program: Acquirer KYB
- authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1
+ authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1, 2.2.2
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
- # Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.
- # Failure to adhere to these requirements may result in noncompliance assessments.
- # The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.
- # Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.
+ # Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, using the correct Member ID/ICA Number, to ensure compliance as per Mastercard SPME §11.2.3.
+ # MATCH records related to Merchants, Sponsored Merchants, or ATM owners must be retained for at least two years following agreement termination, according to Mastercard SPME §11.2.6.
+ # For Acquirers handling personal data of EEA, UK, or Switzerland residents, adherence to the Europe Region standards in Appendix D concerning MATCH activity is mandatory in line with Mastercard SPME §11.7.1.
+ # In alignment with Mastercard SPME §2.2.2, Acquirers must ensure that Level 1, 2, and 3 Merchants validate that any third party-provided payment applications or software they use are listed as compliant on the PCI Security Standards Council website, reflecting enhanced compliance validation requirements.
+ # This includes confirming PCI PA-DSS or PCI Secure Software Standard compliance for payment applications and adherence to PCI Secure SLC Standard for payment software vendors.
+ # These updates strengthen Merchant compliance oversight and risk mitigation related to payment application security.

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.

When this policy applies

This policy applies at initial merchant onboarding and during periodic re-verification reviews. Merchants that do not provide required documentation within set timelines must be suspended until compliance is restored.

Required actions

1. Collect all KYB documentation needed at onboarding.

2. Conduct AML screening against applicable watchlists before approval.

3. Verify business licenses for regulated merchant categories.

4. Schedule full re-verification at least annually.

5. Document verification outcomes and maintain records for audit.

6. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.

7. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.

8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.

9. Ensure that Level 1, Level 2, and Level 3 Merchants validate that all third-party payment applications or software used are listed as compliant on the PCI Security Standards Council (SSC) website to meet updated Mastercard requirements for cybersecurity controls.

Source authority: Mastercard SPME §§2.1, 2.2.2, 7.1, 11.2.3, 11.2.6, 11.7.1.