foreign-issued card transactions acquired in Australia face a regulated interchange cap for the first time. It is a single 1.0 per cent cap across debit, prepaid and credit, regardless of channel. This second date exists for a specific reason worth internalising. Foreign-issued cards are only around 3 per cent of Australian card transactions but account for roughly 20 per cent of the interchange merchants pay, so this change is disproportionately significant for any business with meaningful international customer volume.
Transparency and pass-through. Among the new acquirer obligations, acquirers must publish a measure of their interchange pass-through quarterly for the first four quarters beginning 1 October 2026, with the first publication due by 30 January 2027. Issuer obligations also change, with the net-compensation provisions amended so that all Australian issuers are captured, including those sponsored by a foreign entity, to prevent circumvention of the caps. Card networks face expectations to publish and simplify their interchange and payment scheme fees, so that participants can reconcile and scrutinise them. Changes to the information provided on merchant statements are also part of the package, with that element and the foreign-card cap extending to the 1 April 2027 timeline.
Least-cost routing compliance. The RBA maintained its existing expectations-based approach for in-person, card-present transactions rather than mandating routing, while deferring the question of online and mobile-wallet routing to a further consultation due by the end of June 2026. Because around 90 per cent of Australian debit cards are dual-network debit cards carrying both eftpos and an international scheme, eftpos routing remains a live cost lever, and the interplay between eftpos and Mastercard/Visa in Australia is exactly what the routing rules govern. This is not a static item. The mid-2026 consultation could change online-routing obligations, so it belongs on the watch-list rather than in the "no action" column.
The total scale, per the RBA and repeated by Treasury, is around $2.5 billion a year in reduced costs to merchants, of which the interchange reductions account for roughly $910 million. Those two figures are worth keeping distinct in any board paper, because the surcharge saving to consumers and the interchange saving to merchants are separate pools of money that the media coverage frequently blends into one.
The mistake: treating this as a single compliance event
The most common planning error is to file the whole package under "compliance" and assign it to one team, usually because "no-surcharge rule" and "interchange cap" sound like regulatory obligations. They are regulatory obligations, but the work they generate is not primarily legal work. It is operational, technical, commercial and financial work, with a compliance obligation sitting on top.
Consider surcharging removal alone. It is not a policy document change. It is a change to terminal and gateway configuration so that designated-network cards stop being surcharged. It is a change to checkout flows and payment pages, online and in-app. It is a review of customer-facing communications and pricing displays. It is a commercial decision about whether and how to adjust advertised prices to absorb the cost previously passed on. And it is a finance exercise to model the margin impact of that absorption. That is five different functions responding to one deadline.
This is why a compliance-led response that produces a memo and a sign-off is insufficient. The reforms require a coordinated operational programme, and the first job is to recognise that and structure the work accordingly. An organisation that treats the reform as a document to be reviewed, rather than a set of systems and prices to be changed, will discover the gap only when the technical work turns out to have a lead time nobody scoped.
A stakeholder map: who actually has to act
A reform-readiness plan starts by naming the functions and what each one owns. In most Australian organisations subject to these changes, the map looks like this.
Treasury and finance own the money. Interchange changes and the loss of surcharge revenue both hit the profit and loss, and the impact has to be modelled before October, not discovered after it. For any organisation that currently surcharges, absorbed acceptance cost lands directly in margin, and finance needs to know the size of that by product and by channel. Finance also owns the question of whether the acquirer is passing interchange reductions through. The RBA's quarterly pass-through publications exist to make that checkable, but someone inside the business actually has to check.
Technology and payments engineering own the execution. Terminal configuration, gateway logic, checkout and app flows, and the systems that calculate and display any surcharge all have to change. Where least-cost routing is in play, the routing configuration sits here too, and an orchestration layer is what lets these reform changes be absorbed as configuration rather than rebuilt provider by provider. This is typically the longest-lead-time work in the whole programme, which is exactly what makes it the critical path.
Legal and general counsel own the contracts and the disclosures. Merchant agreements, acquirer contracts and scheme arrangements may all need review against the new rules. Customer-facing terms, pricing disclosures and any surcharge signage need updating. And the interpretation of exactly what the no-surcharge rules permit and prohibit in edge cases is legal work that should not be left to an operations team to guess at.
Commercial and pricing own the response strategy. Absorbing acceptance cost is a pricing decision, not just an accounting one. Whether to adjust advertised prices, how to communicate any change to customers, and how to position against competitors who face the same change are all commercial calls that should be made deliberately rather than defaulted into. The businesses that handle this well will decide their pricing response on purpose; the ones that handle it poorly will have it decided for them by the calendar.
Compliance and risk own the assurance, and for regulated entities this is where the reform meets broader financial services compliance obligations. Their job is not to do all of the above but to ensure it happens, is evidenced, and can be demonstrated. That responsibility connects directly to the operational-risk obligations that already apply to regulated entities, which is the part of the picture most plans leave out.
The point of the map is accountability. Every one of these workstreams has a natural owner, and the failure mode is the assumption that "payments" or "compliance" will quietly handle all of it. Naming the owners, in writing, is the single most useful early action a leadership team can take, because it converts a vague awareness into assigned work with dates against it.
The APRA CPS 230 connection most plans miss
For APRA-regulated entities, which include banks, insurers and superannuation funds, there is a governance dimension that materially raises the stakes, and it is frequently left out of reform planning.
