Mastercard SPME §10.3 · May 2023 → Sep 2023

Responsibilities in Connection with ADC Events and Potential ADC Events

substantive

The section was expanded to clarify that a Customer's failure to cooperate with Mastercard investigations, including withholding information or delaying responses without good cause, may result in adverse inferences against the Customer. Mastercard must notify Customers before doing so and allows opportunities to justify noncompliance. This emphasizes cooperation requirements and potential consequences.

Sources Mastercard SPME · May 2023 · page 122 PDF Mastercard SPME · Sep 2023 · page 112 PDF Chargeback Handling current

Also in §10.x this release substantive §10 Should the responsible Customer cause a PFI to conduct an examination, the responsible substantive §10.2 Policy Concerning Account Data Compromise Events and Potential Account Data substantive §10.3.1 Time-Specific Procedures for ADC Events and Potential ADC Events substantive §10.3.2 Ongoing Procedures for ADC Events and Potential ADC Events substantive §10.6.2 Potential Reduction of Financial Responsibility substantive §10.6.5 Determination of Fraud Recovery (FR) substantive §10.7 Assessments and/or Disqualification for Noncompliance

Why these edits? The updated section 10.3 imposes a clearer obligation on Customers to cooperate fully and timely with Mastercard investigations concerning ADC Events, with explicit consequences including adverse inferences if the Customer fails to comply without good cause. This change directly affects the chargeback_handling policy which cites this section and covers handling responsibilities related to disputed events.

Mastercard SPME §10.3

This section was substantively restructured between versions (5% text overlap). Compare the texts directly below.

Before · May 2023 · page 122

basis throughout the pendency of the Mastercard investigation the information required by those sections. If Mastercard determines that a Customer knew or should have known with reasonable diligence of documents or other information that the Customer was required to submit to Mastercard during the pendency of the Mastercard investigation in accordance with section 10.3 or 10.4, but failed to do so, such documents or other information will not be considered by Mastercard in deciding the appeal. Account Data Compromise Events

After · Sep 2023 · page 112

Security Rules and Procedures—Merchant Edition • 1 August 2023

result from a failure to provide requested information; a failure to cooperate with Mastercard investigation guidelines, procedures, practices, and the like; or a failure to ensure that Mastercard has reasonably unfettered access to the forensic examiner. A Customer may not, by refusing to cooperate with the Mastercard investigation, avoid a determination that there was an ADC Event. Should a Customer fail without good cause to comply with its obligations in this Chapter 10 or to respond fully and in a timely fashion to a request for information to which Mastercard is entitled in this Chapter 10, Mastercard may draw an adverse inference that information to which Mastercard is entitled, but that was not timely obtained as a result of the Customer’s noncompliance, would have supported or, where appropriate, confirmed a determination that there was an ADC Event. Before drawing such an adverse inference, Mastercard will notify the Customer of its noncompliance and give the Customer an opportunity to show good cause, if any, for its noncompliance. The drawing of an adverse inference is not exclusive of other remedies that may be invoked for a Customer’s noncompliance. The following provisions set forth requirements and procedures to which each Customer and its Agent(s) must adhere upon becoming aware of an ADC Event or Potential ADC Event.

Halyard Pay · 2 files

Chargeback Handling · rules.yaml

program: Chargeback Handling
- authority: Mastercard SPME §10.1 and §11.5
+ authority: Mastercard SPME §10.1, §10.3, and §11.5
acknowledgement_business_days: 1
lifecycle_states:
  - first_presentment
  - chargeback
  - second_presentment
  - pre_arbitration
  - arbitration
evidence_requirements:
  first_presentment:
    - transaction_receipt
    - authorization_record
  chargeback:
    - merchant_rebuttal_letter
    - delivery_confirmation
    - customer_communication
  second_presentment:
    - compelling_evidence
    - signed_cardholder_agreement
  pre_arbitration:
    - full_dispute_record
    - prior_correspondence
  arbitration:
    - full_dispute_record
    - arbitration_filing
agent_owner: chargeback_agent
 
- # Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition).
- # These criteria impact evaluation triggers and risk assessment during chargeback handling.
+ # Revised to include obligations under Mastercard SPME §10.3 requiring Customers to cooperate fully and timely with investigations, with provisions for adverse inferences in cases of noncompliance, impacting evidence and response expectations during chargeback handling.

