Mastercard SPME §7.1.3 · Jun 2022 → May 2023

Assessments for Noncompliance with Screening Procedures

substantive

⚠ Extraction warning — review against source PDF. One side of the Mastercard SPME text below appears to contain only the page-running header, not body content. This usually means the section heading fell on a page boundary and the body was attributed to a neighbouring section in the source PDF. The AI summary and proposed edit below may be misleading. Verify in: Jun 2022 · page 66 ↗ · May 2023 · page 77 ↗.

The update clarifies that Acquirers must regularly review e-commerce Merchants’ websites and activities to ensure compliance with standards, including Payment Facilitators doing the same for Sponsored Merchants. It adds specific circumstances requiring re-screening, such as ownership or location changes, activity changes, or suspected violations, and recommends annual screening for certain high-risk merchant categories.

Sources Mastercard SPME · Jun 2022 · page 66 PDF Mastercard SPME · May 2023 · page 77 PDF BRAM Response current KYB Acquirer current

Also in §7.x this release substantive §7 Availability control substantive §7.1 Screening New Merchants, Sponsored Merchants, and ATM Owners substantive §7.1.1 Required Screening Procedures substantive §7.2 Ongoing Monitoring substantive §7.3 Merchant Education

Why these edits? The update requires Acquirers to regularly review and monitor e-commerce Merchants and Payment Facilitators for compliance, strengthening the obligations for Know Your Business (KYB) processes and introducing re-screening triggers such as ownership/location changes or suspected violations.; The addition of re-screening for suspected or confirmed violations of the Business Risk Assessment Management (BRAM) Program directly impacts the BRAM investigation response procedures that must be followed.

Mastercard SPME §7.1.3

This section was substantively restructured between versions (7% text overlap). Compare the texts directly below.

Before · Jun 2022 · page 66

Security Rules and Procedures—Merchant Edition • 22 February 2022

After · May 2023 · page 77

Security Rules and Procedures—Merchant Edition • 7 February 2023

monitoring includes, but is not limited to, the Acquirer fraud loss controls relating to deposit (including credits) and authorization activity described in section 6.2.2. With respect to an electronic commerce (e-commerce) Merchant, the Acquirer regularly, as reasonably appropriate in light of all circumstances, must review and monitor the Merchant’s website(s) and business activities to confirm and to reconfirm regularly that any activity related to or using a Mark is conducted in a legal and ethical manner and in full compliance with the Standards. The Acquirer must ensure that a Payment Facilitator conducts such monitoring with respect to each of its Sponsored Merchant’s website(s). As a best practice, Mastercard recommends that Acquirers use a Merchant monitoring solution to review their e-commerce Merchants’ and Sponsored Merchants’ activity to avoid processing illegal or brand-damaging Transactions. An Acquirer must re-perform the onboarding screening procedures set forth in section 7.1.1 of this manual, in the following situations:

Changes in ownership of a Merchant, Payment Facilitator, or ATM owner, whether confirmed or suspected
Changes in country location of a Merchant, Payment Facilitator, or ATM owner
Changes in Merchant or Payment Facilitator activities, declared by the Merchant, Payment Facilitator or detected by the Acquirer
In case of suspected or confirmed violation of the Questionable Merchant Activity Program (QMAP), Business Risk Assessment Management (BRAM) Program, Excessive Fraud Merchant (EFM) and Excessive Chargeback Merchant (ECM) Program. An Acquirer is recommended to re-perform, on a yearly basis, Merchant screening controls for Merchants with activities in the categories listed in section 9.1 of this manual.

Halyard Pay · 4 files

KYB Acquirer · rules.yaml

program: Acquirer KYB
- authority: Mastercard SPME §2.1
+ authority: Mastercard SPME §2.1, §7.1.3
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
+ re_screening_triggers:
+   - ownership_change
+   - location_change
+   - change_in_activity
+   - suspected_violation_qmap_bram_efm_ecm
+ re_screening_recommendation_frequency_days: 365
+ monitoring_requirements: >-
+   The Acquirer must regularly review and monitor e-commerce Merchants and Payment
+   Facilitators, ensuring their websites and business activities comply with legal,
+   ethical, and Mastercard Standards, including overseeing Payment Facilitators' Sponsored Merchants.
+ monitoring_best_practice: Use of merchant monitoring solutions to detect illegal or brand-damaging transactions.

KYB Acquirer · policy.md

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network ~~are required to perform ¶~~ must conduct thorough Know Your Business (KYB) due diligence on merchants ~~before~~ prior to onboarding and ~~on a ¶ recurring basis thereafter.~~ conduct regular ongoing monitoring afterward. Halyard Pay, as an acquirer, ~~must collect and verify a ¶ minimum set of documents for each merchant to establish business legitimacy,~~ is responsible not only for initial collection and verification of key merchant documentation but also for continuous review to confirm ~~¶ beneficial ownership, and satisfy anti-money laundering screening requirements.~~ merchant compliance with Mastercard standards.

