Mastercard SPME §8.4.2 · May 2023 → Sep 2023
Mastercard Commencement of an Investigation
The updated section specifies procedures for Issuers to notify Mastercard via a web-based form if a Merchant is deemed questionable, detailing required information to be provided. It also introduces the possibility of a filing fee for Issuer notifications and requires Acquirers to promptly notify Mastercard if acquiring for a Questionable Merchant.
Security Rules and Procedures—Merchant Edition • 7 February 2023
Security Rules and Procedures—Merchant Edition • 1 August 2023
The QMAP Issuer Referral Form, completed by the Issuer, is available on Mastercard Connect > Support > Form. Transactions that occurred during the Case Scope Period may qualify as eligible for recovery under the QMAP. Effective 1 January 2022, if an Issuer has reason to believe that a Merchant may be a Questionable Merchant, the Issuer may notify Mastercard by web-based form at https:// form.mastercard.com/jfe/form/SV_01AtAPzF9FXjzrD. Transactions that occurred during the Case Scope Period may qualify as eligible for recovery under the QMAP. In the notification, the Issuer must provide the basis for the Issuer’s reason to believe that the Merchant may be a Questionable Merchant, and must provide all of the following information:
- Issuer name and Member ID;
- Acquirer name and Member ID;
- Merchant name and address (city, state or province, and country);
- Total number of Transactions conducted at the Questionable Merchant by the Issuer’s Cardholders;
- Total dollar volume of Issuer losses at the Questionable Merchant;
- Percentage of Transactions attributed to Cardholder bust-out accounts, if applicable; and
- Details of each Issuer-confirmed fraudulent Transaction, including Cardholder account number, Transaction date and time, and Transaction amount in U.S. dollars. Mastercard may charge the Issuer a filing fee for each Merchant notification at the commencement of a QMAP investigation as described in section 8.4.9 of this manual. If an Acquirer becomes aware that it is acquiring for a Questionable Merchant, the Acquirer must notify Mastercard promptly by email message at qmap@mastercard.com.
program: BRAM- authority: Mastercard SPME §8.6.2, §10.2+ authority: Mastercard SPME §8.4.2, §8.6.2, §10.2response_window_days: 180required_evidence:- transaction_monitoring_records- corrective_action_plan- - police_report # Added requirement for police report according to updated SPME §8.6.2+ - police_report # Mandatory for coercion claims as per updated SPME §8.6.2+ - issuer_notification_details # Added to capture required Issuer notification info under SPME §8.4.2halt_actions:- halt_new_merchant_onboardinginternal_notification_hours: 24agent_owner: bram_response_agent- # Updated to reflect the extended discretionary investigation period and mandatory police report inclusion for at least one coercion claim as specified in Mastercard SPME §8.6.2.+ # Updated to reflect the extended discretionary investigation period, mandatory police report inclusion for coercion claims (SPME §8.6.2),+ # and new detailed notification and filing fee requirements for Questionable Merchants reporting by Issuers and Acquirers (SPME §8.4.2).
BRAM Investigation Response
When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
notice for one of our merchants, the acquirer must halt new merchant onboarding
immediately and submit an evidence package within one hundred eighty (180) days
of receipt of the notice.
Required actions
-
Halt new merchant onboarding for the merchant under investigation.
-
Compile and submit an evidence package containing:
-
Transaction monitoring records covering the prior 180 days.
-
A written corrective action plan.
-
Documentation of any police reports related to alleged coercion claims if applicable.
- Notify the Halyard Pay Compliance lead within 24 hours of receipt.
4. If the merchant is suspected of being a Questionable Merchant, ensure prompt notification to Mastercard via qmap@mastercard.com.
Additional Considerations for Coercion Claims
When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day
investigation period at its discretion. At least one claim must include a police report from the Cardholder.
Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,
though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
merchant within the investigation period to prompt claim submissions.
