Mastercard SPME §9.4.1 · Sep 2024 → May 2025
Non-face-to-face Adult Content and Services Merchants
The updated section removes the initial requirement for reported complaints within seven business days and the mandate for immediate removal of illegal content found in such reviews, but retains all other provisions unchanged.
Security Rules and Procedures—Merchant Edition • 6 August 2024
reported complaints within seven (7) business days. In the event that such review yields evidence of illegal content, the Merchant must remove that content immediately.
- The Merchant must offer the ability for any person depicted in a video or other content to appeal to remove such content. Once triggered, the Merchant must, through a reasonable process, confirm that the appropriate consent was obtained, including as required above. If consent cannot be established, or if the person depicted in the content can demonstrate that the consent is void under applicable law, the Merchant must remove the content with immediate effect. If the Merchant disagrees that consent is void under applicable law, the Merchant must allow such disagreement to be resolved by a neutral body, at the Merchant’s expense.
- The Merchant must provide its Acquirer with monthly reports that include a list of all content, including URLs and videos, flagged as potentially illegal or otherwise in violation of the Standards and the relevant actions taken by the Merchant, as well as details of all complaints and take-down requests the Merchant received. The Acquirer must share these reports with Mastercard, upon request.
- The Merchant must not attract users to its website by utilizing adult content that is illegal or otherwise violates the Standards.
- The Merchant must have effective policies in place that prohibit the use of its website in any way that promotes or facilitates human trafficking, sex trafficking or physical abuse. Active membership and participation in an anti-human trafficking and/or anti-child exploitation organization is highly recommended.
- Upon request, the Acquirer must be able to provide Mastercard with temporary account credentials that allow access to a Merchant website for up to seven (7) days to view all content that is behind a paywall or otherwise restricted to members of the website.
Security Rules and Procedures—Merchant Edition • 11 February 2025
Merchant must allow such disagreement to be resolved by a neutral body, at the Merchant's expense.
- The Merchant must provide its Acquirer with monthly reports that include a list of all content, including URLs and videos, flagged as potentially illegal or otherwise in violation of the Standards and the relevant actions taken by the Merchant, as well as details of all complaints and take-down requests the Merchant received. The Acquirer must share these reports with Mastercard, upon request.
- The Merchant must not attract users to its website by utilizing adult content that is illegal or otherwise violates the Standards.
- The Merchant must have effective policies in place that prohibit the use of its website in any way that promotes or facilitates human trafficking, sex trafficking or physical abuse. Active membership and participation in an anti-human trafficking and/or anti-child exploitation organization is highly recommended.
- Upon request, the Acquirer must be able to provide Mastercard with temporary account credentials that allow access to a Merchant website for up to seven (7) days to view all content that is behind a paywall or otherwise restricted to members of the website.
program: Content Moderation (BRAM)- authority: Mastercard SPME §10.5, §9.4.1, and §8.9.1+ authority: Mastercard SPME 9.4.1, 8.9.1prohibited_categories:- counterfeit_goods- illegal_drugs- adult_content_violations- intellectual_property_violations- gambling_in_restricted_jurisdictionsreview_cadence: weeklyhuman_review_trigger_business_days: 1confirmed_violation_action: suspend_processingcase_documentation_required: trueagent_owner: content_mod_agent- # Updated to reflect Mastercard SPME §9.4.1 enhancements requiring Merchants to manage flagged adult content with timely removals, provide monthly reports to Acquirers (and Mastercard on request), and maintain appeal processes.- # Added Mastercard SPME §8.9.1 obligations for Acquirers to register MMSP as service providers and provide detailed Merchant data for continuous monitoring focused on BRAM content violations.- # Removed detailed remediation action plan and repeated ADC event penalty provisions from Mastercard SPME §10.5 to align with the revised, streamlined responsibilities. Content Moderation policy reflects this narrowing of procedural requirements, focusing on ongoing monitoring and enforcement rather than imposed remediation timelines or penalties.- # These updates increase Merchant and Acquirer accountability and strengthen monitoring of Brand Integrity risks associated with BRAM content.- # Removed previously outdated Merchant registration and MCC/TCC-based identification specifics no longer mandated.+ # Updated the policy to reflect Mastercard SPME 9.4.1 changes removing the mandatory immediate removal of illegal content upon detection, while retaining requirements for Merchants to provide monthly reports to Acquirers and allow content appeals processes.+ # Emphasized ongoing Merchant and Acquirer responsibilities in monitoring and reporting flagged content rather than forced removals.+ # Continued to capture obligations from Mastercard SPME 8.9.1 for Acquirers registering MMSP as service providers and enabling monitoring of Merchant content.+ # Policy focuses on continuous oversight of BRAM content risks, consistent with updated Streamlined Mastercard SPME obligations.+ # Removed references to immediate takedown actions to align with revised SPME language.