When this policy applies

This policy ~~applies to all new merchant onboarding and to all~~ covers initial merchant onboarding, ongoing periodic re-verification ~~¶ reviews.~~ at least annually, and additional re-screening triggered by specific risk indicators such as changes in ownership, location, declared or detected changes in merchant activities, or suspicion of violations of Mastercard’s risk and compliance programs.

Merchants that fail to supply required documentation within ~~the~~ stipulated ~~¶ period~~ timeframes must be suspended from processing until compliance is restored.

Required actions

Collect and verify all required KYB documents ~~at onboarding prior to~~ before approval.
Conduct anti-money laundering (AML ) screening against applicable watchlists before approval.
Verify appropriate business ~~licenses~~ licenses, especially for regulated merchant categories.
~~Schedule a full~~ Implement continuous monitoring of e-commerce merchants’ websites and business activities to confirm ongoing compliance and lawful conduct, including monitoring facilitated merchants as applicable.

5. Perform re-verification ~~review~~ at least ~~once~~ every 365 ~~days. ¶ 5.~~ days, and also promptly upon circumstances such as ownership changes, location changes, declared or observed changes in activities, or suspected program violations.

6. Document all ~~verification outcomes~~ KYB and monitoring activities and retain records for audit purposes.

As a best practice, Halyard Pay should utilize merchant monitoring solutions to detect and prevent processing of illegal or brand-damaging transactions.

Source authority: Mastercard SPME ~~§2.1.~~§2.1, §7.1.3.

BRAM Response · rules.yaml

program: BRAM
- authority: Mastercard SPME §10.2
+ authority: Mastercard SPME 2.2, 7.1.3
response_window_days: 180
required_evidence:
  - transaction_monitoring_records
  - corrective_action_plan
halt_actions:
  - halt_new_merchant_onboarding
internal_notification_hours: 24
agent_owner: bram_response_agent
+ 
+ # Added reference to required re-screening under BRAM program violations per Mastercard SPME 7.1.3 guidance on re-performing onboarding screening.

BRAM Response · policy.md

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation

notice for one of our merchants, the acquirer must immediately halt new merchant onboarding

~~immediately~~ and submit an evidence package within one hundred eighty (180) days ¶ of receipt of the notice.

Required actions

Halt new merchant onboarding for the merchant under investigation.
Compile and submit an evidence package containing:

Transaction monitoring records covering the prior 180 days.
A written corrective action plan.

Notify the Halyard Pay Compliance lead within 24 hours of receipt.

## Re-screening Requirements

Acquirers must re-perform onboarding screening procedures when there are changes in ownership or location, changes in merchant or payment facilitator activities, or in cases of suspected or confirmed violation of the BRAM Program or related risk programs (QMAP, EFM, ECM). Annual re-screening is recommended for merchants in certain high-risk categories.

Source authority: Mastercard SPME ~~§10.2.~~§§7.1.3, 10.2.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

When this policy applies

Merchants that fail to supply required documentation within ~~the~~ stipulated ~~¶ period~~ timeframes must be suspended from processing until compliance is restored.

Required actions

Collect and verify all required KYB documents ~~at onboarding prior to~~ before approval.
Conduct anti-money laundering (AML ) screening against applicable watchlists before approval.
Verify appropriate business ~~licenses~~ licenses, especially for regulated merchant categories.
~~Schedule a full~~ Implement continuous monitoring of e-commerce merchants’ websites and business activities to confirm ongoing compliance and lawful conduct, including monitoring facilitated merchants as applicable.

6. Document all ~~verification outcomes~~ KYB and monitoring activities and retain records for audit purposes.

As a best practice, Halyard Pay should utilize merchant monitoring solutions to detect and prevent processing of illegal or brand-damaging transactions.

Source authority: Mastercard SPME ~~§2.1.~~§2.1, §7.1.3.

policies/bram_response/policy.md — after applying change

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation

notice for one of our merchants, the acquirer must immediately halt new merchant onboarding

~~immediately~~ and submit an evidence package within one hundred eighty (180) days ¶ of receipt of the notice.

Required actions

Halt new merchant onboarding for the merchant under investigation.
Compile and submit an evidence package containing:

Transaction monitoring records covering the prior 180 days.
A written corrective action plan.

Notify the Halyard Pay Compliance lead within 24 hours of receipt.

## Re-screening Requirements

Source authority: Mastercard SPME ~~§10.2.~~§§7.1.3, 10.2.

