Information about this Replacement

Transcription

1 Information about this Replacement Replacement The October 2005 Member Service Provider Rules Manual replaces your existing manual. What is in the new version? This manual contains excerpts of MasterCard member publications that provide information about standards applicable to MasterCard merchants or member service providers (MSPs). Questions? If you have questions about this manual, please contact the Customer Operations Services team or your regional help desk. If you are a merchant or MSP, please contact your acquirer. MasterCard is Listening Please take a moment to provide us with your feedback about the material and usefulness of the Member Service Provider Rules Manual using the following address: publications@mastercard.com We continually strive to improve our publications. Your input will help us accomplish our goal of providing you with the information you need.

2 Member Service Provider Rules Manual October 2005

3 Copyright The information contained in this manual is proprietary and confidential to MasterCard International Incorporated (MasterCard) and its members. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of MasterCard. Trademarks Trademark notices and symbols used in this manual reflect the registration status of MasterCard trademarks in the United States. Please consult with the Customer Operations Services team or the MasterCard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. Media This document is available: On MasterCard OnLine On the MasterCard Electronic Library (CD-ROM) On MasterCard International Incorporated 2200 MasterCard Boulevard O Fallon MO USA Member Service Provider Rules Manual October 2005 Publication Code: MSP

4 Table of Contents Chapter 1 Overview Purpose Audience Contents Important Notices Chapter 2 Excerpts from Bylaws and Rules (published April 2005) Definitions Introduction Integrity of Brand and Network Discounts or Other Benefits at the Point of Interaction Definitions MasterCard Word Mark MasterCard Brand Mark The Right to Use the Marks Licenses Protection and Registration of the Marks Misuse of the Marks General Rules for Use of the Marks Use of the Marks Compliance Required Uses Review of Promotional Materials Signage System Particular Use of the Marks Use of the Word Mark Use of the Interlocking Circles Device Use of Multiple Brand Marks Use of the Card Face Design Member Service Provider Rules Manual October 2005 i

5 Table of Contents 4.4 Additional Requirements for Acquirers and Merchants Merchant Agreement Use of the Marks by Merchants Applicability of the Standards Acceptance Requirements Accept All Cards without Discrimination Use of the MasterCard Mark Introduction Definitions Member Service Provider Agent Program Program Services MSP Classification Independent Sales Organization ( ISO ) Third Party Processor ( TPP ) Determination of Program Services General Obligations Program Responsibility Member Control of MSP Registration MSP Agreement Rules Disclosure Member Point of Contact Affiliate Member Use of the Marks Program Materials Fees Settlement Account Transfer of Rights Prohibited MSP Employees Use of Systems and Confidential Information Other Services Liability Endorsement of the Corporation Audits ii October 2005 Member Service Provider Rules Manual

6 Table of Contents Settlement Failure Obligation Data Security Merchant Acquiring Programs Merchant Agreement Collection of Funds Access to Documentation Access to Merchant Information Member Authority MSP Identification on the Card Card Issuing Programs Card Applicant Approval Cardholder Agreement MSP Identification on the Card Payment of Fees Program Receivables MSP Registration Registration Requirements Registration of ISOs Registration of Type I TPPs Registration of Type II TPPs MSP De-registration Termination of MSP Agreement Processor Evaluation Program ( PEP ) Compliance with PEP Standards Information Requirements PEP Program Manual PEP Renewal De-certification Rules Enforcement and Violations Rules Interpretation and Enforcement Rules Violations Confidential Information of MSPs Confidential Information Cash Disbursements May Be Provided Only By Members Member Service Provider Rules Manual October 2005 iii

7 Table of Contents 9.1 Signing a Merchant The Merchant Agreement Required Provisions Member Responsibility for Merchant Compliance Before Signing a Merchant Verify Bona Fide Business Operation Retain Investigative Records Ongoing Acquirer Obligations and Activities Acquiring Transactions Payments to Merchants Supplying Materials Merchant Monitoring Monitoring Requirements Merchant Standards Merchant Noncompliance Specified Rules Violations Assessments Merchant Agreement Responsibility for Transactions Use of the MasterCard Mark Honor MasterCard Cards Honor All MasterCard Cards Cardholder Identification Electronic Commerce Transactions Scrip-dispensing Terminals Prohibited Practices Discrimination Charges to Cardholders Minimum/Maximum Transaction Amount Prohibited Prohibited Transactions Other Forms of Payment Authorizing Transactions iv October 2005 Member Service Provider Rules Manual

