Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §12 · Sep 2024 → May 2025

The Acquirer is responsible for ensuring that accurate data is entered into MATCH Pro. The

substantive

The change specifies that data in MATCH Pro must match onboarding information and introduces potential noncompliance assessments if errors by the Acquirer or authorized user are not timely corrected, replacing prior guidance about investigation responses and escalation procedures.

Sources Mastercard SPME · Sep 2024 · page 95 PDF Mastercard SPME · May 2025 · page 97 PDF BRAM Response current
Why these edits? The change shifts the obligation from providing timely investigation responses and escalation for incomplete information to ensuring accurate and timely data entry in MATCH Pro that corresponds to onboarding information, with noncompliance assessments if not corrected.
Mastercard SPME §12
This section was substantively restructured between versions (3% text overlap). Compare the texts directly below.
Before · Sep 2024 · page 95

Failure to provide a complete response by the required due date will be deemed a violation of Mastercard Rules section 3.9 Obligation of Customer to Provide Information and may result in escalating Category C noncompliance assessments until the required information is provided. The Customer may also be subject to assessments with respect to any other Standards violations identified during the BRAM investigation. Mastercard may grant an Acquirer additional time to provide the requested documentation if the Acquirer has confirmed to Mastercard that the violating activity has ceased.

After · May 2025 · page 97

data entered into MATCH Pro must be equivalent to the information provided in the Merchant or Sponsored Merchant application at time of onboarding with the Acquirer or Payment Facilitator, as applicable. If erroneous data is entered by the Acquirer or other Authorized User and not corrected within a reasonable time period, the Acquirer may be subject to noncompliance assessments.

Halyard Pay · 2 files
program: BRAM


authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12


response_window_days: 180


required_evidence:


  - transaction_monitoring_records


  - corrective_action_plan


-   - police_report  # Mandatory inclusion per updated SPME 8.6.2


+   - police_report  # Mandatory per SPME 8.6.2


halt_actions:


  - halt_new_merchant_onboarding


internal_notification_hours: 24


agent_owner: bram_response_agent


 


- # Updated to incorporate Mastercard's new appeal process and fee for contesting financial responsibility for ADC Events as detailed in SPME §10.7.


- # Clarifies that appeals must be timely, substantiated with particularized basis, and accompanied by a non-refundable fee, impacting procedural guidance for BRAM responses.


- # Maintains existing police report requirement and escalation procedures for noncompliance per SPME 8.6.2 and 12.


- # Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.


+ # Updated per Mastercard SPME §10.7 appeal process and fee requirements for ADC Events.


+ # Revised per Mastercard SPME §12 to emphasize the obligation for accurate data entry in MATCH Pro matching onboarding applications; noncompliance assessments apply if errors are not timely corrected.


+ # Retains police report mandate and escalation protocols for noncompliance as outlined in SPME §§8.6.2 and 12.


+ # Permits Mastercard to grant additional time upon Acquirer's confirmation of halted violations.


+ 


+ # Note: The policy now focuses on accurate MATCH Pro data entry rather than solely on timely investigation responses, aligning with updated Mastercard compliance expectations.

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting ## Data Accuracy Requirement in escalating Category C MATCH Pro

Data entered into MATCH Pro must accurately reflect the information provided during the merchant or sponsored merchant onboarding with the Acquirer or Payment Facilitator. If incorrect data is entered and not corrected within a reasonable timeframe, the Acquirer may face noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities. assessments.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Customer Appeal Rights on ADC Financial Responsibility Determinations

Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.

Source authority: Mastercard SPME �8.6.2, �10.2, 10.7, 12.0, and section 12.0, 3.9.

policies/bram_response/policy.md — after applying change

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting ## Data Accuracy Requirement in escalating Category C MATCH Pro

Data entered into MATCH Pro must accurately reflect the information provided during the merchant or sponsored merchant onboarding with the Acquirer or Payment Facilitator. If incorrect data is entered and not corrected within a reasonable timeframe, the Acquirer may face noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities. assessments.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Customer Appeal Rights on ADC Financial Responsibility Determinations

Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.

Source authority: Mastercard SPME �8.6.2, �10.2, 10.7, 12.0, and section 12.0, 3.9.

Source authority: Mastercard SPME §12.

--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -4,13 +4,15 @@
 required_evidence:
   - transaction_monitoring_records
   - corrective_action_plan
-  - police_report  # Mandatory inclusion per updated SPME 8.6.2
+  - police_report  # Mandatory per SPME 8.6.2
 halt_actions:
   - halt_new_merchant_onboarding
 internal_notification_hours: 24
 agent_owner: bram_response_agent
 
-# Updated to incorporate Mastercard's new appeal process and fee for contesting financial responsibility for ADC Events as detailed in SPME §10.7.
-# Clarifies that appeals must be timely, substantiated with particularized basis, and accompanied by a non-refundable fee, impacting procedural guidance for BRAM responses.
-# Maintains existing police report requirement and escalation procedures for noncompliance per SPME 8.6.2 and 12.
-# Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.
+# Updated per Mastercard SPME §10.7 appeal process and fee requirements for ADC Events.
+# Revised per Mastercard SPME §12 to emphasize the obligation for accurate data entry in MATCH Pro matching onboarding applications; noncompliance assessments apply if errors are not timely corrected.
+# Retains police report mandate and escalation protocols for noncompliance as outlined in SPME §§8.6.2 and 12.
+# Permits Mastercard to grant additional time upon Acquirer's confirmation of halted violations.
+
+# Note: The policy now focuses on accurate MATCH Pro data entry rather than solely on timely investigation responses, aligning with updated Mastercard compliance expectations.

--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -1,9 +1,6 @@
 # BRAM Investigation Response
 
-When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
-notice for one of our merchants, the acquirer must halt new merchant onboarding
-immediately and submit an evidence package within one hundred eighty (180) days
-of receipt of the notice.
+When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.
 
 ## Required actions
 
@@ -14,18 +11,16 @@
    - Documentation of any police reports related to alleged coercion claims if applicable.
 3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
 
-Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.
+## Data Accuracy Requirement in MATCH Pro
+
+Data entered into MATCH Pro must accurately reflect the information provided during the merchant or sponsored merchant onboarding with the Acquirer or Payment Facilitator. If incorrect data is entered and not corrected within a reasonable timeframe, the Acquirer may face noncompliance assessments.
 
 ## Additional Considerations for Coercion Claims
 
-When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day
-investigation period at its discretion. At least one claim must include a police report from the Cardholder.
-Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,
-though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the
-merchant within the investigation period to prompt claim submissions.
+When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day investigation period at its discretion. At least one claim must include a police report from the Cardholder. Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the merchant within the investigation period to prompt claim submissions.
 
 ## Mastercard's Authority and Customer Appeal Rights on ADC Financial Responsibility Determinations
 
 Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.
 
-Source authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12.0, and section 3.9.+Source authority: Mastercard SPME 12.0, 3.9.