Mastercard SPME §2.2.3 · Feb 2024 → Sep 2024

Service Provider Compliance Requirements

substantive

The updated section clarifies service provider categories and compliance frequency: 3-DSSP compliance validation with the 3DS Core Security Standard is now required every two years instead of annually, and AML/Sanctions Service Providers are reclassified between Level 1 and Level 2 with adjusted requirements. Minor category order changes also occur.

Sources Mastercard SPME · Feb 2024 · page 22 PDF Mastercard SPME · Sep 2024 · page 22 PDF KYB Acquirer current

Also in §2.x this release substantive §2.2.2 Merchant Compliance Requirements substantive §2.2.4 Mastercard Cybersecurity Incentive Program (CSIP) substantive §2.2.5 SDP Program Noncompliance Assessments substantive §2.2.6 Mandatory Compliance Requirements for Compromised Entities substantive §2.3 Card Production Security Standards substantive §2.3.2 Additional Card Production Requirements substantive §2.4.1 PIN Entry Devices (PEDs) and Encrypting PIN Pads (EPPs)

Why these edits? The updated section 2.2.3 revises service provider compliance requirements, notably changing the frequency for 3-DSSP compliance validation with the PCI 3DS Core Security Standard from annually to every two years, and reclassifying AML/Sanctions Service Providers between Level 1 and Level 2 with adjusted obligations. Since kyb_acquirer cites section 2.1 and relates to Know Your Business obligations for acquirers, this change in service provider classification and compliance frequency directly impacts acquirer obligations around monitoring and validating service provider compliance.

Mastercard SPME §2.2.3

This section describes Level 1 and Level 2 Service Provider criteria, and how a Service Provider may successfully validate compliance with the PCI DSS and all other applicable PCI Security Standards and apply cybersecurity best practices. Mastercard recommends that each Level 1 and Level 2 Service Provider demonstrates to Mastercard its compliance with the Designated Entities Supplemental Validation (DESV) appendix of the PCI DSS. All Level 1 and Level 2 Service Providers that use any third party-provided payment applications or payment software must validate that each payment application or payment software used is listed on the PCI SSC website at www.pcisecuritystandards.org as compliant with either the PCI PA-DSS DSS or the PCI Secure Software Standard, as applicable. Mastercard recommends that Service Providers using third party-provided payment software ensure the payment software vendor complies with the PCI Secure SLC Standard. Compliance with the PCI 3DS Core Security Standard is required for any Service Provider that performs or provides 3DS functions as defined in the EMV 3-D Secure Protocol and Core Functions Specification. All Service Providers that use any 3DS SDK must validate that each 3DS SDK used is listed on the PCI SSC website at www.pcisecuritystandards.org as compliant with the PCI 3DS SDK Security Standard, as applicable. Cybersecurity Standards and Programs Level 3 Merchants Security Rules and Procedures—Merchant Edition • 6 August 2024 Level 1 Service Providers A Level 1 Service Provider is any TPP, MPG, SDWO, DASP, TSP, ~~AML/Sanctions Service Provider, ¶~~ 3-DSSP, or ISP (regardless of volume); and any ~~DSE~~ AML/Sanctions Service Provider, DSE, or PF that stores, transmits, or processes ¶ more than 300,000 total combined Mastercard and Maestro Transactions annually. ~~Cybersecurity Standards and Programs ¶ Level 4 Merchants ¶ Security Rules and Procedures—Merchant Edition • 6 February 2024 ¶~~ Each Level 1 Service Provider must validate compliance with the PCI ~~DSS,~~ DSS annually, and each ~~3-DSSP ¶~~ 3- DSSP must validate compliance with the PCI 3DS Core Security Standard every two years by successfully undergoing ~~¶ an annual~~ a PCI assessment resulting in the completion of a ROC conducted by an appropriate ¶ PCI SSC-approved QSA. Level 2 Service Providers A Level 2 Service Provider is any ~~DSE~~ AML/Sanctions Service Provider, DSE, or PF that is not deemed a Level 1 Service Provider and ¶ that stores, transmits, or processes 300,000 or less total combined Mastercard and Maestro ¶ Transactions annually; and any TS. Each Level 2 Service Provider must validate compliance with the PCI DSS by successfully completing an annual SAQ. As an alternative to validating compliance with the PCI DSS, a DSE qualifying as a Level 2 Service Provider may submit a PCI PIN Security Requirements Attestation of Compliance for Onsite Assessments from a PCI SSC-approved Qualified PIN Assessor (QPA) every two years to the Mastercard SDP Department, provided that the DSE does not perform services involving the storage, transmission, or processing of Account, Cardholder, or Transaction Data. As an alternative to validating compliance with the PCI DSS, a TS may submit a completed Terminal Servicer QIR Participation Validation Form to the Mastercard SDP Department, provided that the TS does not perform services involving the storage, transmission, or processing of Account, Cardholder, or Transaction Data, but the TS has access to such Data within the Cardholder Data Environment (CDE) (as the term is defined by the PCI SSC). The Terminal Servicer QIR Participation Validation Form is available on the Service Provider page of the SDP Program website. NOTE: Service Provider classifications (TPPs, DSEs, PFs, SDWOs, DASPs, TSPs, TSs, AML/Sanctions Service Providers, 3-DSSPs, ISPs, and MPGs) are determined by Mastercard. Service Provider registrations with Mastercard will not be deemed complete until the Service Provider’s compliance with the SDP Program is validated. Refer to Chapter 7 of the Mastercard Rules manual for additional Service Provider registration requirements.

