Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §11.7.1 · Sep 2023 → Feb 2024

Privacy and Data Protection

substantive

The section adds a new requirement that any Acquirer handling personal data of residents in the EEA, UK, or Switzerland, or subject to EU Data Protection Law, must comply with specific standards in Appendix D related to MATCH activity in Europe.

Sources Mastercard SPME · Sep 2023 · page 138 PDF Mastercard SPME · Feb 2024 · page 138 PDF KYB Acquirer current
Also in §11.x this release substantive §11 If the Acquirer is currently participating in the Merchant Monitoring Program, and this substantive §11.2.2 When to Add a Merchant to MATCH substantive §11.2.3 Inquiring about a Merchant substantive §11.5 MATCH Reason Codes substantive §11.5.1 Reason Codes for Merchants Listed by the Acquirer
Why these edits? The new requirement mandates Acquirers handling personal data of residents in the EEA, UK, or Switzerland to comply with specific EU data protection standards as per Appendix D related to MATCH activity; this directly impacts the Acquirer KYB obligations outlined in policy kyb_acquirer which cites section 2.1 related to such requirements.
Mastercard SPME §11.7.1
This section was substantively restructured between versions (2% text overlap). Compare the texts directly below.
Before · Sep 2023 · page 138

Security Rules and Procedures—Merchant Edition • 1 August 2023

Chapter 12 Omitted This chapter has been omitted. Omitted Security Rules and Procedures—Merchant Edition • 1 August 2023

Chapter 13 Franchise Management Program This chapter describes the Franchise Management Program Standards and applies to all Mastercard Customers, Service Providers, and Payment Facilitators.

After · Feb 2024 · page 138

An Acquirer that stores, transmits, or processes Personal Data6, of a resident of the European Economic Area, the UK, or Switzerland or that is otherwise subject to EU Data Protection Law6 must comply with the Standards set forth in Appendix D of this manual pertaining to MATCH Activity conducted in the Europe Region. 6 This capitalized term has the meaning set forth in Appendix D of this manual. All other capitalized terms used in this manual are defined in the Definitions appendix (Appendix E) of this manual. MATCH System

Halyard Pay · 2 files
program: Acquirer KYB


- authority: Mastercard SPME 2.1, 11.2.3, 11.2.6


+ authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1


required_documents:


  - incorporation


  - beneficial_ownership


  - aml_screen


  - license_verification


min_review_cycle_days: 365


suspension_trigger: document_collection_failure


record_retention_years: 7


aml_watchlist_sources:


  - ofac_sdn


  - eu_consolidated


agent_owner: kyb_agent


# Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.


# Failure to adhere to these requirements may result in noncompliance assessments.


# The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.


+ # Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to must perform Know Your Business (KYB) due diligence on merchants before prior to onboarding and on a recurring basis thereafter. basis. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, confirm ¶ vet beneficial ownership, and satisfy anti-money laundering screening requirements. (AML) screening.

When this policy applies

This policy applies to all new at initial merchant onboarding and to all during periodic re-verification reviews. Merchants that fail to supply do not provide required documentation within the stipulated ¶ period set timelines must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval. documentation needed at onboarding.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Schedule a full re-verification review at least once every 365 days. annually.

  5. Document all verification outcomes and retain maintain records for audit purposes. audit.

  6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of at least two years after contract termination or expiration of the applicable agreement, to comply with Mastercard's explicit expiration, to meet Mastercard record retention requirements.

  7. Before entering into a Merchant Agreement execution or enabling a Merchant to accept transactions, Halyard Pay must conduct a MATCH inquiry using the proper Halyard Pay's Member ID/ICA Number assigned to to ensure compliance; failure may lead to Mastercard assessments.

8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay to ensure compliance. Failure to perform this check or to use the correct Member ID/ICA may result must comply with EU Data Protection Laws as specified in noncompliance and assessments by Mastercard. Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.

Source authority: Mastercard SPME §§2.1, 7.1, 11.2.3, 11.2.6.11.2.6, 11.7.1.

policies/kyb_acquirer/policy.md — after applying change

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network are required to must perform Know Your Business (KYB) due diligence on merchants before prior to onboarding and on a recurring basis thereafter. basis. Halyard Pay, as an acquirer, must collect and verify a ¶ minimum set of documents for each merchant to establish Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, confirm ¶ vet beneficial ownership, and satisfy anti-money laundering screening requirements. (AML) screening.

