Multi-Merchant CE 3.0: The End of the Data-Poor Merchant’s Excuse

For two years, Visa’s Compelling Evidence 3.0 (CE 3.0) rewarded merchants who already had a paper trail. If you could show two undisputed transactions from the same customer, between 120 and 365 days apart , matching on identifiers like IP address or device ID, you could push liability for a fraud dispute back onto the issuer. Visa introduced the rule in April 2023 to fight friendly fraud in card-not-present transactions, at a time when card-not-present sales had grown 51% between 2019 and 2021 while disputes rose 29%, with roughly 80% of those disputes tied to fraud claims, according to Visa’s own figures cited by the Merchant Risk Council.

The mechanism worked. The problem was who could use it.

A merchant history requirement sounds neutral until you notice who it excludes. A SaaS company billing annually has, at best, one prior transaction with most customers. A marketplace seller might only see a buyer once. A new merchant onboarding first-time customers has no history to draw on at all. These merchants could have a completely legitimate, high-integrity relationship with a customer and still fail CE 3.0 purely on data depth. The rule never asked whether the customer was trustworthy. It asked whether the merchant had two matching timestamps.

What Actually Changed with CE 3.0

That constraint is now gone. Effective October 24, 2026, Visa will expand CE 3.0 to accept purchase history across more than one participating merchant, not just the merchant fighting the dispute. A customer’s undisputed transaction history with a completely different merchant can now help establish the pattern Visa is looking for.

This builds on two changes that came earlier. Starting October 17, 2025, Visa began automatically qualifying transactions for CE 3.0 through Visa Secure and Visa Data Only, meaning some disputes get defended using authentication data already flowing through the network rather than evidence a merchant has to assemble by hand. Then, starting April 17, 2026, Visa introduced a fee for each successful qualification, which is worth noting because the tool that reduces your liability is no longer free.

None of this works without tokenization. Card numbers do not survive the normal life of a payment relationship. Reissues after fraud, expirations, wallet provisioning, and processor migrations all break the old identifier a merchant might use to link one purchase to the next. Industry estimates put annual card reissue rates at 33% to 40%. Network tokens solve that by staying bound to the customer relationship even as the underlying card number changes, which is also why Visa reports a 4.6% lift in authorization rates on tokenized card-not-present transactions and Mastercard reports 2.1%. Without that persistence layer, cross-merchant identity matching would fall apart within a year for most customers.

Who This Actually Helps

The winners are obvious once you say them out loud. Subscription and annual-billing businesses that could never accumulate two transactions in a 120 to 365 day window on their own can now inherit continuity from a customer’s activity elsewhere in the network. Marketplaces with thin repeat-purchase data per individual seller get access to a behavioral signal that used to require volume they didn’t have. A newly onboarded merchant with a first-time customer who has a long, clean history everywhere else is no longer starting from zero.

Put concretely: a $2 million annual-revenue SaaS company that renews customers once a year finally gets access to the kind of proof a high-frequency ecommerce merchant has taken for granted since 2023.

Who CE 3.0 Still Leaves  Behind

The catch is that none of this is automatic. A merchant only benefits if their processor actually captures and passes the underlying data, device fingerprints, IP addresses, and tokenized credentials, into the transaction flow. Merchants on older gateways, or PSP integrations that were never built to pass authentication context, get nothing from this expansion even if their customers are legitimate. The old disadvantage was volume. The new one is integration.

That is a meaningfully different problem to solve. Volume is structural and slow to change. Integration is a checklist item. A merchant can fix it this quarter by asking one question of their processor: does our setup pass the data elements Visa needs for CE 3.0 qualification, including through Visa Secure and network tokens, or are we relying on evidence we assemble by hand after the fact.

The Decision That Matters Now

Evidence quality used to be the differentiator. A well-organized rebuttal with the right documents beat a sloppy one. That still matters at the margins, but it is no longer the thing separating merchants who win disputes from merchants who lose them by default. Network integration is. A merchant who never invested in evidence formatting but is fully wired into Visa Secure, tokenization, and Order Insight is now better positioned than a merchant with a polished representment process sitting on a legacy gateway.

The practical move is to stop treating CE 3.0 as a dispute-response tactic and start treating it as an infrastructure question. Ask your acquirer or PSP directly whether your transaction flow is passing the identifiers that make multi-merchant qualification possible. If the answer is no, the fix is not a better evidence template. It is a technical integration you should already be scoping.