Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada

Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 GCOCC

Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 1 Purpose... 4 2 Audience... 4 3 Definitions... 4 Access Device...4 Account... 4 Acquirer... 4 ATM Owner Agreement... 5 Card...5 Cardholder...5 Corporation... 5 Contactless Payment... 5 Contactless Transaction... 5 Cross-border Transaction... 5 Customer... 5 Debit MasterCard, Debit Card... 5 Digital Activity(ies)... 5 Digital Activity Customer... 6 Issuer... 6 Marks...6 Merchant... 6 Merchant Agreement... 6 Mobile Wallet...6 Other MasterCard Card...6 Payment Applet...6 Payment Credential... 6 Point of Interaction (POI)... 7 Point-of-Sale (POS) Terminal... 7 Premium Card... 7 Program... 7 Program Service... 7 Region... 7 Service Provider... 7 Transaction...7 Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 2

Wallet Token Requestor...7 4 Responsibility for Digital Activity Wallet Token Requestors, Wallet Payment Option Preference and Storage...8 5 Use of Marks on Maestro and Cirrus Cards... 8 6 Use of Marks on MasterCard Cards...8 7 Use of the Marks in Digital Activity...9 8 The Merchant and ATM Owner Agreements... 9 9 Acquirer Obligations to Merchants Provide Information... 12 10 Acquirer Obligation to Merchants Contactless Transactions... 15 11 Acquirer Obligation to Merchants Dispute Resolution Process... 15 12 Prohibited Practices Charges to Cardholders...17 13 Merchant Obligations for Acceptance Honor All Cards... 17 14 Card Issuance General Requirements...17 15 Card Issuance MasterCard Card Issuance...18 16 Selective Authorization... 18 Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 3

1 Purpose 1 Purpose This document sets forth the general guidelines within which MasterCard will support the Code of Conduct for the Credit and Debit Card Industry in Canada, released by the Department of Finance Canada on 13 April 2015. The guidelines apply solely to: 1. Cards and Access Devices issued in the Canada Region and presented for payment in the Canada Region; 2. POS Transactions that take place in the Canada Region; and 3. Merchants and Acquirers of those POS Transactions. Customers and Merchants must continue to comply with the global Rules with respect to Cards and/or Access Devices issued by Customers outside of the Canada Region and presented for payment at Merchant locations in the Canada Region, unless otherwise agreed by the Corporation. Refer to MasterCard Rules, Appendix A, for the Canada Region geographic listing. 2 Audience MasterCard provides this guide for Canada located Issuers and Acquirers and their authorized agents and/or processors. 3 Definitions Solely for purposes of these guidelines, the following terms have the meanings set forth below: Access Device A device other than a Card that uses at least one Payment Application to provide access to an Account in compliance with the Standards. A Cirrus Access Device, Maestro Access Device, and MasterCard Access Device is each an Access Device. Account An account maintained by or on behalf of a Cardholder by an Issuer for the processing of Transactions, and which is identified with a bank identification number (BIN) or Issuer identification number (IIN) designated by the Corporation in its routing tables for routing to the Interchange System. Acquirer A Customer in its capacity as an acquirer of a Transaction. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 4

3 Definitions ATM Owner Agreement An agreement between an ATM owner and a Customer that sets forth the terms pursuant to which the ATM accepts Cards. Card A card issued by a Customer pursuant to License and in accordance with the Standards and that provides access to an Account. Unless otherwise stated herein, Standards applicable to the use and acceptance of a Card are also applicable to an Access Device and, in a Card-notpresent environment, an Account. A Cirrus Card, Maestro Card, and MasterCard Card is each a Card. Cardholder The authorized user of a Card or Access Device issued by a Customer. Corporation MasterCard International Incorporated, Maestro International Inc., and their subsidiaries and affiliates. Contactless Payment A chip Card-based and/or Access Device-enabled Transaction that is initiated at a Point-of-Sale (POS) Terminal that does not require contact with the Point-of-Sale (POS) Terminal. Contactless Transaction A Transaction in which data is exchanged between the Chip Card or Access Device and the Terminal through the reading of the chip using the contactless interface, by means of radio frequency communications. Cross-border Transaction A Transaction that originates via a Terminal located in a different country from the country in which the Card was issued. Customer A financial institution or other entity that has been approved for undertaking any act that can be lawfully undertaken only pursuant to a license granted by the Corporation. Debit MasterCard, Debit Card Any MasterCard Card issued in the Region by a Region Customer that when presented for payment in Canada, accesses, debits, holds, or settles funds from a consumer s demand deposit account. Digital Activity(ies) The undertaking of any act that can be lawfully undertaken only pursuant to approval by the Corporation as set forth in a Digital Activity Agreement or other written documentation. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 5

