This is the most technical-sounding piece of SB 254 compliance, and also the most common way careful businesses get caught. It is worth understanding in plain terms, because it is the one part you genuinely cannot judge by looking at your sign or trusting your intentions.
Debit runs two ways
When a customer pays with a debit card, it can be processed as PIN debit (they enter a PIN) or routed as signature debit through a credit network - often just a swipe or a tap, no PIN. Same card, same deposit account behind it; different rails. SB 254 defines a debit card by what it does - pulls funds from a deposit account - not by how it is routed. So a debit card run as signature is still debit under the law.
Why that matters for surcharging
Surcharging credit cards is not banned. But a "credit-only" surcharge only stays legal if debit is reliably excluded - including debit that runs as signature. Many systems surcharge by card brand (Visa, Mastercard) rather than by card type (debit vs. credit), and a signature-debit transaction can look like a credit transaction to that logic. The result: a business certain it only surcharges credit can be surcharging debit on a real share of its sales without ever seeing it.
A note on timing: Whether debit is truly excluded depends on how your specific terminal and processor are configured, which is the kind of detail enforcement guidance may speak to as it is finalized. The Attorney General's enforcement rules are still being finalized, so some operational details may change. Everything here reflects the law as written - for advice on your specific situation, consult a qualified professional, and confirm rather than assume.
You cannot eyeball this one
This is the rare compliance question you cannot answer from your signage or your intentions - it comes down to how your equipment identifies and excludes debit, signature debit included. And because the retail business is liable, not the processor, the safe move is to verify debit is actually excluded rather than trust that it is. A processing statement shows what is really happening on your account; a free ZeroPoint compliance check reads it and tells you whether debit is truly carved out. If you are not sure where you stand, start with the Risk Scorecard.