Review of Payments System Regulation Summary of Submissions to the Review of Payments System Regulation Issues Paper

2. Merchant Choice in Payments

2.1 Competition across debit card networks

Many stakeholders stated that the RBA should prioritise regulatory action to address barriers to competition between debit card networks for mobile wallet and online transactions, particularly among merchants, issuers and other payment service providers (PSPs). These stakeholders stated that:

  • The way that the tokenisation of payment credentials was implemented has constrained competition between debit card networks. Stakeholders generally considered that international card networks benefited from substantial first-mover advantages with the implementation of tokenised online and mobile wallet transactions. Several noted that when dual-network debit cards (DNDCs) were first tokenised, only the international card networks had the capability to support these form factors. In practice, this meant that eftpos was not available to merchants when making routing decisions for tokenised transactions, even where their acquirer had enabled least-cost routing (LCR). These stakeholders stated that, while eftpos has since developed the necessary capabilities, adding an eftpos token to a mobile wallet or in an online environment where a DNDC is already represented by a single network token creates substantial implementation challenges. Some stakeholders considered that this dynamic had disadvantaged eftpos and continued to limit the volume of contestable debit card transactions.
  • Emerging payment technologies could replicate or amplify existing barriers to competition. Stakeholders identified this risk in relation to passkeys, virtual cards, flexible credentials, Click to Pay and agentic payments. They stated that if these technologies only support single network tokens when first launched or as a default, merchants may have increasingly limited ability to choose their preferred debit network, with further implications for competition in the debit card market. Some also noted that it could become more difficult and costly to add support for two network tokens to these payment technologies after they become widely adopted.
  • Where eftpos can contest only a subset of debit transactions, some merchants may have limited incentives to enable LCR. Several stakeholders noted that merchants may minimise their total acceptance costs by routing all transactions through an international card network, even when eftpos is cheaper for some transactions. Because eftpos can contest only a subset of transactions, routing those transactions to eftpos may reduce the volume discounts available from international card networks, increasing the merchant’s total card acceptance costs.
  • Some intermediaries have not enabled LCR. Although eftpos has developed its online capability, stakeholders noted that some online platforms, gateways and acquirers support only one debit network or do not enable routing functionality when it is available. Some suggested these intermediaries may have limited incentives to build or provide this capability, particularly if an intermediary is owned by a debit card network and building a routing functionality requires integration with a competing debit card network.
  • Australian Payments Plus (AP+) can do more to invest in and support the competitiveness of eftpos. Some stakeholders pointed to issues such as delay in developing new capabilities, lower transaction approval rates or other non-price related factors that may hinder the competitive position of eftpos.

Many of these stakeholders proposed that the RBA should take action to ensure merchants can choose their preferred debit card network regardless of how a transaction is made. Specific proposals included:

  • requiring both networks on a DNDC to be comprehensively provisioned in all form factors including mobile wallets and online
  • setting implementation timelines for large acquirers and PSPs
  • publishing data on actual routing outcomes.

Some card networks, mobile wallet providers, issuers and other PSPs identified factors that may reduce the need for the RBA to take further action to improve competition across debit card networks. These stakeholders stated that:

  • Ongoing industry progress may address implementation concerns. Several stakeholders considered that the enablement of LCR in mobile wallets was improving. One mobile wallet provider expected that all DNDCs in its wallet would support eftpos card-not-present transactions by the end of 2026. Some card networks stated that LCR for online transactions is generating meaningful competitive pressure, citing a decline in online debit net scheme fees following the introduction of eftpos’ online functionality.
  • Any further regulatory action should be proportionate and directed at participants responsible for specific barriers to competition. Some stakeholders considered that the RBA should distinguish persistent competitive bottlenecks from temporary implementation constraints. They supported targeted interventions where an entity can control or restrict access to a capability required for routing, such as particular PSPs that have not performed technical integrations necessary to enable LCR. Some suggested that the investment required to extend LCR to all mobile and online transactions may be disproportionate to the resulting benefits, including implementation costs and operational risks.
  • Other payment methods, including in-person account-to-account (A2A) payments, may provide stronger long-term competitive pressure on card networks.