3 Definitions Participation in the MasterCard Digital Enablement Service as a Wallet Token Requestor is a Digital Activity. Digital Activity Customer A Customer that participates in Digital Activity pursuant to a Digital Activity Agreement and which may not issue Cards, acquire Transactions, or Sponsor any other Customer into the Corporation. Issuer A Customer in its capacity as an issuer of a Card or Account. Marks The names, logos, trade names, logotypes, trademarks, service marks, trade designations, and other designations, symbols, and marks that the Corporation owns, manages, licenses, or otherwise Controls and makes available for use by Customers and other authorized entities in accordance with a License. Merchant A retailer, or any other person, firm or corporation that, pursuant to a Merchant Agreement, agrees to accept Cards when properly presented. Merchant Agreement An agreement between a Merchant and a Customer that sets forth the terms pursuant to which the Merchant is authorized to accept Cards. Mobile Wallet A graphic user interface (software application) that presents one or more payment applets to a consumer for the purposes of enabling a Contactless Payment. Other MasterCard Card Any MasterCard Card issued in the Region by a Region Customer that is not defined as a Debit Card or Debit MasterCard Card. Payment Applet A software application on a mobile device, or within a mobile wallet, that enables a contactless payment by linking a single Payment Credential (e.g. credit or debit) through the MasterCard network. Payment Credential The data that is required to complete a contactless payment (e.g. identifying information for specifically the Corporation, the issuer, and the cardholder) that is stored securely and accessed by a payment applet or token associated with the payment applet. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 6

3 Definitions Point of Interaction (POI) The location at which a Transaction occurs, as determined by the Corporation. Point-of-Sale (POS) Terminal An attended or unattended device located in or at a Merchant s premises that enables a Cardholder to effect a Transaction for the purchase of products or services sold by such Merchant with a Card and/or Access Device, in accordance with the POS Terminal security and other applicable Standards. Premium Card A Debit Card or Other MasterCard Card that is issued in the Region by a Region Customer to a well-defined class of Cardholders in accordance with the Corporation s requirements and specifications for same. Program A Customer s Card issuing program, Merchant acquiring program, ATM Terminal acquiring program, Digital Activity program, or all. Program Service Any service described in the MasterCard Rules manual or elsewhere in the Standards that directly or indirectly supports a Program and regardless of whether the entity providing the service is registered as a Service Provider of one or more Customers. The Corporation has the sole right to determine whether a service is a Program Service. Region A geographic region as defined by the Corporation from time to time. See Appendix A of the MasterCard Rules manual. Service Provider A person that performs Program Service. The Corporation has the sole right to determine whether a person is or may be a Service Provider and if so, the category of Service Provider. A Service Provider is an agent of the Customer that receives or otherwise benefits from Program Service, whether directly or indirectly, performed by such Service Provider. Transaction A financial transaction arising from the proper acceptance of a Card or Account at a Card acceptance location and identified in messages with a Card Program identifier. Wallet Token Requestor A DWO that, upon the request of a Cardholder for Digitization, including Tokenization, of an Account PAN, invokes Identification & Verification (ID&V) and Device Binding; also called a Wallet Provider. A Wallet Token Requestor is a type of Token Requestor. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 7

