Mastercard SPME §2.3.2 · Jun 2022 → May 2023

Additional Card Production Requirements

substantive

The updated section adds requirements for card count verification by opening and auditing sealed cartons, allowing the use of card counts on cartons. It also mandates reporting any suspected or confirmed loss/theft of cards within 24 hours to Mastercard, with specified detailed information. Other disposal requirements remain unchanged.

Sources Mastercard SPME · Jun 2022 · page 32 PDF Mastercard SPME · May 2023 · page 32 PDF KYB Acquirer current

Also in §2.x this release substantive §2.2 Mastercard Site Data Protection (SDP) Program substantive §2.2.5 SDP Program Noncompliance Assessments substantive §2.2.6 Mandatory Compliance Requirements for Compromised Entities substantive §2.3.1 Global Vendor Certification Program substantive §2.4.1 PIN Entry Devices (PEDs) and Encrypting PIN Pads (EPPs)

Why these edits? This section adds specific requirements for card count verification by opening and auditing sealed cartons, and mandates reporting any suspected or confirmed card loss or theft within 24 hours to Mastercard. These obligations directly affect the Acquirer KYB (Know Your Business) Obligations as they pertain to card custody and risk mitigation processes.

Mastercard SPME §2.3.2

Security Rules and Procedures—Merchant Edition • 22 7 February ~~2022~~ 2023 discrepancy and recover any missing Cards. The Issuer may use the Card count noted on each sealed carton in the Card count verification. Sealed cartons may also be opened at random, audited, and resealed. All open cartons and all sealed cartons with no Card count noted on the carton must have the contents counted. Reporting Card Loss or Theft Within 24 hours of discovery, a Customer must report to Mastercard the suspected or confirmed loss or theft of any Cards while in transit from a vendor or in the Customer’s possession. The report must be sent by email to gvcphelpdesk@ mastercard.com and contain the following information: • Issuer name and Customer ID/ICA number • Card type and quantity • With respect to the loss or theft of Cards while in transit from a vendor: – The vendor name – The location from which the Cards were shipped – The date and method of shipment – The address to which the Cards were shipped • Pertinent details about the loss and the investigation • Name and phone number of contact for additional information • Name and phone number of person reporting the loss or theft Disposition of Unissued Cards and Account Information A Customer that ceases to issue Cards must promptly destroy or otherwise properly dispose of all unissued Cards and all media containing Account information.

Halyard Pay · 2 files

KYB Acquirer · rules.yaml

program: Acquirer KYB
- authority: Mastercard SPME §2.1
+ authority: Mastercard SPME §2.1, §2.3.2
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
+ card_management:
+   carton_verification: true
+   carton_audit_and_reseal: true
+   count_open_and_uncounted_cartons: true
+   loss_theft_reporting:
+     timeline_hours: 24
+     report_to: gvcphelpdesk@mastercard.com
+     required_info:
+       - issuer_name
+       - customer_id_or_ica_number
+       - card_type_and_quantity
+       - vendor_details_if_in_transit:
+           - name
+           - shipment_location
+           - shipment_date_and_method
+           - shipment_address
+       - loss_investigation_details
+       - contact_name_and_phone
+       - reporter_name_and_phone
+   disposal_requirements:
+     unissued_cards_and_account_media_must_be_destroyed: true
+ 
+ # This update incorporates enhanced carton auditing and strict 24-hour reporting requirements for loss or theft of cards in transit or possession, per Mastercard SPME §2.3.2.

KYB Acquirer · policy.md

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Verify business licenses for regulated merchant categories.
Schedule a full re-verification review at least once every 365 days.
Document all verification outcomes and retain records for audit purposes.

6. Implement controls for custody and inventory of physical cards including verification of card counts in sealed and unsealed cartons.

7. Report suspected or confirmed card loss or theft to Mastercard within 24 hours, including detailed information as specified by Mastercard.

Source authority: Mastercard SPME ~~§2.1.~~��2.1 and 2.3.2.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Verify business licenses for regulated merchant categories.
Schedule a full re-verification review at least once every 365 days.
Document all verification outcomes and retain records for audit purposes.

6. Implement controls for custody and inventory of physical cards including verification of card counts in sealed and unsealed cartons.

7. Report suspected or confirmed card loss or theft to Mastercard within 24 hours, including detailed information as specified by Mastercard.

Source authority: Mastercard SPME ~~§2.1.~~��2.1 and 2.3.2.

Source authority: Mastercard SPME §2.3.2.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME §2.1
+authority: Mastercard SPME §2.1, §2.3.2
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -12,3 +12,26 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
+card_management:
+  carton_verification: true
+  carton_audit_and_reseal: true
+  count_open_and_uncounted_cartons: true
+  loss_theft_reporting:
+    timeline_hours: 24
+    report_to: gvcphelpdesk@mastercard.com
+    required_info:
+      - issuer_name
+      - customer_id_or_ica_number
+      - card_type_and_quantity
+      - vendor_details_if_in_transit:
+          - name
+          - shipment_location
+          - shipment_date_and_method
+          - shipment_address
+      - loss_investigation_details
+      - contact_name_and_phone
+      - reporter_name_and_phone
+  disposal_requirements:
+    unissued_cards_and_account_media_must_be_destroyed: true
+
+# This update incorporates enhanced carton auditing and strict 24-hour reporting requirements for loss or theft of cards in transit or possession, per Mastercard SPME §2.3.2.
--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -6,11 +6,13 @@
 minimum set of documents for each merchant to establish business legitimacy, confirm
 beneficial ownership, and satisfy anti-money laundering screening requirements.
 
+
 ## When this policy applies
 
 This policy applies to all new merchant onboarding and to all periodic re-verification
 reviews. Merchants that fail to supply required documentation within the stipulated
 period must be suspended from processing until compliance is restored.
+
 
 ## Required actions
 
@@ -19,5 +21,8 @@
 3. Verify business licenses for regulated merchant categories.
 4. Schedule a full re-verification review at least once every 365 days.
 5. Document all verification outcomes and retain records for audit purposes.
+6. Implement controls for custody and inventory of physical cards including verification of card counts in sealed and unsealed cartons.
+7. Report suspected or confirmed card loss or theft to Mastercard within 24 hours, including detailed information as specified by Mastercard.
 
-Source authority: Mastercard SPME §2.1.
+
+Source authority: Mastercard SPME 2.1 and 2.3.2.