Mastercard SPME §9.4.6 · Jun 2022 → May 2023

High-Risk Cyberlocker Merchants

substantive

⚠ Extraction warning — review against source PDF. One side of the Mastercard SPME text below appears to contain only the page-running header, not body content. This usually means the section heading fell on a page boundary and the body was attributed to a neighbouring section in the source PDF. The AI summary and proposed edit below may be misleading. Verify in: Jun 2022 · page 101 ↗ · May 2023 · page 111 ↗.

The updated rules specify that Acquirers must identify all non-face-to-face cyberlocker transactions using MCC 4816 and TCC T, verify legal compliance of merchants with documented evidence at registration, maintain this verification while acquiring transactions, and confirm compliance annually. Additionally, Acquirers must provide documentation promptly to Mastercard upon request.

Sources Mastercard SPME · Jun 2022 · page 101 PDF Mastercard SPME · May 2023 · page 111 PDF KYB Acquirer current

Also in §9.x this release breaking §9.2.1 Merchant Registration Fees and Noncompliance Assessments breaking §9.4.1 Non-face-to-face Adult Content and Services Merchants substantive §9.3 General Monitoring Requirements substantive §9.4.2 Non–face-to-face Gambling Merchants substantive §9.4.3 Pharmaceutical and Tobacco Product Merchants substantive §9.4.7 Recreational Cannabis Merchants (Canada Region Only)

Why these edits? The updated rules impose explicit Know Your Business (KYB) obligations on Acquirers to verify and maintain legal compliance documentation for all non-face-to-face cyberlocker merchants using MCC 4816 and TCC T, including annual compliance confirmation and prompt document furnishing upon Mastercard request.

Mastercard SPME §9.4.6

This section was substantively restructured between versions (6% text overlap). Compare the texts directly below.

Before · Jun 2022 · page 101

Security Rules and Procedures—Merchant Edition • 22 February 2022

After · May 2023 · page 111

Security Rules and Procedures—Merchant Edition • 7 February 2023

The cyberlocker Merchant provides a “link checker” that allows users to determine whether a link has been removed, and if so, allows the user to promptly re-upload that content.
File owners are: – Typically anonymous, – Not required to provide any identifying information, and – Not aware of the identity of those users who have access to or view their files.
File distribution and sharing are emphasized on the cyberlocker site.
Storage or transfer of specific copyrighted file types such as movies, videos, or music is promoted on the cyberlocker site.
Without the purchase of a premium membership, video playback includes frequent display advertisements. An Acquirer must identify all non–face-to-face cyberlocker Transactions using MCC 4816 (Computer Network/Information Services) and TCC T. At the time of registration of a Merchant, Sponsored Merchant, or entity in accordance with this section, the Acquirer of such Merchant, Sponsored Merchant, or entity must have verified that the Merchant’s, Sponsored Merchant’s, or entity’s activity complies fully with all laws applicable to Mastercard, the Merchant, Sponsored Merchant, entity, the Issuer, the Acquirer, and any prospective customer of the Merchant, Sponsored Merchant, or entity. Such verification may include, but is not limited to, a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party. By registering a Merchant, Sponsored Merchant, or entity as required by this section, the Acquirer represents and warrants that the Acquirer has verified compliance with applicable law as described above. The Acquirer must maintain such verification for so long as it acquires Transactions from the Merchant, Sponsored Merchant, or entity that is subject to the aforedescribed registration requirement and must, no less frequently than every 12 months, confirm continued compliance with applicable law concerning the business of the registered Merchant, Sponsored Merchant, or entity. The Acquirer must furnish Mastercard with a copy of such documentation promptly upon request.

Halyard Pay · 2 files

KYB Acquirer · rules.yaml

program: Acquirer KYB
- authority: Mastercard SPME §2.1
+ authority: Mastercard SPME §2.1, §9.4.6
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
+   - legal_compliance_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
+ additional_requirements:
+   cyberlocker_non_face_to_face_transactions:
+     mcc: 4816
+     tcc: T
+     description: >-
+       Acquirers must identify all non–face-to-face cyberlocker transactions under MCC 4816 and TCC T.
+     legal_compliance_verification:
+       description: >-
+         At registration, confirm merchant compliance with all applicable laws via
+         legal opinions or recognized third-party accreditation.
+       annual_confirmation_required: true
+       documentation_furnishing:
+         required_upon_request: true
+         retention_period_years: 7

KYB Acquirer · policy.md

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform ¶ Know Your Business (KYB) due diligence on merchants before onboarding and on a ¶ recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish business legitimacy, confirm ¶ beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification ¶ reviews. Merchants that fail to supply required documentation within the stipulated ¶ period must be suspended from processing until compliance is restored.

