Mastercard SPME §3.13.2 · May 2023 → Sep 2023

Acquirer Information

substantive

The section now requires acquirers to ensure Hybrid Terminals do not reject transactions solely due to service codes on the magnetic stripe, with specific conditions for certain codes and regions. Authorization must be obtained for magnetic stripe-read transactions in Europe when certain service codes are present.

Sources Mastercard SPME · May 2023 · page 44 PDF Mastercard SPME · Sep 2023 · page 41 PDF KYB Acquirer current
Also in §3.x this release substantive §3.11 Consumer Device Cardholder Verification Methods substantive §3.11.3 Persistent Authentication substantive §3.11.7 Use of a Vendor
Why these edits? The updated requirements in section 3.13.2 impose new operational obligations on acquirers to manage Hybrid Terminals in compliance with specific service code processing rules, including authorization protocols in Europe, directly impacting Acquirer KYB obligations.
Mastercard SPME §3.13.2
This section was substantively restructured between versions (3% text overlap). Compare the texts directly below.
Before · May 2023 · page 44

Security Rules and Procedures—Merchant Edition • 7 February 2023

Definition Position 1 Position 2 Position 3 PIN Required Normal Cardholder Verification, No Restrictions Normal Cardholder Verification—Goods and services only at Point of Sale (no cash back) ATM Only, PIN Required PIN Required—Goods and services only at Point of Sale (no cash back) Prompt for PIN if PIN Pad Present Prompt for PIN if PIN Pad Present—Goods and services only at Point of Sale (no cash back)

After · Sep 2023 · page 41

Acquirers must ensure that their Hybrid Terminals do not reject or otherwise decline to complete a Transaction solely because of the service code encoded on the magnetic stripe. Acquirers are not required to act on the service codes at this time unless:

  • A value of 2 or 6 is present in position 1 of the service code for a Mastercard, Maestro, or Cirrus Payment Application. The Hybrid Terminal must first attempt to process the Transaction as a Chip Transaction; or
  • The Terminal is located in the Europe Region and has magnetic stripe-reading capability, and a value of 2 is present in position 2 of the service code for a Mastercard Payment Application. The Acquirer must ensure that authorization is obtained before the Merchant completes a magnetic stripe-read Transaction.
Halyard Pay · 2 files
program: Acquirer KYB
- authority: Mastercard SPME 2.1, 11.2.6
+ authority: Mastercard SPME 2.1, 3.13.2, 11.2.6
required_documents:
- incorporation
- beneficial_ownership
- aml_screen
- license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
- ofac_sdn
- eu_consolidated
agent_owner: kyb_agent
- # The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.
- # This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.
+ # Acquirers must ensure Hybrid Terminals comply with Mastercard SPME §3.13.2 requirements.
+ # Specifically, terminals must not reject transactions solely based on magnetic stripe service codes.
+ # Where service code position 1 contains a 2 or 6 for Mastercard, Maestro, or Cirrus, the transaction
+ # must first be processed as a Chip Transaction.
+ # Terminals in the Europe Region with magnetic stripe capability must obtain authorization before
+ # completing magnetic stripe-read transactions where service code position 2 is 2 for Mastercard.
+ # This operational requirement affects acquirer terminal management and transaction authorization
+ # practices.
+ # The Acquirer must also retain all MATCH records per SPME 11.2.6 for at least two years post contract termination.

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Schedule a full re-verification review at least once every 365 days.

  5. Document all verification outcomes and retain records for audit purposes.

  6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.

7. Ensure Hybrid Terminals managed by Halyard Pay do not reject transactions solely based on magnetic stripe service codes, per Mastercard SPME §3.13.2.

- Attempt Chip Transactions first when service code position 1 is 2 or 6 for Mastercard, Maestro, or Cirrus.

- For terminals in Europe with magnetic stripe capability and service code position 2 equal to 2, ensure authorization is obtained before completing a magnetic stripe-read transaction.

Source authority: Mastercard SPME ��������2.1, §§2.1, 3.13.2, 11.2.6.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Schedule a full re-verification review at least once every 365 days.

  5. Document all verification outcomes and retain records for audit purposes.

  6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.

7. Ensure Hybrid Terminals managed by Halyard Pay do not reject transactions solely based on magnetic stripe service codes, per Mastercard SPME §3.13.2.

- Attempt Chip Transactions first when service code position 1 is 2 or 6 for Mastercard, Maestro, or Cirrus.

- For terminals in Europe with magnetic stripe capability and service code position 2 equal to 2, ensure authorization is obtained before completing a magnetic stripe-read transaction.

Source authority: Mastercard SPME ��������2.1, §§2.1, 3.13.2, 11.2.6.

Source authority: Mastercard SPME §3.13.2.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME 2.1, 11.2.6
+authority: Mastercard SPME 2.1, 3.13.2, 11.2.6
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -12,5 +12,12 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
-# The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.
-# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+# Acquirers must ensure Hybrid Terminals comply with Mastercard SPME §3.13.2 requirements.
+# Specifically, terminals must not reject transactions solely based on magnetic stripe service codes.
+# Where service code position 1 contains a 2 or 6 for Mastercard, Maestro, or Cirrus, the transaction
+# must first be processed as a Chip Transaction.
+# Terminals in the Europe Region with magnetic stripe capability must obtain authorization before
+# completing magnetic stripe-read transactions where service code position 2 is 2 for Mastercard.
+# This operational requirement affects acquirer terminal management and transaction authorization
+# practices.
+# The Acquirer must also retain all MATCH records per SPME 11.2.6 for at least two years post contract termination.
--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -20,5 +20,8 @@
 4. Schedule a full re-verification review at least once every 365 days.
 5. Document all verification outcomes and retain records for audit purposes.
 6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
+7. Ensure Hybrid Terminals managed by Halyard Pay do not reject transactions solely based on magnetic stripe service codes, per Mastercard SPME §3.13.2.
+   - Attempt Chip Transactions first when service code position 1 is 2 or 6 for Mastercard, Maestro, or Cirrus.
+   - For terminals in Europe with magnetic stripe capability and service code position 2 equal to 2, ensure authorization is obtained before completing a magnetic stripe-read transaction.
 
-Source authority: Mastercard SPME 2.1, 11.2.6.+Source authority: Mastercard SPME §§2.1, 3.13.2, 11.2.6.