Since 1 July 2025, APRA's Prudential Standard CPS 230 has required regulated entities to manage operational risk and maintain critical operations through disruption, with clear accountability and demonstrable controls. Payment processing is a critical operation under any reasonable reading. That means a material change to payment configuration, which is exactly what surcharging removal and routing changes are, is a change to a critical operation. CPS 230 expects such changes to be governed, controlled and evidenced rather than improvised.
The practical implication is that a regulated entity cannot treat the reform work as a purely technical scramble. The changes need to be made in a way that produces the artefacts CPS 230 expects, which means documented decisions, tested changes, clear ownership and an audit trail. An organisation that reconfigures its terminals and checkout in a rush the week before 1 October, with no governance wrapper around the change, has arguably created an operational-risk finding at the same moment it complied with the payments reform. Getting both things right at once is the actual task, and it is far easier when the work starts early enough to be done properly and slower when it is compressed into a final fortnight.
There is a subtler point here too. CPS 230 also brings service providers into scope, so an entity that relies on an acquirer, gateway or orchestration provider to make these changes needs assurance that those providers are themselves ready. The reform readiness of your payment partners becomes part of your own operational-risk posture, which is a question worth asking of them now rather than in September.
A reform-readiness framework
Bringing this together, a structured readiness assessment can be organised in five steps. This is the framework worth running now, well ahead of October, rather than the checklist worth assembling in a hurry later.
Step one is exposure mapping. Establish where each reform actually touches your business. What is your card mix, and therefore your interchange exposure by card type? Do you currently surcharge, and if so, what revenue does that represent and where does it sit? What is your foreign-card volume, given the 1 April 2027 cap? This step produces the size of the prize and the size of the risk, and it is the input every later step depends on.
Step two is technical inventory. List every system, terminal, gateway, checkout flow and routing configuration that will need to change, and estimate the lead time for each. This is where the critical path usually reveals itself, and where six months proves shorter than it sounds once testing, certification and release windows are added up.
Step three is commercial and financial modelling. Model the margin impact of absorbing acceptance cost, the benefit of the interchange reductions, and the net position by product and by channel. Decide the pricing response deliberately. Build the mechanism to verify acquirer pass-through against the RBA's published data, so that the saving the reform intends actually reaches your P&L rather than staying with your provider.
Step four is contractual and disclosure review. Review merchant, acquirer and scheme agreements and all customer-facing pricing disclosures against the new rules, and schedule the updates so they land before the relevant date rather than after it.
Step five is governance and evidence. Wrap the whole programme in the governance that CPS 230 requires for regulated entities, or that ordinary good practice suggests for everyone else. That means named owners, documented decisions, tested changes and an audit trail, so that being compliant and being able to demonstrate compliance become the same thing rather than two separate exercises.
The sequencing matters as much as the content. Technical work is the long pole, so it should start first. Commercial decisions feed both finance and customer communications, so they cannot be left to the end. And governance runs throughout the programme rather than being applied as a stamp at sign-off.
What good looks like, and the opportunity hiding in the obligation
It is worth ending on the reframe, because a reform-readiness programme run well is not purely a cost.
The organisations that will come through this best are not the ones that merely comply by 1 October. They are the ones that use the exposure-mapping work to understand their acceptance economics properly, often for the first time, and then act on what they find. The same transaction-level analysis that tells you your surcharge revenue and interchange exposure also tells you where your acceptance cost is concentrated, whether your pricing model actually lets you see it, and whether least-cost routing is being applied where it should be. The reform forces a look under the bonnet that most organisations have been deferring for years, and the look itself is valuable. It converts a one-off compliance exercise into ongoing payment cost management.
There is also a genuine saving to capture, not just a cost to absorb. The interchange reductions are real money, but only if they are passed through, and the RBA has built the pass-through transparency specifically so that merchants who bother to check can hold their acquirers to it. Treating the reform as purely defensive misses the fact that the same programme, run with intent, can lower cost and improve control at the same time. The defensive reading protects the downside; the opportunity reading captures the upside, and both come from the same body of work.
Getting payments compliance right in Australia
The outcome worth aiming for is not a memo confirming awareness. It is a coordinated, evidenced programme in which the technical changes are made and tested well before the deadline, the margin impact is modelled and the pricing response chosen deliberately, the contracts and disclosures are updated in good time, the interchange pass-through is verified rather than assumed, and, for regulated entities, the whole thing is governed to the standard CPS 230 expects.
Getting there depends on treating the reforms as the multi-function operational programme they are, rather than as a compliance sign-off, and on starting early enough that the technical critical path is not compressed into a risky final month.
This is where specialist help earns its place. Conexxia works with Australian banks, insurers, merchants and fintechs on payments compliance and risk. That work involves mapping reform exposure across the payment stack, coordinating the treasury, technology, legal and commercial workstreams, verifying interchange pass-through against the RBA's published data, and ensuring the changes are made and evidenced to the standard regulated entities require. It is the same evidence-led approach we bring across our payments consulting practice, from payments orchestration strategy and payments operations through to payments infrastructure modernisation and cross-border payments.
None of this requires waiting for the next regulatory update to begin. Most organisations start by mapping exposure, which means card mix, surcharge revenue, foreign-card volume and the systems each reform touches, and then letting that map drive the plan and its sequencing.
If your organisation is aware of the RBA's 2026 reforms but has not yet named who owns each part of the response, that gap is the first thing worth closing.
Aftab Khan
Head of Payments Consulting
On a mission to help change the world, one experience at a time
I collaborate with progressive businesses to deliver successful business outcomes in 4 key areas: Increasing Revenues, Improving Operational Efficiencies, Regulatory Compliance and Elevating Customer Experience, leading to sustainable business growth.
Comments