Mastercard SPME §9.4.3 · Sep 2024 → May 2025
Pharmaceutical and Tobacco Product Merchants
The update adds a requirement that Acquirers must annually verify and maintain documentation proving that registered Merchants comply with applicable laws and must provide this documentation to Mastercard upon request.
Security Rules and Procedures—Merchant Edition • 6 August 2024
respectively, including Merchants initiating Gaming Payment Transactions pursuant to the Mastercard Gaming and Gambling Payment Program Standards. 9.4.4.1 Government-owned Lottery Merchants (U.S. Region Only) A U.S. Region Acquirer must:
- use MCC 7800 (Government Owned Lottery [U.S. Region Only]) to identify Transactions arising from a U.S. Region Merchant, Sponsored Merchant, or other entity and involving the purchase of a state lottery ticket; and
- register each such Merchant, Sponsored Merchant, or other entity with Mastercard as described in section 9.2 and this section 9.4.4.1. To register a Merchant, Sponsored Merchant, or other entity, the Acquirer must demonstrate that an adequate due diligence review was conducted by providing the following items via email to Mastercard at specialty_merchant_registration@mastercard.com as part of the registration process (herein, all references to a Merchant also apply to a Sponsored Merchant or other entity):
- Evidence of legal authority. The Acquirer must provide: – a copy of the Merchant’s license (or similar document), if any, issued by the appropriate governmental (for example, state or tribal) authority, that expressly authorizes the Merchant to engage in the gambling activity; and – any law applicable to the Merchant that permits state lottery ticket sales.
- Legal opinion. The Acquirer must obtain a reasoned legal opinion, addressed to the Acquirer, from a private sector U.S. lawyer or U.S. law firm. The legal opinion must: – identify all relevant state lottery and other laws applicable to the Merchant; – identify all relevant state lottery and other laws applicable to Cardholders permitted by the Merchant to transact with the Merchant; and – demonstrate that the Merchant’s and Cardholders’ state lottery and payment activities comply at all times with any laws identified above. The Acquirer must provide Mastercard with a copy of such legal opinion. The legal opinion must be acceptable to Mastercard.
- Effective controls. The Acquirer must provide certification from a qualified independent third party demonstrating that the Merchant’s systems for operating its state lottery business: – include effective age and location verification; and – are reasonably designed to ensure that the Merchant’s state lottery business will remain within legal limits (including in connection with interstate Transactions). The certification must include all screenshots relevant to the certification (for example, age verification process). Certifications from interested parties (such as the Acquirer, ISOs, the Merchant, and so on) are not acceptable substitutes for the independent third-party certification.
- Notification of changes. The Acquirer must certify that it will notify Mastercard of any changes to the information that it has provided to Mastercard, including changes in applicable law, Merchant activities, and Merchant systems. Such notification shall include Mastercard Registration Program 9.4.4.1 Government-owned Lottery Merchants (U.S. Region Only) Security Rules and Procedures—Merchant Edition • 6 August 2024 any revisions or additions to the information provided to Mastercard (for example, legal opinion, third-party certification) to make the information current and complete. Such notification is required within ten (10) days of any such change.
- Acceptance of responsibilities. The Acquirer must specifically affirm that it will not submit restricted Transactions from the Merchant for authorization. Mastercard must approve the registration request before the Acquirer may process any government-owned lottery Transactions for the Merchant, Sponsored Merchant, or other entity. 9.4.4.2 Government-owned Lottery Merchants (Global, Excluding U.S. Region) An Acquirer may use MCC 9406 (Government Owned Lottery [Global, Excluding U.S. Region]) to identify a Merchant, Sponsored Merchant, or other entity located in the Asia/Pacific, Canada, Europe, Latin America and the Caribbean, or Middle East/Africa Region that is engaged in the sale of lottery tickets, recurring lottery subscriptions, or both. For lottery entities located in the U.S. Region, refer to section 9.4.4.1. For lottery entities located in any other country, refer to section 9.4.2. Subject to applicable law and regulation, a government-administered lottery scheme may sell lottery tickets or lottery subscription services through the Internet. As set forth in section 9.2 above, an Acquirer must register any Merchant, Sponsored Merchant, or other entity conducting such sale in a non-face-to-face environment. For the avoidance of doubt, this registration requirement extends to any agent duly licensed by the appropriate government authority to sell lottery tickets online.