8 Table of Contents 9.14 Presenting Transactions Valid and Invalid Transactions Present Transactions within Three Business Days Account, Cardholder, Transaction, and Merchant Information Sale or Exchange of Account and Cardholder Information Prohibited Fraudulent or Unauthorized Use of Account Information Prohibited Account, Cardholder and Transaction Data Must Be Kept Secure Account Information Must Not Be Recorded on a Mailer Merchant Identification Data Storage Entity (DSE) Identification Storage of Account, Cardholder, and Transaction Data Rules Applicable Only to the Asia/Pacific Region A Asia/Pacific Region Variances to Global Rules A.1 MasterCard Affinity/Co-Branded Card Programs Rules Applicable Only to the Canada Region A Canada Region Variances to Global Rules A.1 MasterCard Affinity/Co-Branded Card Programs B Additional Canada Region Rules B.2 Canadian Merchant Transactions; Deposit Requirements Rules Applicable Only to the South Asia/Middle East/Africa Region A South Asia/Middle East/Africa Region Variances to Global Rules A.2 MasterCard Affinity/Co-Branded Card Programs Rules Applicable Only to the U.S. Region Definitions C Debit-related Rules C.1 Definitions C.2 U.S. Region Variances to Global Rules C.3 Additional U.S. Region Rules Rules Applicable Only to the Europe Region Member Service Provider Rules Manual October 2005 v

9 Table of Contents 18.2 Definitions A Europe Region Variances to Global Rules A.2 Member Obligations A.3 Special Issuing Programs A.4 Member Service Providers A.6 Cardholder-Activated Terminals (CATs) A.7 Transaction Processing B Additional Europe Region Rules B.8 Transaction Processing B.11 Data Protection Chapter 3 Excerpts from Chargeback Guide (published May 2005) 2.1 Acceptance Procedures Acceptance Procedures for Purchase Transactions Obtaining an Authorization Obtaining an Authorization for Hotel/Motel, Cruise Line, and Vehicle Rental Transactions Obtaining an Authorization when a Gratuity is Added Obtaining an Authorization for Chip-Read Transactions Completing the Transaction Information Document (TID) Multiple TIDs and Partial Payment Returned Merchandise, Adjustments, Credits and Other Specific Terms of a Transaction Charges for Loss, Theft, or Damage Acceptance Requirements at Hybrid Terminals Payment Transactions Additional Acceptance Information MasterCard Guaranteed Reservations Express Checkout Advance Resort Deposit vi October 2005 Member Service Provider Rules Manual

10 Table of Contents Chapter 4 Excerpts from GCMS Reference Manual (published May 2005) Processing Unique Transactions Completing the Unique Transaction at a POI Terminal Processing Procedures for Non Face-to-Face Unique Transactions Applicability of Standards Processing Payment Transactions Acquirer Obligations Member Registration Procedures for Registered Payment Transaction Providers Payment Transactions for Card Acceptor Activities Four-Digit Card Acceptor Business Codes Cardholder-Activated Terminal Requirements General Requirements Terminal Level Requirements Chapter 5 Excerpts from Security Rules and Procedures (published July 2005) 3.7 Transaction Information Documents (TIDs) Formset Contents Terminal Receipt Contents Primary Account Number Truncation Electronic Signature Capture Technology (ESCT) Personal Identification Numbers (PINs) PIN Usage Standards PIN at the Point of Interaction PIN-based Terminal Standards Security Provisions for EMV Hybrid Terminals Supporting Offline PIN PIN Encryption Standards PIN Encryption at POI Terminals Triple DES Migration Schedule Member Service Provider Rules Manual October 2005 vii

11 Table of Contents 4.6 PIN Entry Device Standards Tamper-Responsive Device Standards Tamper-Evident Device Standards PIN Key Management Hierarchical Structuring of Keys Key Management Standards On-behalf Key Management PIN Key Exchange and Replacement Standards Key Exchange Key Replacement Card Recovery and Return Point-of-Interaction (POI) Card Retention ATM Card Retention Payment of Rewards Reporting Fraudulent Use of Cards Reporting Lost and Stolen Cards Fraud Loss Control Program Standards Acquirer Fraud Loss Control Programs Screening New Merchants Evidence of Compliance with Screening Procedures Retention of Investigative Records Screening Limitations Ongoing Merchant Monitoring and Education Merchant Monitoring Merchant Education Merchants Presenting Invalid Transactions Notifying MasterCard Acquirer Responsibilities Notifying MasterCard Issuer Responsibilities MasterCard Audit Merchant Audit Program Excessive Counterfeit Merchant Program viii October 2005 Member Service Provider Rules Manual

