--- title: Custody, compliance and the cost of a fragmented stack | Ordr field report 01 description: Who owns the fan record, what “secure” has to mean in 2026, the reference architecture that keeps the funds path and the data path separate, and why the dispute math changed in April. --- [![Ordr](https://ordr.io/hubfs/New%20Ordr%20Pictures/brand-ordr-wordmark.png)Commerce Intelligence](https://ordr.io/?hsLang=io) Platform Solutions Research Customers [Schedule a demo](https://ordr.io/research/field-report-01#demo) [![Ordr Pay](https://ordr.io/hubfs/New%20Ordr%20Pictures/brand-ordr-pay.svg)](https://ordr.io/pay?hsLang=io)[**Merchant processing**Interchange optimised, gateway agnostic, no headline rate games](https://ordr.io/pay#processing)[**Virtual payments**Text to pay, email links, and a PCI compliant agent portal](https://ordr.io/pay#virtual)[**Agentic payments**Machine initiated purchase, on rails that already shipped](https://ordr.io/pay#agentic)[**Alternative payments**Wallets, PIN debit, pay by bank, and stablecoin settlement](https://ordr.io/pay#alternative) [![Ordr Insights](https://ordr.io/hubfs/New%20Ordr%20Pictures/brand-ordr-insights.svg)](https://ordr.io/insight?hsLang=io)[**Fan IQ**One fan profile across ticketing, concessions, retail, and premium](https://ordr.io/insight#fan-iq)[**Partner IQ**Attribution your partners can renew against, not impressions](https://ordr.io/insight#partner-iq)[**Transact IQ**Every rate, every downgrade, every overcharge, in one view](https://ordr.io/insight#transact-iq) Live**Fan IQ is live with Ticketmaster** Ticketing, entry, concessions, retail, and partner activation resolved to one fan. [Read the case study →](https://ordr.io/customers/ticketmaster?hsLang=io) #### By role [**Finance**Rate visibility, dispute exposure, and a close that lands the same night](https://ordr.io/solutions/finance?hsLang=io)[**Partnerships**Prove what an activation delivered before the renewal conversation](https://ordr.io/solutions/partnerships?hsLang=io)[**Ticketing**Join the seat to the sale without leaving your ticketing platform](https://ordr.io/solutions/ticketing?hsLang=io)[**Operations**One system across gate, counter, retail, and premium](https://ordr.io/solutions/operations?hsLang=io)[**Technology**One integration layer instead of nine vendor relationships](https://ordr.io/solutions/technology?hsLang=io) #### By moment [Gate and entry](https://ordr.io/solutions/moments#gate) [Concessions and retail](https://ordr.io/solutions/moments#concessions) [Premium and suites](https://ordr.io/solutions/moments#premium) [Partner activation](https://ordr.io/solutions/moments#partner) #### Field reports [**The 2026 Venue Payments Report**What changed at the counter this season, and what it cost](https://ordr.io/research#report)[**Custody, compliance, and the cost of a fragmented stack**Data ownership, card security standards, and dispute economics](https://ordr.io/research/field-report-01?hsLang=io)[**All research**Everything Ordr has published, with sources](https://ordr.io/research?hsLang=io) #### Company [**News**Announcements, partnerships, and coverage](https://ordr.io/news?hsLang=io)[**About Ordr**Who we are and why we built this](https://ordr.io/about?hsLang=io) Free**The 2026 Venue Payments Report** Built from network transaction data and interviews with finance leads across sports and live entertainment. [Get the report →](https://ordr.io/research#report) #### Proof [**Case studies**Named clubs, measured results, stated method](https://ordr.io/customers?hsLang=io)[**Vegas Golden Knights**55 bps off interchange and $82.5k in chargebacks recovered](https://ordr.io/customers/golden-knights?hsLang=io)[**Pittsburgh Penguins**A dozen vendors consolidated, 53% off processing in 60 days](https://ordr.io/customers/penguins?hsLang=io)[**Ticketmaster**The integration that joins the ticket to the counter](https://ordr.io/customers/ticketmaster?hsLang=io) #### Trust [**Trust and security**Certifications, architecture, and who owns the fan record](https://ordr.io/trust?hsLang=io)[**How we handle data**What we hold, why we hold it, and for how long](https://ordr.io/trust#custody) Trusted by**The clubs, the resorts, and the rails** NHL, AHL, CFL and WNBA clubs, MLS, a Las Vegas resort, and the platforms underneath them. [See the roster →](https://ordr.io/customers?hsLang=io) # *One fan, nine systems,**and the question**nobody puts *in writing*.