Halyard Pay Policy Updates

01 · How it works

What the agent did

A three-stage agent reads each Mastercard SPME release, identifies what changed since the previous version, and proposes corresponding edits to Halyard Pay's internal compliance policies.

01

Detect

Extract text from each SPME PDF, identify every numbered section, and compare consecutive versions to surface added, removed, and modified sections.

02

Classify & map

For each detected change, an LLM assigns a materiality grade (breaking → cosmetic) and identifies which Halyard Pay policy areas are affected by the new Mastercard text.

03

Propose

Draft updated rules.yaml and policy.md for each affected policy, emit a change record with side-by-side redlines, and link back to the cited SPME section.

02 · Inputs

Mastercard input documents

The SPME (Security Rules and Procedures — Merchant Edition) is Mastercard's primary compliance publication for acquirers and merchants. Mastercard refreshes it roughly every 6–12 months. The following published versions were reviewed:

Source: archived from Mastercard's public publications via the Internet Archive Wayback Machine. PDFs are bundled with this demo for offline review.

03 · Outputs

Halyard Pay policies evaluated

These represent the eight policy areas a hypothetical Halyard Pay compliance program would maintain to satisfy Mastercard's published rules. These are synthetic v1 baseline policies — they do not reflect any production Halyard Pay policy and exist solely to demonstrate how the agent surfaces and proposes edits.

ATO Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to a cardholder's account and initiates transactions without the cardholder's consent. Halyard Pay implements real-time risk scoring on authentication events and enforces a mandatory 3DS (3-D Secure) challenge for any session where the computed risk score meets or exceeds the defined threshold.

BRAM Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Chargeback Handling

Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, is responsible for managing the full dispute lifecycle on behalf of its merchants from initial first presentment through arbitration. Each stage of the lifecycle has specific evidence requirements and strict response deadlines imposed by Mastercard network rules.

Content Moderation

Mastercard's Business Risk Assessment and Mitigation (BRAM) program includes specific brand-integrity provisions that prohibit acquirers from processing transactions for merchants engaged in activities that violate Mastercard's acceptable use standards. Halyard Pay conducts ongoing content monitoring of merchant storefronts and transaction data to identify and remediate prohibited content.

ECP Thresholds

Mastercard's Excessive Chargeback Program (ECP) identifies merchants whose chargeback activity exceeds defined monthly ratios relative to their transaction volume. Halyard Pay monitors merchant chargeback-to-transaction ratios on a monthly basis and escalates merchants that breach program tiers to the appropriate remediation track.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count reaches at least 100 transactions in that same month triggers mandatory escalation under this policy.

KYB Acquirer

Acquirers processing transactions on the Mastercard network are required to perform Know Your Business (KYB) due diligence on merchants before onboarding and on a recurring basis thereafter. Halyard Pay, as an acquirer, must collect and verify a minimum set of documents for each merchant to establish business legitimacy, confirm beneficial ownership, and satisfy anti-money laundering screening requirements.

Refund Policy

Merchants processing transactions on the Mastercard network must maintain and honor a clearly defined refund policy. Halyard Pay requires that merchants process refunds within 30 days of a valid refund request and that cardholders are notified when a refund has been initiated or declined.

04 · Vocabulary

Glossary

Acronyms used throughout the site, plus the four materiality grades the classifier assigns.

SPME: Security Rules and Procedures — Merchant Edition. Mastercard's primary B2B compliance document for acquirers and merchants.
BRAM: Business Risk Assessment and Mitigation. A Mastercard investigation process triggered when a merchant is suspected of brand-damaging activity.
ECP: Excessive Chargeback Program. Mastercard's framework for monitoring merchants whose chargeback rate exceeds defined thresholds.
KYB: Know Your Business. The acquirer's obligation to verify and document the identity and legitimacy of merchants it onboards.
ATO: Account Takeover. Fraud pattern where an attacker gains unauthorized control of a cardholder's account.
MATCH: Member Alert To Control High-Risk Merchants. Mastercard's shared registry of terminated merchants used by acquirers during onboarding.
PCI DSS: Payment Card Industry Data Security Standard. The cross-network security baseline that acquirers and merchants must satisfy.
Materiality grades
Breaking: Alters an obligation, threshold, or required behavior. A policy revision is required to remain compliant.
Substantive: Adds meaningful new context, references, or examples without altering an obligation. A policy update is recommended.
Clarifying: Restates an existing rule in different language. No policy change required, but cross-references may need updating.
Cosmetic: Formatting, typo, or section reordering with no semantic impact. No action required.

05 · Navigation

How to read this demo

There are two complementary ways to navigate.

By release

The Timeline page shows all SPME release-to-release transitions in chronological order, with the materiality breakdown of each release. Click into a release to see the full list of proposed changes grouped by severity; click a change to review the proposed edit side-by-side against the cited Mastercard section.

By policy

The Policies page shows each Halyard Pay policy with its current text. Each policy detail page includes a mini-timeline of every proposed change touching it across releases — useful for spotting a single policy that's being repeatedly revised.

06 · Disclaimers

What this is not

The Halyard Pay policies shown here are synthetic v1 baselines built for this demo. They do not reflect any production policy.
All proposed edits are agent-generated and have not been reviewed or approved by Halyard Pay Compliance.
This site is for review feedback; nothing here is binding, legal advice, or a recommended course of action.
Mastercard publications are republished here under fair-use review purposes from publicly archived versions. Always consult the current authoritative Mastercard publication for compliance decisions.

Compliance review of Mastercard SPME → Halyard Pay policy updates