Security Rules and Procedures—Merchant Edition • 11 February 2025
By registering a Merchant or Sponsored Merchant as required by this section, the Acquirer represents and warrants that the Acquirer has verified compliance with applicable law as described above. The Acquirer must maintain such verification for so long as it acquires Transactions from the Merchant or Sponsored Merchant that is subject to the aforedescribed registration requirement and must, no less frequently than every 12 months, confirm continued compliance with applicable law concerning the business of the registered Merchant or Sponsored Merchant. The Acquirer must furnish Mastercard with a copy of such documentation promptly upon request.
program: Acquirer KYB- authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1, 2.4.1+ authority: Mastercard SPME 2.1, 9.4.3, 11.2.3, 11.2.6, 11.7.1, 2.4.1required_documents:- incorporation- beneficial_ownership- aml_screen- license_verificationmin_review_cycle_days: 365suspension_trigger: document_collection_failurerecord_retention_years: 7aml_watchlist_sources:- ofac_sdn- eu_consolidatedagent_owner: kyb_agent# Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.# Failure to adhere to these requirements may result in noncompliance assessments.# The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.# Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.# Per the updated Mastercard SPME §2.4.1, Acquirers are required to properly manage their PIN Entry Device (PED) and Encrypting PIN Pad (EPP) inventories. This includes maintaining an up-to-date inventory of device types and locations, ensuring devices receive timely software security patches distributed by vendors, and conducting regular physical inspections by trained staff to detect tampering or substitution.# Acquirers must also manage devices whose PCI PTS approvals have expired by moving them from approved lists to appropriate expired approval lists and ceasing their use for processing transactions if Mastercard issues a sunset date for specific device models.+ # In accordance with Mastercard SPME §9.4.3, when registering Government-owned Lottery Merchants or Sponsored Merchants, Acquirers must maintain ongoing verification of the Merchant's compliance with applicable laws. This verification must be retained while acquiring Transactions and be updated at least annually with documentation promptly available to Mastercard upon request.# These controls strengthen the security posture of Acquirers in line with Mastercard's risk management directives, helping to prevent device-related compromises.
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.
When this policy applies
This policy applies at initial merchant onboarding and onboarding, during periodic re-verification reviews. Merchants that do not provide reviews, and requires annual verification of compliance documentation for certain specialty merchants, including government-owned lottery merchants as required documentation within set timelines must be suspended until compliance is restored. by Mastercard registration rules.
Required actions
-
Collect all KYB documentation needed at onboarding.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule full re-verification at least annually.
-
Maintain and update verification documentation annually for specialty merchants subject to Mastercard registration requirements, including government-owned lottery merchants, ensuring proof of ongoing legal compliance is up to date and available upon request.
6. Document verification outcomes and maintain records for audit.
6. 7. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.
7. 8. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.
8. 9. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.
9. 10. Maintain proper management of PED and EPP device inventories, ensuring devices receive timely software security patches and are physically tracked and inspected regularly for tampering or substitution. This includes keeping an accurate inventory of device types and locations, and training staff to conduct these inspections. Any device model sunset announcements by Mastercard must be adhered to, including ceasing use of such devices by the specified deadline.
Source authority: Mastercard SPME §§2.1, 2.4.1, 7.1, 9.4.3, 11.2.3, 11.2.6, 11.7.1.
Acquirer KYB (Know Your Business) Obligations
Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.
When this policy applies
This policy applies at initial merchant onboarding and onboarding, during periodic re-verification reviews. Merchants that do not provide reviews, and requires annual verification of compliance documentation for certain specialty merchants, including government-owned lottery merchants as required documentation within set timelines must be suspended until compliance is restored. by Mastercard registration rules.
Required actions
-
Collect all KYB documentation needed at onboarding.
-
Conduct AML screening against applicable watchlists before approval.
-
Verify business licenses for regulated merchant categories.
-
Schedule full re-verification at least annually.
-
Maintain and update verification documentation annually for specialty merchants subject to Mastercard registration requirements, including government-owned lottery merchants, ensuring proof of ongoing legal compliance is up to date and available upon request.
