Federal law sets a floor for every gift card sold in the United States: cards generally must stay usable for a minimum validity period set by federal law, which is several years from activation, and issuers can’t charge dormancy or inactivity fees until 12 months have passed without use. States frequently go further, adding their own rules on cash redemption, escheatment and fraud prevention, so the real answer to “is my card legal?” often depends on which state you’re standing in.
TL;DR:
- Federal gift card rules set a minimum validity period of at least five years from activation, with a 12-month inactivity fee ban, but state laws often impose stricter requirements.
- Some states require cash redemption for small remaining balances and impose longer unclaimed property timelines, making multi-state compliance complex.
- Proper operational controls, such as tamper-evident packaging and staff training, are crucial because legal compliance alone does not prevent fraud or reconciliation issues.
- Businesses should draft gift card terms based on the strictest state laws they sell into and ensure disclosures are visible at both sale and point of sale.
- Monitoring legislative changes regularly and automating recordkeeping through tools like Riddlio can significantly reduce compliance risks and streamline reconciliation.
Table of Contents
- Gift card laws USA: the federal baseline under the CARD Act
- State gift card laws: where the rules get stricter
- Turning the rules into compliant card terms
- A compliance checklist built for how gift card programs actually run
- Who enforces gift card law, and what happens when businesses get it wrong
- Where to verify gift card law yourself
- Why operational controls matter as much as the legal wording
- How Riddlio supports gift voucher operations for venues
- Sources
- FAQ
Gift card laws USA: the federal baseline under the CARD Act
The Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act) is the reason every gift card you buy at a US retailer carries a distant expiry date, if it carries one at all. Before 2009, some cards expired within months of purchase, and dormant balances quietly evaporated into fees. The CARD Act stopped that outright, setting a federal minimum validity period requirement that applies nationwide.
The rule sounds simple, but the mechanics matter. The federally mandated validity period clock starts from the date of activation, not the date of purchase or the date the card was loaded with funds. If you buy a card in December and don’t activate it until January, the countdown starts in January. That distinction trips up plenty of retailers when they’re drafting terms.
The implementing regulation, 12 CFR §1005.20, fills in the detail the statute leaves out. It’s the rule the Consumer Financial Protection Bureau (CFPB) enforces, and it covers three broad categories of card:
- Store gift cards issued by a single retailer, redeemable only there.
- General-use prepaid cards carrying a Visa, Mastercard, American Express or Discover logo, usable anywhere that network is accepted.
- Gift certificates, which can be paper or electronic and function similarly to store cards for legal purposes.
Each category has slightly different disclosure obligations, but the core protections (non-expiry and fee limits) apply across the board with a handful of exceptions.
What must be disclosed, and where
12 CFR §1005.20 doesn’t just say “disclose the terms.” It specifies where the disclosure has to physically live. For a card with an expiration date, the card itself must state that date clearly, along with a toll-free number or website where the holder can get a replacement if it does expire and unused funds remain. Pre-purchase disclosures (on packaging or on the website at the point of sale) must cover any fees, the expiry policy, and how to check the balance.
This is where the FTC’s gift card guidance becomes useful for both sides. Retailers use it to sense check their card copy. Buyers use it to know what they’re entitled to see before they hand over cash.
Fee rules: the 12 month inactivity floor
Dormancy, inactivity and service fees are banned outright unless the card has sat unused for at least 12 consecutive months. Even then, the FDIC notes that issuers can charge only one such fee per month, and the fee must be disclosed before purchase, as required by federal regulation. A retailer can’t bury a “$2 monthly maintenance fee after six months” clause in fine print on the back of the packaging. It has to be visible, and it has to respect the 12-month floor regardless of how it’s worded.
A few practical examples clarify where the boundaries sit:
- A $50 department store gift card must remain redeemable for at least five years and can’t carry a maintenance fee until 12 months of inactivity have passed.
- A reloadable open-loop prepaid card carrying a network logo faces the same core rules, though some reloadable products fall under separate exemptions if they’re not marketed or sold as gifts.
- A promotional or loyalty reward card, given away rather than sold, often sits outside the CARD Act’s protections entirely, because the statute is aimed at cards purchased with consideration exchanged for value. Employee-incentive cards frequently fall into a similar grey zone, which is why many states address them separately in their own statutes.
Those exceptions matter more than most businesses realise. Get the classification wrong, treat a promotional card like a purchased one or vice versa, and you can end up either over-complying (costly) or under-complying (a compliance headache waiting to surface).
State gift card laws: where the rules get stricter
Federal law is the floor, not the ceiling. Once you know the CARD Act baseline, the harder question for any US business is which of the 50 states adds extra obligations on top of it, and that’s where a lot of gift card programmes quietly fall out of compliance.