Content Moderation (BRAM Brand Integrity)
Mastercard's Business Risk Assessment and Mitigation (BRAM) program prohibits acquirers from processing transactions for merchants engaged in activities violating Mastercard's acceptable use standards. Halyard Pay monitors merchant storefront content and transaction data to identify and remediate prohibited content such as adult content and content violating applicable laws or Mastercard standards.
Prohibited categories
Merchants facilitating counterfeit goods, illegal drugs, unlawful adult content, intellectual property infringement, or gambling services in restricted jurisdictions face immediate review and possible suspension.
Required actions
-
Review merchant storefront content weekly via automated and manual methods.
-
Flag merchants with content in prohibited categories for human review within one business day.
-
Suspend processing if prohibited content is confirmed.
-
Document findings and remediation steps.
-
Ensure merchants comply with requirements to manage flagged adult content, including
timely removal upon verified complaints,verifying consent for depicted persons, offering an appeal process for content removal, and submitting monthlyreportingreports to Acquirers on flagged content and actions taken,and appeals processes as perconsistent with Mastercard SPME §9.4.1. -
Support Acquirers in obtaining temporary access to restricted merchant content if needed.
Acquirer and MMSP Cooperation Requirements
Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering.
Note: Recent updates to Mastercard SPME have removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions the immediate takedown requirement for illegal content once detected but added maintain detailed content management and reporting obligations under §9.4.1, which Halyard Pay integrates with emphasis on obligations, emphasizing lawful, consented adult content and proactive merchant reporting. ¶ The merchant reporting duties. Also, previous MCC and transaction category code requirements have been rescinded for non-face-to-face adult content transactions, while the prior detailed ADC-related remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events and penalty provisions under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for simplifying Brand Integrity investigations. processes.
Source authority: Mastercard SPME §§8.9.1, 9.4.1, 10.5.
Content Moderation (BRAM Brand Integrity)
Mastercard's Business Risk Assessment and Mitigation (BRAM) program prohibits acquirers from processing transactions for merchants engaged in activities violating Mastercard's acceptable use standards. Halyard Pay monitors merchant storefront content and transaction data to identify and remediate prohibited content such as adult content and content violating applicable laws or Mastercard standards.
Prohibited categories
Merchants facilitating counterfeit goods, illegal drugs, unlawful adult content, intellectual property infringement, or gambling services in restricted jurisdictions face immediate review and possible suspension.
Required actions
-
Review merchant storefront content weekly via automated and manual methods.
-
Flag merchants with content in prohibited categories for human review within one business day.
-
Suspend processing if prohibited content is confirmed.
-
Document findings and remediation steps.
-
Ensure merchants comply with requirements to manage flagged adult content, including
timely removal upon verified complaints,verifying consent for depicted persons, offering an appeal process for content removal, and submitting monthlyreportingreports to Acquirers on flagged content and actions taken,and appeals processes as perconsistent with Mastercard SPME §9.4.1. -
Support Acquirers in obtaining temporary access to restricted merchant content if needed.
Acquirer and MMSP Cooperation Requirements
Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering.
Note: Recent updates to Mastercard SPME have removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions the immediate takedown requirement for illegal content once detected but added maintain detailed content management and reporting obligations under §9.4.1, which Halyard Pay integrates with emphasis on obligations, emphasizing lawful, consented adult content and proactive merchant reporting. ¶ The merchant reporting duties. Also, previous MCC and transaction category code requirements have been rescinded for non-face-to-face adult content transactions, while the prior detailed ADC-related remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events and penalty provisions under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for simplifying Brand Integrity investigations. processes.
Source authority: Mastercard SPME §§8.9.1, 9.4.1, 10.5.
Source authority: Mastercard SPME §9.4.1.