6. Document verification outcomes and maintain records for audit.
6. 7. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.
7. 8. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.
8. 9. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.
9. 10. Maintain proper management of PED and EPP device inventories, ensuring devices receive timely software security patches and are physically tracked and inspected regularly for tampering or substitution. This includes keeping an accurate inventory of device types and locations, and training staff to conduct these inspections. Any device model sunset announcements by Mastercard must be adhered to, including ceasing use of such devices by the specified deadline.
Source authority: Mastercard SPME §§2.1, 2.4.1, 7.1, 9.4.3, 11.2.3, 11.2.6, 11.7.1.
Source authority: Mastercard SPME §9.4.3.
--- a/policies/kyb_acquirer/rules.yaml +++ b/policies/kyb_acquirer/rules.yaml @@ -1,5 +1,5 @@ program: Acquirer KYB -authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1, 2.4.1 +authority: Mastercard SPME 2.1, 9.4.3, 11.2.3, 11.2.6, 11.7.1, 2.4.1 required_documents: - incorporation - beneficial_ownership @@ -18,4 +18,5 @@ # Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1. # Per the updated Mastercard SPME §2.4.1, Acquirers are required to properly manage their PIN Entry Device (PED) and Encrypting PIN Pad (EPP) inventories. This includes maintaining an up-to-date inventory of device types and locations, ensuring devices receive timely software security patches distributed by vendors, and conducting regular physical inspections by trained staff to detect tampering or substitution. # Acquirers must also manage devices whose PCI PTS approvals have expired by moving them from approved lists to appropriate expired approval lists and ceasing their use for processing transactions if Mastercard issues a sunset date for specific device models. -# These controls strengthen the security posture of Acquirers in line with Mastercard's risk management directives, helping to prevent device-related compromises.+# In accordance with Mastercard SPME §9.4.3, when registering Government-owned Lottery Merchants or Sponsored Merchants, Acquirers must maintain ongoing verification of the Merchant's compliance with applicable laws. This verification must be retained while acquiring Transactions and be updated at least annually with documentation promptly available to Mastercard upon request. +# These controls strengthen the security posture of Acquirers in line with Mastercard's risk management directives, helping to prevent device-related compromises. --- a/policies/kyb_acquirer/policy.md +++ b/policies/kyb_acquirer/policy.md @@ -4,7 +4,7 @@ ## When this policy applies -This policy applies at initial merchant onboarding and during periodic re-verification reviews. Merchants that do not provide required documentation within set timelines must be suspended until compliance is restored. +This policy applies at initial merchant onboarding, during periodic re-verification reviews, and requires annual verification of compliance documentation for certain specialty merchants, including government-owned lottery merchants as required by Mastercard registration rules. ## Required actions @@ -12,10 +12,11 @@ 2. Conduct AML screening against applicable watchlists before approval. 3. Verify business licenses for regulated merchant categories. 4. Schedule full re-verification at least annually. -5. Document verification outcomes and maintain records for audit. -6. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements. -7. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments. -8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region. -9. Maintain proper management of PED and EPP device inventories, ensuring devices receive timely software security patches and are physically tracked and inspected regularly for tampering or substitution. This includes keeping an accurate inventory of device types and locations, and training staff to conduct these inspections. Any device model sunset announcements by Mastercard must be adhered to, including ceasing use of such devices by the specified deadline. +5. Maintain and update verification documentation annually for specialty merchants subject to Mastercard registration requirements, including government-owned lottery merchants, ensuring proof of ongoing legal compliance is up to date and available upon request. +6. Document verification outcomes and maintain records for audit. +7. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements. +8. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments. +9. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region. +10. Maintain proper management of PED and EPP device inventories, ensuring devices receive timely software security patches and are physically tracked and inspected regularly for tampering or substitution. This includes keeping an accurate inventory of device types and locations, and training staff to conduct these inspections. Any device model sunset announcements by Mastercard must be adhered to, including ceasing use of such devices by the specified deadline. -Source authority: Mastercard SPME §§2.1, 2.4.1, 7.1, 11.2.3, 11.2.6, 11.7.1. +Source authority: Mastercard SPME §§2.1, 2.4.1, 7.1, 9.4.3, 11.2.3, 11.2.6, 11.7.1.