12 Table of Contents 8.4 Global Merchant Audit Program Repeated Identifications Acquirer Responsibilities Chargeback Liability Exclusion from the Global Merchant Audit Program Potential Exclusions after Initial Identification Notification of Merchant Identification Merchant Online Status Tracking (MOST) System Excessive Chargeback Program Credits Acquirer Liability Registration MasterCard Evaluation MasterCard Post-evaluation Procedure Recurring Payment Transaction Processing Prohibition for Electronic Commerce Adult Content (Videotext) Merchants Merchant Registration Program Overview Registration Requirements Monitoring Requirements Additional Registration and Monitoring Requirements Key-entry Telecom Merchants Other Telecom Merchants and Transactions Electronic Commerce Adult Content (Videotext) Merchants Merchants Identified Under the Excessive Chargeback Program Noncompliance Assessments for Failure to Register and for Excessive Fraud Card and Cardholder Data Protection Standards Working with Third Parties Transaction Data Protection Standards Card-read Data Storage Standards CVC 2 Data Storage Standards Use of Wireless Local Area Network (LAN) Technology Member Service Provider Rules Manual October 2005 ix

13 Table of Contents 10.3 Account Data Compromise Events MasterCard Evaluation Acquirer Responsibilities Notification to Affected Issuers Additional Requirements for the E-commerce Environment Noncompliance Assessments Common Point of Purchase (CPP) Investigations Issuer Investigation Request MasterCard Action Acquirer Response MasterCard Site Data Protection (SDP) Program Payment Card Industry (PCI) Data Security Standard Security Evaluation Tools Vendor Compliance Testing Acquirer Compliance Requirements Implementation Schedule SDP Program Registration MATCH Overview System Features How does MATCH Search when Conducting an Inquiry? MATCH Standards Certification When to Add a Merchant to MATCH Inquiring about a Merchant MATCH Record Retention D.1 MasterCard Formset Specifications D.1 1 Formset Physical Dimensions D.1.2 Number of Copies and Retention Requirements D.1.3 Paper Stock Characteristics D.1.4 Color of Interchange Copy D.1.5 Carbon D.1.6 Registration Mark D.1.7 Formset Numbering D.1.8 Standard Wording D.1.9 Information Slip Specifications x October 2005 Member Service Provider Rules Manual

14 Table of Contents D.2 Formset Printing Standards D.2.1 Retail Sale, Credit, and Cash Disbursement Formsets D.2.2 Information Slip Formsets D.2.3 Imprinters Chapter 6 Excerpts from Maestro Global Rules (published July 2005) 3.1 Compliance Compliance with Law Compliance Information Noncompliance with the Rules Record Retention Use of the Service Marks Cessation of Participation Display of the Service Marks at POI Terminals New and Replacement Signage Protection of the Service Marks Digital Wallets Global Minimum Branding Requirements Applicability of the Standards Acceptance Requirements Accept All Cards without Discrimination Use of the Service Marks Discounts on Purchases Europe Region and Latin America and the Caribbean Region Only Compliance with Prepaid Card Program Requirements Communication Standards Acquirer Obligations and Activities Signing a Merchant POS and Electronic Commerce Only Before Signing a Merchant Member Service Provider Rules Manual October 2005 xi

15 Table of Contents Acquiring Transactions Transmitting and Processing Transactions Card Acceptance Requirements Record Retention Transaction Inquiries and Disputes Audit Trails Quality Assurance Additional Acquirer Obligations and Activities for Acquiring Transactions from a Merchant POS and Electronic Commerce Only Storage of Account, Cardholder, and Transaction Data Account Data Compromise Event Merchant Surcharging Merchant Noncompliance Refinancing of Previously Existing Debt and/or Payment of Bad Debts Asia/Pacific Region Only Acquiring Electronic Commerce Transactions Acquirer Responsibilities: Electronic Commerce Transactions Acquiring Payment Transactions Member Registration Procedures for Payment Transactions Eligible POI Terminals Ineligible Terminals POS Terminal and Terminal Requirements Card Reader Manual Key-Entry of PAN PIN Entry Device Function Keys POS Terminal and Terminal Responses Balance Inquiry Card Authentication Europe Region Only Hybrid POS Terminal and Hybrid Terminal Requirements Chip Liability Shift Europe Region Only Additional Requirements for POS Terminals Additional Requirements for Hybrid POS Terminals POI Terminal Transaction Log xii October 2005 Member Service Provider Rules Manual

