Merchant Network Updates Summer 2019

We are committed to working closely with you to achieve your business goals. As a part of this commitment, we carefully monitor network changes and summarize them for your convenience. This communication serves as a summary of information from American Express, Discover® POINT OF SALE Network, Mastercard® Worldwide and Visa® U.S.A. outlining changes to operating rules and regulations, interchange rates, compliance of network mandates, and other industry updates that may impact your business.

Please contact your Relationship Manager with any questions you may have regarding any of the information contained in this network updates newsletter.

ALL BRANDS

[UPDATE] Return Authorization Requirements, All Brands CP/CNP/eComm

The Program: To ensure better visibility to the cardholder that their refund is in process, and to reduce refund- related customer service burdens on merchants, acquirers, and issuers, the brands have communicated the following refund authorization support and effective dates.

The Change: Visa, Discover, and Mastercard will require acquirers and merchants to submit credit/refunds for authorization.

Recent Visa Update

Visa has communicated the following updates for support of the return authorization, integrity fees, and dispute processing as outlined below:

o October 19, 2019 Visa is postponing the implementation date for all merchants to receive and pass credit voucher / purchase return authorizations in the Canada, LAC and U.S. regions o July 1, 2020 Updated Assessment Date for U.S. Processing Integrity Fees for Credit Vouchers

o April 18, 2020 Date Change for No Authorization Dispute Processing

Recent Discover Update

Discover has communicated the following updates for support of the return authorization and dispute processing:

o April 17, 2020

1 Worldpay strives to ensure that the summaries and information contained within this newsletter are as accurate as possible. This information should not be considered legal and may vary based upon your individual business needs. The information contained within this newsletter is not a substitute for Network rules, regulations, or applicable laws.

Mandated Effective Proc Code Brand Exclusions Chargebacks Fees Dates Required

October 19, 2019  U.S.  Canada  LAC

April 2020  AP Airlines (MCCs 3000–3350 Visa  CEMEA 20 April 18, 2020 July 1, 2020 and 4511) April 2020  Europe (exception 2022 for the UK and Republic of Ireland)

Airlines (MCCs 3000–3350 Mastercard April 17, 2020 20 April 17, 2020 and 4511)

Discover April 17, 2020 20 April 17, 2020

EMV

[REMINDER] EMV Fraud Liability Shift Update for JCB and Union Pay CP

The Change: This fraud liability shift update applies to transactions acquired in the U.S. and processed via Discover Network and PULSE where a contact chip payment device is utilized and a counterfeit card using JCB or UnionPay BIN ranges were used to conduct the transaction.

October 2019 When a JCB or UnionPay contact chip payment device is utilized and a counterfeit card using the JCB or UnionPay BIN ranges was used to conduct the transaction at a POS or ATM, except at an Automated Fuel Dispenser, in the U.S.

October 2020 When a JCB or UnionPay contact chip payment device is utilized and a counterfeit card using the JCB or UnionPay BIN ranges was used to conduct the transaction at an Automated Fuel Dispenser in the U.S.

[REMINDER] EMV Automated Fuel Dispenser (AFD) Liability Shift Update CP

The Program: As of October 2020, the Brands’ (Visa, Mastercard, American Express and Discover) EMV liability shift for U.S. acquired AFD transactions1 under Merchant Category Code 5542 – Automated Fuel Dispensers will take effect.

Worldpay is aware that the following PIN Debit networks that have also announced an October 2020 EMV AFD liability shift date:  Accel  AFFN  Interlink  Jeanie  Maestro  MoneyPass  NYCE  PULSE  Shazam  STAR

1 In late 2016 and early 2017, the brands delayed the U.S. domestic AFD liability shift from October 2017 to October 2020.

The Impact: For properly formatted and identified fallback transactions, fraud liability will remain with the issuer except for Visa lost/stolen transactions. For Visa, merchants may be liable for fallback transactions in lost-or-stolen cases. Visa advises that, where possible, magnetic stripe transactions on AFD terminals be directed to pay inside. Also, issuers may decline fallback transactions at a higher rate than chip read transactions.

