Podcast: Payments Pros – The Payments Law Podcast
Episode: FTC’s Subscription Crackdown: What Payment Processors Need to Know
Host: Keith Barnett
Aired: August 6, 2026
Keith Barnett (00:04):
Welcome to another episode of Payments Pros, a Troutman Pepper Locke podcast focusing on the heavily regulated and ever-evolving payment processing industry. This podcast features insights from members of our fintech and payments practice as well as guest commentary from business leaders and regulatory experts in the payments industry. My name is Keith Barnett and I am one of the hosts of the podcast. Before we jump into today’s episode, let me remind you to visit and subscribe to our blog, troutmanpepperfinancialservices.com. And don’t forget to check out our other podcasts on troutman.com/podcasts. We have episodes that focus on trends that drive enforcement activity, digital assets, consumer financial services and more. Make sure to subscribe to hear the latest episodes.
(00:55):
Today I am going to discuss a recent lawsuit that was filed by the Federal Trade Commission over alleged unlawful subscription schemes. The FTC filed against 15 corporations and eight individuals in that lawsuit. Even though there were no payment processors, banks, money transmitters, none of them were sued, it still has significant payments related implications. And just to back up a little bit, the FTC’s alleged violations arise out of issues with the FTC Act and ROSCA. And if you have listened to our prior podcasts, you will know that the FTC under the Trump administration has really been leaning into ROSCA allegations in the payments industry. And in this particular case, the FTC obtained a temporary restraining order and asset freeze until the parties could have a full hearing on the issues.
(01:55):
So today, we’re going to discuss the allegations in the complaint, what the temporary restraining order prevents the defendants from doing during the course of the lawsuit and what this means overall in the payments industry. But once again, this is yet another example of the FTC continuing to bring investigations and enforcement actions against merchants that affect the payments industry. And here in the summary of what’s going on, we’re going to touch on Bank Secrecy Act compliance and as I mentioned before, the FTC Act and ROSCA. And in particular, the issues in this case concerned advertising that may be deceptive, recurring payments when the recurring nature of the payments were allegedly not disclosed to consumers, cancellation like when a merchant makes it too hard for a consumer to cancel recurring payments, and we are also going to talk about the extensive injunctive relief that the FTC has already received in this case.
(02:57):
So just to back up a second again, let’s get a high-level overview in looking at the basic facts of the case. I mentioned earlier that there were 15 corporate defendants. The companies were Cyprus limited companies, so they are incorporated in Cyprus and operating in Ukraine. The Cyprus subsidiaries marketed or still market, I guess, to US consumers and accessed US payment processing rails through their counterparts incorporated in Delaware. And each Delaware subsidiary is led by an individual residing in the United States. They work together, they meaning the defendants, both the corporate defendants and the individual defendants worked together according to the complaint to continually launch new product offerings, register new corporate identities and open new merchant accounts. According to the FTC’s complaint, these product offerings were deceptive. And also according to the FTC, the defendants received ill-gotten gains through cross-border transfers amongst these corporate affiliates. And the FTC said that they considered this to be ill-gotten and deceptive because they were able, they meaning the defendants, were able to conceal their true identities from consumers and hide their assets. According to the complaint, the defendants had defrauded consumers worldwide out of hundreds of millions of dollars by processing a majority of their transactions through a group of connected payment processor accounts with a payment processor in the US. And the FTC went on to allege that during a 12-month period, the total payment volume of the linked payment processor accounts in the US approached about $700 million.
(04:56):
The FTC alleged that the defendants had created and distributed dozens of varying products in their roles as merchant, but irrespective of the product, the defendants had a consistent playbook that can be broken down into about five stages. In the first stage, the defendants advertised personalized products for free or low one-time cost, often with a money-back guarantee. But according to the FTC, in reality, the defendants’ products were not personalized and they automatically converted into recurring subscriptions without the consumer’s permission. Second, the defendants’ ads directed consumers to websites that engaged consumers in a task. And what they mean by that is, for example, the merchants would offer quizzes online that would reinforce the impression that the product would provide the user with personalized results, and they could upload, edit documents and things of that nature to create incentive for the users to continue with the purchase of the product. Third, the FTC alleged that the defendants’ payment pages diverted attention from references to auto-renewing subscriptions or recurring charges. The pages created the impression of a low-cost, low-risk, single transaction and telling consumers that they needed to make a one-time payment, and they advertised money-back guarantees. The FTC alleged that the defendants failed to disclose material terms clearly and conspicuously, consistently relegating terms to the smallest print on the page or even omitting key terms entirely.
(06:47):
Fourth, the FTC alleged that the defendants made unauthorized charges even beyond the undisclosed subscription fees and at times double-charged consumers for the same product or added more products to the transaction without the consumer’s knowledge and consent. And then fifth and finally, and this is something that, as I mentioned earlier, the Trump FTC has really been focusing on, the FTC alleged that the defendants failed to provide simple mechanisms to stop recurring charges. And in fact, according to the FTC, the defendants did the opposite. They made cancellation difficult by among other things omitting cancellation options from their websites and apps or requiring the consumers to explain why they wanted to cancel. And even after confirming cancellation, the defendants continued charging or attempted to charge the users without authorization. And the FTC alleged that the defendants also refused to honor their money-back guarantees. So that was all alleged in the June 2026 lawsuit. And as I mentioned before, the FTC, within a couple of days, did receive a temporary restraining order and a hearing on the temporary restraining order was supposed to occur in early July.
