UPCOMING SCHEME CHANGES

Transcription

1 UPCOMING SCHEME CHANGES MERCHANTS/PARTNERS/ISO COPY Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

2 Rights of use: COMPLYING WITH ALL APPLICABLE COPYRIGHT LAWS IS THE RESPONSABILITY OF THE USER. WITHOUT LIMITING THE RIGHTS UNDER COPYRIGHT, NO PART OF THIS DOCUMENT MAY BE REPRODUCED, STORED IN INTO A RETRIEVAL SYSTEM, OR TRANSMITTED IN ANY FORM OR BY ANY MEANS (ELECTRONIC, MECHANICAL, PHOTOCOPYING, RECORDING, OR OTHERWISE), OR FOR ANY PURPOSE, WITHOUT THE EXPRESS WRITTEN PERMISSION OF PAYVISION. PAYVISION MAY HAVE PATENTS, PATENT APPLICATIONS, TRADEMARKS, COPYRIGHTS, OR OTHER INTELLECTUAL PROPERTY RIGHTS COVERING SUBJECT MATTER IN THIS DOCUMENT. EXCEPT AS EXPRESSLY PROVIDED IN ANY WRITTEN LICENSE AGREEMENT FROM PAYVISION THE FURNISHING OF THIS DOCUMENT DOES NOT GIVE YOU ANY LICENSE TO THESE PATENTS, TRADEMARKS, COPYRIGHTS, OR OTHER INTELLECTUAL PROPERTY. DISCLAIMER This document does not in any way replace the documents from Schemes. In case of any doubt, user should always refer to scheme documents. This document is prepared by Payvision based on information and previous experience with scheme changes and is therefore based on how Payvision understands and handles scheme changes. By continuing to read this document, user accepts and understands that the information contained represents Payvision s guidelines based on scheme guidelines. Payvision shall not be liable for any misinterpretation of the Scheme s rules. Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

3 TABLE OF CONTENTS 1. Introduction Target audience Purpose of the guide Contact information Revised Maximum Transaction Amount for Contactless Transactions at CAT Level 2 Terminals MASTERCARD Customer Responsibilities Related to Account Data Compromise Events Introduction of New Chargeback Blocking-MASTERCARD NEW Merchant Outlet Location and Website Disclosure Rules Will Be Clarified- VISA GLOBAL... 8 Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

4 1. INTRODUCTION 1.1. Target audience This document has been created for Payvision merchants/resellers/isos regardless of the acquiring bank used by the user. The document is meant to provide notice and information regarding scheme changes as announced by the Schemes Purpose of the guide The purpose of this document is to inform merchants/resellers/isos of any upcoming scheme changes that might have an impact on the users. The document will also remind users of general scheme compliance changes, rules and mandates. This document does not replace official scheme documentation, member letters and scheme bulletins. The document contains summary level interpretation of such changes based on the understanding of Payvision Contact information Should you wish to obtain further clarification regarding the details of the document, please contact the Operations Department: Tel: +31 (0) Fax: +31 (0) Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

5 2. REVISED MAXIMUM TRANSACTION AMOUNT FOR CONTACTLESS TRANSACTIONS AT CAT LEVEL 2 TERMINALS MASTERCARD What is changing? Effective immediately, contactless transactions can be performed at Cardholder-Activated Terminal (CAT) Level 2 terminals with No CVM to the same maximum transaction amount that applies to CAT Level 2 contact transactions (if any) at the acquirer s liability. Chargeback procedures for CAT 2 transactions have also been updated. Current situation. CAT Level 2 Self-Service Terminals (CAT 2) are unattended point-of-sale (POS) terminals. CAT 2 terminals are online-capable, support No CVM and may support both contact and contactless transactions. However, according to the existing processing rules, the maximum transaction amount is not the same for both interfaces. Contact transactions can be performed at CAT 2 terminals with no specified maximum transaction amount, while contactless transactions at CAT 2 terminals cannot exceed the applicable contactless cardholder verification method (CVM) limit. What does the change mean? MasterCard is now clarifying the rules by removing the restriction on the maximum transaction amount for contactless transactions performed at CAT 2 terminals. An acquirer (or its merchant) is now permitted to process contactless transactions at CAT 2 terminals with No CVM to the same maximum transaction amount that the acquirer or merchant applies to CAT 2 contact transactions (if any). How will this affect you? Acquirers will have fraud liability for contactless transactions exceeding the CVM limit under chargeback message reason code 4837 (No Cardholder Authorization). This means that the same fraud liability will be passed directly to you, should you have any chargebacks with the indicated reason code. Effective date. Effective immediately. Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