4 Responsibility for Digital Activity Wallet Token Requestors, Wallet Payment Option Preference and Storage 4 Responsibility for Digital Activity Wallet Token Requestors, Wallet Payment Option Preference and Storage A Digital Activity Customer and each other Customer approved by the Corporation to engage in Digital Activity as a Wallet Token Requestor must ensure that Cardholders have full and unrestricted control over default settings on Access Devices and Mobile Wallets for the purposes of selecting individual debit or credit Payment Applets. Credit and debit Payment Credentials can be stored on, or accessed by, the same Access Device or Mobile Wallet, provided that they are clearly separate Payment Applets, and Cardholders can select which Payment Applet to use for the Contactless Payment. Credit and debit Payment Credentials must only be issued to Access Devices or Mobile Wallets that provide Cardholders with full and unrestricted discretion to establish default preference(s) for payment options. Credit and debit Payment Credentials must not be issued to Access Devices or Mobile Wallets that have pre-set default preferences that cannot be changed by the Cardholder. Selecting default preferences must only be done by Cardholders based on a clear and transparent process, clearly accessible through the mobile user interface. Cardholders must be able to easily change default preference settings in a timely manner. This requirement Wallet Payment Option Preference and Storage is effective 13 February 2016 and applies to all new individual Cardholder debit or credit Payment Applets. 5 Use of Marks on Maestro and Cirrus Cards When the Marks appear on a Maestro Card containing any other local/regional POS debit mark and/or local/international ATM mark, symbol, or logo (herein, other POS debit and/or ATM marks ), the Marks must be as equally branded as all other POS debit and/or ATM marks. To maintain visual parity, the Marks must be as equally prominent as and at least the same size and the same color treatment as any other POS debit and/or ATM marks on the Card. When any other POS debit and/or ATM marks appear on a Maestro Card, those marks must appear on the same side of the Card as the Marks. The Marks and any other POS debit and/or ATM marks must be clearly indicated on Maestro and Cirrus Cards. 6 Use of Marks on MasterCard Cards When the Marks appear on a Debit MasterCard Card containing any other local/regional POS mark and/or local/international network mark, symbol, or logo (herein, other POS and/or network marks ), the Marks must be as equally branded as all other POS and/or network marks. To maintain visual parity, the Marks must be as equally prominent as and be at least the same size and color treatment as any other acceptance mark on the Card. When other acceptance marks appear on a Debit MasterCard Card, those marks must appear on the same side of the Card as the Marks. The Marks and any other POS and/or network marks, symbol or logo must be clearly indicated on Debit MasterCard Cards. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 8

7 Use of the Marks in Digital Activity 7 Use of the Marks in Digital Activity A Digital Activity Customer and each other Customer approved by the Corporation to engage in Digital Activity must ensure that all representations of Payment Applets in a Mobile Wallet or Access Device, and the Marks associated with them, must be clearly identifiable and as equally prominent as any other mark, symbol or logo used to signify payment. A Digital Activity Customer and each other Customer approved by the Corporation to engage in Digital Activity must present debit Payment Credentials in Mobile Wallets or Access Devices as separate Payment Applets. This requirement Use of the Marks in Digital Activity is effective 13 February 2016 and applies to all new Payment Applets. 8 The Merchant and ATM Owner Agreements An Acquirer must ensure that Merchant and ATM Owner Agreements include a sufficient level of detail and are easily understood. Merchant and ATM Owner Agreements must include a cover page containing an information summary box that provides key elements of the contract in a consolidated fashion and a fee disclosure box, using the templates in Exhibit A. Acquirers must ensure that Merchant and ATM Owner Agreements also disclose all other fees (including, by way of example and not limitation, monthly minimums and administration fees) charged to the merchant. Exhibit A, Information Summary and Fee Disclosure Boxes Information Summary Box Date of contract(s) Acquirer Effective start date and length of initial term, including the renewal date of the initial term of each contract(s). Name of Acquirer and contact information. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 9

