Two federal agencies share primary oversight of payment processing practices in the United States, and understanding which one covers what can save a business owner significant time when something goes wrong. The Consumer Financial Protection Bureau focuses on consumer-facing payment products and services, while the Federal Trade Commission has broader authority over deceptive and unfair business practices, including those that affect merchants directly. Together with state attorneys general, these agencies form the enforcement framework behind cfpb merchant services enforcement actions, ftc payment processor cases, and the broader system of merchant services regulation that determines how processors can and can't operate. Neither agency was built specifically to protect small business merchants from predatory processing agreements. That gap matters, but there are still meaningful tools available if you know where to look and what each agency can actually do on your behalf. The CFPB's Role in Payment Processing Oversight The CFPB was created under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, with a mandate to protect consumers in financial markets. Its authority covers banks, credit unions, and nonbank financial companies, including payment processors, but only to the extent those companies interact with consumers. For small business owners, this distinction creates a practical limitation that shapes how useful the agency actually is when you have a dispute with your processor. The CFPB's enforcement actions in the payments space have historically targeted consumer-facing harm: unauthorized charges on consumer accounts, deceptive billing by payment apps, and failures to handle consumer disputes properly. If a processor misleads consumers through a merchant's payment flow, the CFPB can act. If that same processor misleads the merchant about contract terms or fee structures, the CFPB's authority is far less clear and often doesn't apply at all. The agency does accept complaints from small business owners through its public complaint database at consumerfinance.gov. These complaints are forwarded to the company for response, and the data becomes part of the public record. Filing a complaint won't trigger an investigation on its own, but patterns of complaints against the same company can influence the CFPB's supervisory priorities. According to CFPB data, the agency has received hundreds of thousands of complaints related to money transfers, virtual currencies, and financial services since its inception, and the complaint database remains one of the few federal tools that creates a public, searchable record of disputes with financial companies. The agency's enforcement posture and operational scope have shifted under different presidential administrations. As of early 2025, the CFPB's staffing, rulemaking activity, and enforcement priorities were undergoing significant changes. Business owners should verify the agency's current operational status before relying on it as a primary complaint channel. FTC Authority Over Merchant Services The Federal Trade Commission operates under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in commerce. Unlike the CFPB, the FTC's authority isn't limited to consumer-facing transactions. It can pursue enforcement actions against companies that deceive or defraud businesses, including payment processors that use misleading sales tactics, hide fees in contracts, or misrepresent their services to merchants. This broader mandate makes the FTC the more directly relevant federal agency for most merchant services disputes that involve deception rather than simple billing disagreements. The agency has brought enforcement actions against payment processors and their sales organizations for practices including deceptive telemarketing of processing services, unauthorized debits from merchant bank accounts, and failure to honor cancellation requests. These cases typically involve patterns of conduct affecting hundreds or thousands of merchants across multiple states, not isolated billing disputes between one merchant and one processor. The FTC's enforcement model relies on building cases against systemic bad actors rather than resolving individual complaints, which means filing a report at reportfraud.ftc.gov contributes to a data pool that the agency's investigators use to identify targets. The FTC won't resolve your specific problem directly, but if your processor is running the same scheme on hundreds of merchants, your report adds to the evidence that could eventually trigger a formal investigation. FTC cases in the payment processing space have resulted in significant monetary judgments and, in some cases, permanent bans on individuals operating in the industry. State Attorneys General and Merchant Services Regulation State attorneys general represent what is often the most practical enforcement channel for small business merchants dealing with deceptive processor conduct. Every state has consumer protection statutes, typically called UDAP laws (Unfair and Deceptive Acts and Practices), and in most states these laws apply to business-to-business transactions as well as consumer dealings. The scope varies by state. Some states require merchants to demonstrate that the deceptive practice affects consumers before they can bring a claim under the state's UDAP statute. Others allow businesses to bring direct action against deceptive trade practices regardless of consumer impact. A few states have enacted specific legislation targeting merchant services practices, including requirements around contract disclosure, fee transparency, and cancellation rights. This is an area of active legislative development, and requirements vary enough that checking your own state's current statutes is a necessary step before filing any formal