Mastercard SPME §8.8 · Sep 2023 → Feb 2024
Business Risk Assessment and Mitigation (BRAM) Program
A new section describes the BRAM Program, which investigates merchants potentially involved in illegal or brand-damaging transactions to protect Mastercard and its customers from fraud, regulatory, and legal risks. Mastercard collaborates with acquirers to stop violations and reduce future risk, enforcing specific Mastercard Rules related to brand integrity.
The Business Risk Assessment and Mitigation (BRAM) Program investigates Merchants referred to Mastercard as potentially engaging in illegal or brand-damaging Transactions, for the purpose of protecting Mastercard and its Customers against fraud, regulatory, and legal risk. Upon identification of a Merchant in the BRAM Program, Mastercard partners with the Acquirer to ensure the Merchant ceases the violating activity and to mitigate future risk associated with the Merchant. Mastercard Fraud Control Programs 8.7.5.3 Issuer Interchange Recovery (Collected from the Acquirer(s) and Credited to the Issuers(s)) Security Rules and Procedures—Merchant Edition • 6 February 2024
The BRAM Program primarily enforces Mastercard Rules sections 3.7 Integrity of Brand and Network and 5.12.7 Illegal or Brand-damaging Transactions ("the BRAM Rules"), which state in part that a Customer must not directly or indirectly engage in or facilitate any action that is illegal or that, in the opinion of the Corporation and whether or not addressed elsewhere in the Standards, damages or may damage the goodwill or reputation of the Corporation or of any Mark, or damages or may damage the integrity of the Mastercard system, including the Interchange System or other Corporation Assets. From time to time, Mastercard may publish additional information in announcements published in the Technical Resource Center of Mastercard Connect, which highlight or address categories of concern, new trends, and new or revised violation types. Upon Mastercard request, a Customer must promptly cease engaging in or facilitating any such action.
program: BRAM- authority: Mastercard SPME §8.6.2, §10.2+ authority: Mastercard SPME §8.6.2, §8.8, §10.2response_window_days: 180required_evidence:- transaction_monitoring_records- corrective_action_plan- police_report # Mandatory inclusion per updated SPME §8.6.2halt_actions:- halt_new_merchant_onboardinginternal_notification_hours: 24agent_owner: bram_response_agent- # Reflects updated police report requirement and acknowledges Mastercard's exclusive authority to determine ADC Event occurrence and responsibility as clarified in SPME §10.2.- # Policy recognizes Mastercard's sole discretion in classifying and consolidating ADC Events to ensure proper investigation and response procedures.+ # This policy governs response to merchants flagged under the BRAM Program,+ # which enforces Mastercard Rules on brand integrity and illegal or brand-damaging transactions+ # as detailed in SPME §8.8. The policy incorporates the updated police report requirement+ # (SPME §8.6.2) and recognizes Mastercard's sole authority to determine ADC Event occurrence+ # and responsibility per SPME §10.2.+ # It guides the investigation and mitigation process to protect Mastercard and its customers from associated risks.
BRAM Investigation Response
When Mastercard issues a The Business Risk Assessment and Mitigation (BRAM) investigation ¶ Program oversees investigations into Merchants referred to Mastercard for potentially engaging in illegal or brand-damaging Transactions. The Program’s goal is to protect Mastercard and its Customers from fraud, regulatory, and legal risks by ensuring Merchants cease violating activities and mitigate future risks.
## Required actions upon BRAM notice for one of our merchants, the acquirer must
1. Immediately halt onboarding of new merchant onboarding ¶ immediately merchants under investigation.
2. Compile and submit an evidence package within one hundred eighty (180) days ¶ of receipt of the notice. ¶ ## Required actions ¶ 1. Halt new merchant onboarding for the merchant under investigation. ¶ 2. Compile and submit an evidence package days, containing:
-
Transaction monitoring records
coveringfor the prior 180 days. -
A written corrective action plan.
-
Documentation of any policePolice reports related toallegedany coercionclaimsclaims, if applicable.
- Notify the Halyard Pay Compliance lead within 24 hours of
receipt.receiving the notice.
