program: Acquirer KYB
- authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1, 2.4.1
+ authority: Mastercard SPME 2.1, 11.2.3, 11.2.6, 11.7.1, 2.4.1, 9.4.7
required_documents:
  - incorporation
  - beneficial_ownership
  - aml_screen
  - license_verification
+   - provincial_retail_license_cannabis
min_review_cycle_days: 365
suspension_trigger: document_collection_failure
record_retention_years: 7
aml_watchlist_sources:
  - ofac_sdn
  - eu_consolidated
agent_owner: kyb_agent
- # Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant to ensure proper compliance reporting.
- # Failure to adhere to these requirements may result in noncompliance assessments.
- # The Acquirer is also required to retain all MATCH records related to any Merchant, Sponsored Merchant, or ATM owner for a minimum of two years post-agreement termination, as per Mastercard SPME §11.2.6.
- # Additionally, Acquirers that store, transmit, or process personal data of residents in the European Economic Area (EEA), the UK, or Switzerland—or are otherwise subject to EU Data Protection Law—must comply with the standards specified in Appendix D concerning MATCH activity within the Europe Region, consistent with Mastercard SPME §11.7.1.
- # Per the updated Mastercard SPME §2.4.1, Acquirers are required to properly manage their PIN Entry Device (PED) and Encrypting PIN Pad (EPP) inventories. This includes maintaining an up-to-date inventory of device types and locations, ensuring devices receive timely software security patches distributed by vendors, and conducting regular physical inspections by trained staff to detect tampering or substitution.
- # Acquirers must also manage devices whose PCI PTS approvals have expired by moving them from approved lists to appropriate expired approval lists and ceasing their use for processing transactions if Mastercard issues a sunset date for specific device models.
- # These controls strengthen the security posture of Acquirers in line with Mastercard's risk management directives, helping to prevent device-related compromises.
+ # Acquirers must perform a MATCH inquiry prior to entering into any Merchant Agreement or enabling a Merchant to accept transactions, as detailed in Mastercard SPME §11.2.3. This inquiry must be conducted using the correct Member ID/ICA Number associated with the Merchant.
+ # The Acquirer must retain all MATCH records relating to Merchants, Sponsored Merchants, or ATM owners for at least two years after agreement termination per Mastercard SPME §11.2.6.
+ # Acquirers processing data of residents in the EEA, UK, or Switzerland must comply with EU Data Protection standards applicable to MATCH activity as stated in Mastercard SPME §11.7.1.
+ # Per Mastercard SPME §2.4.1, acquirers must maintain an updated PED/EPP device inventory, ensure timely software patching, conduct physical inspections, and manage device PCI PTS approval statuses including sunset policies.
+ # As updated in Mastercard SPME §9.4.7, for Merchants or Sponsored Merchants selling recreational cannabis, acquirers must obtain and retain copies of the applicable Canadian provincial retail licenses permitting cannabis sales.
+ # Acquirers are required to furnish Mastercard copies of these licenses promptly upon request, and must notify Mastercard in writing within 10 business days of any changes or license loss.
+ # If a recreational cannabis merchant loses its license, acquirers must immediately prevent acceptance of Mastercard payments for recreational cannabis and inform Mastercard in writing.
+ # These controls enhance compliance with essential Mastercard KYB requirements concerning cannabis merchants and device security.

Acquirer KYB (Know Your Business) Obligations

Acquirers processing transactions on the Mastercard network must perform Know Your Business (KYB) due diligence on merchants prior to onboarding and on a recurring basis. Halyard Pay is responsible for collecting and verifying required documentation to confirm business legitimacy, vet beneficial ownership, and satisfy anti-money laundering (AML) screening.

When this policy applies

This policy applies at initial merchant onboarding and during periodic re-verification reviews. Merchants that do not provide required documentation within set timelines must be suspended until compliance is restored.

Required actions

1. Collect all KYB documentation needed at onboarding.

2. Conduct AML screening against applicable watchlists before approval.

3. Verify business licenses for regulated merchant categories.

4. Schedule full re-verification at least annually.

5. Document verification outcomes and maintain records for audit.

6. Retain MATCH system records related to Merchants, Sponsored Merchants, or ATM owners for at least two years after contract termination or expiration, to meet Mastercard record retention requirements.

7. Before Merchant Agreement execution or enabling transactions, conduct a MATCH inquiry using Halyard Pay's Member ID/ICA Number to ensure compliance; failure may lead to Mastercard assessments.

8. For merchants whose personal data pertains to residents of the European Economic Area, the UK, or Switzerland, Halyard Pay must comply with EU Data Protection Laws as specified in Appendix D of the Mastercard SPME manual concerning MATCH activities in the Europe Region.

9. Maintain proper management of PED and EPP device inventories, ensuring devices receive timely software security patches and are physically tracked and inspected regularly for tampering or substitution. This includes keeping an accurate inventory of device types and locations, and training staff to conduct these inspections. Any device model sunset announcements by Mastercard must be adhered to, including ceasing use of such devices by the specified deadline.

10. For merchants engaged in the sale of recreational cannabis in Canada, collect and retain a copy of the applicable provincial retail license authorizing the sale. Furnish a copy of this license to Mastercard promptly upon request.

11. Notify Mastercard in writing within ten (10) business days of any changes to a recreational cannabis merchant's or sponsored merchant's provincial retail license information provided during registration.

12. If a recreational cannabis merchant or sponsored merchant loses their licensed status, immediately prevent acceptance of Mastercard-branded payment products for recreational cannabis sales and notify Mastercard promptly in writing.

Source authority: Mastercard SPME §§2.1, 2.4.1, 7.1, 9.4.7, 11.2.3, 11.2.6, 11.7.1.