Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §8.9.2 · Sep 2024 → May 2025

MMP Monthly Reporting Format and Submission

substantive

The reporting requirements were expanded to include detailed merchant information and violations, with new fields such as Merchant URL, MCC, violation type, dates of reporting, and resolution details. A standardized file naming convention using the Acquirer ICA and other identifiers was also introduced, while existing submission and file requirements remained.

Sources Mastercard SPME · Sep 2024 · page 97 PDF Mastercard SPME · May 2025 · page 99 PDF BRAM Response current
Also in §8.x this release substantive §8.6.2 Investigation Process substantive §8.6.8 Coercion Program Performance Assessments substantive §8.8.4 Noncompliance Assessment Mitigation substantive §8.9.1 MMP Participation Requirements
Why these edits? The expanded monthly reporting requirements to include detailed merchant information, violation types, and resolution details directly affect the BRAM Investigation Response policy, which cites section 10.2 related to BRAM obligations and reporting.
Mastercard SPME §8.9.2
Security Rules and Procedures—Merchant Edition • 6 August 2024 11 February 2025 – Date the Merchant information, including URL, was provided to the MMSP – Merchant MCC – Violation type, if applicable – Date the MMSP reported the violation to the Acquirer, when applicable – Violation category, if applicable – URL content details – Date Acquirer resolved and reported to MMSP, when applicable – Investigation findings and final resolution status, when applicable • Each file must utilize a standard naming convention, as follows (where NNNNNN is the Acquirer ICA): NNNNNN Acquirer Name - Service Provider Name - MMSP Name - Date of Report • Separate files must be prepared for each Acquirer ICA or Acquirer legal entity name. Merchant activity acquired under the specified Acquirer ICA or Acquirer legal entity name must be the only data contained in that file. • Submit each report attached to an email message to mmp@mastercard.com or as otherwise approved by Mastercard. The maximum email attachment size is 20 MB. Attachments that exceed this size should be split into multiple attachments (each in a separate email message), so that no single attachment is larger than 20 MB. The Acquirer is responsible for ensuring that Mastercard receives the monthly report within 30 days of the completion of monitoring for a given month (for example, by July 1 for monitoring during the period of May 1 through May 31).
Halyard Pay · 2 files
program: BRAM


- authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12


+ authority: Mastercard SPME 8.6.2, 8.9.2, 10.2, 10.7, 12


response_window_days: 180


required_evidence:


  - transaction_monitoring_records


  - corrective_action_plan


  - police_report  # Mandatory inclusion per updated SPME 8.6.2


halt_actions:


  - halt_new_merchant_onboarding


internal_notification_hours: 24


agent_owner: bram_response_agent


 


# Updated to incorporate Mastercard's new appeal process and fee for contesting financial responsibility for ADC Events as detailed in SPME §10.7.


# Clarifies that appeals must be timely, substantiated with particularized basis, and accompanied by a non-refundable fee, impacting procedural guidance for BRAM responses.


+ # Incorporates expanded reporting requirements per updated SPME §8.9.2, requiring detailed merchant information including URLs, violation types, resolution dates, and standardized file naming conventions for monthly reports.


# Maintains existing police report requirement and escalation procedures for noncompliance per SPME 8.6.2 and 12.


# Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation

notice for one of our merchants, the acquirer must halt new merchant onboarding

immediately and submit an evidence package and monthly monitoring reports as required, including detailed merchant information, violation types, and resolution details, within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Submit monthly monitoring reports to Mastercard with merchant information including merchant URL, MCC, violation types, categories, report dates, resolution statuses, and investigation findings, following the latest Mastercard naming and submission conventions.

4. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response and required reports by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day

investigation period at its discretion. At least one claim must include a police report from the Cardholder.

Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,

though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the

merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Customer Appeal Rights on ADC Financial Responsibility Determinations

Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.

Source authority: Mastercard SPME �8.6.2, �10.2, §§8.6.2, 10.2, 10.7, 12.0, and section 3.9.

policies/bram_response/policy.md — after applying change

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation

notice for one of our merchants, the acquirer must halt new merchant onboarding

immediately and submit an evidence package and monthly monitoring reports as required, including detailed merchant information, violation types, and resolution details, within one hundred eighty (180) days of receipt of the notice.

Required actions

  1. Halt new merchant onboarding for the merchant under investigation.

  2. Compile and submit an evidence package containing:

  • Transaction monitoring records covering the prior 180 days.