## Notification for Questionable Merchants
Per Mastercard SPME §8.4.2, if an issuer suspects a merchant to be questionable, they may notify
Mastercard through the web-based form provided. The notification must include comprehensive details
such as issuer and acquirer information, merchant details, transaction volumes, and specifics on confirmed
fraudulent transactions. Acquirers learning they are acquiring for a Questionable Merchant must notify
Mastercard promptly by email at qmap@mastercard.com. Mastercard may charge a filing fee upon
commencement of a QMAP investigation.
Source authority: Mastercard SPME §8.6.2, §8.4.2, §10.2.
BRAM Investigation Response
When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
notice for one of our merchants, the acquirer must halt new merchant onboarding
immediately and submit an evidence package within one hundred eighty (180) days
of receipt of the notice.
Required actions
-
Halt new merchant onboarding for the merchant under investigation.
-
Compile and submit an evidence package containing:
-
Transaction monitoring records covering the prior 180 days.
-
A written corrective action plan.
-
Documentation of any police reports related to alleged coercion claims if applicable.
- Notify the Halyard Pay Compliance lead within 24 hours of receipt.
4. If the merchant is suspected of being a Questionable Merchant, ensure prompt notification to Mastercard via qmap@mastercard.com.
Additional Considerations for Coercion Claims
When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day
investigation period at its discretion. At least one claim must include a police report from the Cardholder.
Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,
though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
merchant within the investigation period to prompt claim submissions.
## Notification for Questionable Merchants
Per Mastercard SPME §8.4.2, if an issuer suspects a merchant to be questionable, they may notify
Mastercard through the web-based form provided. The notification must include comprehensive details
such as issuer and acquirer information, merchant details, transaction volumes, and specifics on confirmed
fraudulent transactions. Acquirers learning they are acquiring for a Questionable Merchant must notify
Mastercard promptly by email at qmap@mastercard.com. Mastercard may charge a filing fee upon
commencement of a QMAP investigation.
Source authority: Mastercard SPME §8.6.2, §8.4.2, §10.2.
Source authority: Mastercard SPME §8.4.2.
--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -1,13 +1,15 @@
program: BRAM
-authority: Mastercard SPME §8.6.2, §10.2
+authority: Mastercard SPME §8.4.2, §8.6.2, §10.2
response_window_days: 180
required_evidence:
- transaction_monitoring_records
- corrective_action_plan
- - police_report # Added requirement for police report according to updated SPME §8.6.2
+ - police_report # Mandatory for coercion claims as per updated SPME §8.6.2
+ - issuer_notification_details # Added to capture required Issuer notification info under SPME §8.4.2
halt_actions:
- halt_new_merchant_onboarding
internal_notification_hours: 24
agent_owner: bram_response_agent
-# Updated to reflect the extended discretionary investigation period and mandatory police report inclusion for at least one coercion claim as specified in Mastercard SPME §8.6.2.+# Updated to reflect the extended discretionary investigation period, mandatory police report inclusion for coercion claims (SPME §8.6.2),
+# and new detailed notification and filing fee requirements for Questionable Merchants reporting by Issuers and Acquirers (SPME §8.4.2).
--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -13,6 +13,7 @@
- A written corrective action plan.
- Documentation of any police reports related to alleged coercion claims if applicable.
3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
+4. If the merchant is suspected of being a Questionable Merchant, ensure prompt notification to Mastercard via qmap@mastercard.com.
## Additional Considerations for Coercion Claims
@@ -22,4 +23,13 @@
though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
merchant within the investigation period to prompt claim submissions.
-Source authority: Mastercard SPME §8.6.2, §10.2.
+## Notification for Questionable Merchants
+
+Per Mastercard SPME §8.4.2, if an issuer suspects a merchant to be questionable, they may notify
+Mastercard through the web-based form provided. The notification must include comprehensive details
+such as issuer and acquirer information, merchant details, transaction volumes, and specifics on confirmed
+fraudulent transactions. Acquirers learning they are acquiring for a Questionable Merchant must notify
+Mastercard promptly by email at qmap@mastercard.com. Mastercard may charge a filing fee upon
+commencement of a QMAP investigation.
+
+Source authority: Mastercard SPME §8.6.2, §8.4.2, §10.2.