The way businesses take remote card payments is changing in France and the pressure on MOTO (Mail Order / Telephone Order) is increasing across industries. Hospitality is one of the sectors where the impact will be particularly significant.
From 10 September, the MOTO ceiling for hotels in France drops from €4,000 to €2,000 per card, per property, in any rolling 24 hours. It falls to €1,000 on 12 October and to €500 on 12 November, when the sectoral exemption that has covered hotels, airlines, car rental and travel agencies since June 2024 comes to an end.
Key measures for MOTO specifically:
- Restrict to necessary use only (Rec. 1) — Merchants must only accept MOTO for contracts genuinely subscribed remotely by phone/mail, and must use a proximity or secure internet payment instead whenever feasible (e.g., pay at delivery). MOTO should never substitute for what should be a customer-initiated internet (CIT) payment.
- Velocity limits (Rec. 3) — A cap on cumulative MOTO spend per card per merchant per rolling 24 hours:
- Set at €500 since 10 June 2024 for MOTO (this is a flat limit, unlike the internet-payment limit which has been ratcheted down toward ~€0.01)
- Issuers should reject (via soft decline where possible) transactions that would breach this.
- Sectoral exemptions being phased out (Appendix 2) — Many MCCs (hotels, airlines, car rental, travel agencies, insurance, telecoms, legal services, higher education, etc.) were originally exempt from the €500 velocity limit. These exemptions are being wound down in two waves:
- Group 1 (telecoms, utilities, insurance, legal, education, etc.): stepped down to €500 by 11 May 2026
- Group 2 (airlines, car rental, hotels, railways, travel agencies, catalogue sales, debt collection): stepped down to €500 by 12 November 2026
- Only mail/email catalogue sales (MCC 5965, non-internet) keeps a permanent exemption, since no authentication solution exists for paper-based orders.
- Priority merchant regime (Rec. 3a, Appendix 4) — Merchants with high MOTO fraud volume/rate relative to peers (fraud >€5,000/month AND >0.13% by value, flagged by 3+ of the 7 major French issuing PSPs in 4 of 6 months) get identified as “priority” and must submit a remediation action plan to Banque de France, or face a forced step-down to the €500 velocity cap.
- Individual derogations possible (Appendix 3) — A merchant seeing acceptance-rate damage can apply for a waiver if it can show a low fraud rate (<0.13%) or high refusal rate (>20%) plus credible anti-fraud actions.
- Data security (Rec. 4) — For telephone orders, merchants should route card data entry through a controller/voice-response system (keypad entry or voice recognition) rather than having an operator manually handle the card number.
- Future authentication push (Rec. 5) — The Observatory is encouraging experimentation with authentication for MOTO (e.g., mobile app push authentication, SMS OTP) and wants the payments ecosystem to develop a workable strong-authentication solution for telephone orders during 2026 — none currently exists.
Practical takeaway for a hospitality-facing business: hotels currently sit in the Group 2 exemption bucket, so MOTO phone bookings can keep using higher thresholds for now, but that exemption disappears on a fixed schedule ending November 2026.
Securely replace phone payments with Prommt:
Prommt offers a more secure alternative to MOTO payments.
A Prommt payment request is a fully authenticated 3D Secure transaction, so velocity limits do not apply. The guest completes the payment on their own device, authenticated by their own bank, which makes the transaction customer initiated and fully 3DS2 compliant. Because the authentication is performed by the issuer, fraud liability sits with the issuer rather than with the property. That places the transaction outside the scope of the Banque de France plan rather than putting it under a falling ceiling, so a deposit on a wedding block or a suite booking isn’t affected by the September to November step-downs.
