My take (from a brief stint with a debit card issuer): This is about the chilling effect of regulator's behavior. Compliance is expensive, hard, and detailed.

My take (from a brief stint with a debit card issuer): This is about the chilling effect of regulator's behavior. Compliance is expensive, hard, and detailed. And if you fuck it up, it can sting very badly. Financial companies get away with a whole hell of a lot in America, but they can still get very expensive fines, and whole departments exist to mitigate this risk. Financial software engineering is precisely as poor as you think it was. In 1985. Forget the scary stuff they build on purpose. The real fear is the scary stuff you didn't realize you built until an auditor finds it. You don't ever want to do the kind of thing that causes an auditor to say "let's examine this closer", even if that thing is ultimately legal for reasons X and Y. You want the system to pass inspection with the minimum amount of scrutiny. Being genuinely compliant for many types of nuanced clients is great. But it's a lot cheaper, and a lot safer, to be strictly compliant for limited types of generic clients. When you support services like this, you put a target on your back[0]. Mastercard and Visa are like Palantir. They're not innocent, but they're single nodes in a large machine that you'll never hear about because it doesn't interface directly with the public, and so they get all the shit because nobody knows where else to send it. Payment processors like FIS, the many institutions that issue cards through the card companies processed by the processing companies, they all have their own shaky infrastructure and compliance fears. No one org decides to shaft the public. They're all covering their asses. As a result, the set of industry best practices converges on the safest common denominator. You want them to risk millions in fines and investigation that unearths more skeletons so you can host gifs of boobs? Through services where margins are measured in basis points? Good luck. TLDLR: Visa and Mastercard are following orders from America, and behaving sanely given a corporation's fiduciary duty to not die. The correct place to attack this is with regulation that mandates equal access. Or better yet, blind access. Again, good luck. [0] https://en.wikipedia.org/wiki/Operation_Choke_Point https://en.wikipedia.org/wiki/Operation_Choke_Point