8 The Merchant and ATM Owner Agreements Information Summary Box Cancellation of contract(s) and any applicable penalties Complaint handling procedures Information about Payment Terminal Contactless payments acceptance Date that the contract can be cancelled without penalty; page in contract with information on cancellation procedures (including who to contact to cancel contract). Information on any cancellation fees that could apply. Information on how and when the contract may be renewed, including the right for a Merchant to provide notice of non-renewal at any point up to 90 days prior to the renewal date. Specify if separate terms, conditions, fees apply for point-of-sale terminal equipment. Information on the complaints handling process, including contact information for the Acquirer s complaints department and a link to the complaints handling process on the Acquirer s website. In instances where multiple service providers are involved (e.g. separate processors for debit and credit), must provide information on each of their respective complaints handling processes. If point-of-sale equipment is offered to a Merchant, general information on buying, leasing, or renting options of point-of- sale hardware shall be provided to the Merchant, including: Name and contact information regarding the terminal leasing company and whether terminal is rented, leased or purchased; Information on all rental/lease rates and other service charges related to the terminal; Details about the expiry of the contract with the provider and early termination fees. This provision does not create an obligation for all of these options (buy, lease, or rent) to be offered to a Merchant. For each payment card network, must indicate whether contactless payments have been enabled at the point-of-sale. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 10

8 The Merchant and ATM Owner Agreements Information Summary Box Transaction return policy Independent Sales Organization or Referral Agent (where applicable) Information about Credit and Debit Card service providers (if different from the acquirer). Code of Conduct Statements Information about whether, and how, card acceptance fees will be applied to Transaction returns. The name of the independent sales organization or referral agent and their contact information must be provided. The relationship between the Acquirer and independent sales organization or agent must be explained. Name and contact information for each debit and credit service providers, and a brief description of services provided. Expiry date and cancellation terms of contract with each service provider. Include link to the Code of Conduct. Information on how to access statements (e.g. paper or online) and whether there is charge for paper statements. Exhibit A, Fee Disclosure Box Fee Disclosure Box Each rate disclosed below is the sum of: MasterCard interchange rate + MasterCard assessment fee + per-transaction processing fees. Per-transaction fees must capture the Acquirer fees. A single rate is to be displayed for domestic Card transactions, regardless of the pricing methodology used. For purposes of this disclosure box, a domestic Card transaction refers to a Transaction initiated using a card issued by a Canadian issuer. Acquirers must disclose prices for processing methods for domestic Cards that attract differentiated rates (e.g. electronic, swiped, manually keyed, card not present, etc.). Include as many columns as needed. A short definition, in plain language, must be provided for each type of processing method. This table is for illustrative purposes only and is not intended to capture all possible Card types or processing methods. It is intended to present price information for the most common type of domestic Card transactions and processing methods available to merchants. Payment card type Processing Method A (definition) Processing Method B (definition) Processing Method C (definition) MasterCard Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 11

9 Acquirer Obligations to Merchants Provide Information Fee Disclosure Box MasterCard World MasterCard World Elite MasterCard Business MasterCard Debit This requirement The Merchant and ATM Owner Agreements is effective 13 November 2016 and applies to all new and renewed Merchant and ATM Owner Agreements. 9 Acquirer Obligations to Merchants Provide Information For purposes of this requirement Acquirer Obligations to Merchants Provide Information, the following terms have the meanings set forth below: Service Provider Agreement An agreement where a Service Provider provides the tools or services required to accept, transmit, or process payment Transactions or to facilitate the electronic transfer of information and funds concluded with Merchants by the Service Provider. Multiple Service Provider Agreements Agreements where more than one Service Provider provides the tools or services required to accept, transmit, or process payment Transactions or facilitate the electronic transfer of information and funds concluded with Merchants by one or more Service Providers. A Canada Region Acquirer must comply with all of the following requirements: 1. Manner of Disclosure. An Acquirer must provide all disclosures to Merchants as provided under the Code in a manner that is clear, simple and not misleading. This requirement is effective 13 February 13 2016 and applies to all new Merchant Agreements. 2. Notice of Fees. An Acquirer must provide a minimum of 90 days notice to Merchants of any fee increases or reductions, including those related to applicable interchange rates, or the introduction of a new fee related to any Card or Transaction. For greater clarity, applicable refers to only those categories of interchange rates that apply to the Transactions originated by an individual Merchant. For example, if rates for a specific industry program are reduced, but the Transactions originated by the Merchant do not qualify for those program-specific rates, then the Merchant would not be entitled to passthrough of those program-specific reductions. The notice to Merchants must describe the nature of the fee change and the change must be clearly identifiable on the Merchant s subsequent monthly statement. This requirement relating to describing the nature of the fee change is effective 13 February 2016 and applies to all new Merchant Agreements. Acquirers must also provide an updated fee disclosure box reflecting the fee impact, upon written request from the Merchant, following a new fee or fee increase. See the Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 12

