applicable presentment time frame to the Corporation via the Interchange System, for the purpose of a transfer of funds via the Interchange System, and Definitions Point–of–Sale (POS) Transaction Security Rules and Procedures—Merchant Edition • 7 February 2023

such Transaction Data is subsequently transferred by the Corporation to the Issuer for such purpose. Processing of Personal Data Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of such data. Program A Customer’s Card issuing program, Merchant acquiring program, ATM Terminal acquiring program, Digital Activity program, and/or a PTA Program in which a Customer is Participating. Program Service Any service described in the Standards that directly or indirectly supports a Program and regardless of whether the entity providing the service is registered as a Service Provider of one or more Customers. The Corporation has the sole right to determine whether a service is a Program Service. PTA Account A PTA Originating Account and/or a PTA Receiving Account. PTA Account Number The account number allocated to a PTA Account by a PTA Customer. PTA Account Portfolio All PTA Accounts issued by a PTA Customer. Definitions Processing of Personal Data Security Rules and Procedures—Merchant Edition • 7 February 2023

PTA Agreement The agreement between the Corporation and a PTA Customer granting the PTA Customer the right to Participate in a PTA Program, in accordance with the Standards. PTA Customer A Customer that Participates in a PTA Program pursuant to a PTA Agreement. PTA Originating Account The funding source of the Originating Account Holder, from where funds are acquired by the Originating Institution to initiate a PTA Transaction. PTA Program A type of Payment Transfer Activity that is identified in the applicable Standards as being a PTA Program, including the MoneySend Program, the Mastercard Merchant Presented QR Program, the Mastercard Send Cross-Border Service, and the Mastercard Gaming and Gambling Payments Program. PTA Receiving Account The Account or, if applicable for a particular PTA Program (as set forth in the Standards for such PTA Program), the Non-Mastercard Receiving Account, held by a Receiving Account Holder and to which the Receiving Customer must ensure receipt of a PTA Transaction. PTA Settlement Guarantee Covered Program A PTA Settlement Obligation arising from a PTA Transaction conducted pursuant to a PTA Program that is identified in the applicable Standards as being a PTA Settlement Guarantee Covered Program. Definitions PTA Agreement Security Rules and Procedures—Merchant Edition • 7 February 2023

PTA Settlement Obligation A financial obligation of a Principal or Association PTA Customer to another Principal or Association PTA Customer arising from a PTA Transaction. PTA Transaction A financial transaction in which funds are transferred from an Originating Institution to a Receiving Customer on behalf of Account Holders pursuant to a PTA Program. Quick Response (QR) Code An ISO 18004-compliant encoding and visualization of data. Receiving Account Holder The Account Holder receiving the PTA Transaction. Receiving Agent A PTA Customer that Participates in Payment Transfer Activity as an agent for the purpose of receiving a PTA Transaction. Receiving Customer A Receiving Agent or a Receiving Institution. Receiving Institution (RI) A PTA Customer that Participates in Payment Transfer Activity as a receiver of PTA Transactions on behalf of a Receiving Account Holder. Region A geographic region as defined by the Corporation from time to time. See Appendix A of the Mastercard Rules manual. Definitions PTA Settlement Obligation Security Rules and Procedures—Merchant Edition • 7 February 2023

Remote Electronic Transaction In the Europe Region, all types of Card-not-present Transaction (e-commerce Transactions, recurring payments, installments, Card-on-file Transactions, in-app Transactions, and Transactions completed through a Digital Wallet, including MasterPass™). Mail order and telephone order (MO/TO) Transactions and Transactions completed with anonymous prepaid Cards are excluded from this definition. Service Provider A person that performs Program Service. The Corporation has the sole right to determine whether a person is or may be a Service Provider and if so, the category of Service Provider. A Service Provider is an agent of the Customer that receives or otherwise benefits from Program Service, whether directly or indirectly, performed by such Service Provider. Settlement Obligation A financial obligation of a Principal or Association Customer to another Principal or Association Customer arising from a Transaction. Shared Deposit Transaction A deposit to a savings Account or checking Account conducted at an ATM Terminal located in the U.S. Region, initiated with a Card issued by a U.S. Region Customer other than the Acquirer, and processed through the Mastercard ATM Network. Solicitation, Solicit An application, advertisement, promotion, marketing communication, or the like distributed as printed materials, in electronic format (including but not limited to an email, website, mobile application, or social media platform), or both intended to solicit the enrollment of a person or entity as a Cardholder or Account Holder or as a Merchant. To “Solicit” means to use a Solicitation. Definitions Remote Electronic Transaction Security Rules and Procedures—Merchant Edition • 7 February 2023

