The CARD Act, Truth in Lending, and Why Business Cards Are Different

The Credit Card Accountability Responsibility and Disclosure Act of 2009 (Public Law 111-24, commonly the "Credit CARD Act" or "CARD Act") added a substantial layer of consumer protection to the federal regulatory regime governing credit cards. The Act amended the Truth in Lending Act (TILA, 15 U.S.C. Sec. 1601 et seq.) and is implemented by the Federal Reserve Board's Regulation Z (12 C.F.R. Part 1026, transferred to the CFPB after Dodd-Frank).

What the CARD Act does for personal cards

• 45-day notice on rate increases. Issuers must provide written notice 45 days before raising the APR or other significant terms on a consumer card.
• 21-day grace-period floor. The grace period between statement close and payment due date must be at least 21 days for consumer cards.
• No double-cycle billing. Interest cannot be assessed on balances that were paid off in the previous cycle.
• Prohibition on universal default. An issuer cannot raise the APR on a consumer account because of late payment to a different creditor.
• Late-fee caps. Late fees on consumer cards are capped at a regulator-set amount, periodically revised.
• Ability-to-pay assessment. The issuer must assess the consumer's ability to make required payments before extending credit or increasing limits.
• Over-limit fee restrictions. Over-limit fees are restricted on consumer cards; the cardholder must opt in for the issuer to authorise over-limit transactions and charge fees.
• Promotional rate restrictions. Promotional APRs must remain in effect for at least six months on consumer cards.

These protections substantially constrained issuer practices that had been common before 2009 and shifted the consumer-card market toward more disclosure and less rate-and-fee surprise. The Act has been broadly successful at its consumer-protection goals on consumer cards.

Why most of it does not apply to business cards

The CARD Act amended TILA, and TILA's scope is set at the threshold by 15 U.S.C. Sec. 1603. That section enumerates exclusions from the entire TILA framework. Subsection (1) excludes "credit transactions involving extensions of credit primarily for business, commercial, or agricultural purposes."

The exclusion has been in TILA since the 1968 enactment and has never been narrowed. It captures the credit-card products marketed to businesses, regardless of how small the business is or how similar the underwriting and product are to consumer-card analogues. Because the CARD Act amended a statute that does not cover business-purpose credit, the CARD Act's protections do not extend to the cards excluded from TILA.

The Federal Reserve Board's commentary to Regulation Z makes the technical position explicit. Regulation Z, the implementing regulation for TILA, applies only to credit subject to TILA, and the business-purpose exclusion at the statutory level carries through to the regulatory level. The CFPB inherited Regulation Z from the Federal Reserve Board after Dodd-Frank and has not changed the scope.

Practical implications for cardholders. The 45-day rate-change notice does not apply: business-card APRs can be raised with shorter notice or no notice as the agreement permits. The 21-day grace-period floor does not apply: business cards may have shorter grace periods, although most match the consumer-card practice for operational simplicity. Late-fee caps do not apply: business-card late fees can exceed consumer-card caps and have done so historically at some issuers. The ability-to-pay assessment does not apply: business cards are underwritten on different criteria. The opt-in requirement for over-limit fees does not apply.

Voluntary issuer practice

Some issuers have voluntarily extended specific CARD Act protections to their business cards. The motivation is marketing: a business card that promises CARD Act-equivalent protections is differentiated and may attract more cautious applicants. The voluntary commitments vary in scope and are issuer-specific. They are not legal obligations and can be withdrawn at the issuer's discretion, although issuers that have made public commitments have generally honoured them.

The cardholder cannot assume that a business card has consumer-card protections by default. The card agreement is the operative document, and the CFPB card agreement database publishes the full text of every issuer's current agreement. Reading the agreement to understand which protections apply to a specific card is the only reliable approach.

What protections do apply: Regulation B and state UDAP

Several frameworks apply to business credit cards regardless of the TILA exclusion:

Regulation B (Equal Credit Opportunity Act). 12 C.F.R. Part 1002 applies to business credit applications and accounts. The non-discrimination rules at 12 C.F.R. Sec. 1002.4 apply: an issuer cannot discriminate on the basis of race, colour, religion, national origin, sex, marital status, age, or receipt of public assistance. The adverse-action notice requirement at 12 C.F.R. Sec. 1002.9 applies: declined applicants are entitled to specific reasons within 30 days. The spouse-signature prohibition at 12 C.F.R. Sec. 1002.7 applies: a creditor cannot require a spouse's signature when the applicant individually qualifies.

State-level UDAP statutes. Every state has an unfair-or-deceptive-acts-and-practices statute that applies broadly to commercial conduct, including credit-card issuance. State attorneys general can investigate and enforce. The protections vary by state and overlap with federal frameworks.

Federal Arbitration Act. Most business-card agreements contain mandatory arbitration clauses with a designated arbitrator. The Federal Arbitration Act governs the enforcement of those clauses. Cardholders disputing a charge or seeking redress under the agreement typically proceed through arbitration rather than litigation.

Fair Debt Collection Practices Act (FDCPA). 15 U.S.C. Sec. 1692 et seq. applies to third-party collectors pursuing consumer debt; the application to business debt is narrower. Where a debt is treated as consumer debt at any point in the collection chain, the FDCPA may apply.

Fair Credit Reporting Act. 15 U.S.C. Sec. 1681 et seq. governs personal-credit reporting. To the extent a business card reports to personal bureaus, the FCRA's accuracy and dispute requirements apply.

Dispute paths

Cardholders with disputes on business cards have several channels:

The CFPB complaint system. The CFPB accepts complaints about business credit cards and can investigate even where substantive CARD Act protections do not apply. The complaint database is publicly searchable.

State attorney-general consumer-protection authority. State AGs investigate UDAP claims, including those related to business-card practices. Some states have dedicated small-business protection units.

Federal Trade Commission. The FTC's consumer-protection enforcement is primarily personal-credit-focused, but the FTC has acted on business-credit issues in cases involving systematic deception.

Industry arbitration under the card agreement. Most agreements designate an arbitrator (commonly the American Arbitration Association or JAMS). The arbitration is binding under the Federal Arbitration Act unless the agreement specifies otherwise.

Litigation. Where the agreement permits or where the arbitration clause is unenforceable in a specific case, litigation in state or federal court is available. The Federal Arbitration Act limits this path significantly for most business-card agreements.

Network-level chargeback for transactional disputes. Visa and Mastercard chargeback procedures apply to transactional disputes (defective merchandise, non-delivery, fraud) regardless of cardholder type. The chargeback path is the most accessible dispute route for transaction-level issues and runs through the issuer's customer service.