16 Table of Contents 7.13 Requirements for Transaction Receipts Receipt Contents for POS Terminals Receipt Contents for Terminals Receipt Contents for Electronic Commerce Transactions Balance Inquiry Display PAN Truncation Requirements Chip Transactions POS Terminal and Terminal Availability Return of Cards POS Transactions Only Triple DES Migration Processing Plan POS Transaction Types Acquirer Online POS Transactions Acquirer Offline POS Transactions Offline Processing POS Transactions Terminal Transaction Types Acquirer Requirements Terminal Edit Specifications Europe Region Only Special Transaction Types Processing Requirements POS Special Transaction Types Processing Requirements Electronic Commerce and Payment Transactions (Other Special Transactions) Processing Requirements Track 1 Processing PAN Processing Card Data Processing Chip Card Processing Processing Electronic Commerce Transactions Cardholder Verification Method (CVM) Policy for Electronic Commerce Transactions Authorizations Cash Withdrawal Transactions Terminal Transaction Routing Location Information Requirements Authorization Response Time Member Service Provider Rules Manual October 2005 xiii

17 Table of Contents Offline Chip Authorizations Europe Region Only Performance Standards Acquirer Terminal Standards Rules Applicable Only to the Asia/Pacific Region Additional Acquirer Obligations and Activities for Acquiring Transactions from a Merchant POS and Electronic Commerce Only Refinancing of Previously Existing Debt and/or Payment of Bad Debts POS Terminal and Terminal Requirements Manual Key-Entry of PAN Additional Requirements for POS Terminals Return Merchandise Adjustments, Credits, and Other Specific Terms of a Transaction Pre-authorized Transactions Use of Member Service Provider MSP Classification Independent Sales Organization ( ISO ) Third Party Processor ( TPP ) Determination of Program Services General Obligations Program Responsibility Member Control of MSP Registration MSP Agreement Rules Disclosure Member Point of Contact Sponsored Member Use of the Service Marks Program Materials Fees Settlement Account Transfer of Rights Prohibited MSP Employees xiv October 2005 Member Service Provider Rules Manual

18 Table of Contents Use of Systems and Confidential Information Other Services Liability Endorsement of The Organization Audits Data Security Acquiring Programs Merchant Agreement Collection of Funds Access to Documentation Access to Information Member Authority Member Payment Technical Requirements MSP Identification on the Card Card Issuing Programs Card Applicant Approval Cardholder Agreement MSP Identification on the Card Payment of Fees Program Receivables MSP Registration Registration Requirements Registration of ISOs Registration of TPPs MSP De-registration Termination of MSP Agreement Rules Enforcement and Violations Rules Interpretation and Enforcement Rules Violations Confidential Information of MSPs Confidential Information Rules Applicable Only to the Canada Region POS Terminal and Terminal Requirements PIN Entry Device Member Service Provider Rules Manual October 2005 xv

19 Table of Contents 9.2 Terminal Transaction Types Acquirer Requirements Authorizations Terminal Transaction Routing Rules Applicable Only to the Europe Region Record Retention Use of the Service Marks Display of the Service Marks at POI Terminals Display at POS Terminals Display at Terminals Display of the Service Marks in Advertising Protection of the Service Marks Applicability of the Standards Discounts on Purchases Acquirer Obligations and Activities Signing a Merchant POS and Electronic Commerce Only Acquiring Transactions Transmitting and Processing Transactions Additional Acquirer Obligations and Activities for Acquiring Transactions from a Merchant POS and Electronic Commerce Only Merchant Surcharging Acquiring Electronic Commerce Transactions Eligible POI Terminals POS Terminal and Terminal Requirements Function Keys Card Authentication Hybrid POS Terminal and Hybrid Terminal Requirements Additional Requirements for POS Terminals Additional Requirements for Hybrid POS Terminals xvi October 2005 Member Service Provider Rules Manual

20 Table of Contents 7.12 POI Terminal Transaction Log Requirements for Transaction Receipts Receipt Contents for POS Terminals Balance Inquiry Display POS Transaction Types Acquirer Online POS Transactions Acquirer Offline POS Transactions Terminal Transaction Types Acquirer Requirements Performance Requirements Card Issuing Programs Payment of Fees Rules Applicable Only to the Latin America and the Caribbean Region Discounts on Purchases POS Transaction Types Acquirer Online POS Transactions Authorizations Terminal Transaction Routing Rules Applicable Only to the United States Region Display of the Service Marks at POI Terminals POS Terminal and Terminal Requirements Manual Key-Entry of PAN PIN Entry Device Balance Inquiry Additional Requirements for POS Terminals POI Terminal Transaction Log POS Transaction Types Acquirer Online POS Transactions Member Service Provider Rules Manual October 2005 xvii