* Every operator knows its payment data is fragmented. Far fewer can say, on paper, who owns the fan record once it leaves the turnstile. This report sets out the three things to require in writing from any payments partner, and why the dispute rules that changed in April make the question urgent rather than academic. [Get the technical pack →](https://ordr.io/research/field-report-01#demo)[Trust and security](https://ordr.io/trust?hsLang=io) Field report 0112 references ##### Scope North American arenasStadiumsMulti property operators ##### Subject Data custodyCard security standardsDispute economics ##### Published August 2026Ordr Technologies Inc. **11 min**Reading time **12**References, all linked **Aug 2026**Published **Free**No form in front of it ## The stack, not the rate. When a team puts payments out to tender, the document that comes back is priced in basis points. The problem it is meant to solve is not a pricing problem. 01**The same person appears as several people** The fan who bought the ticket in March and the fan who bought two beers in section 103 in October are, inside the operator's own systems, two different people. 02**Every channel has its own identifier** Ticketing on one platform, food and beverage on a second, retail on a third, premium on a fourth, parking on a fifth, CRM on a sixth. Each with its own merchant identifier, its own export format, and its own idea of what a customer record is. 03**The rate is the smallest line in the argument** A processor competing on interchange plus is competing on the smallest number in the operator's economics. The larger ones sit in reconciliation labour, in sponsorship inventory that cannot be priced because attribution is missing, and in renewals decided without knowing what a seat holder actually spends. On that last point there is a number. Forrester found that 76 percent of US B2C marketing executives who invested in sports sponsorship in 2024 struggle to calculate the ROI, while 39 percent planned to increase investment and 28 percent planned to enter the category for the first time. [Forrester, Q4 2024 CMO Pulse Survey](https://www.forrester.com/blogs/sports-sponsorships-surge-despite-fuzzy-roi). Money is going in faster than measurement is. ![A fan paying at a stadium concourse counter](https://ordr.io/hubfs/New%20Ordr%20Pictures/img-city-concourse-counter.jpg) ## Who owns the fan record. This is the question most payment vendors never answer in writing, and the one an operator should ask first. In Canada it has a precise legal answer, and the answer is not flattering to vendors who prefer to leave it vague. [See the custody model](https://ordr.io/trust#custody) ## The operator is the accountable party. Under PIPEDA, Schedule 1, Principle 4.1.3, an organisation is responsible for personal information in its possession or custody, including information transferred to a third party for processing, and must use contractual or other means to provide a comparable level of protection while that third party processes it. 01 ### A transfer is a use, not a disclosure The Office of the Privacy Commissioner has consistently treated a transfer to a service provider as a use by the organisation rather than a disclosure to a new owner. The information stays under the transferring organisation's control, and the service provider may use it only for the purposes for which it was originally collected. - **The operator sets the purpose** and owns the record. - **The processor is purpose limited by contract**, with comparable protection required for as long as it holds the data. - **Enriched records return to the operator's systems**, exportable in full on request or on exit. - **Four exclusions are worth checking clause by clause:** no resale, no cross client modelling, no marketing to the operator's fans, and no retention after termination beyond a stated window. Custody chainPIPEDA 4.1.3 ##### Fan Consents once, to the operator's terms ##### Operator Accountable organisationSets purposeOwns the record ##### Processor Purpose limitedComparable protectionReturns or deletes on exit ## Three instruments, one direction. Federal privacy reform in Canada is on its third attempt, and every version of it moves the same way. 01 **Bill C-27 died on the Order Paper** The bill that would have replaced PIPEDA's private sector rules did not survive the parliamentary session. It was the second attempt after 2020's Bill C-11. 