FTC Debanking Warning Letters: What PayPal and Stripe Were—and Were Not—Told

On March 26, 2026, Federal Trade Commission Chairman Andrew N. Ferguson sent warning letters to the CEOs of PayPal, Stripe, Visa, and Mastercard concerning what the agency announcement called the debanking of American consumers.

The letters are important supervisory signals for nonbank payment companies. They are not findings that any recipient violated the law.

August 17, 2026 status correction

The FTC’s primary release uses careful language: the letters warn that certain debanking conduct may violate the FTC Act. The public record does not support describing the letters as prosecutions, final Commission determinations, or new binding account-closure regulations.

The release also links separately to the four letters. Firms should not attribute a detailed request, deadline, or factual finding to a letter without reading that specific document.

What the FTC announcement says

The announcement identifies two related concerns:

1. payment companies may deny or limit services because of a person’s political or religious beliefs; and
2. a company’s debanking practices may be inconsistent with its stated policies or a customer’s reasonable expectations.

Chairman Ferguson said such conduct may implicate Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in or affecting commerce. That is a warning about potential legal exposure—not an adjudicated conclusion about PayPal, Stripe, Visa, or Mastercard.

What the letters did not do

The letters did not, by themselves:

• commence an administrative complaint;
• impose a civil penalty;
• enter a consent order;
• establish that a recipient violated Section 5;
• create a universal pre-closure notice period;
• require a particular appeal process; or
• amend the FTC Act.

A recipient may face follow-up, and the letters can inform future enforcement analysis. But compliance content should preserve the difference between a warning, an investigation, a complaint, and a final order.

The Section 5 risk to review

Two familiar Section 5 concepts are relevant to the risk signaled by the announcement.

Deception risk

A deception issue may arise when a material representation or omission is likely to mislead a reasonable consumer. For a payment company, the review question is whether published terms, account-closure explanations, and support communications accurately describe how restrictions and terminations are decided.

Unfairness risk

An unfairness analysis is fact-specific and governed by the FTC Act. A prudent review should examine consumer injury, avoidability, and countervailing benefits rather than assuming that every termination—or every unpopular customer—is an unfair practice.

The Chairman’s warning letters do not eliminate lawful fraud, sanctions, anti-money-laundering, credit, network, or safety controls. They reinforce the need to connect an adverse action to a documented, consistently applied basis.

A practical account-restriction review

The following controls are risk-management recommendations, not requirements created by the March letters.

1. Map policy to decision logic

For each acceptable-use or account-closure provision, identify the operational rule, data source, decision owner, and exception process. Flag reasons used in practice that do not appear in customer-facing terms.

2. Test consistency

Sample restrictions and closures across products, customer types, and decision channels. Confirm that similar facts receive similar treatment and that overrides are documented.

3. Review notices for accuracy

Where a notice is lawful and appropriate, ensure the stated reason reflects the actual basis for the action. Coordinate with counsel on disclosures that could compromise fraud prevention, sanctions, anti-money-laundering, or security controls.

4. Create an escalation path

Provide a defined route for complex or high-impact cases to reach legal, compliance, fraud, sanctions, or senior risk personnel. An escalation path is especially important where automated signals do not explain the full context.

5. Reconcile appeals with the original record

If the company offers review or appeal, preserve the original rationale, new evidence, reviewer, decision, and timing. Use appeal outcomes to identify rules that are too broad, poorly disclosed, or inconsistently applied.

Separate the Decision Basis From the Customer Message

The internal basis for an account restriction and the explanation that can lawfully be sent to a customer are related but not always identical. Fraud, sanctions, anti-money-laundering, security, legal-process, and network-rule considerations may limit what can be disclosed.

That constraint should not produce a blank internal record. Preserve:

• the specific policy or legal basis used;
• the facts and data that triggered review;
• whether the outcome was automated, human, or combined;
• each exception or override considered;
• the customer-facing reason actually sent;
• the legal or security reason for withholding any detail;
• the decision maker and approval level; and
• the date, duration, and review trigger for a restriction.

This separation allows compliance to test whether practice matches published terms without assuming every internal signal belongs in a notice. It also helps reviewers identify vague customer messages that conceal an unsupported decision rather than a legitimate disclosure constraint.

Test Outcomes, Not Just Written Policy

A policy can prohibit arbitrary treatment while production rules create it. Build a sample that covers more than closed accounts:

For each sampled action, trace customer terms to the operational rule, underlying evidence, decision, communication, and any appeal. Test whether similarly situated cases were handled consistently and whether the stated reason remained accurate after later review.

Do not use a simple closure-rate target as proof of compliance. A lower rate can hide failure to act on fraud or sanctions risk; a higher rate can reflect either genuine risk or an overbroad rule. Useful monitoring combines outcome counts with reason codes, reversals, complaints, control exceptions, unsupported decisions, and time to resolve reviews.

Keep Separate Regulatory Threads Separate

The March warning letters concern potential FTC Act risk as framed by the Chairman. They do not erase other obligations or turn every risk-based restriction into unlawful “debanking.” A decision may also require analysis under sanctions, anti-money-laundering, credit, consumer-finance, privacy, network, contract, or state law, depending on the entity and product.

For banks, the OCC and FDIC reputation-risk rule update is a separate supervisory development; it should not be presented as the legal basis for the FTC letters or automatically extended to every nonbank platform. Likewise, feed complaints and appeal reversals into a documented consumer complaint management process without implying that a CFPB examination manual governs every FTC recipient.

The practical control is an authority map. For each product and legal entity, identify the governing rule or obligation, the responsible decision team, the information that may be disclosed, the escalation path, and the evidence retained. When two duties pull in different directions, record the counsel-reviewed resolution instead of forcing one generic global closure script.

Governance for Rules and Exceptions

Assign ownership separately for customer terms, operational decision rules, model or vendor inputs, notices, appeals, and legal restrictions. Require change review when a new reason code, data source, prohibited-use category, or automated threshold is introduced.

Exception reporting should reach a body that can compare legal, compliance, fraud, sanctions, customer, and commercial effects. Preserve the decision, rationale, affected population, testing plan, and sunset or reapproval date. The objective is not to eliminate judgment; it is to make judgment reviewable and consistent with what the company represented.

Evidence worth preserving

A defensible file ordinarily includes:

• the applicable terms and version in force;
• the factual triggers and data used;
• automated and human decision records;
• the identity and authority of the decision maker;
• customer communications;
• escalation or appeal records; and
• any legal restriction on the detail the company could disclose.

This evidence helps a firm evaluate whether practice matches policy. It does not guarantee the FTC’s view of a particular case.

Preserve policy, rule, model, and notice versions with effective dates. Without version history, a reviewer cannot reliably compare the customer’s experience with the terms and controls that actually governed the decision.

Bottom line

The March 2026 communications were warning letters from the FTC Chair. They signal potential Section 5 scrutiny of payment-company debanking practices, especially where actual treatment diverges from published terms or customer expectations. They do not establish a violation or impose a new universal closure procedure.

Primary sources

• FTC press release: Chairman Ferguson Issues Warning Letters to CEOs of PayPal, Stripe, Visa and Mastercard (March 26, 2026)
• FTC warning letter to PayPal Holdings, Inc.
• FTC warning letter to Stripe, Inc.
• 15 U.S.C. § 45, Unfair methods of competition and unfair or deceptive acts or practices

This article is for general informational purposes and is not legal advice. Account restrictions may implicate other legal and regulatory duties that require fact-specific analysis.