What the CARD Act guarantees every credit card holder
The Credit Card Accountability Responsibility and Disclosure Act of 2009 and the Regulation Z rules that carry it out give every consumer credit card holder advance notice of major changes, at least 21 days to pay each bill, payments applied to the costliest balance first, no over-limit fees without consent, and limits on fees. The CFPB's 2024 rule that would have cut large issuers' late fee safe harbor to $8 was vacated by court order on April 15, 2025.
Contents8 sections
Key takeaways
- Issuers must give written notice at least 45 days before a significant change to your account terms, and for many changes you can reject the change before it takes effect.2
- Issuers must have reasonable procedures designed to ensure statements are mailed or delivered at least 21 days before the payment due date, and the due date must fall on the same day of each month.45
- Apart from special rules for deferred interest and secured balances, any amount you pay above the minimum must go first to the balance with the highest annual percentage rate.7
- An issuer cannot charge an over-the-limit fee unless you have opted in.8
- The CFPB says its 2024 credit card penalty fees rule, including the $8 late fee safe harbor, was vacated by court order on April 15, 2025.11
The Credit Card Accountability Responsibility and Disclosure Act of 2009, known as the CARD Act, was enacted on May 22, 2009 as Public Law 111-24.1 It amended the Truth in Lending Act and provides that it takes effect 9 months after enactment, except where the Act specifically says otherwise.1 The rules that carry it out are in Regulation Z, 12 CFR part 1026, and most of the card-specific ones apply to any credit card account under an open-end consumer credit plan that is not secured by a home, whatever the issuer or rewards program.710 This article explains each guarantee without quoting any card’s rate.
Notice before your terms change, and the right to reject
For a significant change in account terms, the issuer must send written notice at least 45 days before the change takes effect.2 Significant changes include changes to the terms disclosed in the account-opening table under 12 CFR 1026.6(b)(1) and (b)(2), an increase in the required minimum payment and taking a security interest.2 Your general acceptance of the agreement’s clause reserving the right to change terms, or simply using the card, does not count as agreeing to a change so as to shorten the notice.2
For many of these changes the notice must also tell you that you can reject the change, and you can do so by telling the issuer before the effective date.2 If you reject, the issuer must not apply the change, must not charge a fee or treat the account as in default solely because you rejected it, and must not require repayment of the balance by a method less favorable than those the regulation allows.2 Those methods include the method in place before the change, an amortization period of at least five years, or a minimum payment percentage no more than twice the previous one.3 Among the listed exceptions, the right to reject does not cover an increase in the minimum payment, a change in an annual percentage rate, or a change triggered by not receiving your minimum payment within 60 days after its due date.2
Rate increases are limited separately. An issuer may raise a rate or certain fees only under listed exceptions, such as the end of a disclosed temporary rate period of six months or longer, a variable rate following its index, or after advance notice.3 An increase made after advance notice cannot apply to transactions made before, or within 14 days after, the notice, and it cannot take effect during the first year after the account is opened.3 If a rate rises because a payment is more than 60 days late, the issuer must return to the earlier rate for transactions made before, or within 14 days after, the notice once it receives six consecutive minimum payments on or before their due dates, starting with the first payment due after the increase takes effect.3
Statements, due dates and when a payment counts
| Rule | What Regulation Z requires |
|---|---|
| Statement timing | Reasonable procedures designed to ensure statements are mailed or delivered at least 21 days before the payment due date4 |
| No late treatment inside 21 days | A minimum payment received within 21 days after the statement was mailed or delivered cannot be treated as late for any purpose4 |
| Consistent due date | The due date must be the same day of the month for each billing cycle5 |
| Payment cut-off time | No earlier than 5 p.m. on the due date at the location the issuer specifies6 |
| No mail on the due date | If the issuer does not receive or accept mail payments on the due date, a mailed payment received the next business day cannot be treated as late6 |
Payments made in person at a branch of an issuer that is a financial institution count on the day you make them if made before the branch closes.6
Where your payment goes
When you pay more than the minimum, the issuer must apply the excess first to the balance with the highest annual percentage rate, then to the other balances in descending order of rate.7 Deferred interest balances have a special rule: during the two billing cycles immediately before the deferred interest period ends, the excess must go first to that balance.7 The issuer may also, at its option, split the excess as you request for a deferred interest balance.7 The minimum payment itself is not covered by this rule.7
Over-limit fees and young applicants
An issuer cannot charge a fee for a transaction that takes you over your credit limit unless you have opted in.8 Before you opt in, it must give you a separate notice of your right to do so, then confirm your consent in writing or electronically, and tell you on each statement that shows an over-limit fee that you can revoke the consent.8 Without your consent the issuer may still approve an over-limit transaction, but it may not charge a fee for it.8 You can revoke consent by any method the issuer offers for giving it.8
Every applicant gets an ability-to-pay check: an issuer may not open an account or raise a credit limit without considering your ability to make the required minimum payments based on your income or assets and current obligations.9 For applicants under 21, the application must be in writing, and the issuer must have financial information showing an independent ability to make the minimum payments, or a signed agreement from a cosigner, guarantor or joint applicant aged 21 or older who has that ability.9 On an account opened with a cosigner, the credit limit cannot rise before the cardholder turns 21 unless the cosigner agrees in writing to be liable for the increase.9
Limits on fees
During the first year after an account opens, the fees you are required to pay cannot total more than 25 percent of the credit limit in effect at opening.10 Late payment, over-the-limit and returned-payment fees, and fees you are not required to pay, are outside that cap.10
Penalty fees, such as late or returned-payment fees, must either reflect a reasonable proportion of the issuer’s costs for that type of violation or fall within dollar safe harbors that are adjusted for inflation.10 Several fees are banned outright:
- A penalty fee larger than the dollar amount associated with the violation.10 The official interpretation says that for a late payment, that amount is the required minimum payment due immediately before the fee, so the late fee cannot exceed that minimum payment.13
- A fee for a transaction the issuer declines, for account inactivity, or for closing or terminating the account.10
- More than one penalty fee based on a single event or transaction.10
What happened to the $8 late fee rule
The CFPB issued a final rule on credit card penalty fees on March 5, 2024, published it in the Federal Register on March 15, 2024, and gave it an effective date of May 14, 2024.12 The rule set a late fee safe harbor of $8 for card issuers that, together with their affiliates, have one million or more open credit card accounts, and kept the higher inflation-adjusted safe harbors only for smaller issuers.10 The CFPB’s rule page states that, as a result of ongoing litigation, the rule was stayed.12
The CFPB’s compliance page states that on April 15, 2025, the Credit Card Penalty Fees Final Rule was vacated pursuant to a court order in Chamber of Commerce of the United States of America, et al. v. Consumer Financial Protection Bureau, et al., No. 4:24-cv-00213-P.11
As of October 11, 2026, the eCFR text of 12 CFR 1026.52 still prints the 2024 rule’s $8 figure and lists the March 15, 2024 Federal Register document as the section’s latest amendment.10 The CFPB’s compliance page is where the Bureau records the vacatur.11
Sources
- 1
- 2
- 3
- 4
- 5
- 6 Electronic Code of Federal Regulations, 12 CFR 1026.10, Payments (Regulation Z) Checked Oct 11, 2026 · Back to text ↑
- 7
- 8
- 9
- 10
- 11
- 12 Consumer Financial Protection Bureau, Credit Card Penalty Fees Final Rule Checked Oct 11, 2026 · Back to text ↑
- 13
Has something changed? Report an error