9 Acquirer Obligations to Merchants Provide Information requirement The Merchant and ATM Owner Agreements, Exhibit A, for requirements regarding the fee disclosure box. This requirement relating to providing, upon request, an updated fee disclosure box reflecting the fee impact is effective 13 November 2016 and applies to all new Merchant Agreements. Notification is not required for fee changes made in accordance with pre-determined fee schedules, such as those based on Merchant sales volume, provided that the schedules are included in the Merchant s contract. A Merchant may opt out of its Merchant Agreement and any Service Provider Agreement entered into with a Service Provider with a business connection to that Acquirer, without penalty by the Acquirer or by any such Service Provider with respect to the termination of services performed in accordance with the terms of the Merchant Agreement or the Service Provider Agreement, within 90 days of receiving notice of the fee increase or introduction of a new fee, or a reduction in applicable interchange rates not passed on to Merchants. An Acquirer must grant the Merchant s right to provide 90 days notice to exit their Merchant Agreement without penalty in the event that the Acquirer does not passthrough the full savings from any reduction to the Corporation s interchange rates that are applicable to that Merchant, within 90 days of receiving notice of the interchange reduction. A Merchant may not opt out of the Merchant Agreement or the Service Provider Agreement if the fee increase is made in accordance with a pre-determined fee schedule (including, by way of example and not limitation, fees related to Merchant sales volume), provided such fee schedule is included in the Merchant Agreement or the Service Provider Agreement. If a Merchant decides to opt out of its Merchant Agreement or any Service Provider Agreement as described above, the Acquirer must ensure that no Service Provider charges a penalty fee to the Merchant in connection with the termination of services performed by the Service Provider in accordance with the terms of the Merchant Agreement or the Service Provider Agreement (including, by way of example and not limitation, terminal lessors and third party processors) brokered by the acquirer and/or its registered agents, processors, or other agents. The Financial Consumer Agency of Canada (FCAC) has released guidance that provides additional clarification on the extension of this element to Multiple Service Provider Agreements. This requirement does not apply in a situation where a Merchant, on its own initiative, enters into separate contractual arrangements with unrelated third parties. In such situations, each contract with any such third party should be treated as a separate agreement. For purposes of this Rule, a business connection will be found where a contractual arrangement exists between the parties or a business linkage (for example, a holding company or affiliate relationship) exists, or where financial incentives and/or payments can be confirmed by the Corporation, Acquirers, and Service Providers. 3. Consent to Accept Cards and Services. A Merchant is not obligated to accept a Card with new Marks, a Card with Marks not previously accepted by the Merchant, or a new MasterCard service. An Acquirer must obtain the Merchant s express consent each time a Card with new Marks, or a Card with Marks not previously accepted by the Merchant, or a new MasterCard service will be accepted by the Merchant. 4. Detailed Monthly Statements. An Acquirer must provide monthly statements to Merchants that include a sufficient level of detail and are easily understood. Merchant statements must include: Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 13