21 Table of Contents 9.6 Authorizations Terminal Transaction Routing Authorization Response Time Pre-authorized Transactions Chapter 7 Excerpts from Cirrus Worldwide Operating Rules (published June 2005) 14.1 Use of Member Service Provider MSP Classification Independent Sales Organization ( ISO ) Third Party Processor ( TPP ) Determination of Program Services General Obligations Program Responsibility Member Control of MSP Registration MSP Agreement Rules Disclosure Member Point of Contact Sponsored Member Use of the Service Marks Program Materials Fees Transfer of Rights Prohibited MSP Employees Use of Systems and Confidential Information Other Services Liability Endorsement of the Organization Audits Data Security Acquiring Programs Access to Documentation Access to Information Member Authority xviii October 2005 Member Service Provider Rules Manual

22 Table of Contents Technical Requirements MSP Identification on the Card Card Issuing Programs Card Applicant Approval Cardholder Agreement MSP Identification on the Card Payment of Fees Program Receivables MSP Registration Registration Requirements Registration of ISOs Registration of TPPs MSP De-registration Termination of MSP Agreement Rules Enforcement and Violations Rules Interpretation and Enforcement Rules Violations Confidential Information of MSPs Confidential Information Rules Applicable Only to the Europe Region Card Issuing Programs Payment of Fees Member Service Provider Rules Manual October 2005 xix

23 1 Overview This chapter provides information on the purpose, audience, and contents of this manual. It also contains important notices regarding the use of this manual. Purpose Audience Contents Important Notices Member Service Provider Rules Manual October i

24 Overview Purpose Purpose The MasterCard Member Service Provider Rules Manual provides Member Service Providers (MSPs) with MasterCard rules applicable to MSPs that support member acquiring programs, issuing programs, or both, and the rules relating to merchant acceptance of MasterCard cards and Maestro cards. MasterCard believes that MSPs are important participants in the MasterCard, Cirrus, and Maestro payment programs and are vital to the continued success of the MasterCard, Cirrus, and Maestro brands. MasterCard also believes that merchants and consumers benefit if MSPs have access to, and are encouraged to be aware of and conform to, rules that pertain to the services MSPs provide to MasterCard members. A MasterCard member is obligated at all times to comply with MasterCard rules and to cause any merchant from which it acquires MasterCard transactions and any MSP that supports its acquiring or issuing program to at all times comply with MasterCard rules. A MasterCard member may require a merchant or MSP to adhere to additional and/or more stringent standards than MasterCard rules require. Audience MasterCard provides this manual for the benefit of any merchant that has entered into or is contemplating entering into an agreement with a MasterCard member for the purpose of accepting either MasterCard cards, Maestro cards, or both. This document is available via the following Web sites: Member Service Provider Rules Manual October

25 Overview Contents Contents The manual contains excerpts from the following MasterCard manuals: Excerpted Manual Bylaws and Rules published April 2005 Chargeback Guide published May 2005 GCMS Reference Manual published May 2005 Security Rules and Procedures published July 2005 Description of Excerpt The portions of the Bylaws and Rules manual included in this Member Service Provider Rules Manual address procedures governing the acceptance of MasterCard cards by merchants. Those procedures address such matters as use of the MasterCard marks, prohibited practices such as setting minimum or maximum purchase amounts, merchant obligations such as the obligation to honor all MasterCard cards without discrimination, the authorization and presentment of transactions, and the importance of treating securely card account and transaction data. The portions of the Chargeback Guide included in this Member Service Provider Rules Manual address procedures governing the acceptance of MasterCard cards by merchants, such as how to complete the sales transaction, deal with suspicious cards, and handle credits and returns, and special procedures that pertain to particular types of transactions, including hotel/motel, cruise line, and car rental transactions. The portions of the GCMS Reference Manual included in this Member Service Provider Rules Manual address cardholder-activated terminal requirements and acceptance procedures governing the treatment of unique transactions and Payment Transactions. The portions of the Security Rules and Procedures manual included in this Member Service Provider Rules Manual address certain responsibilities of a MasterCard member, particularly those regarding any merchant from which the member acquires MasterCard transactions. The included portions also describe programs that MasterCard administers, such as merchant audit, monitoring and registration to ensure that its members and merchants are acting in an appropriate fashion so as to protect cardholder information and reduce chargebacks and fraud. 1-2 October 2005 Member Service Provider Rules Manual

