Visa CE 3.0 Update: The Same-Processor Limit

Q: Does this mean my fraud dispute will be denied?

No. CE 3.0 is an all-or-nothing test. If any condition fails — including the same-acquirer condition — the rule does not apply.

The short answer: multi-merchant prior purchases are now in effect for Visa disputes processed on or after October 24, 2026 — but the acquirer "must only submit Transaction data accepted and processed by that Acquirer." Priors from stores on a different processor do not count, and a merchant cannot reach into another merchant's customer records. If your dispute is denied on CE 3.0 grounds, the first question is not whether the priors exist — it is whether they came from the same processor.

Now in effect: what changed on October 24

Visa's Compelling Evidence 3.0 (CE 3.0) expansion is now live. For Visa card-absent fraud disputes (Dispute Condition 10.4) processed on or after October 24, 2026, a merchant defending a claim may rely on two earlier, undisputed purchases made at one or more merchants — not only at its own store. Before that date, the two earlier purchases had to be at the defending merchant. Our original live guide, Visa CE 3.0 Is Now Live, covers the full rule; this update corrects the reading that most summaries invite, because the expansion is narrower than "any purchase anywhere counts."

One honest sourcing note first: Visa's full rulebook is not freely published online. The October 24 date and the same-acquirer limit below are taken from secondary summaries that quote Visa's April 18, 2026 rulebook edition directly — principally Pulse, which states it worked from that edition, Candidyak, and Chargeflow, which cites section 11.7.5.3, Table 11-28 and footnotes 8–9, and section 11.7.5.6, Table 11-31. Where this article quotes Visa's wording, it is quoting those summaries' quotation of the rulebook, labelled as such. Confirm the details with your acquirer before relying on them in a live dispute.

The limit that matters: same acquirer only

Visa's rulebook states, as quoted by both Pulse and Candidyak, that an acquirer "must only submit Transaction data accepted and processed by that Acquirer." That single sentence is the whole constraint on the expansion:

Same processor, not same store. The two earlier purchases may be at other merchants — but only merchants whose transactions the defending merchant's acquirer (payment processor) itself accepted and processed.
A purchase on a different processor is useless as CE 3.0 evidence, however well it matches on device, IP or address. The merchant's acquirer cannot submit data it never handled.
No access to other merchants' customer records. As Chargeflow puts it, the rule change "does not give you access to another merchant's customer records." What travels is transaction data the acquirer already holds — not a rival store's order history.
At pre-arbitration the limit bites hardest. Pulse's headline makes the point explicitly: priors can come from other merchants, "and in Pre-Arbitration Only From Ones Your Acquirer Processed." A merchant whose acquirer cannot assemble multi-merchant data gains nothing from the expansion in practice, whatever the rulebook allows in theory.

That is why the expansion helps large-processor merchants most and changes little for a merchant on a small or niche acquirer: the benefit is bounded by the acquirer's own transaction footprint, not by the cardholder's shopping history.

The other conditions did not change

The expansion changed where the two earlier purchases may come from. It did not relax anything else. The merchant must still show: two earlier transactions on the same card or an associated credential (such as a token) that were not reported to Visa as fraud; each more than 120 days and no more than 365 days before the dispute is processed; at least two matching data elements, one of which must be the device ID/fingerprint or the IP address; and, per Chargeflow's reading, device ID and device fingerprint count as similar elements, not two independent matches. Visa excludes Chile from the expanded rule, according to Chargeflow. The rule still applies only to 10.4 card-absent fraud disputes — not to not-received, not-as-described or cancelled-subscription claims — and it still does not change the federal $50 liability cap for unauthorised credit-card use.

What to ask your bank or acquirer

Consumers: if your bank cites CE 3.0, ask in writing which two transactions it means, their dates, and — the question this update adds — how the bank verified that both were accepted and processed by the same acquirer as the defending merchant. If either prior came from another processor, the rule does not apply.
Merchants: ask your acquirer in writing whether it can submit multi-merchant CE 3.0 data at all, and for which of your disputes. Do not assume a first-time customer is now defensible until the acquirer confirms it can assemble the evidence.
Everyone: check the 120–365-day window and the matching elements first. A same-acquirer prior that is too recent, too old, or matched only on delivery address still fails.

FAQ

Can a merchant use my purchases at any other store?

No. Only purchases accepted and processed by the same acquirer as the defending merchant count. Purchases on a different payment processor do not count.

Does this mean my fraud dispute will be denied?

No. CE 3.0 is an all-or-nothing test: two qualifying priors, in the 120–365-day window, with the required matching data, from the same acquirer. If any condition fails, the rule does not apply, and your federal unauthorised-use protections still apply regardless.

Is the Visa rulebook itself publicly available?

Not in full. This article relies on secondary summaries quoting Visa's April 18, 2026 rulebook edition, labelled as such above. Confirm the details with your acquirer before relying on them in a live dispute.