Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §9.3 · Sep 2024 → May 2025

General Monitoring Requirements

substantive

The updated rules add two new obligations for merchants: they must resolve reported complaints about potentially illegal content within seven business days, removing illegal content immediately, and must provide a process allowing individuals depicted in content to appeal for its removal if consent is invalid.

Sources Mastercard SPME · Sep 2024 · page 102 PDF Mastercard SPME · May 2025 · page 106 PDF Content Moderation current
Also in §9.x this release substantive §9.2 General Registration Requirements substantive §9.4.1 Non-face-to-face Adult Content and Services Merchants substantive §9.4.2 Non-face-to-face Gambling Merchants substantive §9.4.3 Pharmaceutical and Tobacco Product Merchants substantive §9.4.4 Government-owned Lottery Merchants substantive §9.4.5 Skill Games Merchants substantive §9.4.7 Recreational Cannabis Merchants (Canada Region Only) substantive §9.4.8 High-Risk Securities Merchants substantive §9.4.9 Cryptocurrency Merchants
Why these edits? The updated Mastercard rule in section 9.3 introduces new obligations requiring merchants to resolve complaints about potentially illegal content within seven business days, remove illegal content immediately, and provide a process for individuals depicted in content to appeal for its removal if consent is invalid, directly affecting the Content Moderation policy that cites this section.
Mastercard SPME §9.3
Security Rules and Procedures—Merchant Edition • 6 August 2024 ¶ • ¶ MCC 5967 (Direct Marketing—Inbound Telemarketing Merchants) and TCC T; or ¶ • ¶ MCC 7841 (Video Entertainment Rental Stores) and TCC T. ¶ Before an Acquirer may process non-face-to-face adult content and services Transactions from ¶ a Merchant or Sponsored Merchant, it must register the Merchant or Sponsored Merchant with ¶ Mastercard as described in section 9.2 of this manual. ¶ By registering an adult content and services Merchant or Sponsored Merchant, the Acquirer is ¶ certifying that the Merchant or Sponsored Merchant meets the following requirements and has 11 February 2025 effective controls in place to monitor, block, and where necessary, take down all content as appropriate. All of the following Merchant requirements also apply to Sponsored Merchants. In situations where the Merchant allows a third-party user (“content provider”"content provider") to upload or generate content, including real-time/live streaming content: 1. The Merchant must enter into a written agreement with each content provider and such written agreement must: a. Specifically prohibit any activity that is illegal or otherwise violates the Standards b. Require the content provider to obtain and keep on record written consent from all persons depicted in the content specific to the following areas: – Consent to be depicted in the content – Consent to allow for the public distribution of the content and to upload the content to the Merchant’s Merchant's website – If the content will be made available for downloading by other users, consent to have the content downloaded c. Require the content provider to verify the identity and age of all persons depicted in content to ensure that all persons depicted are adults and to be able to provide supporting documents upon request. 2. The Merchant must only permit content uploads from verified content providers and must have a robust process for verifying the age and identity of the content provider, which includes the review and validation of a government-issued identification and steps to ensure that the government identification is in the possession of, and belongs to, the content provider. The use of a third-party vendor that specializes in the validation of government identifications is recommended. 3. All uploaded content must be reviewed prior to publication to ensure that the content is not illegal and does not otherwise violate the Standards. 4. If providing real-time or live video streaming services, the Merchant must operate on a platform that the Merchant is able to fully control and that allows for real-time monitoring and the removal of the content being streamed. For all adult content and services Merchants: 1. The Merchant must not market the content of its website or permit content search terms to give the impression that the content contains child exploitation materials or the depiction of nonconsensual activities. 2. The Merchant must support a complaint process that allows for the reporting of content that may be illegal or otherwise violates the Standards and must review and resolve all Mastercard reported complaints within seven (7) business days. In the event that such review yields evidence of illegal content, the Merchant must remove that content immediately. 3. The Merchant must offer the ability for any person depicted in a video or other content to appeal to remove such content. Once triggered, the Merchant must, through a reasonable process, confirm that the appropriate consent was obtained, including as required above. If consent cannot be established, or if the person depicted in the content can demonstrate that the consent is void under applicable law, the Merchant must remove the content with immediate effect. If the Merchant disagrees that consent is void under applicable law, the Specialty Merchant Registration Program
Halyard Pay · 2 files
program: Content Moderation (BRAM)


- authority: Mastercard SPME §10.5, §9.4.1, and §8.9.1


+ authority: Mastercard SPME 9.4.1, 9.3, and 8.9.1


prohibited_categories:


  - counterfeit_goods


  - illegal_drugs


  - adult_content_violations


  - intellectual_property_violations


  - gambling_in_restricted_jurisdictions


review_cadence: weekly


human_review_trigger_business_days: 1


confirmed_violation_action: suspend_processing


case_documentation_required: true


agent_owner: content_mod_agent


 


- # Updated to reflect Mastercard SPME §9.4.1 enhancements requiring Merchants to manage flagged adult content with timely removals, provide monthly reports to Acquirers (and Mastercard on request), and maintain appeal processes.