26 Overview Important Notices Excerpted Manual Maestro Global Rules published July 2005 Cirrus Worldwide Operating Rules published June 2005 Description of Excerpt The portions of the Maestro Global Rules manual included in this Member Service Provider Rules Manual address procedures for the acceptance of Maestro cards by merchants. The portions of the Cirrus Worldwide Operating Rules manual included in this Member Service Provider Rules Manual address procedures for the acceptance of Cirrus cards by merchants. Important Notices The following information contains important notices regarding the usage of this text. Excerpted Text. This Member Service Provider Rules Manual consists entirely of text excerpted from other MasterCard manuals as published on the dates noted. The text of the sundry MasterCard manuals is amended from time to time, as requirements are added, deleted, and modified. While we will endeavor to keep the text appearing in this Member Service Provider Rules Manual current, in the event of a discrepancy between text set forth in this Member Service Provider Rules Manual and the referenced source document, the text set forth in the referenced source document shall be afforded precedence. Because only excerpts of text of manuals are included in this Member Service Provider Rules Manual, a reader may not be afforded a complete or accurate understanding of a subject that is referenced or addressed. MSPs should direct any questions to the member(s) for whom they provide issuing or acquiring program services. MasterCard International. MasterCard International ( MasterCard ) is a leading global payment solutions company that manages a family of wellknown, widely accepted payment card brands, including MasterCard, MasterCard Electronic, Maestro and Cirrus, which MasterCard licenses to its member. The principal members of MasterCard and its affiliates are approximately 2,600 financial institutions worldwide that participate in MasterCard payment programs. In addition, there are over 22,000 affiliate members of MasterCard that participate indirectly in MasterCard payment programs through one or more principal members. MasterCard is structured as an open bankcard association in which cardholder and merchant relationships are managed principally by the members. Member Service Provider Rules Manual October

27 Overview Important Notices MasterCard Standards. Each MasterCard member is obligated to comply with all MasterCard Standards, as such Standards may be amended from time to time. As used herein, Standards means the bylaws, rules and policies, and the operating regulations and procedures of MasterCard, as may be amended from time to time. Among other things, the Standards obligate each MasterCard member to conduct MasterCard activity in compliance with applicable law and to protect, indemnify and hold harmless MasterCard and other members with respect to any claim, demand, loss, cost, liability and/or expense resulting from the member s (and its affiliate members ) MasterCard activity. Any person that in any manner uses this Member Service Provider Rules Manual or any portion thereof does so at his or her exclusive risk and with the express understanding that MasterCard makes no representations or warranties of any kind whatsoever as to the accuracy or completeness of the text set forth in this Member Service Provider Rules Manual. 1-4 October 2005 Member Service Provider Rules Manual

28 2 Excerpts from Bylaws and Rules (published April 2005) This chapter contains excerpts of the Bylaws and Rules manual published April This Member Service Provider Rules Manual contains only information that applies to merchants or Member Service Providers (MSPs); therefore, some numbered sections provided in the Bylaws and Rules manual that do not apply to merchants or MSPs may have been omitted herein. Definitions Introduction Integrity of Brand and Network Discounts or Other Benefits at the Point of Interaction Definitions MasterCard Word Mark MasterCard Brand Mark The Right to Use the Marks Licenses Protection and Registration of the Marks Misuse of the Marks General Rules for Use of the Marks Use of the Marks Compliance Required Uses Review of Promotional Materials Signage System Particular Use of the Marks Use of MasterCard in a Corporate or Business Name Use of Modifiers Use on Stationery Use on Non-Licensed Goods Use on Checks Use of the Word Mark Use of the MasterCard Word Mark Member Service Provider Rules Manual October i

29 Excerpts from Bylaws and Rules (published April 2005) Generic Use Use of Master Terminology Use of MasterCard in Text Registration Notice Program Names Use of the Interlocking Circles Device Variations Prohibited Standard Colors Legends Registration Notice Use of Similar Logos, Designs, and Names Use of Multiple Brand Marks Parity Use of the Card Face Design In Advertising and Marketing Material In Merchant Advertising In Statement Enclosures Additional Requirements for Acquirers and Merchants Merchant Agreement Direct Mail Cardholder Solicitation Merchants Use of the Marks by Merchants Merchants Must Display the MasterCard Brand Mark Merchant Advertising and POI Materials Local/Regional Acceptance Brands Applicability of the Standards Acceptance Requirements Accept All Cards without Discrimination Use of the MasterCard Mark Introduction Definitions Member Service Provider Agent Program Program Services MSP Classification Independent Sales Organization ( ISO ) ii October 2005 Member Service Provider Rules Manual