6 3. CUSTOMER RESPONSIBILITIES RELATED TO ACCOUNT DATA COMPROMISE EVENTS What is changing? MasterCard reminds acquirers and their merchants of their duty to fully cooperate with MasterCard investigations of ADC events and potential ADC events. Should a merchant fail to fully cooperate with an investigation, MasterCard may draw one or more adverse inference and may impose an assessment of up to USD 25,000 per day for each day that the customer and merchant is noncompliant. Current situation MasterCard s Security rules and procedures requires that: Each acquirer and its merchants apply the utmost diligence and forthrightness in protecting against and responding to any ADC event or potential ADC event. Each acquirer and its merchants acknowledge and agree that MasterCard has both the right and need to obtain full disclosure (as determined by MasterCard) concerning the causes and effects of an ADC event or potential ADC event as well as the authority to impose assessments, recover costs, and administer compensation, if appropriate, to Customers that have incurred costs, expenses, losses, and/or other liabilities in connection with ADC events and potential ADC events. What does the change mean? Your full cooperation is expected whenever there is an ADC event. As a merchant, you have the responsibility of NOT interfering with investigations of an ongoing case. Adverse Inference Examples When evaluating the acquirer s or its merchants actions before, during, and after the ADC event or potential ADC event, MasterCard will consider, and may draw an adverse inference from, evidence that an acquirer or its merchant deleted or altered data. Deletion or alteration of data may include, but is not limited to: Evidence rendered unobtainable due to software upgrades after notification of an investigation and before Payment Card Industry Security Standards Council Forensic Investigator (PFI) engagement Firewall firmware updated after notification of an investigation and before PFI engagement Destruction of firewalls, or other network device logs, server logs, and/or log files after notification of an investigation and before PFI engagement Changes to the environment made by a third party engaged by the customer or agent after notification of an investigation and before PFI engagement Overwriting of pertinent artifacts of note, such as reimaging systems within scope, after notification of an investigation and before PFI engagement How will this affect you? Refusing to cooperate with MasterCard or interfering with investigations of an ADC event, will have adverse effect that might also include non-compliance fines passed on to the acquirer, which will be passed to you in combination with any other fee assessed directly to you by MasterCard. Effective date. Immediately. Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

7 4. INTRODUCTION OF NEW CHARGEBACK BLOCKING-MASTERCARD What is changing? MasterCard will block fraud-related chargebacks that exceed the Fraud Notification Service (FNS) criteria. Current situation On 15 April 2011, MasterCard implemented a rule that stated issuers must: Either close an account or relinquish their fraud and cardholder-does-not-recognize chargeback rights on transactions authorized subsequent to the date of the second fraud chargeback on the account. Include the expiration date of an account that is charged back in all of their first chargeback/1442 messages, for accounts that they soft re-issued (such as the same primary account number [PAN] with a different expiration date). What does the change mean? To support this new rule, MasterCard implemented the FNS for MasterCard transactions with the goal of restricting the level of fraud that issuers can transfer to acquirers over time, once an account has suffered fraud. FNS provides acquirers and merchants with a second presentment right on any fraudrelated chargebacks initiated on transactions authorized after the date of the second fraud-related chargeback on an account. Effective 14 October 2016, MasterCard will provide a new service that automatically blocks fraudrelated chargebacks that are ineligible because of FNS criteria: Acquirers will be notified of MasterCard actions using error number: 2801 (Ineligible Chargeback Reject reason codes FNS date exceeded ), or 2802 (Ineligible Chargeback Reject reason codes FNS counter exceeded ). This service applies to all brands including MasterCard, Cirrus, and Maestro. How will this affect you? Acquirers will be billed USD 3 (EUR 3 in Europe region) if MasterCard blocks an ineligible chargeback on behalf of an acquirer. The same amount will be passed to you should any of your chargebacks be listed as those blocked automatically by MasterCard. This amount is separate from the existing chargeback fees billed separately by Payvision. Effective date. 14 October 2016 Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