AFD Merchants should be working toward EMV capability in order to meet the October 2020 deadline. Merchants are asked to contact their Relationship Manager as soon as possible to confirm timelines for EMV certification.

[REMINDER] Expiring Certificate Authority Public (CAP) Keys CP

The Program: The EMV standard uses Public Key technology to perform certain functions related to offline authentication, some aspects of online transactions and offline PIN encryption. Each of the card brands publish sets of these keys for use with their EMV applications.

Public keys are distributed to acquirers, merchants and solution providers to load into their terminals. Each of the brands’ key sets is comprised of keys of varying lengths. On an annual basis, EMVCo reviews the keys and makes recommendations on the expected life span (on a rolling 10-year projection window) of the different key lengths. Once EMVCo determines a key length is beginning to approach the point where it may become vulnerable to attacks, they will set that key’s expiration date. While the individual brands are free to set their own expiration dates, they traditionally follow EMVCo’s advice.

The Change: The following are the active CAP key lengths and their expiration or projected lifespan dates:  UnionPay has announced the expiration date for their 1152-bit key is 12/31/2021  1408-bit keys have expiry date of 12/31/2024  1984-bit keys have an anticipated expiry date of 12/31/2028

The Impact: Once a key expires, it must be removed from the terminal within six months.  Merchants and their solutions providers are advised to begin the process of removing of these keys  Merchants are also reminded that because expiration dates can change they should not be stored on terminals.  Per UnionPay rules, merchants must not remove the 1152-bit key for UnionPay until the expiration as outlined above

[UPDATE] Contactless Terminal Requirements: All Brands, All Regions CP

The Change: To increase the acceptance of contactless transactions and support more secure transactions, the card brands have published contactless terminal requirements. Contactless terminals must support EMV grade contactless technology as outlined by region and effective date.

The Impact: Merchants should work with their hardware vendors to ensure that EMV contactless devices are properly configured as outlined by the brands.

RECENT UPDATES

MASTERCARD

EMV Contactless Support Requirements:  Merchants using a contactless-enabled terminal that supports contact EMV transactions must also support EMV mode contactless transactions.

Removal of MSD Contactless:  Prior to October 18, 2019, a newly deployed contactless-enabled terminal may support Magnetic Stripe Mode contactless payment functionality. Mastercard announced support for contactless MSD is optional.

 On and after October 18, 2019, all newly-deployed point of sale (POS) terminals that support contactless acceptance must only support EMV mode contactless transactions. Mag-stripe mode contactless must not be supported.

 Effective April 1, 2023, all POS terminals that support contactless acceptance must only support EMV mode contactless transactions. Mag-stripe mode contactless must be removed or disabled

Compliance monitoring:  Worldpay has received reports of issuer declines from Mastercard due to invalid CVC3 data from MSD contactless transactions. Impacted merchants will be notified through their relationship manager.

o Mastercard has identified merchants where declines are a result of the terminal only being able to support MSD contactless

. To address the issue, merchants that have terminals that can only support MSD contactless may either:

 Work with their relationship manager to certify EMV grade contactless for their terminals or;

 Consider disabling contactless acceptance on the terminals until EMV contactless certification can occur in an effort to prevent non-compliance assessments

VISA (U.S. Region Reminders)

EMV Contactless Support Requirements:  Merchants currently processing MSD contactless transactions must be able to process EMV grade contactless transactions.

 Merchants unable to support EMV contactless may be subject to a compliance violation

 Merchants currently working towards EMV contactless do not have to disable their existing contactless capabilities; however, it is recommended that customers work closely with their Implementations Consultant and Relationship Manager to ensure certification timelines are met.

Removal of MSD Contactless:  For merchants that implement contactless EMV BEFORE APRIL 13, 2019 legacy MSD magnetic-stripe data (MSD) contactless technology must be disabled by October 19, 2019.