30 Excerpts from Bylaws and Rules (published April 2005) Third Party Processor ( TPP ) Type I Type II Determination of Program Services General Obligations Program Responsibility Member Control of MSP Registration MSP Agreement Before Entering Into an Agreement with an MSP Rules Disclosure Member Point of Contact Affiliate Member Use of the Marks Program Materials Fees Settlement Account Transfer of Rights Prohibited MSP Employees Use of Systems and Confidential Information Other Services Liability Endorsement of the Corporation Audits Settlement Failure Obligation Data Security Merchant Acquiring Programs Merchant Agreement Collection of Funds Access to Documentation Access to Merchant Information Member Authority MSP Identification on the Card Card Issuing Programs Card Applicant Approval Cardholder Agreement MSP Identification on the Card Payment of Fees Member Service Provider Rules Manual October iii

31 Excerpts from Bylaws and Rules (published April 2005) Program Receivables MSP Registration Registration Requirements Registration of ISOs Registration of Type I TPPs Registration of Type II TPPs MSP De-registration Termination of MSP Agreement Processor Evaluation Program ( PEP ) Compliance with PEP Standards Information Requirements PEP Program Manual PEP Renewal De-certification Rules Enforcement and Violations Rules Interpretation and Enforcement Rules Violations Confidential Information of MSPs Confidential Information Cash Disbursements May Be Provided Only By Members Signing a Merchant The Merchant Agreement If Using an MSP Required Provisions Member Responsibility for Merchant Compliance Before Signing a Merchant Verify Bona Fide Business Operation Retain Investigative Records Ongoing Acquirer Obligations and Activities Acquiring Transactions Payments to Merchants Supplying Materials iv October 2005 Member Service Provider Rules Manual

32 Excerpts from Bylaws and Rules (published April 2005) 9.4 Merchant Monitoring Monitoring Requirements Merchant Standards Merchant Noncompliance Specified Rules Violations Assessments Assessments for Disclosure and Securing Account Data Rules Violations Terminated Merchants Merchant Agreement Responsibility for Transactions Use of the MasterCard Mark Honor MasterCard Cards Honor All MasterCard Cards Cardholder Identification Electronic Commerce Transactions Scrip-dispensing Terminals Prohibited Practices Discrimination Charges to Cardholders Charges for Unique Transactions Minimum/Maximum Transaction Amount Prohibited Prohibited Transactions Other Forms of Payment Authorizing Transactions Presenting Transactions Valid and Invalid Transactions Present Transactions within Three Business Days Account, Cardholder, Transaction, and Merchant Information Sale or Exchange of Account and Cardholder Information Prohibited Fraudulent or Unauthorized Use of Account Information Prohibited Member Service Provider Rules Manual October v

33 Excerpts from Bylaws and Rules (published April 2005) Account, Cardholder and Transaction Data Must Be Kept Secure Account Information Must Not Be Recorded on a Mailer Merchant Identification Data Storage Entity (DSE) Identification Storage of Account, Cardholder, and Transaction Data Rules Applicable Only to the Asia/Pacific Region A Asia/Pacific Region Variances to Global Rules A.1 MasterCard Affinity/Co-Branded Card Programs Rules Applicable Only to the Canada Region A Canada Region Variances to Global Rules A.1 MasterCard Affinity/Co-Branded Card Programs B Additional Canada Region Rules B.2 Canadian Merchant Transactions; Deposit Requirements Rules Applicable Only to the South Asia/Middle East/Africa Region A South Asia/Middle East/Africa Region Variances to Global Rules A.2 MasterCard Affinity/Co-Branded Card Programs Rules Applicable Only to the U.S. Region Definitions C Debit-related Rules C.1 Definitions C.2 U.S. Region Variances to Global Rules C.3 Additional U.S. Region Rules Rules Applicable Only to the Europe Region Definitions A Europe Region Variances to Global Rules A.2 Member Obligations A.2.2 Discounts at Point of Interaction A.2.3 Charges to Cardholders vi October 2005 Member Service Provider Rules Manual

34 Excerpts from Bylaws and Rules (published April 2005) 18.A.3 Special Issuing Programs A.3.1 Affinity/Co-Branded Card Programs A Definitions A Discounts at Point of Interaction A.4 Member Service Providers A.4.1 Payment of Cardholder Fees to MSPs A.6 Cardholder-Activated Terminals (CATs) A.6.1 Self-Service Terminals/Level A.6.2 Limited Amount Terminals/Level A.6.3 In-flight Commerce Terminals/Level A.7 Transaction Processing A.7.1 Transaction Information Documents (TIDs) B Additional Europe Region Rules B.8 Transaction Processing B.8.1 Refund Transactions B.11 Data Protection B.11.1 Processing of Transaction Data B.11.2 Data Subjects Communications and Consent B.11.3 Applications from Data Subjects Member Service Provider Rules Manual October vii