Special Issuer Program Issuer Activity that the Corporation deems may be undertaken only with the express prior consent of the Corporation. As of the date of the publication of these Rules, Special Issuer Programs include Affinity Card Programs, Co-Brand Card Programs, and Prepaid Card Programs, and with respect to Mastercard Activity only, Brand Value Transaction and proprietary account, Remote Transaction Mastercard Account, and secured Mastercard Card Programs. Sponsor, Sponsorship The relationship described in the Standards between:

• a Principal or Association and an Affiliate that engages in Activity indirectly through the Principal or Association, in which case, the Principal or Association is the Sponsor of the Affiliate and the Affiliate is Sponsored by the Principal or Association;
• a Payment Facilitator and a Sponsored Merchant, in which case the Payment Facilitator is the Sponsor of the Sponsored Merchant and the Sponsored Merchant is Sponsored by the Payment Facilitator; or
• a Digital Activity Sponsoring Customer and a Sponsored Digital Activity Entity, in which case the Digital Activity Sponsoring Customer is the Sponsor of the Sponsored Digital Activity Entity. “Sponsorship” means the Sponsoring of a Customer, a Sponsored Merchant, or a Sponsored Digital Activity Entity. Sponsored Digital Activity Entity A wholly-owned subsidiary (or other affiliated entity as approved by the Corporation) of a Digital Activity Sponsoring Customer. The Sponsored Digital Activity Entity may be approved at the sole discretion of the Corporation to participate in Digital Activity pursuant to a Digital Activity Agreement or other agreement with the Corporation. Sponsored Merchant A merchant that, pursuant to an agreement with a Payment Facilitator, is authorized to accept Cards when properly presented. A Sponsored Merchant is also referred to as a Submerchant. Definitions Special Issuer Program Security Rules and Procedures—Merchant Edition • 7 February 2023 Sponsored Merchant Agreement An agreement between a Sponsored Merchant and a Payment Facilitator that sets forth the terms pursuant to which the Sponsored Merchant is authorized to accept Cards. A Sponsored Merchant Agreement is also referred to as a Submerchant Agreement. Staged Digital Wallet Functionality that can be used at more than one retailer, and by which the Staged Digital Wallet Operator effects a two-stage payment to a retailer to complete a purchase initiated by a Cardholder. The following may occur in either order:
• Payment stage—In the payment stage, the Staged DWO pays the retailer by means of: – A proprietary non-Mastercard method (and not with a Mastercard Card); or – A funds transfer to an account held by the Staged DWO for or on behalf of the retailer.
• Funding stage—In the funding stage, the Staged DWO uses a Mastercard or Maestro Account provided to the Staged DWO by the Cardholder (herein, the “funding account”) to perform a transaction that funds or reimburses the Staged Digital Wallet. The retailer does not receive Mastercard or Maestro Account data or other information identifying the network brand and payment card issuer for the funding account. Staged Digital Wallet Operator (DWO) A registered Service Provider that operates a Staged Digital Wallet. Standards The organizational documents, operating rules, regulations, policies, and procedures of the Corporation, including but not limited to any manuals, guides, announcements or bulletins, as may be amended from time to time. Definitions Sponsored Merchant Agreement Security Rules and Procedures—Merchant Edition • 7 February 2023 Stand-In Parameters A set of authorization requirements established by the Corporation or the Issuer that are accessed by the Interchange System using the Stand-In Processing Service to determine the appropriate responses to authorization requests. Stand-In Processing Service A service offered by the Corporation in which the Interchange System authorizes or declines Transactions on behalf of and uses Stand-In Parameters provided by the Issuer (or in some cases, by the Corporation). The Stand-In Processing Service responds only when the Issuer is unavailable, the Transaction cannot be delivered to the Issuer, or the Issuer exceeds the response time parameters set by the Corporation. Strong Customer Authentication (SCA) Authentication as required by the 2nd Payment Services Directive (Directive [EU] 2015/2366 of 25 November 2015) Regulatory Technical Standards on Strong Customer Authentication (as amended and replaced from time to time). Sub-licensee A person authorized in writing to use a Mark either by a Licensee in accordance with the Standards or by the Corporation. Terminal Any attended or unattended device capable of the electronic capture and exchange of Account data that meets the Corporation requirements for Terminal eligibility, functionality, and security, and permits a Cardholder to effect a Transaction in accordance with the Standards. An ATM Terminal, Bank Branch Terminal, and POS Terminal is each a type of Terminal. Third Party Processor (TPP) A Service Provider that performs TPP Program Service. Definitions Stand-In Parameters Security Rules and Procedures—Merchant Edition • 7 February 2023 Token A numeric value that (i) is a surrogate for the primary account number (PAN) used by a payment card issuer to identify a payment card account or is a surrogate for the PTA Account Number used by a PTA Customer to identify a PTA Account; (ii) is issued in compliance with the EMV Payment Tokenization Specification Technical Framework; and (iii) passes the basic validation rules for a PAN, including