Halyard Pay policy

BRAM Response

27 proposed revisions across 5 of 5 reviewed releases, including 2 breaking changes.

Current policy

policy.md

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation notice for one of our merchants, the acquirer must halt new merchant onboarding immediately and submit an evidence package within one hundred eighty (180) days of receipt of the notice.

Required actions

Halt new merchant onboarding for the merchant under investigation.
Compile and submit an evidence package containing:
- Transaction monitoring records covering the prior 180 days.
- A written corrective action plan.
Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Source authority: Mastercard SPME §10.2.

rules.yaml

program: BRAM
authority: Mastercard SPME §10.2
response_window_days: 180
required_evidence:
  - transaction_monitoring_records
  - corrective_action_plan
halt_actions:
  - halt_new_merchant_onboarding
internal_notification_hours: 24
agent_owner: bram_response_agent

Authorized by

SPME §10.2 — BRAM Investigation Process

Proposed changes across releases

Jun 2022 → May 2023

3 changes

substantive §7.1.3 Assessments for Noncompliance with Screening Procedures substantive §8.6.1 Issuer Submissions substantive §8.6.2 Investigation Process

May 2023 → Sep 2023

5 changes

substantive §10 Should the responsible Customer cause a PFI to conduct an examination, the responsible substantive §10.2 Policy Concerning Account Data Compromise Events and Potential Account Data substantive §2.2.6 Mandatory Compliance Requirements for Compromised Entities substantive §8.4.2 Mastercard Commencement of an Investigation substantive §8.7.4 Mastercard Determination

Sep 2023 → Feb 2024

9 changes

substantive §12 Any other information the Acquirer determines relevant to be considered. substantive §8.4.2 Mastercard Commencement of an Investigation substantive §8.4.6 Mastercard Determination substantive §8.6.1 Issuer Submissions substantive §8.8 Business Risk Assessment and Mitigation (BRAM) Program substantive §8.8.1 BRAM Investigation Process substantive §8.8.2 Acquirer Response Requirements substantive §8.8.4 Noncompliance Assessment Mitigation substantive §8.9 Merchant Monitoring Program (MMP)

Feb 2024 → Sep 2024

4 changes

substantive §10 Should the responsible Customer cause a PFI to conduct an examination, the responsible breaking §10.2 Policy Concerning Account Data Compromise Events and Potential Account Data substantive §10.7 Assessments and/or Disqualification for Noncompliance substantive §8.4.8 Fraud Recovery

Sep 2024 → May 2025

6 changes

substantive §10 Not use, or allow the use of, any type of technology or other organization measures that breaking §11.2.3 "Inquiring about a Merchant" (regarding the use of MATCH Pro) substantive §12 The Acquirer is responsible for ensuring that accurate data is entered into MATCH Pro. The substantive §8.8.4 Noncompliance Assessment Mitigation substantive §8.9.1 MMP Participation Requirements substantive §8.9.2 MMP Monthly Reporting Format and Submission