States tend to diverge along four main axes:
- Cash-back thresholds. A number of states require merchants to redeem the remaining balance of a low-value gift card in cash once it drops below a set amount, so a customer isn’t left holding a card worth $1.20 forever.
- Escheat and unclaimed property timelines. Some states require unredeemed balances to be remitted to the state after a dormancy period; others exempt gift cards from escheatment entirely.
- Stricter non-expiry rules. A handful of states ban expiration altogether, going beyond the federal five-year floor.
- Fraud-prevention requirements. Newer laws mandate tamper-evident packaging, point-of-sale warnings and staff training aimed at gift card scams.
Representative state examples
Florida’s approach shows how far a state can push past the federal minimum. Under F.S. 501.95, gift certificates generally cannot expire and cannot carry post-sale fees at all, not just within the first year, with narrow carve-outs for charitable promotions and certain employee-incentive programs. That’s materially stricter than the federal five-year rule, and it means a national retailer’s standard card terms have to be adjusted for Florida customers or drafted to meet the stricter standard everywhere.
California takes a different tack, focusing on cash redemption rather than an outright expiry ban: cards with small remaining balances must be redeemable for cash so the value doesn’t get trapped. Delaware, by contrast, is known for aggressive unclaimed property enforcement generally, which shapes how companies incorporated there think about gift card liability on the balance sheet, not just at the point of sale.
The NCSL’s state-by-state table is the fastest way to check where a given state lands. Cash-back thresholds alone range from under $1 to under $15 depending on the state, and whether a state requires escheat remittance versus exempting non-expiring cards outright varies just as widely.
Escheatment reality check: unclaimed gift card balances aren’t simply forfeited revenue for a business. In states that require it, unredeemed funds must eventually be remitted to the state’s unclaimed property division, often after a multi-year dormancy period. Get the state’s dormancy trigger wrong and you either remit too early (giving up cash you could still legitimately hold) or too late (risking penalties for non-compliance).
Why escheat and unclaimed property risk deserves its own conversation
Unclaimed property law is arguably the most misunderstood corner of gift card compliance because it isn’t really consumer protection law at all. It’s a state revenue mechanism. States use dormant gift card balances (along with forgotten bank accounts and uncashed cheques) to fund unclaimed property programs, and the rules for when a balance becomes “reportable” vary by the state where the business is incorporated, the state where the card was sold, and sometimes the state where the buyer resides.
That layering creates genuine risk for any business selling cards across state lines. A single national card program might need three or four different dormancy and remittance calendars running simultaneously, one for each state whose escheat rules apply to a meaningful slice of sales. Reconciling gift card liabilities against those state rules annually isn’t optional bookkeeping. It’s the difference between a clean unclaimed property filing and a multi-state audit.
How to check a state’s current rule quickly
Given how often state legislatures revisit this topic, the fastest reliable path is a three-step check: start with the NCSL summary table for a quick overview, then confirm the exact statutory text through the state’s own legislature website (as with Florida’s Section 501.95), and finally check the state Attorney General’s consumer protection page or the state’s unclaimed property office for enforcement posture and reporting deadlines. Skipping straight to a search engine result or a competitor’s blog post is how outdated cash-back thresholds end up baked into a new card program.
Turning the rules into compliant card terms
Knowing the law is one thing. Writing terms that actually hold up when a customer, a state AG, or an auditor reads them is another. Here’s how to translate the federal and state rules into language that survives scrutiny.
- Draft the expiry clause around activation, not purchase. State plainly: “This card does not expire for at least five years from the date of activation,” and if you’re selling into Florida or another no-expiry state, drop the expiry clause entirely for those buyers rather than trying to run two conflicting policies.
- Place fee disclosures where a buyer will actually see them before paying. That means on the card face for any fee that could apply, on the packaging for pre-purchase disclosures, and repeated on the checkout page for cards sold online.
- Calculate inactivity correctly. The 12-month clock runs from the last transaction, not from the purchase date, and a used-but-dormant card resets the clock every time it’s tapped, however small the transaction.
- Separate promotional and loyalty cards from purchased cards in your terms. If a card was given away rather than sold, say so explicitly in the terms, because that’s usually the detail that determines whether CARD Act protections even apply.
- Flag employee-incentive cards for HR and finance, not just marketing. These often fall under narrower state exemptions, and getting the tax treatment and disclosure requirements wrong tends to surface at year-end rather than at the point of sale.
Pro Tip: Write your gift card terms once for the strictest state you sell into, then apply that version everywhere. Running 50 slightly different versions of the same card terms is how a small compliance gap in one state quietly becomes a company-wide liability.