02 **Bill C-36 was introduced on 15 June 2026** The Protecting Privacy and Consumer Data Act would repeal Part 1 of PIPEDA and replace it. Third attempt in six years, and substantially similar in shape to what came before. 03 **Bill C-15 received Royal Assent on 26 March 2026** The Budget 2025 Implementation Act No. 1 adds a data mobility framework to PIPEDA. Regulations are still to come, so it is not yet operative. Quebec's Law 25 is already fully in force with penalties in the same tier as GDPR. For any operator with Quebec resident fans, which is most Canadian sports and entertainment businesses, that is the effective floor today regardless of where federal reform lands. The practical implication for a procurement team is simple: write the custody model in controller and processor terms now, because that is where all of these instruments are heading. ## What "secure" has to mean. Security claims on payments websites have a language problem. "Bank grade", "enterprise grade" and "PCI aligned" are not standards. There are only a small number of statements here that mean something, and each has a date attached. v4.0.1Primary source The active PCI DSS version. v3.2.1 was retired on 31 March 2024, and v4.0.1 was published in June 2024 as a limited revision that added and removed no requirements. Any assessment conducted in 2026 is conducted against it. PCI Security Standards Council[Open the source →](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1) 31 Mar 2025 The date the 51 requirements that were future dated best practices in v4.0 became mandatory. A vendor describing itself as PCI compliant without naming a version and a validation date is describing nothing. PCI Security Standards Council[Open the source →](https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x) Type II The SOC 2 report enterprise buyers in regulated environments generally require. Type I is an opinion on design at a point in time. Type II tests whether controls operated over an observation window, typically six to twelve months. The complete sentence names type, window and criteria[See our position →](https://ordr.io/trust#certifications) So "we have SOC 2" is an incomplete sentence. The complete one names the type, the observation window, the criteria in scope, and the systems inside the boundary. The six questions that produce an answer, and the non answers to watch for, are on the [trust and security page](https://ordr.io/trust?hsLang=io). ## Section 04. Reference architecture. The single most useful thing a payments partner can publish is a topology, because it shows without adjectives which path the money takes, which path the data takes, and whether those paths are the same one. In the model below they are deliberately separate. **Capture** Card credential tokenised at the point of authorisation, across PIN pads, mobile checkout, kiosks, box office and online ticketing. No primary account number enters the team’s systems. **Funds path** Gateway orchestration, then the acquirer under the operator's own merchant identifiers, then the operator's own bank accounts. The operator stays merchant of record and settlement never passes through the intelligence layer. **Data path** A matching engine joins card present and card not present activity to one fan record, and writes the enrichment back to the operator's CRM, loyalty and sponsorship systems. **The test to apply** If removing the analytics product would require re-tendering payments, the two paths are not actually separate, and the operator's switching cost is higher than the contract suggests. [See the full topology →](https://ordr.io/trust?hsLang=io) ## The dispute math changed in April. Chargeback management has moved from a back office nuisance to a threshold problem with a date on it. On 1 April 2026 the Visa merchant excessive threshold under the Acquirer Monitoring Program dropped from 220 basis points to 150. 