9 Acquirer Obligations to Merchants Provide Information a. The effective merchant discount rate for each Card associated with a unique interchange program. The effective merchant discount rate is calculated as the total fees paid by the Merchant to an Acquirer, related to the processing of a specific type of Card with a unique interchange program, divided by the total sales volume for that type of Card; b. Interchange rates, and if applicable, all other rates charged to the Merchant by the Acquirer; c. The number and volume of Transactions associated with a unique interchange program; d. The total amount of fees applicable to each rate; and e. Details of each fee that relates to the Corporation. 5. Merchant Agreements and Service Provider Agreements. a. An Acquirer must provide information about Merchant Agreements that is disclosed in a way this is clear, simple, and not misleading (including, by way of example and not limitation, cancellation and renewal terms and conditions). b. An Acquirer must support, without Merchant penalty, a Merchant s ability to provide notice of nonrenewal at any point in time during the contract period up to ninety days prior to contract expiry. Fixed term Merchant Agreements and any related service contracts with Service Providers must not be automatically renewed for the full initial term, yet may convert to automatically renewable contract extensions of no longer than six months. An Acquirer must support, without Merchant penalty, a Merchant s ability to provide notice of nonrenewal at any point in time during the extension period up to ninety days prior to the end of each term. In situations where there is a business connection between the participant and the Service Provider, services are considered related and as a single service package. See Financial Consumer Agency of Canada (FCAC) Commissioner s Guidance 10 for additional information on the interpretation of this single service package clause. This requirement is limited to standard-form contracts. For example, contracts that have not been custom negotiated between the Acquirer and Merchant with the benefit of legal counsel. The requirement is effective 13 February 2016 and applies toall Merchant Agreements and related Service Provider Agreements. 6. Multiple Service Provider Agreements. An Acquirer must ensure that with respect to a circumstance in which Multiple Service Provider Agreements are employed in connection with the performance of a Program Service, the following information is provided: a. The name, coordinates, contact information of each Service Provider and the nature of the services being provided by each; b. The date on which such Program Services will commence; c. The date on which such Program Services will end or clear disclosure that the services will automatically renew if not cancelled as of a specific date, as applicable; d. Detailed information on any applicable fees and rates; e. Information on how statements will be provided to the Merchant (for example, on paper or online); Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 14

10 Acquirer Obligation to Merchants Contactless Transactions f. The cancellation terms of the Program Services being provided, including specific information on any cancellation fees that could apply; g. If point-of-sale services are offered to a Merchant, general information on buying, leasing or renting options of POS Terminals and other hardware and services; h. A customer service phone number or other contact information for each Service Provider by which the Merchant may address any complaints regarding the Program Service provided. Sales or business practices inconsistent with the requirement to provide clear and simple disclosure to Merchants or that may be misleading to Merchants, in accordance with Element 1 of the Code of Conduct, will not be permitted and will be addressed in an appropriate and timely fashion. These practices may include, but are not limited to: 1. Failing to provide Merchants with complete copies of the agreed upon Merchant Agreement or Service Provider Agreement or terms incorporated therein by reference in a timely manner (for example, not providing a copy of applicable Transaction and processing fees and rates at the time the merchant enters into the agreement); 2. Unilaterally altering or modifying a Merchant Agreement or Service Provider Agreement governing payment card Transaction processing without providing advance notice (for example, 30 days or more before the changes); 3. Sales representatives advertising and promising rates and fees that Acquirers or Service Providers are not able to honor; 4. Inconsistencies between the information disclosed in the Merchant Agreement or Service Provider Agreements and the Merchant s monthly statements (that is, different terminology used to describe fees and rates or different fees/rates in agreement and statements), and 5. Misrepresenting contractual terms. 10 Acquirer Obligation to Merchants Contactless Transactions The Acquirer must ensure that its Merchants are not required to accept Contactless Transactions or required to upgrade Point-of-Sale (POS) Terminals to enable Contactless Transactions. If a Merchant chooses to accept Contactless Transactions, the Merchant must be able to cancel the Contactless Transaction acceptance within 30 days notice to Acquirer, while maintaining all other aspects of the existing Merchant Agreement without penalty. This requirement applies to all Merchant Agreements. 11 Acquirer Obligation to Merchants Dispute Resolution Process An Acquirer or Service Provider must provide Merchants with access to a clear dispute resolution process that provides for an investigation and timely response to complaints pertaining to the Code of Conduct-related Rules. The existence of such a process must be clearly communicated to all Merchants. An Acquirer or Service Provider must ensure each Merchant understands that if the Merchant believes that its Service Providers or its Acquirers Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 15