2.2 Integrated platforms and bundling of payment services

There was some support from stakeholders for the RBA prioritising actions to address competition concerns about the way payment services are bundled on some integrated platforms.

Some PSPs and merchants stated that the RBA should prioritise this issue because:

  • Some integrated platforms have financial and non-financial barriers to merchants choosing a PSP other than the platform’s preferred or default payment service. Some stakeholders referred to Shopify imposing an additional ad valorem fee if merchants use a third-party PSP other than Shopify’s own payments platform. They stated that this fee can make it uneconomical to use alternative PSPs. More generally, some stakeholders referred to other factors that may disincentivise merchants from choosing alternative PSPs, such as platform settings or tying certain non-payments features to the use of the preferred payments service. Some stakeholders stated that some integrated platforms may not allow merchants to use the PSP of their choice as the platform did not support integration with that PSP.
  • Non-preferred PSPs may face integration barriers. Some stakeholders stated third-party PSPs face challenges when seeking to integrate with platforms, including restrictive integration arrangements, high fees or limited access to merchant data. These stakeholders stated that this could reduce competition for payment processing services, as well as hinder competition from alternative payment methods like A2A.
  • When choosing a platform, merchants may not have information about the cost of payment processing services or the potential cost of switching from the default payments service. Stakeholders identified other factors that may hinder competition for payment processing services on integrated platforms: lack of information about switching PSPs when merchants are signing up to an integrated platform; some platforms do not distinguish between platform fees from payment processing costs; contractual restrictions and termination charges; and merchants face operational challenges when switching providers.

Stakeholders suggested several potential initiatives to address the barriers they identified. These include:

  • prohibiting fees for using third-party providers
  • requiring platforms to provide equivalent functionality to preferred and non-preferred PSPs
  • mandating disclosures about switching costs
  • mandating unbundling of payment processing costs from platform fees.

Some platforms, industry associations representing merchants and technology firms, and a few PSPs did not support the RBA prioritising this issue. These stakeholders stated that:

  • Bundling can provide substantial efficiency benefits, both to merchants (particularly for small and medium-sized enterprises) and service providers. Some stakeholders stated that platforms should retain the ability to adopt different business models, including by pricing different parts of their services differently to help merchant adoption. These stakeholders asked the RBA to consider the platforms’ offerings as a whole.
  • Integrating payment processing services can improve reliability and financial safety. Some stakeholders noted that maintaining a few tightly managed integrations best supports the platform’s security environment, reduces third-party risks and can improve fraud controls and chargeback handling.
  • The operational complexity of switching is a natural consequence of changing providers and is not inherently anti-competitive. Some stakeholders stated these operational requirements highlight the value of integration offered by such platforms. One PSP stated competition is already robust and enhanced disclosures would be sufficient to address any remaining switching concerns.

2.3 Portability and syncing of tokenised card information

There was some support for the RBA to prioritise action to support portability of tokens and synchronisation of token lifecycle events.

Some stakeholders, including industry groups, technology firms and PSPs, stated that the RBA should prioritise these issues. These stakeholders stated:

  • Merchants using proprietary gateway/PSP tokens can face challenges when switching PSPs. Some stakeholders stated that when merchants switch PSPs, only the relevant cardholder data are transferred, as the proprietary tokens themselves are tied to the incumbent PSP. Stakeholders noted while the Payments System Board has set an Expectation about token portability and AusPayNet has set a standard about the porting of cardholder data by PSPs, the standard does not enforce PSP facilitation of token transfer through decryption and re-tokenisation. Some stakeholders stated that, as a result, merchants encounter difficulties re-tokenising credentials or may need to ask customers to re-enter card details after switching in order to process affected card-on-file or recurring payments. This can lead to failed recurring payments, checkout abandonment and operational disruption.
  • There are inconsistent practices in migrating cardholder data. Some stakeholders stated that data migration practices differ across industry, which can result in delays, incomplete migrations or provision of data in non-standard formats. This compounds the challenge that merchants face when seeking to switch PSPs.
  • Portability outcomes are unlikely to improve without regulation and enforcement. Stakeholders proposed a number of initiatives to improve portability outcomes. These include:
    • expanding portability requirements to require the porting of gateway/PSP tokens
    • formal regulations standardising the token migration process, including setting specific timing obligations and the fees that can be charged
    • regulation targeting the conduct of specific participants that imposed barriers on portability.
  • A few stakeholders also supported action to address token synchronisation issues that may limit the effectiveness of online LCR. They noted that merchants can sometimes lose access to one of the network tokens on a DNDC following card replacement or other lifecycle events, or after tokens are migrated across providers. When that occurs, merchants are unable to choose the network through which transactions on those cards are routed. These stakeholders supported clearer information about token lifecycle events, stronger processes for ensuring synchronisation during token migrations, and issuer-orchestrated synchronisation.

