Would card agreements need to be updated to reflect the new VISA Account Updater?

No. Your card agreement should already have a confidentiality clause which states that you share information for the purpose of servicing the account. Any notification that you provide is a matter of customer service and education about the features and benefits of the card and to try and head any complaints off at the pass.

I cannot find anything regarding the ability for the customer to opt out in VISA's rules. Did VISA require this or is it just recommended?

There is nothing in VISA rule 8.5.1.3 that states a cardholder opt-out is required. You may elect to from a customer service perspective. I also know of at least one forms vendor that is hawking opt-out verbiage and notices trying to convince their clients to purchase to send to their customers.

The reputation risk the bank faces is that the current consumer perception with respect to recurring payments is that they can "cancel" by terminating the card rather than contacting the merchant directly. Guess who gets the blame when their strategy backfires and the health club starts charging the new card?

We also offer mastercard credit cards. Do you know if their rule requires the opt out option?

Thanks,

Nothing in Mastercard rule 5.6 states anything about opt-out requirements.

That is what I thought. Thank you for your help.

So, do we need to notify our customers of this? It sounds like we don't have to give them the right to opt-out. Are you considering the updating of the card information to the merchant (through Visa or MC) to be a servicing process? Trying to make sure we do not need to update our privacy policy if we only share for servicing purposes.

There is no need to update a privacy notice because the Reg P features the same exclusion regarding the sharing of information to service an account. I have done some additional research into the rules cited above. It appears that in the update codes that we must submit to VISA/Mastercard there are codes to notify the merchant that the consumer elected not to participate in the program. The VISA code is titled "Contact Customer" advising the merchant that they must reach out to the customer to get updated information. The Mastercard rule states that specific information is available by reviewing the Automatic Billing Updater Reference Guide which is only available to member banks through the Mastercard Connect portal so I do not have access to that document.

This indicates that we have the ability to accept a customer opt-out, but I have yet to have a client or a card processor provide a specific citation from a VISA or Mastercard bulletin showing where we must proactively offer the opt-out option.

Thanks Brian. I'm not even sure if our core processor has the ability to notate an opt-out for a customer, so we're looking into that. I'm also trying to get a copy of the MC guide you referenced.

Our forms vendor is trying to sell us the opt-out notice. At this point, we are not even sure our processor allows that. We are still looking into it.

With this update, are we required to update our Reg E EFT disclosure?

Your Reg E disclosure already has a "Confidentiality" section under 1005.7(b)(9) which states that you will share information for the purpose of servicing the account. VAU falls under the same category as sharing account balances so that merchant can obtain approval/decline responses. There is no required update to your Reg E disclosure.