11 Acquirer Obligation to Merchants Dispute Resolution Process conduct is contrary to the Code of Conduct-related Rules, they may report the issue to the Acquirer or Service Provider. An Acquirer or Service Provider will review the issue with the Merchant, undertake an investigation, and respond to the Merchant within ninety days. If the Acquirer s or Service Provider s complaint process is exhausted and a satisfactory resolution not achieved, the Merchant may submit the complaint to the Corporation. An Acquirer or Service Provider must use a common template to facilitate the submission of a complaint by a Merchant. An Acquirer or Service Provider must establish an internal complaints handling process and make information on their process easily available to Merchants. The complaints handling process must adhere to certain requirements. An Acquirer or Service Provider must: Provide Merchants with a summary of the complaint handling process and post it prominently on their website. NOTE: A link to the website must be included in the information summary box. Acknowledge receipt of the Merchant complaint within five business days. Investigate all complaints and provide a substantive response to Merchants that consists of either: (a) an offer to resolve the complaint; or (b) denial of the complaint with reasons. Provide their final decision within 90 days of receiving the Merchant complaint, along with: A summary of the complaint; The final result of the investigation; Explanation of the final decision; and Information on how to further escalate a complaint in the event of an unsatisfactory outcome, along with a complaint handling form. If the Acquirer or Service Provider cannot provide a response within 90 days, the Merchant must be informed of the delay, reason for the delay, and the expected response time. The Corporation must be informed in writing of the aggregate number of any Code of Conduct Rules related complaints received by Acquirers or Service Providers, the nature of the Merchant complaints, and the outcomes on a semi-annual basis. The Corporation will also share the above information with the Financial Consumer Agency of Canada, as well as aggregate information on complaints resolved by the Corporation. This requirement Dispute Resolution Process is effective 13 July 2015 and applies to all Merchant Agreements. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 16

12 Prohibited Practices Charges to Cardholders 12 Prohibited Practices Charges to Cardholders In addition to a discount for cash, a Merchant may provide a discount to its customers for other forms of payment, including differential discounts for other payment brands. Such discounts must be clearly communicated at the Point of Interaction. 13 Merchant Obligations for Acceptance Honor All Cards The following applies to MasterCard Card and Payment Credential acceptance: 1. Honor All Debit MasterCard Cards. A Merchant that chooses to accept Debit MasterCard Cards must honor all valid Debit MasterCard Cards without discrimination when properly presented for payment. The Merchant must maintain a policy that does not discriminate among customers seeking to make purchases with a Debit MasterCard Card. A Merchant that chooses to accept a debit Payment Credential, which is a payment funding debit account accessed by a consumer through a Mobile Wallet or Access Device, must honor all valid debit Payment Credentials accessed by a Mobile Wallet or Access Device without discrimination when properly presented for payment. The Merchant must maintain a policy that does not discriminate among customers seeking to make purchases with a payment funding debit account accessed by a Mobile Wallet or Access Device. 2. Honor All Other MasterCard Cards. A Merchant that chooses to accept Other MasterCard Cards must honor all Other MasterCard Cards without discrimination when properly presented for payment. The Merchant must maintain a policy that does not discriminate among customers seeking to make purchases with an Other MasterCard Card. A Merchant that chooses to accept an Other MasterCard Card Payment Credential, which is a payment funding Other MasterCard Card account accessed by a consumer through a Mobile Wallet or Access Device, must honor all valid Other MasterCard Card Payment Credentials accessed by a Mobile Wallet or Access Device without discrimination when properly presented for payment. The Merchant must maintain a policy that does not discriminate among customers seeking to make purchases with a payment funding Other MasterCard Card account accessed by a Mobile Wallet or Access Device. These requirements apply to all Merchant Agreements. 14 Card Issuance General Requirements Premium Cards may only be provided to a well-defined class of Cardholders, based on individual spending, assets under management, and/or income thresholds and not on the Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 17

