Mastercard SPME §9.4.8 · May 2023 → Sep 2023
High-Risk Securities Merchants
The updated rules require Acquirers to ensure Merchants maintain lawful status, keep permits valid, provide third-party certification on system controls, promptly notify Mastercard of changes, and affirm they won't submit restricted transactions. Additionally, certain regulated non-face-to-face securities activities must be registered as gambling merchants.
Security Rules and Procedures—Merchant Edition • 7 February 2023
Security Rules and Procedures—Merchant Edition • 1 August 2023
The legal opinion must be acceptable to Mastercard. Further, the Acquirer shall ensure that: – the Merchant properly maintains its lawful status in any jurisdiction where such Merchant engages in high-risk trading activities as described in this section; and – any relevant permits remain unexpired.
- Effective controls. The Acquirer must obtain certification from a qualified independent third party demonstrating that the Merchant’s systems for operating its high-risk securities business: – include effective age and location verification; and – are reasonably designed to ensure that the Merchant’s high-risk securities business will remain within legal limits (including in connection with cross-border Transactions).
- Notification of changes. The Acquirer must certify that the Acquirer will notify Mastercard of any changes to the information that the Acquirer has provided to Mastercard, including changes in applicable law, Merchant activities, and Merchant systems. Such notification shall include any revisions or additions to the information provided to Mastercard (for example, legal opinion, third-party certification) to make the information current and complete. Such notification is required within ten (10) days of any such change.
- Acceptance of responsibilities. The Acquirer must specifically affirm that it will not submit restricted Transactions from the Merchant for authorization. If a Merchant’s non-face-to-face high-risk trading activities are regulated as gambling in any jurisdiction, then the Acquirer must register such Merchant as a non-face-to-face gambling Merchant with Mastercard as described in section 9.2 and section 9.4.2 of this manual.
program: Acquirer KYB- authority: Mastercard SPME 2.1, 11.2.6+ authority: Mastercard SPME 2.1, 9.4.8, 11.2.6required_documents:- incorporation- beneficial_ownership- aml_screen- license_verification+ - legal_opinion+ - third_party_certificationmin_review_cycle_days: 365suspension_trigger: document_collection_failurerecord_retention_years: 7aml_watchlist_sources:- ofac_sdn- eu_consolidatedagent_owner: kyb_agent# The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.- # This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+ # For Merchants engaged in high-risk securities trading, the Acquirer must verify lawful status and valid permits, obtain independent third-party certification of effective age and location verification controls, and ensure timely notification to Mastercard of any changes, as specified in Mastercard SPME 9.4.8.+ # The Acquirer must affirm it will not submit restricted Transactions from such Merchants and comply with registration requirements if activities are regulated as gambling.
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network are required to perform ¶ Know Your Business (KYB) due diligence on merchants before onboarding and on a ¶ recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish business legitimacy, confirm ¶ beneficial ownership, and satisfy anti-money laundering screening requirements.
When this policy applies
This policy applies to all new merchant onboarding and to all periodic re-verification ¶ reviews. Merchants that fail to supply required documentation within the stipulated ¶ period must be suspended from processing until compliance is restored.
Required actions
-
Collect all required KYB documents at onboarding prior to approval.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule a full re-verification review at least once every 365 days.
-
Document all verification outcomes and retain records for audit purposes.
-
Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
## Additional obligations for high-risk securities merchants
For merchants engaged in high-risk securities activities as defined by Mastercard, Halyard Pay must also:
- Verify the merchant maintains lawful status and that all relevant permits remain current and unexpired in every jurisdiction of operation.
- Obtain and review certification from a qualified independent third party confirming that the merchant’s systems incorporate effective age and location verification controls and are designed to keep the business within legal boundaries, including for cross-border transactions.
- Commit to notifying Mastercard within ten (10) days of any changes to information previously provided, such as updates to legal opinions, third-party certifications, or changes in applicable laws, merchant activities, and systems.
- Affirm responsibility for not submitting restricted transactions from such merchants for authorization.
If the merchant’s non-face-to-face high-risk securities activities are regulated as gambling in any jurisdiction, the merchant must be registered appropriately as a non-face-to-face gambling merchant with Mastercard according to the relevant sections.
Source authority: Mastercard SPME ��������2.1, §§2.1, 9.4.8, 11.2.6.
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network are required to perform ¶ Know Your Business (KYB) due diligence on merchants before onboarding and on a ¶ recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish business legitimacy, confirm ¶ beneficial ownership, and satisfy anti-money laundering screening requirements.