the Luhn Formula for Computing Modulus 10 Check Digit. Also see Mastercard Token. Tokenization, Tokenize The process by which a Mastercard Token replaces an Account PAN or a PTA Account Number. Token Requestor An entity that requests the replacement of Account PANs with Mastercard Tokens. Token Vault A repository of tokens that are implemented by a tokenization system, which may also perform primary account number (PAN) mapping and cryptography validation. Transaction A financial transaction arising from the proper acceptance of a Card or Account bearing or identified with one or more of the Brand Marks, either alone or in combination with the marks of another payment scheme, at a Card acceptance location and identified in messages with a Card Program identifier. Transaction Data Any data and/or data element or subelement that the Standards and/or the Corporation’s interface specifications require to be used to initiate, authorize, clear, and/or settle a Transaction or PTA Transaction (whether authorized, cleared, and/or settled via the Interchange System or otherwise) or that the Corporation requires to be provided. Definitions Token Security Rules and Procedures—Merchant Edition • 7 February 2023 Transaction Management System Performs Transaction management services for Mastercard Cloud-Based Payments, which may include credential authentication, application cryptogram mapping and validation, ensuring synchronization with the Credentials Management System, and forwarding of Transactions to the Issuer for authorization. Trusted Service Manager Provisions an Access Device with the Payment Application, personalization data, or post-issuance application management commands by means of an over-the-air (OTA) communication channel. Virtual Account A Mastercard Account issued without a physical Card or Access Device. A Virtual Account cannot be electronically read. Volume The aggregate financial value of a group of Transactions. “Volume” does not mean the number of Transactions. Wallet Token Requestor A Wallet Token Requestor is a Pass-through DWO that connects directly to the Mastercard Digital Enablement Service (MDES) for the purpose of Tokenizing a Mastercard or Maestro Account primary account number (PAN) provided by a Cardholder for use in a future Transaction. Word Mark A Mark consisting of the name of one of the Corporation’s brands followed by a registered trademark ®or ™symbol (depending on its trademark status in a particular country) or the local law equivalent. See Cirrus Word Mark, Maestro Word Mark, Mastercard Word Mark. Definitions Transaction Management System Security Rules and Procedures—Merchant Edition • 7 February 2023 Inter-European Transaction A Transaction completed using a Card issued in a country or territory listed in Single European Payments Area (SEPA) at a Terminal located in a country or territory listed in Non-Single European Payments Area (Non-SEPA) or Transaction completed using a Card issued in a country or territory listed in Non-Single European Payments Area (Non–SEPA) at a Terminal located in a country or territory listed in Single European Payments Area (SEPA). Definitions Inter-European Transaction Security Rules and Procedures—Merchant Edition • 7 February 2023 Notices Following are policies pertaining to proprietary rights, trademarks, translations, and details about the availability of additional information online. Proprietary Rights The information contained in this document is proprietary and confidential to Mastercard International Incorporated, one or more of its affiliated entities (collectively “Mastercard”), or both. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of Mastercard. Trademarks Trademark notices and symbols used in this document reflect the registration status of Mastercard trademarks in the United States. Consult with the Global Customer Service team or the Mastercard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. Disclaimer Mastercard makes no representations or warranties of any kind, express or implied, with respect to the contents of this document. Without limitation, Mastercard specifically disclaims all representations and warranties with respect to this document and any intellectual property rights subsisting therein or any part thereof, including but not limited to any and all implied warranties of title, non- infringement, or suitability for any purpose (whether or not Mastercard has been advised, has reason to know, or is otherwise in fact aware of any information) or achievement of any particular result. Translation A translation of any Mastercard manual, bulletin, release, or other Mastercard document into a language other than English is intended solely as a convenience to Mastercard customers. Mastercard provides any translated document to its customers “AS IS” and makes no representations or warranties of any kind with respect to the translated document, including, but not limited to, its accuracy or reliability. In no event shall Mastercard be liable for any damages resulting from reliance on any translated document. The English version of any Mastercard document will take precedence over any translated version in any legal proceeding. Notices Security Rules and Procedures—Merchant Edition • 7 February 2023 Information Available Online Mastercard provides details about the standards used for this document, including times expressed, language use, and contact information, on the Technical Resource Center (TRC). Go to the Rules collection of the References section for centralized information. Notices Security Rules and Procedures—Merchant Edition • 7 February 2023