01**Compliant yesterday, in breach today** The Acquirer Monitoring Program consolidated the legacy Dispute and Fraud Monitoring Programs into a single ratio: reported fraud plus disputes divided by settled transactions. An operator comfortably inside the old ceiling can be outside the new one without changing a single operational practice. 02**Measured by count, which is the worst case for an arena** Because the ratio uses transaction count rather than value, a high volume game night carries proportionally more exposure than the same revenue spread across fewer, larger transactions. Acquirer level thresholds sit tighter still. 03**The obvious response makes it worse** Tightening fraud rules to decline more transactions shrinks the denominator without shrinking the numerator, which can push the ratio further out of compliance. The workable path is approving more legitimate transactions while reducing genuine disputes, and that requires transaction level evidence rather than a stricter rule. Threshold and programme structure from the [Visa Acquirer Monitoring Program fact sheet](https://corporate.visa.com/content/dam/VCOM/corporate/visa-perspectives/security-and-trust/documents/visa-acquirer-monitoring-program-fact-sheet-2025.pdf). Mastercard does not publish its numeric excessive chargeback thresholds, so this report does not state them. ## Evidence, and its basis. A report that argues for numbers over testimonials owes its own numbers a basis. Below is what Ordr has deployed, what was measured, and how each figure was produced, including where the measurement is weaker than we would like. 55 bps Average interchange cost reduction following a fee structure review and routing changes, measured against the trailing period under the prior provider. Vegas Golden Knights. Club reported, method documented[Read the case study →](https://ordr.io/customers/golden-knights?hsLang=io) 53% Reduction in processing costs within sixty days, following consolidation of more than a dozen vendors onto one platform. Pittsburgh Penguins. Club reported, method documented[Read the case study →](https://ordr.io/customers/penguins?hsLang=io) 80+ hrs Internal staff time per month previously spent on reconciliation and manual reporting. Self reported by the club's finance team, and labelled as such wherever it appears. Self reported[Read the case study →](https://ordr.io/customers/penguins?hsLang=io) Two further figures recovered from Ordr's earlier material, a 2.86 percent to 1.91 percent effective rate comparison and a $37,000 average annual saving, are deliberately absent from this report and from the rest of this site. Neither states across how many merchants or over what period it was measured. Until they do, they are not publishable by the standard this document is asking operators to apply. ## Method and disclosure. Regulatory and card network statements in this report are drawn from primary sources where available, and from named secondary analysis where a primary source is paywalled or not public. Every such statement carries a reference and a date, because each is a moving target. Card network thresholds have changed twice in eighteen months, and Canadian federal privacy legislation is on its third attempt at reform. ### References 1. PIPEDA, Schedule 1, Principle 4.1.3. *Justice Laws Canada*. [Open →](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-7.html) 2. Guidelines for processing personal data across borders. *Office of the Privacy Commissioner of Canada*. [Open →](https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/) 3. Bill C-36, the Protecting Privacy and Consumer Data Act, introduced 15 June 2026. *Fasken*. [Open →](https://www.fasken.com/en/knowledge/2026/06/bill-c-36) 4. Bill C-15, Budget 2025 Implementation Act No. 1, Royal Assent 26 March 2026. *Parliament of Canada*. [Open →](https://www.parl.ca/documentviewer/en/45-1/bill/C-15/royal-assent) 5. Amendments to PIPEDA add data mobility. *McCarthy Tetrault*. [Open →](https://www.mccarthy.ca/en/insights/blogs/techlex/move-it-move-it-amendments-to-pipeda-add-data-mobility) 6. PCI DSS v4.0.1 published. *PCI Security Standards Council*. [Open →](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1) 