(08:16):
That hearing did not occur because some of the defendants actually agreed to some form of injunctive relief while the lawsuit was pending. So we don’t have a complete settlement in the case as of the date of this recording, but the defendants agreed, subject to the court’s order, on certain things that I believe are pretty significant that I’d like to go over with you before we wrap up. First, the defendants agreed to the following. So they are prohibited from failing, I know it sounds like a double negative there, but failing to clearly and conspicuously disclose all material terms of a transaction. They are also prohibited from failing to obtain the consumer’s express informed consent before charging the consumer’s credit card, debit card, bank account, or any other financial account. And the defendants are prohibited from failing to provide simple mechanisms to stop recurring charges from being placed on the consumer’s credit card, debit card, bank account or other financial account. So that gets to the crux of the issues concerning the ROSCA-related allegations. But the stipulated consent temporary restraining order actually goes a little bit further.
(09:39):
Secondly, there is a prohibition on the release of customer information. And in particular, the defendants are prohibited from disclosing, using or benefiting from any type of customer information. So that includes the name, address, phone number, email address, Social Security number or any other identifying information or any other data that enables access to a customer’s account. The third significant part of this temporary restraining order is the asset freeze. And in particular, the defendants who signed the order are prohibited from transferring, liquidating, converting, encumbering, doing anything that would cause the disposition of any assets that are owned or controlled directly or indirectly by any of the defendants. And an asset freeze actually goes a couple of steps farther because not only are they not allowed to transfer, convert, encumber, pledge, or anything like that that they do own, but they’re also prohibited from opening or causing to be opened any safe deposit boxes, commercial mailboxes, storage facilities titled in the name of any defendant. And they are prohibited from incurring charges or cash advances on any credit, debit, ATM, any type of card or financial product in the corporate name. The other thing that I found was interesting is the fourth part of this restraining order, and that pertained to the duties of the asset holders or other third parties. Here, the FTC and the stipulating defendants agreed that any financial or brokerage institution, electronic data host, credit card processor, payment processor, merchant bank, acquiring bank, ISO, third-party processor, payment gateway, insurance company, business entity or anyone, so they want to make sure they covered the whole payments ecosphere, anyone who received actual notice of the order, they must hold, preserve and retain within their control and prohibit the withdrawal, removal, alteration or any relinquishment of any asset that was owned by the defendants and asset does include funds. So if you are a bank, payment processor, money transmitter, anyone that is holding funds belonging to any of the defendants, you are to, at least according to this order, if you get notice of it, you are to continue to hold on to it. And I would expect to see more of this as we go on in the future with respect to enforcement actions. So basically holding third parties to task into helping the government with their enforcement actions.
(12:38):
The fifth issue or the fifth part of the order requires each defendant to prepare and deliver to the FTC completed financial statements. And that is ‘cause the FTC wants to know where they are going to recover in the event of a final judgment. And it also will inform the FTC on the ability to pay if there is some sort of settlement agreement. Sixth part of the order that I want to discuss. Remember earlier during this podcast I talked about the fact that these corporations were based in either Cyprus or Ukraine. And so there is a section of this order entitled Foreign Asset Repatriation. And that part of the order requires each defendant to provide the FTC with a full accounting of all assets and accounts that are outside of the United States that are in their name or control and provide the FTC with access to those records and transfer all of those assets to the US. And again, presumably that is so the FTC can seize or satisfy any judgment with defendants’ assets. And on top of that, the defendants agreed that they cannot and will not do anything to hinder that transfer process.
(14:02):
The defendants must also report any new business activities to the FTC. And the reason for that part of the order, I’m going to assume, is to prevent the defendants from starting a new business under a different name and engaging in similar acts that are alleged in the complaint. So the FTC wants to shut that down during the pendency of the lawsuit and presumably afterwards. The next important part of the agreed-upon order, temporary restraining order, is that the parties agreed to expedited discovery. So instead of waiting the normal period of time to serve and respond to discovery, discovery is immediate and it’s on a shortened timeframe, in some instances within a few days. The interesting part of this part of the order is that I noticed that this expedited discovery also applies to third parties. So if you are one of those banks, processors or other vendors or business partners of any of the defendants, do not be shocked if you get some sort of expedited discovery request from the Federal Trade Commission.
(15:25):
Now, for what it’s worth, the order also does allow the parties some leeway. So even though depositions or deposition notices may be sent and conduct… And the depositions themselves may be conducted within a few days of service, there is leeway for the parties to extend that period of time. And presumably it is to assist with the third parties who actually have nothing to do with the case who would have to get geared up. This enforcement action shows that the FTC is still active in the payments and payment processing space and they’re going to continue to be active and enforce the FTC Act, enforce ROSCA, and focus on things that include BSA compliance, advertising that may be deceptive, recurring payments, cancellation. We’ll keep you posted on this case ‘cause at least for the time being, it looks like they are going to continue to litigate this case.
(16:23):
Now I’d like to thank our audience for listening to today’s episode. Do not forget to visit our blog, troutmanfinancialservices.com and subscribe so you can get the latest updates. Make sure to subscribe to this podcast via Apple Podcast, Google Play, Stitcher or whatever platform you use. We look forward to the next time.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided “as is,” with no warranty as to the accuracy or reliability. Please listen to the podcast for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.
