Mastercard SPME §7.1.1 · Jun 2022 → May 2023

Required Screening Procedures

substantive

The updated section changes terminology from 'Submerchant' to 'Sponsored Merchant', expands location confirmation to include 'country or territory', adds requirements to verify merchant names to prevent impersonation and fraud, and clarifies controls for name consistency in authentication and authorization messages, strengthening screening procedures.

Sources Mastercard SPME · Jun 2022 · page 64 PDF Mastercard SPME · May 2023 · page 75 PDF Fraud Monitoring current KYB Acquirer current

Also in §7.x this release substantive §7 Availability control substantive §7.1 Screening New Merchants, Sponsored Merchants, and ATM Owners substantive §7.1.3 Assessments for Noncompliance with Screening Procedures substantive §7.2 Ongoing Monitoring substantive §7.3 Merchant Education

Why these edits? The changes expand the screening procedures by requiring verification of merchant names to prevent impersonation and fraud, and by including an explicit check on merchant location at the country or territory level, thereby strengthening Know Your Business obligations for Acquirers regarding prospective Sponsored Merchants.; The addition of controls to ensure merchant names do not impersonate other entities and must be consistent in authentication and authorization messages enhances fraud loss control measures, impacting fraud monitoring requirements.

Mastercard SPME §7.1.1

The Acquirer of a prospective Merchant or ATM owner, and any Payment Facilitator of the Acquirer with respect to a prospective ~~Submerchant,~~ Sponsored Merchant, must ¶ ensure that the following screening procedures are performed: • In accordance with the Acquirer’s “know your customer” policies and procedures implemented pursuant to Rule 1.2, “Mastercard Anti-Money Laundering and Sanctions Requirements”, of the Mastercard Rules, collect information about the entity and each of its principal owners as necessary or appropriate for identification and due diligence purposes; verify that the information collected is true and accurate; and comply with all U.S. and local sanction screening requirements; and • Confirm that the entity is located and conducting legal business in a country ¶ or territory within the Area of Use of the Acquirer’s License, as described in Rule 5.4, ¶ “Merchant Location”, and ~~Rule 5.5, “Submerchant Location”, of~~ the Mastercard ¶ Rules; and • Ensure that an inquiry is submitted to the Mastercard Alert to Control High-risk (Merchants) (MATCH™) system if a prospective Merchant or ~~Submerchant ¶~~ Sponsored Merchant proposes to accept Mastercard® ~~Card.~~ Cards. If sales will be conducted on a website or ¶ digital application, the inquiry must include the uniform resource locator (URL) ¶ address. An Acquirer must submit inquiries both for its own Merchants and for ~~¶ the Submerchants~~ the Sponsored Merchants of its Payment Facilitators; and • Ensure Merchant names do not belong to other legal entities to prevent unlawful usage of existing business trademark, including impersonation of these names to scam consumers. Where legally allowed, controls include matching Merchant names with scam negative listing where they exist; and • Ensure Merchant names that will be used in both authentication and authorization messages match (or is consistent with) registered Merchant names • Establish fraud loss control measures appropriate for the business to be conducted, including but not limited to Transaction authorization and deposit activity monitoring parameters, as described in section 6.2.2, “Acquirer Fraud ¶ Loss Control Programs”, of this manual; and ¶ • ¶ Assign a Card acceptor business code (MCC) that most accurately describes the ¶ nature of the business (for MCC descriptions, see Chapter 3, “Card Acceptor ¶ Business Codes [MCCs]”, of the Quick Reference Booklet). ¶ • ¶ For a prospective negative option billing Merchant or Submerchant, identify any ¶ entity that provides service for the Merchant or Submerchant that would allow ¶ Merchant, Submerchant, and ATM Owner Screening and Monitoring Standards