Some stakeholders did not support the RBA prioritising these issues. These stakeholders stated:

  • Further regulation on these topics would be unnecessary or premature. Some stakeholders noted that the AusPayNet portability standard commenced on 1 July 2026. These stakeholders suggested the RBA should monitor the implementation of the standard and only intervene if material barriers to portability or synchronisation persist. Schemes and wallet providers stated that any efforts to promote greater portability should not weaken the security features of tokens.

2.4 Use of AI agents for payments in e-commerce

Many merchants, PSPs and issuers raised concerns about the implications of agentic commerce for competition in payment services, the allocation of liability for agent-initiated transactions and cybersecurity. These stakeholders stated that:

  • AI agents can make decisions about which card networks and PSPs to send transactions to. Some stakeholders considered that commercial arrangements with the companies that provide agents could build in preferences for some card networks, which could reduce merchants’ ability to choose their preferred debit network and undermine the RBA’s LCR policy. Similarly, several stakeholders stated that built-in preferences for some PSPs could reduce competition between providers of acquiring services.
  • Use of AI agents could add to merchant costs. Some stakeholders stated that agentic commerce introduces another intermediary or sales channel that can add to the fees that merchants pay in e-commerce. One stakeholder referred to reports that in early 2026, when customers used one AI agent to complete a purchase, the merchant would be charged an additional fee of 4 per cent.
  • Chargeback arrangements do not clearly allocate liability where an agent may have acted outside its authority. A large number of submissions stated that current rules are unclear on who should bear losses in a dispute about AI-initiated transactions. Without a framework for identifying agentic transactions and recording an agent’s instructions, merchants, issuers and PSPs may be unable to determine whether the agent acted within its authority. Some merchants were particularly concerned that these areas of uncertainty could increase chargebacks.
  • Compromised or malicious agents could create new security risks. Stakeholders stated that a malicious actor could manipulate or otherwise compromise an agent, or use compromised credentials to impersonate an agent. In these scenarios, the agent may transact beyond authority, initiate unauthorised payments or allow payment credentials to be used for fraud. These risks may be harder to detect or resolve where payment industry participants cannot identify that a transaction was initiated by an agent or access reliable records of the agent’s instructions.
  • Current system design choices may become difficult to reverse once agentic commerce scales. Stakeholders suggested that principles or protocols governing key aspects of agentic commerce transactions, including authority and liability, should be established while technologies and commercial models are developing. Some were concerned that international companies may define industry standards, potentially building in barriers to competition or efficiency in the Australian market and making later intervention more costly.

Despite these risks, stakeholders generally proposed that the RBA continue to monitor developments and support the development of industry standards rather than considering regulation. These stakeholders stated that:

  • Agentic commerce remains at an early stage of adoption and evidence of harm is limited. Agentic commerce use cases, standards and commercial models are under development. Several stakeholders noted that existing evidence did not establish the likelihood or scale of competition, efficiency or financial safety harms, and considered regulatory intervention would be premature.
  • Regulation could inhibit innovation and prevent some efficiencies from being realised.
  • Other frameworks may address risks. Some stakeholders considered that many of the issues may be addressed through existing initiatives including the ePayments Code, the RBA’s tokenisation expectations and industry-led initiatives.
Continue to ‘3. Mobile Payments, Non-designated Card Networks and Buy Now Pay Later’