Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §8.4.8 · Feb 2024 → Sep 2024

Fraud Recovery

substantive

The updated section adds conditions around administrative fees related to the QMAP investigation, specifying when Mastercard may or may not charge fees to Issuer accounts, while retaining the audit fee charge to Acquirers for identifying Questionable Merchants.

Sources Mastercard SPME · Feb 2024 · page 82 PDF Mastercard SPME · Sep 2024 · page 85 PDF BRAM Response current
Also in §8.x this release breaking §8.4.2 Mastercard Commencement of an Investigation substantive §8.3.1 ECP Definitions substantive §8.4 Questionable Merchant Audit Program (QMAP) substantive §8.4.7 Chargeback Responsibility substantive §8.6.2 Investigation Process
Why these edits? The update clarifies the conditions under which Mastercard may charge administrative fees to Issuer accounts at the conclusion of a QMAP investigation, affecting the BRAM Investigation Response processes related to fee assessments.
Mastercard SPME §8.4.8
Security Rules and Procedures—Merchant Edition • 6 February August 2024 Issuer account at the commencement of the QMAP investigation from the administrative fee charged to the Issuer at the end of the QMAP investigation. If Mastercard determines that a Merchant is a Questionable Merchant and the administrative fee is less than the Issuer filing fee, Mastercard may not debit an administrative fee from the Issuer account at the end of the QMAP investigation. Mastercard may charge an Acquirer an audit fee not to exceed USD 2,500 for each identification of a Merchant as a Questionable Merchant.
Halyard Pay · 2 files
program: BRAM


- authority: Mastercard SPME 8.6.2, 10.2, 12


+ authority: Mastercard SPME 8.6.2, 8.4.8, 10.2, 12


response_window_days: 180


required_evidence:


  - transaction_monitoring_records


  - corrective_action_plan


  - police_report  # Mandatory inclusion per updated SPME 8.6.2


halt_actions:


  - halt_new_merchant_onboarding


internal_notification_hours: 24


agent_owner: bram_response_agent


 


- # Includes updated police report requirement per SPME 8.6.2 and affirms Mastercard's exclusive authority in determining ADC Event responsibility (SPME 10.2).


- # Added policy note on consequences for failure to provide complete responses by deadlines, including escalating Category C noncompliance assessments as specified in SPME 12.


- # Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.


+ # Updated to reflect new fee assessment clarifications in Mastercard SPME 8.4.8 regarding administrative fees charged to Issuer accounts following QMAP investigations.


+ # Retains previously incorporated police report requirements and compliance deadline mandates from SPME 8.6.2, 10.2, and 12.


+ # Confirms Mastercard's authority on ADC event responsibility determinations and outlines fee-related procedural considerations for Acquirers and Issuers after Questionable Merchant identifications.

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Determinations on ADC Events

Mastercard retains exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters are final and not subject to internal appeal. Customers are advised to seek Mastercard guidance if uncertain about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards.

## Administrative and Audit Fees Related to QMAP Investigations

Mastercard may charge the Acquirer an audit fee not exceeding USD 2,500 for each identification of a Merchant as a Questionable Merchant. Additionally, Mastercard may assess an administrative fee to the Issuer account at the end of a QMAP investigation. However, if the administrative fee is less than the Issuer filing fee, Mastercard will not debit the administrative fee from the Issuer account. These fee provisions apply in the context of BRAM-related investigations and should be considered during response and remediation activities.

Source authority: Mastercard SPME ������8.6.2, ������10.2, 12.0, and section 3.9.§§3.9, 8.4.8, 8.6.2, 10.2, 12.0.

policies/bram_response/policy.md — after applying change

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Determinations on ADC Events

Mastercard retains exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters are final and not subject to internal appeal. Customers are advised to seek Mastercard guidance if uncertain about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards.

## Administrative and Audit Fees Related to QMAP Investigations

Mastercard may charge the Acquirer an audit fee not exceeding USD 2,500 for each identification of a Merchant as a Questionable Merchant. Additionally, Mastercard may assess an administrative fee to the Issuer account at the end of a QMAP investigation. However, if the administrative fee is less than the Issuer filing fee, Mastercard will not debit the administrative fee from the Issuer account. These fee provisions apply in the context of BRAM-related investigations and should be considered during response and remediation activities.

Source authority: Mastercard SPME ������8.6.2, ������10.2, 12.0, and section 3.9.§§3.9, 8.4.8, 8.6.2, 10.2, 12.0.

Source authority: Mastercard SPME §8.4.8.

--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -1,5 +1,5 @@
 program: BRAM
-authority: Mastercard SPME 8.6.2, 10.2, 12
+authority: Mastercard SPME 8.6.2, 8.4.8, 10.2, 12
 response_window_days: 180
 required_evidence:
   - transaction_monitoring_records
@@ -10,6 +10,6 @@
 internal_notification_hours: 24
 agent_owner: bram_response_agent
 
-# Includes updated police report requirement per SPME 8.6.2 and affirms Mastercard's exclusive authority in determining ADC Event responsibility (SPME 10.2).
-# Added policy note on consequences for failure to provide complete responses by deadlines, including escalating Category C noncompliance assessments as specified in SPME 12.
-# Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.+# Updated to reflect new fee assessment clarifications in Mastercard SPME 8.4.8 regarding administrative fees charged to Issuer accounts following QMAP investigations.
+# Retains previously incorporated police report requirements and compliance deadline mandates from SPME 8.6.2, 10.2, and 12.
+# Confirms Mastercard's authority on ADC event responsibility determinations and outlines fee-related procedural considerations for Acquirers and Issuers after Questionable Merchant identifications.

--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -1,9 +1,6 @@
 # BRAM Investigation Response
 
-When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
-notice for one of our merchants, the acquirer must halt new merchant onboarding
-immediately and submit an evidence package within one hundred eighty (180) days
-of receipt of the notice.
+When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.
 
 ## Required actions
 
@@ -18,14 +15,14 @@
 
 ## Additional Considerations for Coercion Claims
 
-When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day
-investigation period at its discretion. At least one claim must include a police report from the Cardholder.
-Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,
-though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
-merchant within the investigation period to prompt claim submissions.
+When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.
 
 ## Mastercard's Authority and Determinations on ADC Events
 
 Mastercard retains exclusive authority to determine the occurrence, scope, and responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including the consolidation of related incidents into single or multiple events where applicable. Mastercard’s decisions in these matters are final and not subject to internal appeal. Customers are advised to seek Mastercard guidance if uncertain about their rights or obligations related to ADC Events. This framework ensures accountability and proper management of ADC risks in line with Mastercard's network security standards.
 
-Source authority: Mastercard SPME 8.6.2, 10.2, 12.0, and section 3.9.+## Administrative and Audit Fees Related to QMAP Investigations
+
+Mastercard may charge the Acquirer an audit fee not exceeding USD 2,500 for each identification of a Merchant as a Questionable Merchant. Additionally, Mastercard may assess an administrative fee to the Issuer account at the end of a QMAP investigation. However, if the administrative fee is less than the Issuer filing fee, Mastercard will not debit the administrative fee from the Issuer account. These fee provisions apply in the context of BRAM-related investigations and should be considered during response and remediation activities.
+
+Source authority: Mastercard SPME §§3.9, 8.4.8, 8.6.2, 10.2, 12.0.