Mastercard SPME §10.6.4 · Feb 2024 → Sep 2024
Determination of Operational Reimbursement (OR)
The update adds specific criteria for halving or waiving Operational Reimbursement (OR) amounts for US and Canada merchants affected by Account Data Compromise (ADC) events, based on tokenization rates, ecommerce transaction percentages, absence of prior ADC events, and storage of sensitive authentication data. It also clarifies OR determination for other regions remains unchanged.
Sources
Mastercard SPME · Feb 2024 · page 126
PDF
Mastercard SPME · Sep 2024 · page 129
PDF
ATO Detection
current
Also in §10.x this release
breaking
§10.2
Policy Concerning Account Data Compromise Events and Potential Account Data
breaking
§10.3.1
Time-Specific Procedures for ADC Events and Potential ADC Events
breaking
§10.3.2
Ongoing Procedures for ADC Events and Potential ADC Events
breaking
§10.5
Alternative Acquirer Investigation (AAI) Standards
substantive
§10
Should the responsible Customer cause a PFI to conduct an examination, the responsible
substantive
§10.1
Applicability and Defined Terms
substantive
§10.3
Responsibilities in Connection with ADC Events and Potential ADC Events
substantive
§10.4
Forensic Report
substantive
§10.6
Mastercard Determination of ADC Event or Potential ADC Event
substantive
§10.6.2
Potential Reduction of Financial Responsibility
substantive
§10.7
Assessments and/or Disqualification for Noncompliance
Why these edits? The update introduces detailed criteria for halving or waiving Operational Reimbursement amounts for merchants impacted by Account Data Compromise (ADC) events in the US and Canada, specifically affecting how exposure to ADC and tokenization rates are assessed.
Mastercard SPME §10.6.4
This section was substantively restructured between versions (17% text overlap). Compare the texts directly below.
Before · Feb 2024
· page 126
Security Rules and Procedures—Merchant Edition • 6 February 2024
manner set forth in step 4, above, provided the requisite percentage of processed Transactions were processed through Hybrid POS Terminals.
After · Sep 2024
· page 129
Security Rules and Procedures—Merchant Edition • 6 August 2024
- United States or Canada Regions Only—For an ADC Event investigation opened by Mastercard on or after 18 October 2019 for the United States and on or after 18 May 2020 for Canada, Mastercard will:
- Halve the amount determined by steps 1, 2, and 3, above, if the compromised entity is a U.S. or Canada Region Acquirer’s Merchant located in the U.S. or Canada Region and Mastercard determines that (i) at least seventy-five percent (75%) of the Merchant’s annual total Transaction count was Tokenized using a Token Service Provider; and (ii) at least twenty-five percent (25%) of the Transactions deemed by Mastercard to be within the scope of the ADC Event were processed as e-commerce Transactions; and (iii) the Merchant has not been identified by Mastercard as having experienced a different ADC Event during the twelve (12) months prior to the date of publication of the earliest ADC Alert for the subject ADC Event; and (iv) Mastercard determines that the Merchant was not storing Sensitive Authentication Data; or
- Not assess OR if the compromised entity is a U.S. or Canada Region Acquirer’s Merchant located in the U.S. or Canada Region and Mastercard determines that (i) at least ninety- five percent (95%) of the Merchant’s annual total Transaction count was Tokenized using a Token Service Provider; and (ii) at least five percent (5%) of the Transactions deemed by Mastercard to be within the scope of the ADC Event were processed as e- commerce Transactions; and (iii) the Merchant has not been identified by Mastercard as having experienced a different ADC Event during the twelve (12) months prior to the date of publication of the earliest ADC Alert for the subject ADC Event; and (iv) Mastercard determines that the Merchant was not storing Sensitive Authentication Data.
- All Regions Other than the U.S. and Canada Regions—For an ADC Event investigation opened by Mastercard on or after 1 December 2014, Mastercard will determine OR in the manner set forth in step 4, above, provided the requisite percentage of processed Transactions were processed through Hybrid POS Terminals.
Halyard Pay · 1 file
program: ATO Detection- authority: Mastercard SPME §10.6.2.1+ authority: Mastercard SPME 10.6.2.1, 10.6.4risk_threshold_for_3ds_challenge: 0.5risk_score_range: [0.0, 1.0]signals:- geo_anomaly- device_fingerprint_change- velocity_breach- credential_stuffingchallenge_method: 3ds_v2persistent_risk_escalation_threshold: 3persistent_risk_lookback_days: 7agent_owner: ato_agent- # This policy update reflects the expanded requirements in Mastercard SPME §10.6.2.1 for Terminal Servicers in Account Data Compromise (ADC) events,- # including mandated PCI DSS compliance verification at event time, timely forensic investigations, and enforced containment measures with- # a 90-day PCI DSS revalidation and a further 12-month PCI DESV appendix compliance period. These detailed steps support risk mitigation- # aligned with Mastercard’s enhanced responsibility reductions during ADC events, reinforcing rigorous security controls within the ATO detection program.+ # This ATO Detection policy incorporates Mastercard SPME .6.4 updates that affect Account Data Compromise (ADC) event mitigation. It adjusts risk evaluation processes by recognizing that merchants in the U.S. and Canada with high tokenization rates and e-commerce transaction volumes may benefit from reduced or waived reimbursement requirements during such events. This complements detection signal thresholds by informing downstream operational decisions on ADC events, ensuring alignment with Mastercard's revised criteria for operational reimbursement and event assessment.
This change affects YAML rules only — see the side-by-side or raw diff tabs.
--- a/policies/ato_detection/rules.yaml +++ b/policies/ato_detection/rules.yaml @@ -1,5 +1,5 @@ program: ATO Detection -authority: Mastercard SPME §10.6.2.1 +authority: Mastercard SPME 10.6.2.1, 10.6.4 risk_threshold_for_3ds_challenge: 0.5 risk_score_range: [0.0, 1.0] signals: @@ -12,7 +12,4 @@ persistent_risk_lookback_days: 7 agent_owner: ato_agent -# This policy update reflects the expanded requirements in Mastercard SPME §10.6.2.1 for Terminal Servicers in Account Data Compromise (ADC) events, -# including mandated PCI DSS compliance verification at event time, timely forensic investigations, and enforced containment measures with -# a 90-day PCI DSS revalidation and a further 12-month PCI DESV appendix compliance period. These detailed steps support risk mitigation -# aligned with Mastercard’s enhanced responsibility reductions during ADC events, reinforcing rigorous security controls within the ATO detection program. +# This ATO Detection policy incorporates Mastercard SPME .6.4 updates that affect Account Data Compromise (ADC) event mitigation. It adjusts risk evaluation processes by recognizing that merchants in the U.S. and Canada with high tokenization rates and e-commerce transaction volumes may benefit from reduced or waived reimbursement requirements during such events. This complements detection signal thresholds by informing downstream operational decisions on ADC events, ensuring alignment with Mastercard's revised criteria for operational reimbursement and event assessment.