## Compliance with Mastercard Rules
The BRAM Program enforces Mastercard Rules sections 3.7 (Integrity of Brand and Network) and 5.12.7 (Illegal or Brand-damaging Transactions), which prohibit Customers from engaging in activities deemed illegal or damaging to Mastercard’s brand, goodwill, reputation, or integrity of its network and assets.
Mastercard may issue additional guidance through announcements in the Technical Resource Center of Mastercard Connect regarding new trends or violation types. Upon such requests, Customers must promptly cease any identified prohibited actions.
Additional Considerations considerations for Coercion Claims coercion claims
When allegations of involve coerced Transactions arise, note that Transactions, Mastercard may extend the usual 120-day ¶ investigation period at its discretion. At least one claim must include a police report from the Cardholder. ¶ Transactions reported as periods beyond the standard 120 days. Investigations cover Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, ¶ though Mastercard and may consider extend to other fraud codes. Mastercard types at Mastercard’s discretion. Issuers with affected Transactions will notify issuers with Transactions at the ¶ merchant within the investigation period to prompt be notified to facilitate claim submissions.
Mastercard's Authority and Determinations authority on ADC Events
Mastercard retains holds exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of their scope and responsibility, and may consolidate related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters incidents. These determinations are final and not subject to internal appeal. appealable internally. Customers are advised to should seek Mastercard guidance if uncertain when in doubt about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards. ADC-related obligations.
Source authority: Mastercard SPME §8.6.2, §8.7, §10.2.
BRAM Investigation Response
When Mastercard issues a The Business Risk Assessment and Mitigation (BRAM) investigation ¶ Program oversees investigations into Merchants referred to Mastercard for potentially engaging in illegal or brand-damaging Transactions. The Program’s goal is to protect Mastercard and its Customers from fraud, regulatory, and legal risks by ensuring Merchants cease violating activities and mitigate future risks.
## Required actions upon BRAM notice for one of our merchants, the acquirer must
1. Immediately halt onboarding of new merchant onboarding ¶ immediately merchants under investigation.
2. Compile and submit an evidence package within one hundred eighty (180) days ¶ of receipt of the notice. ¶ ## Required actions ¶ 1. Halt new merchant onboarding for the merchant under investigation. ¶ 2. Compile and submit an evidence package days, containing:
-
Transaction monitoring records
coveringfor the prior 180 days. -
A written corrective action plan.
-
Documentation of any policePolice reports related toallegedany coercionclaimsclaims, if applicable.
- Notify the Halyard Pay Compliance lead within 24 hours of
receipt.receiving the notice.
## Compliance with Mastercard Rules
The BRAM Program enforces Mastercard Rules sections 3.7 (Integrity of Brand and Network) and 5.12.7 (Illegal or Brand-damaging Transactions), which prohibit Customers from engaging in activities deemed illegal or damaging to Mastercard’s brand, goodwill, reputation, or integrity of its network and assets.
Mastercard may issue additional guidance through announcements in the Technical Resource Center of Mastercard Connect regarding new trends or violation types. Upon such requests, Customers must promptly cease any identified prohibited actions.
Additional Considerations considerations for Coercion Claims coercion claims
When allegations of involve coerced Transactions arise, note that Transactions, Mastercard may extend the usual 120-day ¶ investigation period at its discretion. At least one claim must include a police report from the Cardholder. ¶ Transactions reported as periods beyond the standard 120 days. Investigations cover Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, ¶ though Mastercard and may consider extend to other fraud codes. Mastercard types at Mastercard’s discretion. Issuers with affected Transactions will notify issuers with Transactions at the ¶ merchant within the investigation period to prompt be notified to facilitate claim submissions.
Mastercard's Authority and Determinations authority on ADC Events
Mastercard retains holds exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of their scope and responsibility, and may consolidate related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters incidents. These determinations are final and not subject to internal appeal. appealable internally. Customers are advised to should seek Mastercard guidance if uncertain when in doubt about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards. ADC-related obligations.
Source authority: Mastercard SPME §8.6.2, §8.7, §10.2.
Source authority: Mastercard SPME §8.8.