- # Added Mastercard SPME §8.9.1 obligations for Acquirers to register MMSP as service providers and provide detailed Merchant data for continuous monitoring focused on BRAM content violations.


- # Removed detailed remediation action plan and repeated ADC event penalty provisions from Mastercard SPME §10.5 to align with the revised, streamlined responsibilities. Content Moderation policy reflects this narrowing of procedural requirements, focusing on ongoing monitoring and enforcement rather than imposed remediation timelines or penalties.


- # These updates increase Merchant and Acquirer accountability and strengthen monitoring of Brand Integrity risks associated with BRAM content.


- # Removed previously outdated Merchant registration and MCC/TCC-based identification specifics no longer mandated.


+ # Updated to incorporate additional merchant obligations from Mastercard SPME 9.3 requiring a formal complaint resolution process for potentially illegal adult content within seven business days and immediate removal of confirmed illegal content.


+ # Included new requirement for merchants to provide an appeal mechanism for individuals depicted in content to seek removal if consent is invalid.


+ # These updates reinforce the importance of timely content moderation and enhanced consumer protections within adult content areas.


+ # Maintains previous updates reflecting broader monitoring, reporting, and registration requirements from Mastercard SPME 9.4.1 and 8.9.1.


+ # Streamlined enforcement focus on prompt and effective content review, removal, and appeals handling.

Content Moderation (BRAM Brand Integrity)

Mastercard's Business Risk Assessment and Mitigation (BRAM) program prohibits acquirers from processing transactions for merchants engaged in activities violating Mastercard's acceptable use standards. Halyard Pay monitors merchant storefront content and transaction data to identify and remediate prohibited content such as adult content and content violating applicable laws or Mastercard standards.

Prohibited categories

Merchants facilitating counterfeit goods, illegal drugs, unlawful adult content, intellectual property infringement, or gambling services in restricted jurisdictions face immediate review and possible suspension.

Required actions

  1. Review merchant storefront content weekly via automated and manual methods.

  2. Flag merchants with content in prohibited categories for human review within one business day.

  3. Suspend processing if prohibited content is confirmed.

  4. Document findings and remediation steps.

  5. Ensure merchants comply with requirements to manage flagged adult content, including timely removal upon verified complaints, monthly reporting to Acquirers on flagged content and actions taken, and appeals processes as per Mastercard SPME §9.4.1.

  6. Support Acquirers in obtaining temporary access to restricted merchant content if needed.

7. Require merchants to resolve reported complaints about potentially illegal adult content within seven business days and to remove immediately any content confirmed to be illegal. Merchants must also provide a process for individuals depicted in such content to appeal for removal if consent is invalid, in line with updated Mastercard SPME §9.3 requirements.

Acquirer and MMSP Cooperation Requirements

Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering.

Note: Mastercard SPME removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions but added detailed content management and reporting obligations under §9.4.1, §9.4.1 and enhanced complaint resolution and appeals provisions in §9.3, which Halyard Pay integrates with emphasis on emphasizing lawful, consented adult content and proactive merchant reporting.

The prior detailed remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for Brand Integrity investigations.

Source authority: Mastercard SPME §§8.9.1, 9.3, 9.4.1, 10.5.

policies/content_moderation/policy.md — after applying change

Content Moderation (BRAM Brand Integrity)

Mastercard's Business Risk Assessment and Mitigation (BRAM) program prohibits acquirers from processing transactions for merchants engaged in activities violating Mastercard's acceptable use standards. Halyard Pay monitors merchant storefront content and transaction data to identify and remediate prohibited content such as adult content and content violating applicable laws or Mastercard standards.

Prohibited categories

Merchants facilitating counterfeit goods, illegal drugs, unlawful adult content, intellectual property infringement, or gambling services in restricted jurisdictions face immediate review and possible suspension.

Required actions

  1. Review merchant storefront content weekly via automated and manual methods.

  2. Flag merchants with content in prohibited categories for human review within one business day.

  3. Suspend processing if prohibited content is confirmed.

  4. Document findings and remediation steps.

  5. Ensure merchants comply with requirements to manage flagged adult content, including timely removal upon verified complaints, monthly reporting to Acquirers on flagged content and actions taken, and appeals processes as per Mastercard SPME §9.4.1.