Special cases deserve their own line of thinking. Promotional cards (“spend $50, get a $10 card free”) typically sit outside CARD Act protections because no money changed hands for the card itself, but several states still require disclosure of any conditions attached. Loyalty program cards follow similar logic. Employee-incentive cards are the trickiest: the exemption usually depends on the card being non-transferable and tied to employment, and losing either of those features can pull the card back under full gift card regulation.
A compliance checklist built for how gift card programs actually run
Legal wording only protects a business if the operational side matches it. A perfectly drafted terms page doesn’t help if the point-of-sale staff hand out cards in packaging with no visible disclosures, or if nobody reconciles unredeemed balances against state deadlines until an auditor asks.
Terms and disclosure basics:
- Publish one standardised terms document that meets the federal disclosure rules and layers in the stricter state variances for wherever you sell.
- Make sure the expiry statement (or its absence, for no-expiry states) appears identically across the card, the packaging and the online checkout flow.
- List any applicable fees, the 12-month inactivity trigger, and the replacement process for an expired card with remaining funds.
Point-of-sale and packaging:
- Third-party gift cards displayed on racks are a common fraud target, so tamper-evident packaging isn’t just good practice, it’s increasingly a legal requirement in states responding to card-draining scams.
- Pre-purchase disclosures need to be visible without opening the packaging, not printed inside where a buyer only sees them after paying.
- Online sellers should mirror the same disclosures on the product page itself, not just in a linked terms document nobody clicks.
Employee training:
- Staff should know how to spot a tampered card, most commonly one where the PIN sticker has been peeled and reapplied, a classic sign of a scammer copying the number before it’s sold.
- Train staff on how to handle a customer’s cash-out request where state law requires it, since a “we don’t do that” response can itself trigger a complaint.
- Give staff a clear, simple script for refund and balance-transfer requests so answers stay consistent across shifts.
Recordkeeping and annual tasks:
- Reconcile gift card liabilities against your state escheat calendars at least annually, and track dormancy triggers by the state where each card was sold.
- Keep transaction records long enough to prove compliance if a state unclaimed property audit reaches back several years, which they often do.
- Review your terms whenever a state passes new legislation, since recent bills in Delaware, Maryland, New York and Rhode Island have added packaging and training requirements that didn’t exist a few years ago.
Pro Tip: Treat gift card compliance as a cross-functional job, not a legal one. Legal sets the terms, finance reconciles the liability, retail operations handles the packaging and point-of-sale disclosures, and HR trains staff on fraud recognition. When only legal owns it, the operational gaps are usually where the fines land.
Understanding how gift card revenue and liability actually get recorded is worth a closer look too, since gift card accounting practices directly affect how cleanly a business can demonstrate compliance at audit time.
Who enforces gift card law, and what happens when businesses get it wrong
Three layers of authority police gift card compliance in the US, and they don’t always move in the same direction. The FTC handles deceptive marketing and misleading expiry claims at the federal level. The CFPB oversees the prepaid and gift card rule itself, chasing violations of 12 CFR §1005.20 around disclosure and fees. State attorneys-general enforce their own statutes, which is usually where the sharper penalties for expiry violations or undisclosed fees actually land, alongside state unclaimed property offices chasing remittance failures.
The violations that trigger enforcement tend to repeat across cases:
- Undisclosed or hidden dormancy fees applied before the 12-month floor.
- Expiry language that’s technically present but buried or misleading about the actual date.
- Failing to remit unredeemed balances to a state’s unclaimed property division on schedule.
- Selling cards without the required pre-purchase disclosures on packaging or checkout pages.
Consumers who run into a problem, an expired card that shouldn’t have expired, or a fee that was never disclosed, have a reasonably clear path: file a complaint with the FTC, the CFPB, or the relevant state AG’s consumer protection office. Typical remedies include a refund of the card balance, restitution where a pattern of violations is found, and civil penalties against the business, which can scale quickly if the practice affected a large batch of customers rather than one buyer.
The clearest trend right now sits with the states, not Washington. Fraud-prevention legislation, requiring conspicuous point-of-sale warnings, tamper-resistant packaging and staff training, has picked up momentum because gift card draining scams (where a fraudster copies a card’s PIN before it’s sold) have become common enough that legislators are targeting the retail environment directly rather than just the card terms.
Where to verify gift card law yourself
Anyone drafting or reviewing gift card terms should bookmark a short list rather than relying on secondhand summaries that go stale.
- The CARD Act text via the FTC for the federal statutory language itself.
- 12 CFR §1005.20 on eCFR for the current regulatory text, including definitions and exceptions.
- The CFPB’s prepaid rule page for agency interpretation and compliance dates.