--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -1,5 +1,5 @@
program: BRAM
-authority: Mastercard SPME §8.6.2, §10.2
+authority: Mastercard SPME §8.6.2, §8.8, §10.2
response_window_days: 180
required_evidence:
- transaction_monitoring_records
@@ -10,5 +10,9 @@
internal_notification_hours: 24
agent_owner: bram_response_agent
-# Reflects updated police report requirement and acknowledges Mastercard's exclusive authority to determine ADC Event occurrence and responsibility as clarified in SPME §10.2.
-# Policy recognizes Mastercard's sole discretion in classifying and consolidating ADC Events to ensure proper investigation and response procedures.
+# This policy governs response to merchants flagged under the BRAM Program,
+# which enforces Mastercard Rules on brand integrity and illegal or brand-damaging transactions
+# as detailed in SPME §8.8. The policy incorporates the updated police report requirement
+# (SPME §8.6.2) and recognizes Mastercard's sole authority to determine ADC Event occurrence
+# and responsibility per SPME §10.2.
+# It guides the investigation and mitigation process to protect Mastercard and its customers from associated risks.
--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -1,29 +1,28 @@
# BRAM Investigation Response
-When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
-notice for one of our merchants, the acquirer must halt new merchant onboarding
-immediately and submit an evidence package within one hundred eighty (180) days
-of receipt of the notice.
+The Business Risk Assessment and Mitigation (BRAM) Program oversees investigations into Merchants referred to Mastercard for potentially engaging in illegal or brand-damaging Transactions. The Program’s goal is to protect Mastercard and its Customers from fraud, regulatory, and legal risks by ensuring Merchants cease violating activities and mitigate future risks.
-## Required actions
+## Required actions upon BRAM notice
-1. Halt new merchant onboarding for the merchant under investigation.
-2. Compile and submit an evidence package containing:
- - Transaction monitoring records covering the prior 180 days.
+1. Immediately halt onboarding of new merchants under investigation.
+2. Compile and submit an evidence package within 180 days, containing:
+ - Transaction monitoring records for the prior 180 days.
- A written corrective action plan.
- - Documentation of any police reports related to alleged coercion claims if applicable.
-3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
+ - Police reports related to any coercion claims, if applicable.
+3. Notify the Halyard Pay Compliance lead within 24 hours of receiving the notice.
-## Additional Considerations for Coercion Claims
+## Compliance with Mastercard Rules
-When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day
-investigation period at its discretion. At least one claim must include a police report from the Cardholder.
-Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,
-though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
-merchant within the investigation period to prompt claim submissions.
+The BRAM Program enforces Mastercard Rules sections 3.7 (Integrity of Brand and Network) and 5.12.7 (Illegal or Brand-damaging Transactions), which prohibit Customers from engaging in activities deemed illegal or damaging to Mastercard’s brand, goodwill, reputation, or integrity of its network and assets.
-## Mastercard's Authority and Determinations on ADC Events
+Mastercard may issue additional guidance through announcements in the Technical Resource Center of Mastercard Connect regarding new trends or violation types. Upon such requests, Customers must promptly cease any identified prohibited actions.
-Mastercard retains exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters are final and not subject to internal appeal. Customers are advised to seek Mastercard guidance if uncertain about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards.
+## Additional considerations for coercion claims
-Source authority: Mastercard SPME §8.6.2, §10.2.+When allegations involve coerced Transactions, Mastercard may extend investigation periods beyond the standard 120 days. Investigations cover Lost or Stolen Fraud (fraud codes 00 or 01) and may extend to other fraud types at Mastercard’s discretion. Issuers with affected Transactions will be notified to facilitate claim submissions.
+
+## Mastercard's authority on ADC Events
+
+Mastercard holds exclusive authority to determine Account Data Compromise (ADC) Events or Potential ADC Events, including their scope and responsibility, and may consolidate related incidents. These determinations are final and not appealable internally. Customers should seek Mastercard guidance when in doubt about ADC-related obligations.
+
+Source authority: Mastercard SPME §8.6.2, §8.7, §10.2.