7. The future dated requirements of PCI DSS v4.x became mandatory 31 March 2025. *PCI Security Standards Council*. [Open →](https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x) 8. Visa Acquirer Monitoring Program fact sheet. *Visa*. [Open →](https://corporate.visa.com/content/dam/VCOM/corporate/visa-perspectives/security-and-trust/documents/visa-acquirer-monitoring-program-fact-sheet-2025.pdf) 9. What is the true cost of a chargeback. *Mastercard, updated June 2026*. [Open →](https://www.mastercard.com/global/en/news-and-trends/Insights/2025/what-s-the-true-cost-of-a-chargeback-in-2025.html) 10. Sports sponsorships surge despite fuzzy ROI. *Forrester, Q4 2024 CMO Pulse Survey*. [Open →](https://www.forrester.com/blogs/sports-sponsorships-surge-despite-fuzzy-roi) 11. Archtics season ticketing and Archtics Transaction Services. *Ticketmaster developer docs*. [Open →](https://developer.ticketmaster.com/products-and-docs/apis/season-ticketing/) 12. Cost of a Data Breach Report 2025. *IBM*. [Open →](https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai) Deployment figures are Ordr's own, from client engagements, with the basis of each stated above. Ordr is a commercial payments and data platform for live event operators and this report argues for a position its product is built to serve. Weigh it accordingly and verify the regulatory claims independently. Every one of them is publicly checkable, which is the point. Last reviewed August 2026. ## Take Section 03 with you. The six questions in this report work on any payments vendor, ours included. Ask us first if you like. The technical pack answers all of them in writing. > Switching to Ordr was one of the smartest and easiest decisions we've made. By moving our payments under Ordr, we gained visibility into hidden costs and started unlocking valuable, revenue-driving data. **Mike Dillon**Chief Financial Officer, Pittsburgh Penguins First name Last name Work email Organisation Phone optional How can we help?Choose oneLower what we pay in card feesTake payments away from a terminalGet usable data out of our transactionsProve what our partners actually deliveredReplace several vendors with oneSomething else, or not sure yet Request the technical pack We use this to route you to the right person. No sequence, no drip. ### Thank you. Your request is in. Someone from Ordr will reply directly, usually within one business day. [![Ordr](https://ordr.io/hubfs/New%20Ordr%20Pictures/brand-ordr-wordmark.png)](https://ordr.io/?hsLang=io) The commerce intelligence layer for sports and live entertainment. One ledger across ticketing, the counter, retail and premium. #### Platform [Ordr Pay](https://ordr.io/pay?hsLang=io)[Merchant processing](https://ordr.io/pay#processing)[Virtual payments](https://ordr.io/pay#virtual)[Agentic payments](https://ordr.io/pay#agentic)[Alternative payments](https://ordr.io/pay#alternative)[Ordr Insights](https://ordr.io/insight?hsLang=io)[Fan IQ](https://ordr.io/insight#fan-iq)[Partner IQ](https://ordr.io/insight#partner-iq)[Transact IQ](https://ordr.io/insight#transact-iq) #### By role [Finance](https://ordr.io/solutions/finance?hsLang=io)[Partnerships](https://ordr.io/solutions/partnerships?hsLang=io)[Ticketing](https://ordr.io/solutions/ticketing?hsLang=io)[Operations](https://ordr.io/solutions/operations?hsLang=io)[Technology](https://ordr.io/solutions/technology?hsLang=io)[By moment](https://ordr.io/solutions/moments?hsLang=io) #### Customers [Case studies](https://ordr.io/customers?hsLang=io)[Vegas Golden Knights](https://ordr.io/customers/golden-knights?hsLang=io)[Pittsburgh Penguins](https://ordr.io/customers/penguins?hsLang=io)[Ticketmaster](https://ordr.io/customers/ticketmaster?hsLang=io)[Trust and security](https://ordr.io/trust?hsLang=io) #### Company [About Ordr](https://ordr.io/about?hsLang=io)[News](https://ordr.io/news?hsLang=io)[Research](https://ordr.io/research?hsLang=io)[Venue Payments Report](https://ordr.io/research#report)[Schedule a demo](https://ordr.io/research/field-report-01#demo) © 2026 Ordr Technologies Inc. [Privacy](https://ordr.io/privacy?hsLang=io) [Terms](https://ordr.io/terms?hsLang=io) [Trust and security](https://ordr.io/trust?hsLang=io)