In response to my inquiry Chase sent an email repeating the contents of the email, and adding "We regret that we are unable to provide the list of all the third party services." I have replied.
How is that possible? Here's a new rule, but we can't tell you how we're going to apply it? How would the IT department flag the transactions. They have the list.