 For merchants that certify contactless EMV ON or AFTER April 13, 2019 the terminal must not support the legacy magnetic-stripe data (MSD) contactless functionality

REQUIREMENTS & TIMING BY REGION

United States / Canada

Brand Effective Date Terminal Type and Requirement

Newly deployed terminals must support EMV contactless Mastercard Effective October 2014 functionality Terminals that are being upgraded must also support EMV mode Discover August 23, 2018 contactless. All POS terminals in the ecosystem must also support EMV mode Amex December 31, 2018 contactless.

Newly deployed POS terminals or terminals being upgraded must Visa April 13, 2019 (U.S.) disable MSD contactless.

All newly-deployed point-of-sale (POS) terminals that support contactless acceptance must only support EMV mode contactless transactions. Magstripe mode contactless must not be Discover October 18, 2019 supported. All newly-deployed POS terminals that support contactless acceptance must only support EMV mode. Magstripe mode Mastercard October 18, 2019 contactless must not be supported. Terminals upgraded to EMV prior to April 13, 2019 must disable Visa October 18, 2019 (U.S.) MSD contactless by this date Visa October 19, 2019 (Canada) All POS terminals in the ecosystem, remove MSD Mastercard April 1, 2023 All POS terminals in the ecosystem, remove MSD

Asia Pacific

Brand Effective Date Terminal Type Visa January 1, 2018 All POS terminals in the ecosystem, remove MSD Discover August 23, 2018 Terminals that are being upgraded Amex December 31, 2018 All POS terminals in the ecosystem Mastercard October 12, 2018 All newly deployed POS and CAT terminals (Excludes Mobile POS (MPOS))

Discover October 18, 2019 All newly-deployed point-of-sale (POS) terminals that support contactless acceptance must only support EMV mode contactless transactions. Mag-stripe mode contactless must not be supported. Mastercard October 18, 2019 All newly-deployed MPOS terminals Mastercard April 1, 2023 All POS and CAT terminals

Latin Caribbean and Caribbean Region

Brand Effective Date Terminal Type Discover August 23, 2018 Terminals that are being upgraded Amex December 31, 2018 All POS terminals in the ecosystem Discover October 18, 2019 All newly-deployed point-of-sale (POS) terminals that support contactless acceptance must only support EMV mode contactless transactions. Mag-stripe mode contactless must not be supported. Mastercard October 18, 2019 All newly-deployed MPOS terminals Visa October 19, 2019 All POS terminals in the ecosystem, remove MSD Mastercard October 20, 2020 All newly-deployed Integrated POS (IPOS) terminals Mastercard April 1, 2023 All terminals in the ecosystem Visa April 1, 2025 All mPOS devices, AFDs, ECRs and ATMs in the ecosystem

Mastercard®

[NEW] Mastercard Revises Standards – Electronic Commerce Transactions at Automated Fuel Dispensers (AFD) eComm

The Program: Merchants selling automotive fuel are offering consumers the ability to make “in-app” payments using the merchant’s digital application offering.

The Change: Mastercard is supporting this new acceptance channel by expanding the transaction processing options for AFDs to include ecommerce transactions.

The Impact: AFD transactions are to be formatted as follows:

 MCC 5542 (Automated Fuel Dispenser)  Transaction Category Code (TCC) R = All Other Merchants Face to Face U = Cardholder-Activated Terminal Level 1 or 2 T = All Other Non–Face to Face Transactions

 Cardholder Activated Terminal (CAT) level indicator CAT 1 (Automated Dispensing Machine) when a PIN is entered CAT 2 (Self-Service Terminal) when no cardholder verification method (CVM) is used CAT 6 (Electronic Commerce) plus other ecommerce transaction indicators

All existing Standards applicable to AFD transactions, including requirements related to the support of pre- authorizations, partial approval responses and advice messages will apply to in-app fuel purchases.

Chargeback Impact  In app transactions are e-commerce transactions and all fraud related chargeback rights applicable to an e-commerce transaction will therefore apply, including but not limited to, all chargeback provisions related to the use of Mastercard SecureCode and Mastercard Identity Check.