15 Card Issuance MasterCard Card Issuance average of the Issuer s portfolio. An Issuer may only provide a Premium Card to a person that has applied for or consented to receiving a Premium Card. Premium Cards, and the Payment Applets that link to Premium Card Payment Credentials, should clearly indicate that they are premium products (including, by way of example and not limitation, display of clear and prominent branding provided by the Corporation to identify the product as a premium product). If a Premium Card includes a differential acceptance cost to a Merchant, the Issuer must include a statement on the cardholder application for the Premium Card that discloses that the Premium Card can impose a higher card acceptance cost to Merchants. This disclosure must be featured prominently on the cardholder application. The following are effective 13 February 2016 and apply to all new or reissued Premium Cards:requirements related to assets under management, Premium Card indicator on the Card, payment applet that links to the Premium Card, and statement to include on the Premium Card cardholder application. 15 Card Issuance MasterCard Card Issuance An Issuer must not issue a MasterCard Card that provides access to a Debit Card Account and an Other MasterCard Card Account on the same Card. A MasterCard Card may be either a Debit Card or an Other MasterCard Card, but must not be both a Debit Card and an Other MasterCard Card. 16 Selective Authorization For the purpose of effecting a Transaction, an Issuer must not place competing domestic applications of other payment card networks on a Debit MasterCard Card or a Maestro Card to process each type of domestic Transaction (including, by way of example and not limitation, point-of-sale, Internet, telephone). A Debit Card may contain multiple applications, such as PIN-based and contactless. This limitation does not apply to ATM Transactions and Crossborder Transactions. An issuer may place complementary domestic applications on a Debit MasterCard Card or a Maestro Card. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 18

Notices Notices Following are policies pertaining to proprietary rights, trademarks, translations, and details about the availability of additional information online. Proprietary Rights The information contained in this document is proprietary and confidential to MasterCard International Incorporated, one or more of its affiliated entities (collectively MasterCard ), or both. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of MasterCard. Trademarks Trademark notices and symbols used in this document reflect the registration status of MasterCard trademarks in the United States. Please consult with the Global Customer Service team or the MasterCard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. Disclaimer MasterCard makes no representations or warranties of any kind, express or implied, with respect to the contents of this document. Without limitation, MasterCard specifically disclaims all representations and warranties with respect to this document and any intellectual property rights subsisting therein or any part thereof, including but not limited to any and all implied warranties of title, non-infringement, or suitability for any purpose (whether or not MasterCard has been advised, has reason to know, or is otherwise in fact aware of any information) or achievement of any particular result. Without limitation, MasterCard specifically disclaims all representations and warranties that any practice or implementation of this document will not infringe any third party patents, copyrights, trade secrets or other rights. Translation A translation of any MasterCard manual, bulletin, release, or other MasterCard document into a language other than English is intended solely as a convenience to MasterCard customers. MasterCard provides any translated document to its customers AS IS and makes no representations or warranties of any kind with respect to the translated document, including, but not limited to, its accuracy or reliability. In no event shall MasterCard be liable for any damages resulting from reliance on any translated document. The English version of any MasterCard document will take precedence over any translated version in any legal proceeding. Information Available Online MasterCard provides details about the standards used for this document including times expressed, language use, and contact information on the Publications Support page available on MasterCard Connect. Go to Publications Support for centralized information. Guidelines for Code of Conduct for the Credit and Debit Card Industry in Canada 29 October 2015 19