8 5. NEW MERCHANT OUTLET LOCATION AND WEBSITE DISCLOSURE RULES WILL BE CLARIFIED- VISA GLOBAL What is changing? Effective 15 October 2016, Visa will update these rules to clarify location requirements for all merchants, payment facilitators and sponsored merchants. This update is particularly important to ensure that the location of card-absent merchants and merchant outlets that are not in a fixed place are accurately determined and disclosed. Current situation Visa is introducing new regulations in regards to merchant outlet location and website disclosure. What does the change mean? Requirement to Assign the Correct Location Card-Present Transactions In general, the location of a merchant outlet for card-present transactions is the physical location where the transaction takes place. However, specific rules will apply for a merchant outlet that is not in a fixed location: The merchant outlet location for an in-transit transaction (e.g. on board a plane) must be one of the following: -Where the journey began. -The destination. -The merchant s principal place of business. The merchant outlet location for transactions at other outlets that are not in fixed locations (e.g. a traveling salesman) must be either where the sale occurred or the merchant s principal place of business. The principal place of business for all merchant outlet requirements is the fixed location where the merchant s executive officers direct, control and coordinate the entity s activities. Card-Not Present (CNP) Transactions For CNP, the merchant outlet location is the country of its principal place of business. However, additional countries might be assigned as merchant outlet locations (i.e. in addition to the merchant s principal place of business), depending on the merchant and the type of transactions it conducts, as follows: Travel Related Merchants: For the purchase of transportation or other travel transactions (e.g. airline, passenger railway, cruise line), the merchant location is the country where the first leg of the journey begins. For a lodging merchant, the location is the country where the accommodation is provided. For a car rental, taxi or ride service merchant, the location is the country where the cardholder rents the vehicle or where the journey originates.if a travel agent conducts the transaction, the merchant location is the country of the travel agent. Other Merchants: For multinational merchants not mentioned above additional merchant outlet locations may be assigned only in countries where the merchant conducts business activities and Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

9 operations directly related to providing the cardholder with goods or services purchased in the specific transaction. For an acquirer to assign an additional country to a merchant outlet outside its principal place of business, all of the following must be true: The merchant has permanent premises at which its employees or agents conduct business activities and operations required to provide the cardholder with the goods or services purchased in the transaction. This location must be: 1. The location where the merchant conducts business activities, and not a post office box; mailforwarding address; the address of the merchant s law firm, agent or vendor; or an address. 2. The country where those who are employed and accountable for the development, manufacturing, management and sale / distribution of the goods or services purchased in the specific transaction. -The merchant assesses sales taxes or value-added taxes on the transaction activity (in places where taxes apply). -The location is the legal jurisdiction that governs the contractual relationship between the merchant and the cardholder. How will this affect you? Disclosure Requirements for Electronic Commerce Merchants Accurate disclosure of merchant outlet location before the cardholder completes the purchase is important for ecommerce transactions, as such information may affect fees, taxes and shipping times. Visa has strengthened the merchant outlet disclosure requirements on merchant websites, which must clearly and prominently display the country of the merchant outlet either: On the same screen view as the checkout screen that presents the final transaction amount. Within the sequence of web pages the cardholder accesses during the checkout process. A link to a separate web page is not allowed. The merchant outlet location disclosed to the cardholder must be the location used in the transaction. The merchant must also disclose on its website its address for cardholder correspondence. All merchants must therefore make the necessary changes to correctly display the location to the cardholder on one of the provided options, before completion of purchase. Merchant Location Compliance Program Visa is introducing a compliance program to promote accurate assignment of merchant outlet location and merchant website disclosure by acquirers. Visa is committed to ensuring compliance to the rules and taking action against non-compliant acquirers and merchants by applying non-compliance assessments. Acquirers and merchants that are out of compliance with the program after 31 January 2017 will be subject to a non-compliance assessments as a willful violation of the rules. Such noncompliance fees will be passed on to the merchant not compliant with Visa rules. Effective date. 15 October 2016 Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august

10 Payvision Ref: Payvision-Upcoming Scheme Changes (v1.0)-august