  • A written corrective action plan.

  • Documentation of any police reports related to alleged coercion claims if applicable.

  1. Submit monthly monitoring reports to Mastercard with merchant information including merchant URL, MCC, violation types, categories, report dates, resolution statuses, and investigation findings, following the latest Mastercard naming and submission conventions.

4. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Failure to submit a complete response and required reports by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day

investigation period at its discretion. At least one claim must include a police report from the Cardholder.

Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation,

though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the

merchant within the investigation period to prompt claim submissions.

Mastercard's Authority and Customer Appeal Rights on ADC Financial Responsibility Determinations

Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.

Source authority: Mastercard SPME �8.6.2, �10.2, §§8.6.2, 10.2, 10.7, 12.0, and section 3.9.

Source authority: Mastercard SPME §8.9.2.

--- a/policies/bram_response/rules.yaml
+++ b/policies/bram_response/rules.yaml
@@ -1,5 +1,5 @@
 program: BRAM
-authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12
+authority: Mastercard SPME 8.6.2, 8.9.2, 10.2, 10.7, 12
 response_window_days: 180
 required_evidence:
   - transaction_monitoring_records
@@ -12,5 +12,6 @@
 
 # Updated to incorporate Mastercard's new appeal process and fee for contesting financial responsibility for ADC Events as detailed in SPME §10.7.
 # Clarifies that appeals must be timely, substantiated with particularized basis, and accompanied by a non-refundable fee, impacting procedural guidance for BRAM responses.
+# Incorporates expanded reporting requirements per updated SPME §8.9.2, requiring detailed merchant information including URLs, violation types, resolution dates, and standardized file naming conventions for monthly reports.
 # Maintains existing police report requirement and escalation procedures for noncompliance per SPME 8.6.2 and 12.
 # Allows for potential additional time granted by Mastercard upon Acquirer's confirmation of cessation of violating activity.

--- a/policies/bram_response/policy.md
+++ b/policies/bram_response/policy.md
@@ -2,8 +2,7 @@
 
 When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation
 notice for one of our merchants, the acquirer must halt new merchant onboarding
-immediately and submit an evidence package within one hundred eighty (180) days
-of receipt of the notice.
+immediately and submit an evidence package and monthly monitoring reports as required, including detailed merchant information, violation types, and resolution details, within one hundred eighty (180) days of receipt of the notice.
 
 ## Required actions
 
@@ -12,9 +11,10 @@
    - Transaction monitoring records covering the prior 180 days.
    - A written corrective action plan.
    - Documentation of any police reports related to alleged coercion claims if applicable.
-3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
+3. Submit monthly monitoring reports to Mastercard with merchant information including merchant URL, MCC, violation types, categories, report dates, resolution statuses, and investigation findings, following the latest Mastercard naming and submission conventions.
+4. Notify the Halyard Pay Compliance lead within 24 hours of receipt.
 
-Failure to submit a complete response by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.
+Failure to submit a complete response and required reports by the deadline will be considered a violation of Mastercard Rules section 3.9, resulting in escalating Category C noncompliance assessments until compliance is met. Additional assessments may occur for other Standards violations revealed during the BRAM investigation. Mastercard may grant extensions if the acquirer confirms cessation of violating activities.
 
 ## Additional Considerations for Coercion Claims
 
@@ -28,4 +28,4 @@
 
 Mastercard retains exclusive authority to determine the occurrence, scope, and financial responsibility for Account Data Compromise (ADC) Events or Potential ADC Events, including whether to consolidate related incidents. Once Mastercard notifies a responsible Customer of the financial responsibility amount, the Customer has thirty (30) calendar days to submit a written appeal with supporting documentation, specifically contending that Mastercard's determination was not according to the Standards. Mastercard charges a non-refundable USD 5,000 fee to review such appeals. Appeals that are untimely or do not meet criteria will not be considered, and Mastercard's decisions on appeals are final without further internal review. Customers remain obligated to provide ongoing information throughout the investigation and failure to submit required documentation in a timely manner may result in such documents being excluded from the appeal consideration. This process safeguards the integrity and finality of Mastercards’ ADC financial responsibility determinations.
 
-Source authority: Mastercard SPME 8.6.2, 10.2, 10.7, 12.0, and section 3.9.+Source authority: Mastercard SPME §§8.6.2, 10.2, 10.7, 12.0, and section 3.9.