When this policy applies
This policy applies to all new merchant onboarding and to all periodic re-verification ¶ reviews. Merchants that fail to supply required documentation within the stipulated ¶ period must be suspended from processing until compliance is restored.
Required actions
-
Collect all required KYB documents at onboarding prior to approval.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule a full re-verification review at least once every 365 days.
-
Document all verification outcomes and retain records for audit purposes.
-
Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
## Additional obligations for high-risk securities merchants
For merchants engaged in high-risk securities activities as defined by Mastercard, Halyard Pay must also:
- Verify the merchant maintains lawful status and that all relevant permits remain current and unexpired in every jurisdiction of operation.
- Obtain and review certification from a qualified independent third party confirming that the merchant’s systems incorporate effective age and location verification controls and are designed to keep the business within legal boundaries, including for cross-border transactions.
- Commit to notifying Mastercard within ten (10) days of any changes to information previously provided, such as updates to legal opinions, third-party certifications, or changes in applicable laws, merchant activities, and systems.
- Affirm responsibility for not submitting restricted transactions from such merchants for authorization.
If the merchant’s non-face-to-face high-risk securities activities are regulated as gambling in any jurisdiction, the merchant must be registered appropriately as a non-face-to-face gambling merchant with Mastercard according to the relevant sections.
Source authority: Mastercard SPME ��������2.1, §§2.1, 9.4.8, 11.2.6.
Source authority: Mastercard SPME §9.4.8.
--- a/policies/kyb_acquirer/rules.yaml +++ b/policies/kyb_acquirer/rules.yaml @@ -1,10 +1,12 @@ program: Acquirer KYB -authority: Mastercard SPME 2.1, 11.2.6 +authority: Mastercard SPME 2.1, 9.4.8, 11.2.6 required_documents: - incorporation - beneficial_ownership - aml_screen - license_verification + - legal_opinion + - third_party_certification min_review_cycle_days: 365 suspension_trigger: document_collection_failure record_retention_years: 7 @@ -13,4 +15,5 @@ - eu_consolidated agent_owner: kyb_agent # The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6. -# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+# For Merchants engaged in high-risk securities trading, the Acquirer must verify lawful status and valid permits, obtain independent third-party certification of effective age and location verification controls, and ensure timely notification to Mastercard of any changes, as specified in Mastercard SPME 9.4.8. +# The Acquirer must affirm it will not submit restricted Transactions from such Merchants and comply with registration requirements if activities are regulated as gambling. --- a/policies/kyb_acquirer/policy.md +++ b/policies/kyb_acquirer/policy.md @@ -1,16 +1,10 @@ # Acquirer KYB (Know Your Business) Obligations -Acquirers processing transactions on the Mastercard network are required to perform -Know Your Business (KYB) due diligence on merchants before onboarding and on a -recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a -minimum set of documents for each merchant to establish business legitimacy, confirm -beneficial ownership, and satisfy anti-money laundering screening requirements. +Acquirers processing transactions on the Mastercard network are required to perform Know Your Business (KYB) due diligence on merchants before onboarding and on a recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a minimum set of documents for each merchant to establish business legitimacy, confirm beneficial ownership, and satisfy anti-money laundering screening requirements. ## When this policy applies -This policy applies to all new merchant onboarding and to all periodic re-verification -reviews. Merchants that fail to supply required documentation within the stipulated -period must be suspended from processing until compliance is restored. +This policy applies to all new merchant onboarding and to all periodic re-verification reviews. Merchants that fail to supply required documentation within the stipulated period must be suspended from processing until compliance is restored. ## Required actions @@ -21,4 +15,15 @@ 5. Document all verification outcomes and retain records for audit purposes. 6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements. -Source authority: Mastercard SPME 2.1, 11.2.6.+## Additional obligations for high-risk securities merchants + +For merchants engaged in high-risk securities activities as defined by Mastercard, Halyard Pay must also: + +- Verify the merchant maintains lawful status and that all relevant permits remain current and unexpired in every jurisdiction of operation. +- Obtain and review certification from a qualified independent third party confirming that the merchant’s systems incorporate effective age and location verification controls and are designed to keep the business within legal boundaries, including for cross-border transactions. +- Commit to notifying Mastercard within ten (10) days of any changes to information previously provided, such as updates to legal opinions, third-party certifications, or changes in applicable laws, merchant activities, and systems. +- Affirm responsibility for not submitting restricted transactions from such merchants for authorization. + +If the merchant’s non-face-to-face high-risk securities activities are regulated as gambling in any jurisdiction, the merchant must be registered appropriately as a non-face-to-face gambling merchant with Mastercard according to the relevant sections. + +Source authority: Mastercard SPME §§2.1, 9.4.8, 11.2.6.