35 Excerpts from Bylaws and Rules (published April 2005) Definitions Definitions acquirer The following terms used in this rules portion of the MasterCard International Bylaws and Rules manual have the meanings set forth below. As used herein, acquirer means a member of the Corporation in its capacity as an acquirer of a MasterCard transaction from a merchant. approval or approved As used herein, approval or approved means the affirmative written approval of the Corporation or its Board of Directors (as applicable), which may be granted, denied, or withheld as conditioned in the Board s or Corporation s sole and absolute discretion. Board, Board of Directors Corporation issuer Marks As used herein, Board or Board of Directors means the Board of Directors of MasterCard International Incorporated. As used herein, Corporation means MasterCard International Incorporated. As used herein, issuer means a member of the corporation in its capacity as an issuer of a MasterCard card or MasterCard account. As used herein, Marks means the names, logos, trade names, logotypes, trademarks, service marks, trade designations, and other designations, symbols, and marks that the Corporation and/or its affiliates or subsidiaries own, manage, license, or otherwise control and make available for use by members and other authorized entities. A Mark means any one of the Marks. member, membership As used herein, member generally means a card member of the Corporation as set forth in Section 3(b) of Article I of the bylaws of the Corporation. Depending on the context, member may sometimes mean any member of the Corporation as set forth in the bylaws. As used herein, membership means membership in the Corporation and principal member, association member, and affiliate member mean principal card member, association card member, and affiliate card member, respectively. Member Service Provider Rules Manual October

36 Excerpts from Bylaws and Rules (published April 2005) Introduction sponsorship Standards As used herein, reference to a member that sponsors or is sponsored by another member means the relationship set forth in the Standards between a principal or association card member and an affiliate card member. As used herein, Standards means the bylaws, rules and policies, and the operating regulations and procedures of the Corporation, as may be amended from time to time. Introduction These rules set forth and explain certain powers, rights, duties and the responsibilities of MasterCard International Incorporated (referred to in these rules as either MasterCard or the Corporation ) and its members in respect to interchange of credit and debit card privileges and the procedures that apply to such interchange, standards for membership, and security safeguards and procedures. Other powers, rights, duties, and responsibilities may be found in the MasterCard Certificate of Incorporation and bylaws. A fundamental purpose of the Corporation is to provide to the cardholders of its members a means whereby they may enjoy the benefits of full and unrestricted interchange. In furtherance of this end, each member of this Corporation subscribes to the policy adopted by the Board of Directors that it will in good faith use its best efforts to issue the largest number of interchangeable credit and debit cards consistent with sound credit judgment. Each member of this Corporation also undertakes to use its best efforts to participate fully in interchange operations and to implement this Corporation s rules in a manner that will promote complete interchange and that will assure the acceptance of interchange credit and debit cards when properly presented. The basic purpose of the Corporation is to provide to its members the advantages of widespread interchange while modifying each member s local operations as little as possible. In keeping with this philosophy, the specifications as to forms and procedures contained in these rules are considered to be the minimum standards necessary to make credit and debit interchange workable. These rules are intended to be solely for the benefit of the Corporation and its members. 2-2 October 2005 Member Service Provider Rules Manual

37 Excerpts from Bylaws and Rules (published April 2005) 3.10 Integrity of Brand and Network 3.10 Integrity of Brand and Network No member may place or cause to be placed on any MasterCard card or any MasterCard card acceptance device any information, applications, or products that would in any way, directly or indirectly, diminish or devalue the brand, impair or discourage acceptance or use of MasterCard cards, products, or services, or impair any aspect of MasterCard transactions or network infrastructure. MasterCard shall have the right, in its sole discretion, in the event of violation of this rule, to require and enforce the immediate removal of such information, application, or products, and to impose a monetary penalty within the framework of MasterCard rules. No member may engage in or support any activity that is illegal, that may, in the opinion of MasterCard, damage the good will of MasterCard, or reflect negatively on the MasterCard brand. A member that engages in repeated or multiple violations of this Standard or other Standards may be subject to sanctions in addition to those that may be provided for a specific violation of a Standard Discounts or Other Benefits at the Point of Interaction Subject to other MasterCard Standards, a MasterCard card may not access a discount or other point-of-interaction (POI) benefit unless such discount or other POI benefit may be accessed by any valid MasterCard card. In addition, MasterCard prohibits the promotion at the POI of discounts or other POI benefits on transactions effected with a particular MasterCard card. The following are the only discount practices permitted in conjunction with a particular MasterCard card: A discount or other point of interaction benefit accessed after the transaction has been effected (for example, credit on the billing statement, rebates, and so on); and A discount or other POI benefit accessed at the time of or after the transaction has been effected by a separate instrument and not by the MasterCard card (for example, a coupon or voucher). Member Service Provider Rules Manual October