Mastercard SPME §5 · Jun 2022 → May 2023

Entry control

substantive

The text now specifies that technical and organizational measures like logging, reporting, audit trails, and documentation are used to monitor data entry, changes, or removal in data processing systems, replacing a vague statement about developing risk information for merchant acquiring risk assessment.

Sources Mastercard SPME · Jun 2022 · page 11 PDF Mastercard SPME · May 2023 · page 11 PDF Fraud Monitoring current

Also in §5.x this release substantive §5.1.2 ATM Card Retention

Why these edits? The updated obligation explicitly requires technical and organizational measures such as logging and audit trails to monitor data processing entries and changes, enhancing fraud monitoring capability.

Mastercard SPME §5

This section was substantively restructured between versions (2% text overlap). Compare the texts directly below.

Before · Jun 2022 · page 11

purpose of developing enhanced or incremental risk information to aid in its own determination of risk in its Merchant acquiring business.

After · May 2023 · page 11

Technical and organizational measures to monitor whether data have been entered, changed or removed (deleted), and by whom, from data processing systems, include: – Logging and reporting systems; – Audit trails and documentation.

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §5
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ logging_and_audit_trails:
+   description: >-
+     Technical and organizational measures are implemented to monitor all data entries,
+     modifications, and deletions within the data processing systems, including logging,
+     reporting systems, and audit trails to ensure accountability and enhance fraud monitoring.
+   enabled: true
+   components:
+     - logging_systems
+     - reporting_systems
+     - audit_trails
+ 
+ # Updated to incorporate mandatory technical and organizational controls for monitoring data changes as required by Mastercard SPME §5.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

Track case progress until the account returns to threshold compliance or is

terminated.

5. Maintain and review technical and organizational controls such as logging and audit trails to monitor data entries, changes, or deletions in fraud monitoring data systems.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §5.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

Track case progress until the account returns to threshold compliance or is

terminated.

5. Maintain and review technical and organizational controls such as logging and audit trails to monitor data entries, changes, or deletions in fraud monitoring data systems.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §5.

Source authority: Mastercard SPME §5.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §5
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,15 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+logging_and_audit_trails:
+  description: >-
+    Technical and organizational measures are implemented to monitor all data entries,
+    modifications, and deletions within the data processing systems, including logging,
+    reporting systems, and audit trails to ensure accountability and enhance fraud monitoring.
+  enabled: true
+  components:
+    - logging_systems
+    - reporting_systems
+    - audit_trails
+
+# Updated to incorporate mandatory technical and organizational controls for monitoring data changes as required by Mastercard SPME §5.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -21,5 +21,6 @@
    transaction data.
 4. Track case progress until the account returns to threshold compliance or is
    terminated.
+5. Maintain and review technical and organizational controls such as logging and audit trails to monitor data entries, changes, or deletions in fraud monitoring data systems.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §5.