Additionally, for all non–face-to-face cyberlocker merchants identified by MCC 4816 and TCC T, Halyard Pay must perform enhanced KYB checks due to the elevated risk profile of such merchants.

## Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Verify business licenses for regulated merchant categories.
Verify that cyberlocker merchants comply fully with all applicable laws, which may include obtaining a written legal opinion or third-party accreditation.

5. Schedule a full re-verification review at least once every 365 ~~days. ¶ 5.~~ days, including confirmation of ongoing legal compliance for cyberlocker merchants.

6. Document all verification outcomes and retain records for audit purposes.

7. Furnish compliance verification documentation promptly to Mastercard upon request for these merchants.

Source authority: Mastercard SPME §9.4.6, §2.1.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

When this policy applies

Additionally, for all non–face-to-face cyberlocker merchants identified by MCC 4816 and TCC T, Halyard Pay must perform enhanced KYB checks due to the elevated risk profile of such merchants.

## Required actions

Collect all required KYB documents at onboarding prior to approval.
Conduct AML screening against applicable watchlists before approval.
Verify business licenses for regulated merchant categories.
Verify that cyberlocker merchants comply fully with all applicable laws, which may include obtaining a written legal opinion or third-party accreditation.

5. Schedule a full re-verification review at least once every 365 ~~days. ¶ 5.~~ days, including confirmation of ongoing legal compliance for cyberlocker merchants.

6. Document all verification outcomes and retain records for audit purposes.

7. Furnish compliance verification documentation promptly to Mastercard upon request for these merchants.

Source authority: Mastercard SPME §9.4.6, §2.1.

Source authority: Mastercard SPME §9.4.6.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,10 +1,11 @@
 program: Acquirer KYB
-authority: Mastercard SPME §2.1
+authority: Mastercard SPME §2.1, §9.4.6
 required_documents:
   - incorporation
   - beneficial_ownership
   - aml_screen
   - license_verification
+  - legal_compliance_verification
 min_review_cycle_days: 365
 suspension_trigger: document_collection_failure
 record_retention_years: 7
@@ -12,3 +13,17 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
+additional_requirements:
+  cyberlocker_non_face_to_face_transactions:
+    mcc: 4816
+    tcc: T
+    description: >-
+      Acquirers must identify all non–face-to-face cyberlocker transactions under MCC 4816 and TCC T.
+    legal_compliance_verification:
+      description: >-
+        At registration, confirm merchant compliance with all applicable laws via
+        legal opinions or recognized third-party accreditation.
+      annual_confirmation_required: true
+      documentation_furnishing:
+        required_upon_request: true
+        retention_period_years: 7

--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -1,23 +1,21 @@
 # Acquirer KYB (Know Your Business) Obligations
 
-Acquirers processing transactions on the Mastercard network are required to perform
-Know Your Business (KYB) due diligence on merchants before onboarding and on a
-recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
-minimum set of documents for each merchant to establish business legitimacy, confirm
-beneficial ownership, and satisfy anti-money laundering screening requirements.
+Acquirers processing transactions on the Mastercard network are required to perform Know Your Business (KYB) due diligence on merchants before onboarding and on a recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a minimum set of documents for each merchant to establish business legitimacy, confirm beneficial ownership, and satisfy anti-money laundering screening requirements.
 
 ## When this policy applies
 
-This policy applies to all new merchant onboarding and to all periodic re-verification
-reviews. Merchants that fail to supply required documentation within the stipulated
-period must be suspended from processing until compliance is restored.
+This policy applies to all new merchant onboarding and to all periodic re-verification reviews. Merchants that fail to supply required documentation within the stipulated period must be suspended from processing until compliance is restored.
+
+Additionally, for all non–face-to-face cyberlocker merchants identified by MCC 4816 and TCC T, Halyard Pay must perform enhanced KYB checks due to the elevated risk profile of such merchants.
 
 ## Required actions
 
 1. Collect all required KYB documents at onboarding prior to approval.
 2. Conduct AML screening against applicable watchlists before approval.
 3. Verify business licenses for regulated merchant categories.
-4. Schedule a full re-verification review at least once every 365 days.
-5. Document all verification outcomes and retain records for audit purposes.
+4. Verify that cyberlocker merchants comply fully with all applicable laws, which may include obtaining a written legal opinion or third-party accreditation.
+5. Schedule a full re-verification review at least once every 365 days, including confirmation of ongoing legal compliance for cyberlocker merchants.
+6. Document all verification outcomes and retain records for audit purposes.
+7. Furnish compliance verification documentation promptly to Mastercard upon request for these merchants.
 
-Source authority: Mastercard SPME §2.1.
+Source authority: Mastercard SPME §9.4.6, §2.1.