Security Rules and Procedures—Merchant Edition • 1 August 2023

8.7.5.2 Acquirer Non-Performance Assessments Mastercard may bill an Acquirer for non-performance assessments for each impacted Merchant ID (MID) for a substantiated claim as described in the table below: Miscoded Brazil GCMS Domestic Transaction Volume Non-Performance Assessment Less than BRL 5,000,000 Up to BRL 10,000 More than BRL 5,000,000 but less than BRL 30,000,000 Up to BRL 50,000 More than BRL 30,000,000 Up to BRL 150,000 Non-performance assessments may be escalated as described in the below tables. For the second violation within twelve months: Miscoded Brazil GCMS Domestic Transaction Volume Non-Performance Assessment Less than BRL 5,000,000 Up to BRL 20,000 More than BRL 5,000,000 but less than BRL 30,000,000 Up to BRL 100,000 More than BRL 30,000,000 Up to BRL 300,000 For the third violation within twelve months: Miscoded Brazil GCMS Domestic Transaction Volume Non-Performance Assessment Less than BRL 5,000,000 Up to BRL 30,000 More than BRL 5,000,000 but less than BRL 30,000,000 Up to BRL 150,000 More than BRL 30,000,000 Up to BRL 450,000 For the fourth and subsequent violations within twelve months: Miscoded Brazil GCMS Domestic Transaction Volume Non-Performance Assessment Less than BRL 5,000,000 Up to BRL 40,000 Mastercard Fraud Control Programs 8.7.5.2 Acquirer Non-Performance Assessments Security Rules and Procedures—Merchant Edition • 1 August 2023

Miscoded Brazil GCMS Domestic Transaction Volume Non-Performance Assessment More than BRL 5,000,000 but less than BRL 30,000,000 Up to BRL 200,000 More than BRL 30,000,000 Up to BRL 600,000 Acquirer Non-Performance Assessments may be mitigated at the Corporation’s discretion, using the below guidance:

• Mitigated by 50% if the Qualifying Merchant is recoded with an appropriate MCC within 5 calendar days of the Corporation’s notification.
• Mitigated by 25% if the Qualifying Merchant is recoded with an appropriate MCC within fifteen calendar days of the Corporation’s notification. 8.7.5.3 Issuer Interchange Recovery (Collected from the Acquirer(s) and Credited to the Issuers(s)) Mastercard will calculate and assess Acquirers for Issuer Interchange Recovery by applying adjustments to the interchange rate submitted for each Transaction processed through GCMS within a substantiated claim. The interchange adjustment will be made based on the calculated differential between the interchange rates submitted for each Transaction processed through GCMS within a substantiated claim and the interchange rates that should have been submitted based on the validity or accuracy of the MCC data, at the product level. In instances where the Acquirer is unable to identify the appropriate MCC or fails to recode the Qualifying Merchant with an appropriate MCC within the required time frame, Mastercard may calculate the interchange adjustment based on the differential between the interchange rate submitted for each Transaction processed through GCMS within a substantiated claim and the highest Brazil interchange rates by product. Mastercard will debit each responsible Acquirer the Issuer Interchange Recovery amount for each substantiated claim and credit each impacted Issuer through the settlement process for each substantiated claim. Actual recovery provided to each impacted Issuer will vary depending on the extent and duration of the violation, the number of Transactions and Transaction Volume processed through GCMS by each Issuer, and will be paid solely out of the amounts Mastercard collects from the responsible Acquirer(s) for the Issuer Interchange Recovery amount. Mastercard Fraud Control Programs 8.7.5.3 Issuer Interchange Recovery (Collected from the Acquirer(s) and Credited to the Issuers(s)) Security Rules and Procedures—Merchant Edition • 1 August 2023 Chapter 9 Mastercard Registration Program This chapter may be of particular interest to Customer personnel responsible for registering Merchants, Submerchants, and other entities with Mastercard. The Mastercard Registration Program (MRP) formerly was referred to as the Merchant Registration Program.