Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §9.4.9 · May 2023 → Sep 2023

Cryptocurrency Merchants

substantive

The updated section adds requirements for Acquirers to identify cryptocurrency transactions with specific codes and mandates verification of full compliance with all relevant laws, supported by legal opinions or third-party accreditation, upon registering crypto merchants. The original requirement to maintain such verification and provide documentation upon request remains.

Sources Mastercard SPME · May 2023 · page 115 PDF Mastercard SPME · Sep 2023 · page 106 PDF KYB Acquirer current
Also in §9.x this release substantive §9.2 General Registration Requirements substantive §9.3 General Monitoring Requirements substantive §9.4.1 Non-face-to-face Adult Content and Services Merchants substantive §9.4.5 Skill Games Merchants substantive §9.4.8 High-Risk Securities Merchants
Why these edits? The updated Mastercard SPME section 9.4.9 introduces new obligations for Acquirers to specifically identify cryptocurrency transactions using designated codes and to verify full compliance with all relevant laws, supported by legal or third-party verification at the time of merchant registration. These changes directly impact the Acquirer KYB policy, which addresses Know Your Business obligations referenced from section 2.1, requiring updates to incorporate handling of cryptocurrency merchant compliance and transaction identification.
Mastercard SPME §9.4.9
Security Rules and Procedures—Merchant Edition • 7 February 1 August 2023 occur or be offered to Cardholders, that expressly authorizes the entity to engage in such activity; and • a copy of the entity’s registration, where required under applicable law, with a licensed exchange or licensed trading platform. An Acquirer must identify all cryptocurrency Transactions using MCC 6051 (Quasi Cash— Merchant), TCC U, and a Transaction Type Identifier (TTI) value of P70 (Cryptocurrency), in each Transaction. At the time of registration of a Merchant, Sponsored Merchant, or other entity in accordance with this section, the Acquirer of such entity must have verified that the entity’s activity complies fully with all laws and regulations applicable to Mastercard, the entity, the Issuer, the Acquirer, and any prospective customer of the entity. Such verification may include, but is not limited to, a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party. By registering a Merchant, Sponsored Merchant, or other entity as required by this section, the Acquirer represents and warrants that the Acquirer has verified compliance with applicable law as described above. The Acquirer must maintain such verification for so long as it acquires Transactions from the Merchant, Sponsored Merchant, or other entity that is subject to the aforedescribed registration requirement and must, no less frequently than every 12 months or if any applicable laws and regulations change, confirm continued compliance with applicable law concerning the business of the registered Merchant, Sponsored Merchant, or other entity. The Acquirer must furnish Mastercard with a copy of such documentation promptly upon request.
Halyard Pay · 2 files
program: Acquirer KYB


- authority: Mastercard SPME 2.1, 11.2.6


+ authority: Mastercard SPME 2.1, 9.4.9, 11.2.6


required_documents:


  - incorporation


  - beneficial_ownership


  - aml_screen


  - license_verification


min_review_cycle_days: 365


suspension_trigger: document_collection_failure


record_retention_years: 7


aml_watchlist_sources:


  - ofac_sdn


  - eu_consolidated


agent_owner: kyb_agent


+ 


# The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.


# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.


+ 


+ # For merchants engaged in cryptocurrency transactions, the Acquirer must:


+ # - Identify such transactions using MCC 6051 (Quasi Cash—Merchant), TCC U, and Transaction Type Identifier (TTI) P70 as required by Mastercard SPME 9.4.9.


+ # - Verify at registration that the merchant’s activities comply with all applicable laws, which may include obtaining a legal opinion or third-party accreditation.


+ # - Maintain this compliance verification throughout the relationship, revalidating at least annually or upon relevant legal changes.


+ # - Provide Mastercard with documentation promptly upon request.

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Confirm compliance with all applicable laws and regulations, including those specific to cryptocurrency activities, where relevant. This may require obtaining written opinions from qualified legal counsel or third-party accreditation.

5. Schedule a full re-verification review at least once every 365 days.

5. 6. Document all verification outcomes and retain records for audit purposes.

6. 7. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.

8. Identify all cryptocurrency transactions with MCC 6051 (Quasi Cash—Merchant), TCC U, and Transaction Type Identifier (TTI) value P70 (Cryptocurrency) as per Mastercard requirements.

Source authority: Mastercard SPME ��������2.1, §§2.1, 9.4.9, 11.2.6.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to perform

Know Your Business (KYB) due diligence on merchants before onboarding and on a

recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a

minimum set of documents for each merchant to establish business legitimacy, confirm

beneficial ownership, and satisfy anti-money laundering screening requirements.

When this policy applies

This policy applies to all new merchant onboarding and to all periodic re-verification

reviews. Merchants that fail to supply required documentation within the stipulated

period must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Confirm compliance with all applicable laws and regulations, including those specific to cryptocurrency activities, where relevant. This may require obtaining written opinions from qualified legal counsel or third-party accreditation.

5. Schedule a full re-verification review at least once every 365 days.

5. 6. Document all verification outcomes and retain records for audit purposes.

6. 7. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.

8. Identify all cryptocurrency transactions with MCC 6051 (Quasi Cash—Merchant), TCC U, and Transaction Type Identifier (TTI) value P70 (Cryptocurrency) as per Mastercard requirements.

Source authority: Mastercard SPME ��������2.1, §§2.1, 9.4.9, 11.2.6.

Source authority: Mastercard SPME §9.4.9.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME 2.1, 11.2.6
+authority: Mastercard SPME 2.1, 9.4.9, 11.2.6
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -12,5 +12,12 @@
   - ofac_sdn
   - eu_consolidated
 agent_owner: kyb_agent
+
 # The Acquirer must specifically retain all MATCH records concerning any Merchant, Sponsored Merchant, or ATM owner for at least two years following the termination or expiration of the related agreement, per Mastercard SPME 11.2.6.
-# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.+# This retention requirement updates prior guidance by imposing a defined minimum retention period beyond the MATCH system's internal data purging schedule.
+
+# For merchants engaged in cryptocurrency transactions, the Acquirer must:
+# - Identify such transactions using MCC 6051 (Quasi Cash—Merchant), TCC U, and Transaction Type Identifier (TTI) P70 as required by Mastercard SPME 9.4.9.
+# - Verify at registration that the merchant’s activities comply with all applicable laws, which may include obtaining a legal opinion or third-party accreditation.
+# - Maintain this compliance verification throughout the relationship, revalidating at least annually or upon relevant legal changes.
+# - Provide Mastercard with documentation promptly upon request.

--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -17,8 +17,10 @@
 1. Collect all required KYB documents at onboarding prior to approval.
 2. Conduct AML screening against applicable watchlists before approval.
 3. Verify business licenses for regulated merchant categories.
-4. Schedule a full re-verification review at least once every 365 days.
-5. Document all verification outcomes and retain records for audit purposes.
-6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
+4. Confirm compliance with all applicable laws and regulations, including those specific to cryptocurrency activities, where relevant. This may require obtaining written opinions from qualified legal counsel or third-party accreditation.
+5. Schedule a full re-verification review at least once every 365 days.
+6. Document all verification outcomes and retain records for audit purposes.
+7. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
+8. Identify all cryptocurrency transactions with MCC 6051 (Quasi Cash—Merchant), TCC U, and Transaction Type Identifier (TTI) value P70 (Cryptocurrency) as per Mastercard requirements.
 
-Source authority: Mastercard SPME 2.1, 11.2.6.+Source authority: Mastercard SPME §§2.1, 9.4.9, 11.2.6.