  6. Support Acquirers in obtaining temporary access to restricted merchant content if needed.

7. Require merchants to resolve reported complaints about potentially illegal adult content within seven business days and to remove immediately any content confirmed to be illegal. Merchants must also provide a process for individuals depicted in such content to appeal for removal if consent is invalid, in line with updated Mastercard SPME §9.3 requirements.

Acquirer and MMSP Cooperation Requirements

Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering.

Note: Mastercard SPME removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions but added detailed content management and reporting obligations under §9.4.1, §9.4.1 and enhanced complaint resolution and appeals provisions in §9.3, which Halyard Pay integrates with emphasis on emphasizing lawful, consented adult content and proactive merchant reporting.

The prior detailed remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for Brand Integrity investigations.

Source authority: Mastercard SPME §§8.9.1, 9.3, 9.4.1, 10.5.

Source authority: Mastercard SPME §9.3.

--- a/policies/content_moderation/rules.yaml
+++ b/policies/content_moderation/rules.yaml
@@ -1,5 +1,5 @@
 program: Content Moderation (BRAM)
-authority: Mastercard SPME §10.5, §9.4.1, and §8.9.1
+authority: Mastercard SPME 9.4.1, 9.3, and 8.9.1
 prohibited_categories:
   - counterfeit_goods
   - illegal_drugs
@@ -12,8 +12,8 @@
 case_documentation_required: true
 agent_owner: content_mod_agent
 
-# Updated to reflect Mastercard SPME §9.4.1 enhancements requiring Merchants to manage flagged adult content with timely removals, provide monthly reports to Acquirers (and Mastercard on request), and maintain appeal processes.
-# Added Mastercard SPME §8.9.1 obligations for Acquirers to register MMSP as service providers and provide detailed Merchant data for continuous monitoring focused on BRAM content violations.
-# Removed detailed remediation action plan and repeated ADC event penalty provisions from Mastercard SPME §10.5 to align with the revised, streamlined responsibilities. Content Moderation policy reflects this narrowing of procedural requirements, focusing on ongoing monitoring and enforcement rather than imposed remediation timelines or penalties.
-# These updates increase Merchant and Acquirer accountability and strengthen monitoring of Brand Integrity risks associated with BRAM content.
-# Removed previously outdated Merchant registration and MCC/TCC-based identification specifics no longer mandated.
+# Updated to incorporate additional merchant obligations from Mastercard SPME 9.3 requiring a formal complaint resolution process for potentially illegal adult content within seven business days and immediate removal of confirmed illegal content.
+# Included new requirement for merchants to provide an appeal mechanism for individuals depicted in content to seek removal if consent is invalid.
+# These updates reinforce the importance of timely content moderation and enhanced consumer protections within adult content areas.
+# Maintains previous updates reflecting broader monitoring, reporting, and registration requirements from Mastercard SPME 9.4.1 and 8.9.1.
+# Streamlined enforcement focus on prompt and effective content review, removal, and appeals handling.

--- a/policies/content_moderation/policy.md
+++ b/policies/content_moderation/policy.md
@@ -14,13 +14,14 @@
 4. Document findings and remediation steps.
 5. Ensure merchants comply with requirements to manage flagged adult content, including timely removal upon verified complaints, monthly reporting to Acquirers on flagged content and actions taken, and appeals processes as per Mastercard SPME §9.4.1.
 6. Support Acquirers in obtaining temporary access to restricted merchant content if needed.
+7. Require merchants to resolve reported complaints about potentially illegal adult content within seven business days and to remove immediately any content confirmed to be illegal. Merchants must also provide a process for individuals depicted in such content to appeal for removal if consent is invalid, in line with updated Mastercard SPME §9.3 requirements.
 
 ## Acquirer and MMSP Cooperation Requirements
 
 Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering.
 
-Note: Mastercard SPME removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions but added detailed content management and reporting obligations under §9.4.1, which Halyard Pay integrates with emphasis on lawful, consented adult content and proactive merchant reporting.
+Note: Mastercard SPME removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions but added detailed content management and reporting obligations under §9.4.1 and enhanced complaint resolution and appeals provisions in §9.3, which Halyard Pay integrates emphasizing lawful, consented adult content and proactive merchant reporting.
 
 The prior detailed remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for Brand Integrity investigations.
 
-Source authority: Mastercard SPME §§8.9.1, 9.4.1, 10.5.+Source authority: Mastercard SPME §§8.9.1, 9.3, 9.4.1, 10.5.