Source authority: Mastercard SPME §7.1.3.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME §2.1
+authority: Mastercard SPME §2.1, §7.1.3
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -12,3 +12,14 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
+re_screening_triggers:
+  - ownership_change
+  - location_change
+  - change_in_activity
+  - suspected_violation_qmap_bram_efm_ecm
+re_screening_recommendation_frequency_days: 365
+monitoring_requirements: >-
+  The Acquirer must regularly review and monitor e-commerce Merchants and Payment
+  Facilitators, ensuring their websites and business activities comply with legal,
+  ethical, and Mastercard Standards, including overseeing Payment Facilitators' Sponsored Merchants.
+monitoring_best_practice: Use of merchant monitoring solutions to detect illegal or brand-damaging transactions.
--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -1,23 +1,22 @@
 # Acquirer KYB (Know Your Business) Obligations
 
-Acquirers processing transactions on the Mastercard network are required to perform
-Know Your Business (KYB) due diligence on merchants before onboarding and on a
-recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
-minimum set of documents for each merchant to establish business legitimacy, confirm
-beneficial ownership, and satisfy anti-money laundering screening requirements.
+Acquirers processing transactions on the Mastercard network must conduct thorough Know Your Business (KYB) due diligence on merchants prior to onboarding and conduct regular ongoing monitoring afterward. Halyard Pay, as an acquirer, is responsible not only for initial collection and verification of key merchant documentation but also for continuous review to confirm merchant compliance with Mastercard standards.
 
 ## When this policy applies
 
-This policy applies to all new merchant onboarding and to all periodic re-verification
-reviews. Merchants that fail to supply required documentation within the stipulated
-period must be suspended from processing until compliance is restored.
+This policy covers initial merchant onboarding, ongoing periodic re-verification at least annually, and additional re-screening triggered by specific risk indicators such as changes in ownership, location, declared or detected changes in merchant activities, or suspicion of violations of Mastercard’s risk and compliance programs.
+
+Merchants that fail to supply required documentation within stipulated timeframes must be suspended from processing until compliance is restored.
 
 ## Required actions
 
-1. Collect all required KYB documents at onboarding prior to approval.
-2. Conduct AML screening against applicable watchlists before approval.
-3. Verify business licenses for regulated merchant categories.
-4. Schedule a full re-verification review at least once every 365 days.
-5. Document all verification outcomes and retain records for audit purposes.
+1. Collect and verify all required KYB documents before approval.
+2. Conduct anti-money laundering (AML) screening against applicable watchlists before approval.
+3. Verify appropriate business licenses, especially for regulated merchant categories.
+4. Implement continuous monitoring of e-commerce merchants’ websites and business activities to confirm ongoing compliance and lawful conduct, including monitoring facilitated merchants as applicable.
+5. Perform re-verification at least every 365 days, and also promptly upon circumstances such as ownership changes, location changes, declared or observed changes in activities, or suspected program violations.
+6. Document all KYB and monitoring activities and retain records for audit purposes.
 
-Source authority: Mastercard SPME §2.1.
+As a best practice, Halyard Pay should utilize merchant monitoring solutions to detect and prevent processing of illegal or brand-damaging transactions.
+
+Source authority: Mastercard SPME §2.1, §7.1.3.
--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -1,5 +1,5 @@
 program: BRAM
-authority: Mastercard SPME §10.2
+authority: Mastercard SPME 2.2, 7.1.3
 response_window_days: 180
 required_evidence:
   - transaction_monitoring_records
@@ -8,3 +8,5 @@
   - halt_new_merchant_onboarding
 internal_notification_hours: 24
 agent_owner: bram_response_agent
+
+# Added reference to required re-screening under BRAM program violations per Mastercard SPME 7.1.3 guidance on re-performing onboarding screening.
--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -1,9 +1,8 @@
 # BRAM Investigation Response
 
 When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
-notice for one of our merchants, the acquirer must halt new merchant onboarding
-immediately and submit an evidence package within one hundred eighty (180) days
-of receipt of the notice.
+notice for one of our merchants, the acquirer must immediately halt new merchant onboarding
+and submit an evidence package within one hundred eighty (180) days of receipt of the notice.
 
 ## Required actions
 
@@ -13,4 +12,8 @@
    - A written corrective action plan.
 3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
 
-Source authority: Mastercard SPME §10.2.
+## Re-screening Requirements
+
+Acquirers must re-perform onboarding screening procedures when there are changes in ownership or location, changes in merchant or payment facilitator activities, or in cases of suspected or confirmed violation of the BRAM Program or related risk programs (QMAP, EFM, ECM). Annual re-screening is recommended for merchants in certain high-risk categories.
+
+Source authority: Mastercard SPME §§7.1.3, 10.2.