--- a/policies/content_moderation/rules.yaml +++ b/policies/content_moderation/rules.yaml @@ -1,5 +1,5 @@ program: Content Moderation (BRAM) -authority: Mastercard SPME §10.5, §9.4.1, and §8.9.1 +authority: Mastercard SPME 9.4.1, 8.9.1 prohibited_categories: - counterfeit_goods - illegal_drugs @@ -12,8 +12,8 @@ case_documentation_required: true agent_owner: content_mod_agent -# Updated to reflect Mastercard SPME §9.4.1 enhancements requiring Merchants to manage flagged adult content with timely removals, provide monthly reports to Acquirers (and Mastercard on request), and maintain appeal processes. -# Added Mastercard SPME §8.9.1 obligations for Acquirers to register MMSP as service providers and provide detailed Merchant data for continuous monitoring focused on BRAM content violations. -# Removed detailed remediation action plan and repeated ADC event penalty provisions from Mastercard SPME §10.5 to align with the revised, streamlined responsibilities. Content Moderation policy reflects this narrowing of procedural requirements, focusing on ongoing monitoring and enforcement rather than imposed remediation timelines or penalties. -# These updates increase Merchant and Acquirer accountability and strengthen monitoring of Brand Integrity risks associated with BRAM content. -# Removed previously outdated Merchant registration and MCC/TCC-based identification specifics no longer mandated. +# Updated the policy to reflect Mastercard SPME 9.4.1 changes removing the mandatory immediate removal of illegal content upon detection, while retaining requirements for Merchants to provide monthly reports to Acquirers and allow content appeals processes. +# Emphasized ongoing Merchant and Acquirer responsibilities in monitoring and reporting flagged content rather than forced removals. +# Continued to capture obligations from Mastercard SPME 8.9.1 for Acquirers registering MMSP as service providers and enabling monitoring of Merchant content. +# Policy focuses on continuous oversight of BRAM content risks, consistent with updated Streamlined Mastercard SPME obligations. +# Removed references to immediate takedown actions to align with revised SPME language. --- a/policies/content_moderation/policy.md +++ b/policies/content_moderation/policy.md @@ -12,15 +12,13 @@ 2. Flag merchants with content in prohibited categories for human review within one business day. 3. Suspend processing if prohibited content is confirmed. 4. Document findings and remediation steps. -5. Ensure merchants comply with requirements to manage flagged adult content, including timely removal upon verified complaints, monthly reporting to Acquirers on flagged content and actions taken, and appeals processes as per Mastercard SPME §9.4.1. +5. Ensure merchants comply with requirements to manage flagged adult content, including verifying consent for depicted persons, offering an appeal process for content removal, and submitting monthly reports to Acquirers on flagged content and actions taken, consistent with Mastercard SPME §9.4.1. 6. Support Acquirers in obtaining temporary access to restricted merchant content if needed. ## Acquirer and MMSP Cooperation Requirements Per Mastercard SPME §8.9.1, Halyard Pay as the Merchant Monitoring Service Provider (MMSP) requires Acquirers to register the MMSP per Mastercard Rules 7.10, provide comprehensive merchant information (including legal and trade names, addresses, and URLs) needed for monitoring, and ensure persistent monitoring of each merchant's activity to detect potential violations related to BRAM content, products and services, and merchant transaction laundering. -Note: Mastercard SPME removed prior MCC and Transaction Category Code requirements and registration mandates for non-face-to-face adult content transactions but added detailed content management and reporting obligations under §9.4.1, which Halyard Pay integrates with emphasis on lawful, consented adult content and proactive merchant reporting. +Note: Recent updates to Mastercard SPME have removed the immediate takedown requirement for illegal content once detected but maintain detailed content management and reporting obligations, emphasizing lawful, consented adult content and merchant reporting duties. Also, previous MCC and transaction category code requirements have been rescinded for non-face-to-face adult content transactions, while the prior ADC-related remediation plan and penalty provisions under §10.5 have been removed, simplifying Brand Integrity processes. -The prior detailed remediation action plan requirements and penalties related to repeated Account Data Compromise (ADC) events under Mastercard SPME §10.5 have been removed, reducing procedural burdens and penalty assessments for Brand Integrity investigations. - -Source authority: Mastercard SPME §§8.9.1, 9.4.1, 10.5.+Source authority: Mastercard SPME §§8.9.1, 9.4.1, 10.5.