Halyard Pay · 2 files

KYB Acquirer · rules.yaml

program: Acquirer KYB
- authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1
+ authority: Mastercard SPME 2.1, 2.2.3, 11.2.3, 11.2.6, 11.7.1
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
# Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.
# Failure to adhere to these requirements may result in noncompliance assessments.
# The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.
# Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.
+ # Updated to reflect Mastercard SPME §2.2.3 changes: Level 1 and Level 2 Service Providers classifications now include AML/Sanctions Service Providers with adjusted criteria.
+ # 3-DSSPs must validate PCI 3DS Core Security Standard compliance biennially via PCI assessments, rather than annually.
+ # Acquirers must ensure ongoing monitoring of service providers' compliance per the revised classification and assessment frequencies to maintain adherence with Mastercard standards.

KYB Acquirer · policy.md

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.

When this policy applies

This policy applies at initial merchant onboarding and during periodic re-verification reviews. Merchants that do not provide required documentation within set timelines must be suspended until compliance is restored.

Required actions

Collect all KYB documentation needed at onboarding.
Conduct AML screening against applicable watchlists before approval.
Verify business licenses for regulated merchant categories.
Schedule full re-verification at least annually.
Document verification outcomes and maintain records for audit.
Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.
Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.
For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.

## Service Provider Compliance Monitoring

In accordance with Mastercard SPME §2.2.3, Halyard Pay recognizes the updated classifications of Level 1 and Level 2 Service Providers and their related cybersecurity validation requirements. Specifically:

- Certain Service Providers, including AML/Sanctions Service Providers, DSEs, and PFs, are classified as Level 1 or Level 2 based on transaction volumes and services provided.

- Level 1 Service Providers must validate PCI DSS compliance annually, while 3-DSSPs now validate PCI 3DS Core Security Standard compliance biennially via a PCI assessment.

- Level 2 Service Providers have corresponding annual or alternative compliance documentation requirements.

Halyard Pay will integrate these criteria into its KYB due diligence and ongoing monitoring processes to ensure service providers handling Mastercard transactions comply with applicable cybersecurity and data security standards.

Source authority: Mastercard SPME §§2.1, 2.2.3, 7.1, 11.2.3, 11.2.6, 11.7.1.

policies/kyb_acquirer/policy.md — after applying change