Halyard Pay · 4 files

KYB Acquirer · rules.yaml

program: Acquirer KYB
- authority: Mastercard SPME §2.1
+ authority: Mastercard SPME 7.1.1
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
+ screening_procedures:
+   - Follow Acquirer KYC policies per Mastercard Rules 1.2, including information collection, verification, and compliance with US and local sanctions.
+   - Confirm that the entity operates legally in a country or territory within the Acquirer's licensed Area of Use, per Rules 5.4 and Mastercard Rules.
+   - Submit MATCH inquiries for prospective Merchants and Sponsored Merchants proposing to accept Mastercard Cards; include URL for online sales.
+   - Verify that merchant names do not correspond to other legal entities to avoid trademark infringement or impersonation; where allowed, match names against scam negative lists.
+   - Ensure consistency between merchant names used in authentication and authorization messages and registered merchant names.
+   - Implement fraud loss control measures appropriate to the business, including transaction authorization and deposit monitoring per SPME section 6.2.2.

KYB Acquirer · policy.md

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform ¶ Know Your Business (KYB) due diligence on merchants before onboarding and on a ¶ recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish business legitimacy, confirm ¶ beneficial ownership, and satisfy anti-money laundering and screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification ¶ reviews. Merchants that fail to supply required documentation within the stipulated ¶ period must be suspended from processing until compliance is restored.

Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Confirm that the merchant is located and conducting legal business in a country or territory within Halyard Pay’s licensed area of use.

4. Verify business licenses for regulated merchant categories.

4. 5. Submit enquiries to the Mastercard MATCH™ system for prospective merchants, including URLs for online sales, covering both merchants and any sub-merchants under Payment Facilitators.

6. Ensure that merchant names do not correspond to other existing legal entities to avoid fraud or impersonation. Where lawful, cross-check merchant names against negative listings for scams.

7. Confirm that merchant names used in authentication and authorization messages match registered merchant names.

8. Establish and maintain fraud loss control measures appropriate to the business, including transaction authorizations and deposit activity monitoring.

9. Schedule a full re-verification review at least once every 365 days.

5. 10. Document all verification outcomes and retain records for audit purposes.

Source authority: Mastercard SPME ~~§2.1.~~§7.1.1.

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME 7.1.1, with enhanced Merchant name verification requirements
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ 
+ # Added enhanced Merchant name verification controls to prevent impersonation fraud and ensure consistency in authorization and authentication messages, as mandated in Mastercard SPME 77.1.1.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that ¶ exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling ¶ monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count ¶ reaches at least 100 transactions in that same month triggers mandatory escalation ¶ under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs both card-present and ¶ card-not-present transaction streams.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Verify that merchant identity information, including names used in authentication and authorization messages, is consistent and does not impersonate other legal entities, in line with Mastercard's screening standards.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §7.1.1.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

When this policy applies

Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Confirm that the merchant is located and conducting legal business in a country or territory within Halyard Pay’s licensed area of use.

4. Verify business licenses for regulated merchant categories.

4. 5. Submit enquiries to the Mastercard MATCH™ system for prospective merchants, including URLs for online sales, covering both merchants and any sub-merchants under Payment Facilitators.

6. Ensure that merchant names do not correspond to other existing legal entities to avoid fraud or impersonation. Where lawful, cross-check merchant names against negative listings for scams.

7. Confirm that merchant names used in authentication and authorization messages match registered merchant names.

8. Establish and maintain fraud loss control measures appropriate to the business, including transaction authorizations and deposit activity monitoring.

9. Schedule a full re-verification review at least once every 365 days.

5. 10. Document all verification outcomes and retain records for audit purposes.

Source authority: Mastercard SPME ~~§2.1.~~§7.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

When this policy applies

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Verify that merchant identity information, including names used in authentication and authorization messages, is consistent and does not impersonate other legal entities, in line with Mastercard's screening standards.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §7.1.1.