action. State AG offices can investigate processors, issue civil investigative demands, and bring enforcement actions. They can also join multistate coalitions when a processor's deceptive practices cross state lines, which they almost always do in payment processing since most major processors operate nationally. For individual merchants, filing a complaint with your state attorney general's office is typically the most actionable first step because state AG offices are generally more responsive to individual complaints than federal agencies and have the authority to mediate disputes, demand documentation from the processor, and escalate to formal investigation when patterns emerge. What Protections Actually Exist for Small Business Merchants Federal processor consumer protection for merchants is thinner than most business owners expect. The regulatory framework was designed primarily to protect consumers, and merchants often fall into a gap between consumer protection law and commercial contract law. That said, several protections do apply, even if they aren't as centralized or accessible as the consumer-facing equivalents. Card network rules from Visa and Mastercard require processors to provide certain disclosures and honor specific dispute resolution procedures. These aren't government regulations, but they function as enforceable standards because processors must comply with network rules to maintain their ability to process transactions. Violations can be reported to the card networks directly, though the enforcement mechanism isn't particularly transparent to individual merchants. Some states have enacted laws specifically requiring transparency in merchant processing agreements, which may mandate that processors disclose effective rates, provide itemized fee breakdowns, or honor cancellation within a specific window. At the federal level, the Electronic Fund Transfer Act and Regulation E provide some protections related to electronic payments, though these primarily protect consumers rather than merchants in the processing relationship. There isn't a federal equivalent of these laws that specifically governs the processor-to-merchant relationship, which is why state-level protections and card network rules carry outsized practical importance. How to File a Complaint Against Your Payment Processor If you believe your processor has engaged in deceptive practices, misrepresented fees, debited your account without authorization, or refused to honor cancellation terms, you have several complaint channels available. None of them are fast, and none guarantee resolution, but using them correctly improves your chances of getting a result and builds the public record that regulators use to identify bad actors across the industry. Start with your state attorney general's office. File a complaint through their website, include copies of your processing agreement, bank statements showing disputed charges, and any written communication with the processor. Be specific about what was promised versus what was delivered, because vague complaints are harder for investigators to act on. State AG offices can't act as your lawyer, but they can contact the processor on your behalf and, if they receive enough similar complaints, open a formal investigation. File a report with the FTC at reportfraud.ftc.gov as well. The FTC won't resolve your individual case, but your report feeds their investigative database with the same documentation you provided to your state AG. If the dispute involves unauthorized debits from your business bank account, contact your bank and request a reversal under the ACH dispute process, since your bank has its own obligations under NACHA operating rules to investigate unauthorized debits. That path is often the fastest route to recovering funds, though processors may contest the reversal. Document everything from the start: your signed agreement, every statement, all email correspondence, and notes from phone calls including dates and the names of representatives you spoke with. This documentation is essential for any formal complaint, mediation, or legal action down the line. The Practical Reality of Enforcement Federal enforcement in merchant services tends to target large-scale fraud operations and systemic deceptive practices rather than individual contract disputes. If a processor buried a fee increase in page 14 of your contract and you signed it, that's likely a contract dispute rather than a regulatory enforcement matter. If that same processor is systematically misrepresenting fees to thousands of merchants through deceptive sales scripts, that's the kind of pattern federal agencies build cases around. State-level enforcement fills more of the gap for individual merchants, but resources vary widely across jurisdictions. For disputes that don't rise to the level of regulatory action, small business merchants may need to pursue resolution through private legal channels: demand letters, small claims court for smaller amounts, or commercial litigation for larger losses. Some processing agreements include mandatory arbitration clauses that limit your ability to bring disputes to court, so reviewing your agreement before deciding on a legal strategy is critical. The system isn't perfect. Merchant services regulation at the federal level remains primarily consumer-focused, and processors operate in a space where contract law often favors the party that wrote the contract. But the complaint channels described above are real, they do produce results over time, and they create the documented record that makes future enforcement action possible. Knowing which agency does what, and what each channel can realistically deliver, puts you in a stronger position if your processor isn't operating in good faith.
CFPB and FTC Enforcement in Merchant Services