When this policy applies

This policy applies to all new at initial merchant onboarding and to all during periodic re-verification reviews. Merchants that fail to supply do not provide required documentation within the stipulated ¶ period set timelines must be suspended from processing until compliance is restored.

Required actions

  1. Collect all required KYB documents at onboarding prior to approval. documentation needed at onboarding.

  2. Conduct AML screening against applicable watchlists before approval.

  3. Verify business licenses for regulated merchant categories.

  4. Schedule a full re-verification review at least once every 365 days. annually.

  5. Document all verification outcomes and retain maintain records for audit purposes. audit.

  6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of at least two years after contract termination or expiration of the applicable agreement, to comply with Mastercard's explicit expiration, to meet Mastercard record retention requirements.

  7. Before entering into a Merchant Agreement execution or enabling a Merchant to accept transactions, Halyard Pay must conduct a MATCH inquiry using the proper Halyard Pay's Member ID/ICA Number assigned to to ensure compliance; failure may lead to Mastercard assessments.

8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay to ensure compliance. Failure to perform this check or to use the correct Member ID/ICA may result must comply with EU Data Protection Laws as specified in noncompliance and assessments by Mastercard. Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.

Source authority: Mastercard SPME §§2.1, 7.1, 11.2.3, 11.2.6.11.2.6, 11.7.1.

Source authority: Mastercard SPME §11.7.1.

--- a/policies/kyb_acquirer/rules.yaml
+++ b/policies/kyb_acquirer/rules.yaml
@@ -1,5 +1,5 @@
 program: Acquirer KYB
-authority: Mastercard SPME 2.1, 11.2.3, 11.2.6
+authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1
 required_documents:
   - incorporation
   - beneficial_ownership
@@ -15,3 +15,4 @@
 # Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.
 # Failure to adhere to these requirements may result in noncompliance assessments.
 # The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.
+# Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.

--- a/policies/kyb_acquirer/policy.md
+++ b/policies/kyb_acquirer/policy.md
@@ -1,25 +1,20 @@
 # Acquirer KYB (Know Your Business) Obligations
 
-Acquirers processing transactions on the Mastercard network are required to perform
-Know Your Business (KYB) due diligence on merchants before onboarding and on a
-recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a
-minimum set of documents for each merchant to establish business legitimacy, confirm
-beneficial ownership, and satisfy anti-money laundering screening requirements.
+Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.
 
 ## When this policy applies
 
-This policy applies to all new merchant onboarding and to all periodic re-verification
-reviews. Merchants that fail to supply required documentation within the stipulated
-period must be suspended from processing until compliance is restored.
+This policy applies at initial merchant onboarding and during periodic re-verification reviews. Merchants that do not provide required documentation within set timelines must be suspended until compliance is restored.
 
 ## Required actions
 
-1. Collect all required KYB documents at onboarding prior to approval.
+1. Collect all KYB documentation needed at onboarding.
 2. Conduct AML screening against applicable watchlists before approval.
 3. Verify business licenses for regulated merchant categories.
-4. Schedule a full re-verification review at least once every 365 days.
-5. Document all verification outcomes and retain records for audit purposes.
-6. Retain all MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for a minimum of two years after termination or expiration of the applicable agreement, to comply with Mastercard's explicit record retention requirements.
-7. Before entering into a Merchant Agreement or enabling a Merchant to accept transactions, Halyard Pay must conduct a MATCH inquiry using the proper Member ID/ICA Number assigned to Halyard Pay to ensure compliance. Failure to perform this check or to use the correct Member ID/ICA may result in noncompliance and assessments by Mastercard.
+4. Schedule full re-verification at least annually.
+5. Document verification outcomes and maintain records for audit.
+6. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.
+7. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.
+8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.
 
-Source authority: Mastercard SPME §§2.1, 7.1, 11.2.3, 11.2.6.+Source authority: Mastercard SPME §§2.1, 7.1, 11.2.3, 11.2.6, 11.7.1.