program: BRAM
- authority: Mastercard SPME 8.6.2, 10.2, 12
+ authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12
response_window_days: 180
required_evidence:
  - transaction_monitoring_records
  - corrective_action_plan
  - police_report  # Mandatory inclusion per updated SPME 8.6.2
halt_actions:
  - halt_new_merchant_onboarding
internal_notification_hours: 24
agent_owner: bram_response_agent
 
- # Includes updated police report requirement per SPME 8.6.2 and affirms Mastercard's exclusive authority in determining ADC Event responsibility (SPME 10.2).
- # Added policy note on consequences for failure to provide complete responses by deadlines, including escalating Category C noncompliance assessments as specified in SPME 12.
+ # Updated to incorporate Mastercard's new appeal process and fee for contesting financial responsibility for ADC Events as detailed in SPME §10.7.
+ # Clarifies that appeals must be timely, substantiated with particularized basis, and accompanied by a non-refundable fee, impacting procedural guidance for BRAM responses.
+ # Maintains existing police report requirement and escalation procedures for noncompliance per SPME 8.6.2 and 12.
# Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation

notice for one of our merchants, the acquirer must halt new merchant onboarding

immediately and submit an evidence package within one hundred eighty (180) days

of receipt of the notice.

Required actions

1. Halt new merchant onboarding for the merchant under investigation.

2. Compile and submit an evidence package containing:

• Transaction monitoring records covering the prior 180 days.

• A written corrective action plan.

• Documentation of any police reports related to alleged coercion claims if applicable.

3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day

investigation period at its discretion. At least one claim must include a police report from the Cardholder.

Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,

though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the

merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Determinations Customer Appeal Rights on ADC Events Financial Responsibility Determinations

Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of whether to consolidate related incidents into single incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or multiple events where applicable. Mastercard’s do not meet criteria will not be considered, and Mastercard's decisions in these matters on appeals are final and not subject to without further internal appeal. review. Customers are advised to seek Mastercard guidance if uncertain about their rights or obligations related to remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards. financial responsibility determinations.

Source authority: Mastercard SPME ������8.6.2, ������10.2, �8.6.2, �10.2, 10.7, 12.0, and section 3.9.

program: Chargeback Handling
- authority: Mastercard SPME §10.1, §10.3, §10.4, and §11.5
+ authority: Mastercard SPME §10.1, §10.3, §10.4, §10.7, and §11.5
acknowledgement_business_days: 1
lifecycle_states:
  - first_presentment
  - chargeback
  - second_presentment
  - pre_arbitration
  - arbitration
evidence_requirements:
  first_presentment:
    - transaction_receipt
    - authorization_record
  chargeback:
    - merchant_rebuttal_letter
    - delivery_confirmation
    - customer_communication
    - fraud_and_chargeback_data_analysis
  second_presentment:
    - compelling_evidence
    - signed_cardholder_agreement
  pre_arbitration:
    - full_dispute_record
    - prior_correspondence
  arbitration:
    - full_dispute_record
    - arbitration_filing
agent_owner: chargeback_agent
 
- # Added evidence requirement for fraud and chargeback data analysis to address new MATCH reason codes
- # related to excessive chargebacks and fraud ratios as introduced in Mastercard SPME §11.5 update,
- # supporting compliance with chargeback management standards per Mastercard SPME §10.1 and §10.3.
+ # Incorporated new appeal process details for Account Data Compromise events from Mastercard SPME §10.7,
+ # emphasizing the 30-day appeal window, documentation requirements, non-refundable fee, and finality of appeal decisions.
+ # This update aligns chargeback handling procedures with recent clarifications regarding financial responsibility appeals,
+ # supplementing existing rules per Mastercard SPME §§10.1, 10.3, 10.4, and 11.5.

Chargeback Handling

Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, acting as the acquirer, manages disputes from initial presentment through potential arbitration, adhering to Mastercard's requirements to protect all parties involved.

Lifecycle overview

Disputes progress through defined phases: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Compliance with evidence standards and timelines at each step is essential to prevent adverse rulings.

Required actions

1. Acknowledge incoming chargebacks within one business day.

2. Gather necessary evidence relevant to the dispute stage.

3. Submit second presentments when liability is disputable, supported by strong documentation.

4. Escalate to pre-arbitration and arbitration only after issuer rejection of second presentment.

5. Retain comprehensive case documentation for auditing and reporting purposes.

6. Provide all requested documentation promptly to Mastercard during investigations or appeals investigations, appeals, and financial responsibility determinations as governed by sections 10.3 and 10.4 10.3, 10.4, and updated appeals procedures related to Account Data Compromise Events in section 10.7 of the Mastercard SPME.

Monitoring and Risk Factors

Halyard Pay evaluates merchant risk using updated Mastercard MATCH Listing Reason Codes, including new, specific definitions for elevated chargeback and fraud concerns:

• Laundering: Merchant presenting invalid transaction records rather than bona fide sales.

• Excessive Chargebacks: Monthly Mastercard chargebacks exceed 1% of sales transactions with total chargebacks ≥ USD 5,000.

• Excessive Fraud: Fraud-to-sales ratio of 8% or more, with at least 10 fraudulent transactions totaling USD 5,000+ in a calendar month.

These clarified definitions, part of Mastercard's updated SPME MATCH Listing Reason Codes (see section 11.5), guide Halyard Pay’s risk assessments and chargeback management protocols to align with Mastercard’s evolving standards.

Source authority: Mastercard SPME §§10.1, 10.3, 10.4, 10.7, 11.5.