- The NCSL state gift card statutes table for a fast state-by-state comparison.
- Individual state statute sites, such as Florida’s Section 501.95, for the exact wording that applies where you sell.
- Your state’s Attorney General consumer protection page and unclaimed property office for enforcement posture and reporting deadlines.
Cross-checking two or three of these before finalising a card program’s terms catches most of the gaps that a single source misses.
Why operational controls matter as much as the legal wording
The legal side of gift cards gets most of the attention, but the failures I’ve seen discussed most often in state enforcement actions aren’t really legal drafting failures. They’re operational ones. A business can have flawless terms sitting in a legal file and still get burned by a rack of cards in tamper-friendly packaging, or a staff member who has no idea what a drained PIN looks like.
That gap is why the fraud-prevention wave sweeping through states like Delaware, Maryland, New York and Rhode Island matters more than it might first appear. These laws assume the terms are fine and go straight after the physical retail environment instead, because that’s where scammers actually operate. Legislators have effectively concluded that good legal language without good operational habits doesn’t protect anyone.
The other underestimated risk is reconciliation drift. States keep adjusting cash-back thresholds and escheat timelines, and a business that set its program up two years ago on rules that have since shifted won’t find out until an audit or a customer complaint forces the issue. Monitoring legislative activity isn’t a once-a-year task anymore given how often these statutes move.
Platforms that centralise transaction records and automate disclosure delivery take a meaningful chunk of this burden off a small compliance team’s plate, simply by making the reconciliation and the paper trail exist automatically rather than depending on someone remembering to update a spreadsheet.
— Iosif Beraru
How Riddlio supports gift voucher operations for venues
Riddlio doesn’t replace a lawyer, and nothing here should be read as legal advice. What it does is take the operational weight off the parts of gift card compliance that live and die on recordkeeping and consistency, which is exactly where most small venues actually stumble.
For escape room and event venues selling gift vouchers, Riddlio’s booking platform generates automated confirmations that show the voucher code and the relevant terms at the point of redemption, so disclosure language doesn’t rely on a staff member remembering to hand over a printed slip. Every voucher transaction lands in a centralised record, which makes annual reconciliation against state unclaimed property deadlines far less of a scramble than digging through separate point-of-sale and email systems. Riddlio also supports the packaging and workflow habits that reduce fraud risk, giving staff a consistent process for handling voucher redemptions and cash-out requests rather than leaving it to individual judgement on a busy Saturday.
Plans start with Starter at $29 a month, running up to Pro at $79 and Unlimited at $199, with an Enterprise tier available for larger operations. If gift vouchers are part of how you sell experiences, take a look at Riddlio’s booking and voucher features and see how it fits your venue’s compliance workflow.
Sources
- Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act) — FTC
- 12 CFR §1005.20 — Requirements for gift cards and gift certificates — eCFR
- Gift cards and gift certificates statutes and legislation — NCSL
- What you should know about gift cards — FDIC
FAQ
What are the basic rules for gift cards in the US?
Federal law requires most gift cards to stay valid for at least five years from activation, and bans dormancy or fee charges until 12 months of inactivity have passed. States can add stricter rules on top, covering cash redemption, escheatment and fraud prevention, so the exact rules depend on where the card is sold.
Do you have to be 18 to buy a $500 Visa gift card?
There’s no federal age requirement written into gift card law itself, but individual retailers commonly set their own minimum purchase age, which varies by store and card network, particularly for higher-value general-use prepaid cards. Check the specific retailer’s policy at the point of sale, since it varies by store and by card network rather than being set by a single national rule.
What restrictions apply when purchasing a gift card?
Most restrictions come from the retailer rather than federal law: purchase limits per transaction, ID requirements for large cash purchases, and activation delays designed to prevent fraud are common. Some states also cap the dollar value that can be loaded onto certain prepaid card types in a single purchase as an anti-fraud measure.
What are the IRS rules for gift cards given to customers or employees?
Gift cards given to employees are generally treated as taxable wages by the IRS regardless of the amount, since cash-equivalent gifts don’t qualify for the minor “de minimis” fringe benefit exclusion that applies to small non-cash items. Gift cards given to customers as promotions are typically treated as a marketing expense for the business, though the tax treatment can shift depending on whether the card is tied to a purchase or given unconditionally, so a tax adviser should confirm the specific structure.
Does Riddlio handle gift card compliance for my venue?
Riddlio isn’t a legal compliance tool, but it does centralise voucher transaction records, automate disclosure delivery at confirmation, and support consistent redemption workflows that make state reporting and reconciliation far easier to manage. For the legal side of drafting terms or interpreting state statutes, a licensed attorney remains the right call.