Mastercard SPME §11.2.1 · May 2023 → Sep 2023
Certification
The updated section mandates that Acquirers must be officially certified by Mastercard to access and use the MATCH system, detailing the certification process and consequences of noncompliance, including penalties and fees, whereas previously only failure to enter a Merchant into MATCH was addressed.
Security Rules and Procedures—Merchant Edition • 7 February 2023
An Acquirer that fails to enter a Merchant into MATCH is subject to a noncompliance assessment, and may be subject to an unfavorable ruling in a compliance case filed by a subsequent Acquirer of that Merchant.
Each Acquirer that conducts Merchant acquiring Activity must be certified by Mastercard to use MATCH because it is a mandatory system. An Acquirer that does not comply with these requirements may be assessed for noncompliance, as described in this chapter. Certification is the process by which Mastercard connects an Acquirer to the MATCH system, so that the Acquirer may send and receive MATCH records to and from Mastercard. To be certified for MATCH usage, Acquirers must request access for each Member ID/ICA number under which acquiring Activity is conducted. NOTE: An Acquirer that conducts Merchant acquiring Activity under a Member ID/ICA number that does not have access to the MATCH system is not considered certified. An Acquirer that is not MATCH-certified is subject to noncompliance assessments as described in Table 11.3. 3 If country is USA. 4 If country is not USA. 5 Acquirers globally are assessed an annual MATCH usage fee of USD 5,000. In addition, Acquirers are assessed a MATCH inquiry fee (per Member ID/ICA number) for each MATCH inquiry. MATCH System
program: Acquirer KYB- authority: Mastercard SPME 2.1, 11.2.6+ authority: Mastercard SPME 2.1, 11.2.1, 11.2.6required_documents:- incorporation- beneficial_ownership- aml_screen- license_verificationmin_review_cycle_days: 365suspension_trigger: document_collection_failurerecord_retention_years: 7aml_watchlist_sources:- ofac_sdn- eu_consolidatedagent_owner: kyb_agent- # The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.- # This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+ # The Acquirer must be formally certified by Mastercard to use the MATCH system for all Member ID/ICA numbers under which acquiring activity is conducted (per Mastercard SPME 11.2.1).+ # Noncompliance with MATCH certification requirements may result in assessments and penalties as outlined in the SPME.+ # Furthermore, all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner must be retained for at least two years after agreement termination or expiration (SPME 11.2.6).
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network are required to perform
Know Your Business (KYB) due diligence on merchants before onboarding and on a
recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
minimum set of documents for each merchant to establish business legitimacy, confirm
beneficial ownership, and satisfy anti-money laundering screening requirements.
When this policy applies
This policy applies to all new merchant onboarding and to all periodic re-verification
reviews. Merchants that fail to supply required documentation within the stipulated
period must be suspended from processing until compliance is restored.
Required actions
-
Collect all required KYB documents at onboarding prior to approval.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule a full re-verification review at least once every 365 days.
-
Document all verification outcomes and retain records for audit purposes.
-
Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
7. Ensure that Halyard Pay is formally certified by Mastercard to access and use the MATCH system. Certification requires requesting access for each Member ID/ICA number under which we conduct acquiring activity. Operating without MATCH certification is noncompliant and may result in penalties.
Source authority: Mastercard SPME ��������2.1, 11.2.6.§2.1, §11.2.6, §11.3.
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network are required to perform
Know Your Business (KYB) due diligence on merchants before onboarding and on a
recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
minimum set of documents for each merchant to establish business legitimacy, confirm
beneficial ownership, and satisfy anti-money laundering screening requirements.
When this policy applies
This policy applies to all new merchant onboarding and to all periodic re-verification
reviews. Merchants that fail to supply required documentation within the stipulated
period must be suspended from processing until compliance is restored.
Required actions
-
Collect all required KYB documents at onboarding prior to approval.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule a full re-verification review at least once every 365 days.
-
Document all verification outcomes and retain records for audit purposes.
-
Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
7. Ensure that Halyard Pay is formally certified by Mastercard to access and use the MATCH system. Certification requires requesting access for each Member ID/ICA number under which we conduct acquiring activity. Operating without MATCH certification is noncompliant and may result in penalties.
Source authority: Mastercard SPME ��������2.1, 11.2.6.§2.1, §11.2.6, §11.3.
Source authority: Mastercard SPME §11.2.1.
--- a/policies/kyb_acquirer/rules.yaml +++ b/policies/kyb_acquirer/rules.yaml @@ -1,5 +1,5 @@ program: Acquirer KYB -authority: Mastercard SPME 2.1, 11.2.6 +authority: Mastercard SPME 2.1, 11.2.1, 11.2.6 required_documents: - incorporation - beneficial_ownership @@ -12,5 +12,6 @@ - ofac_sdn - eu_consolidated agent_owner: kyb_agent -# The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6. -# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+# The Acquirer must be formally certified by Mastercard to use the MATCH system for all Member ID/ICA numbers under which acquiring activity is conducted (per Mastercard SPME 11.2.1). +# Noncompliance with MATCH certification requirements may result in assessments and penalties as outlined in the SPME. +# Furthermore, all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner must be retained for at least two years after agreement termination or expiration (SPME 11.2.6). --- a/policies/kyb_acquirer/policy.md +++ b/policies/kyb_acquirer/policy.md @@ -20,5 +20,6 @@ 4. Schedule a full re-verification review at least once every 365 days. 5. Document all verification outcomes and retain records for audit purposes. 6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements. +7. Ensure that Halyard Pay is formally certified by Mastercard to access and use the MATCH system. Certification requires requesting access for each Member ID/ICA number under which we conduct acquiring activity. Operating without MATCH certification is noncompliant and may result in penalties. -Source authority: Mastercard SPME 2.1, 11.2.6.+Source authority: Mastercard SPME §2.1, §11.2.6, §11.3.