Chargeback Handling · policy.md

Chargeback Handling

Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, manages the entire dispute lifecycle for its merchants, from initial first presentment through arbitration, in compliance with Mastercard's requirements.

Lifecycle overview

Disputes move through defined stages: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Adherence to strict evidence requirements and deadlines at each stage is critical to avoid automatic rulings against the acquirer.

Required actions

Acknowledge each incoming chargeback within one business day.
Collect the necessary evidence based on the current lifecycle stage.
Submit second presentments when merchant liability is disputable, providing strong supporting evidence.
Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.
Ensure full cooperation with Mastercard investigations related to Account Data Compromise (ADC) Events, responding fully and timely to all requests. Failure to comply without good cause may result in adverse inferences against Halyard Pay in the dispute process.

6. Maintain full case documentation for audits and reporting.

Monitoring and Risk Factors

Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.

These refined definitions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.

Source authority: Mastercard SPME §§10.1, 10.3, 11.5.

policies/chargeback_handling/policy.md — after applying change

Chargeback Handling

Lifecycle overview

Required actions

Acknowledge each incoming chargeback within one business day.
Collect the necessary evidence based on the current lifecycle stage.
Submit second presentments when merchant liability is disputable, providing strong supporting evidence.
Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.
Ensure full cooperation with Mastercard investigations related to Account Data Compromise (ADC) Events, responding fully and timely to all requests. Failure to comply without good cause may result in adverse inferences against Halyard Pay in the dispute process.

6. Maintain full case documentation for audits and reporting.

Monitoring and Risk Factors

These refined definitions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.

Source authority: Mastercard SPME §§10.1, 10.3, 11.5.

Source authority: Mastercard SPME §10.3.

--- a/policies/chargeback_handling/rules.yaml
+++ b/policies/chargeback_handling/rules.yaml
@@ -1,5 +1,5 @@
 program: Chargeback Handling
-authority: Mastercard SPME §10.1 and §11.5
+authority: Mastercard SPME §10.1, §10.3, and §11.5
 acknowledgement_business_days: 1
 lifecycle_states:
   - first_presentment
@@ -26,5 +26,4 @@
     - arbitration_filing
 agent_owner: chargeback_agent
 
-# Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition).
-# These criteria impact evaluation triggers and risk assessment during chargeback handling.+# Revised to include obligations under Mastercard SPME §10.3 requiring Customers to cooperate fully and timely with investigations, with provisions for adverse inferences in cases of noncompliance, impacting evidence and response expectations during chargeback handling.
--- a/policies/chargeback_handling/policy.md
+++ b/policies/chargeback_handling/policy.md
@@ -12,7 +12,8 @@
 2. Collect the necessary evidence based on the current lifecycle stage.
 3. Submit second presentments when merchant liability is disputable, providing strong supporting evidence.
 4. Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.
-5. Maintain full case documentation for audits and reporting.
+5. Ensure full cooperation with Mastercard investigations related to Account Data Compromise (ADC) Events, responding fully and timely to all requests. Failure to comply without good cause may result in adverse inferences against Halyard Pay in the dispute process.
+6. Maintain full case documentation for audits and reporting.
 
 ## Monitoring and Risk Factors
 
@@ -20,4 +21,4 @@
 
 These refined definitions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.
 
-Source authority: Mastercard SPME §§10.1, 11.5.+Source authority: Mastercard SPME §§10.1, 10.3, 11.5.