Source authority: Mastercard SPME §7.1.1.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME §2.1
+authority: Mastercard SPME 7.1.1
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -12,3 +12,10 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
+screening_procedures:
+  - Follow Acquirer KYC policies per Mastercard Rules 1.2, including information collection, verification, and compliance with US and local sanctions.
+  - Confirm that the entity operates legally in a country or territory within the Acquirer's licensed Area of Use, per Rules 5.4 and Mastercard Rules.
+  - Submit MATCH inquiries for prospective Merchants and Sponsored Merchants proposing to accept Mastercard Cards; include URL for online sales.
+  - Verify that merchant names do not correspond to other legal entities to avoid trademark infringement or impersonation; where allowed, match names against scam negative lists.
+  - Ensure consistency between merchant names used in authentication and authorization messages and registered merchant names.
+  - Implement fraud loss control measures appropriate to the business, including transaction authorization and deposit monitoring per SPME section 6.2.2.
--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -1,23 +1,22 @@
 # Acquirer KYB (Know Your Business) Obligations
 
-Acquirers processing transactions on the Mastercard network are required to perform
-Know Your Business (KYB) due diligence on merchants before onboarding and on a
-recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
-minimum set of documents for each merchant to establish business legitimacy, confirm
-beneficial ownership, and satisfy anti-money laundering screening requirements.
+Acquirers processing transactions on the Mastercard network are required to perform Know Your Business (KYB) due diligence on merchants before onboarding and on a recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a minimum set of documents for each merchant to establish business legitimacy, confirm beneficial ownership, and satisfy anti-money laundering and screening requirements.
 
 ## When this policy applies
 
-This policy applies to all new merchant onboarding and to all periodic re-verification
-reviews. Merchants that fail to supply required documentation within the stipulated
-period must be suspended from processing until compliance is restored.
+This policy applies to all new merchant onboarding and to all periodic re-verification reviews. Merchants that fail to supply required documentation within the stipulated period must be suspended from processing until compliance is restored.
 
 ## Required actions
 
 1. Collect all required KYB documents at onboarding prior to approval.
 2. Conduct AML screening against applicable watchlists before approval.
-3. Verify business licenses for regulated merchant categories.
-4. Schedule a full re-verification review at least once every 365 days.
-5. Document all verification outcomes and retain records for audit purposes.
+3. Confirm that the merchant is located and conducting legal business in a country or territory within Halyard Pay’s licensed area of use.
+4. Verify business licenses for regulated merchant categories.
+5. Submit enquiries to the Mastercard MATCH™ system for prospective merchants, including URLs for online sales, covering both merchants and any sub-merchants under Payment Facilitators.
+6. Ensure that merchant names do not correspond to other existing legal entities to avoid fraud or impersonation. Where lawful, cross-check merchant names against negative listings for scams.
+7. Confirm that merchant names used in authentication and authorization messages match registered merchant names.
+8. Establish and maintain fraud loss control measures appropriate to the business, including transaction authorizations and deposit activity monitoring.
+9. Schedule a full re-verification review at least once every 365 days.
+10. Document all verification outcomes and retain records for audit purposes.
 
-Source authority: Mastercard SPME §2.1.
+Source authority: Mastercard SPME §7.1.1.
--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME 7.1.1, with enhanced Merchant name verification requirements
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,5 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+
+# Added enhanced Merchant name verification controls to prevent impersonation fraud and ensure consistency in authorization and authentication messages, as mandated in Mastercard SPME 77.1.1.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -1,25 +1,17 @@
 # Fraud Monitoring
 
-Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
-exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
-monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
-reaches at least 100 transactions in that same month triggers mandatory escalation
-under this policy.
+Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count reaches at least 100 transactions in that same month triggers mandatory escalation under this policy.
 
 ## When this policy applies
 
-This policy applies to all merchants processed through Halyard Pay's acquiring platform
-where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+This policy applies to all merchants processed through Halyard Pay's acquiring platform where Mastercard is the applicable card network. It governs both card-present and card-not-present transaction streams.
 
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
-   escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
-   transaction data.
-4. Track case progress until the account returns to threshold compliance or is
-   terminated.
+2. If the ratio meets or exceeds the threshold AND the minimum count is reached, escalate the merchant account to human review immediately.
+3. Verify that merchant identity information, including names used in authentication and authorization messages, is consistent and does not impersonate other legal entities, in line with Mastercard's screening standards.
+4. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+5. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §7.1.1.