 Authorization-related chargeback rights that currently apply to AFD transactions will apply to in-app fuel payments. Issuers will not be able to use message reason code 4808 (Authorization-related Chargeback) to charge back an AFD transaction occurring in the U.S. region that is identified as an e- commerce transaction

The Timing: October 18, 2019

[NEW] Mastercard Announces Support for Electric Vehicle Charging CP

The Program: Mastercard has announced the ability for merchants to support electric vehicle charging services under any existing merchant category code the merchant is using to conduct current operations.

The Change: This solution is effective immediately; however, it is a temporary solution and will expire when the broader electric vehicle charging service is launched.

Current criteria:  Must not be one of the following MCCs: o 5541—Service Stations (with or without Ancillary Services) o 5542—Fuel Dispenser, Automated

 Terminal should support any of the following input methods: o Magnetic stripe o Contact chip o Contactless chip

 Terminal should support online authorization

[NEW] Mastercard Announces Authentication Enhancements for Mastercard Identity Check Program eComm

The Program: Mastercard Identity Check program, formerly known as SecureCode 3DS 1.0, leverages the latest authentication standards of EMV 3-D Secure (replacing 3DS 1.0) to help ensure digital transactions are secure.

The Change: Mastercard has announced that customers who enroll in the Mastercard Identity Check program using EMV 3-D Secure (3DS) will use the Second Secure Payment Application (SPA2) for Accountholder Authentication Value (AAV) generation.

SPA2 is the enhanced version of the AAV, Universal Cardholder Authentication Field (UCAF), data field that was announced and implemented in October 2018 under Identity Check 3DS 2.0.

Mastercard customers still on the legacy 3DS platform (SecureCode 3DS 1.0) will continue to use the current SPA1 algorithm as SPA2 is not supported for 3DS 1.0 transactions.

Identity Check will completely replace SecureCode by December 2019.

The Timing: October 1, 2019

[NEW] Mastercard Introduces New Nominal Amount Authorization Fee CNP/eComm

The Program: Mastercard is introducing a new program, Transaction Processing Excellence (TPE), to promote correct processing behavior.

The Change: As part of TPE, Mastercard will be introducing the Nominal Amount Authorization fee that will be assessed on transactions where the merchant conducted a $1.00 status check instead of using the non- financial Account Status Inquiry transaction type.

The Impact: This Nominal Amount Authorization fee will apply only to Card-Not-Present transactions for $1.00 USD or less. The fee amount of $0.045 will be assessed for each approved nominal amount transaction with a subsequent reversal. Merchants should use Account Status Inquiry (ASI) tran types for account status checks

The Timing: January 2020

[NEW] Mastercard Revises Standard for Recurring Payment Transactions CNP/eComm

The Change: Mastercard will revise its Standards to clarify that Point of Sale [POS] Data, subfield POS Cardholder Presence, complies with the appropriate values for the first transaction of a recurring payment series for e-commerce transactions.

The Impact:

Indicating a Recurring Payment

1. For the first transaction of a recurring payment series, a value of one of the following: 0 (Cardholder present) 1 (Cardholder not present, unspecified) 2 (Mail/facsimile order) 3 (Phone/ARU order) 5 (Electronic order [home PC, Internet, mobile phone, PDA])

2. For any subsequent recurring payment transaction, a value of 4 (Standing order/recurring transactions)

REMINDER: For subsequent recurring payment transactions, the transactions must follow the credential on file requirements (e.g, POS Entry Mode of COF).

The Timing: January 2020

[REMINDER] Mastercard Data Integrity Edits to Monitor Use and Acceptance of Credential-On-File Indicator CP/CNP/eComm

The Program: Mastercard will update their Data Integrity Monitoring Program to include new edits to ensure transactions are using the Credential-On-File (POS Entry Mode 10) properly in authorization messages.

The Impact: The following new edits will be added to existing Data Integrity Monitoring Edits:

 Edit Number 10 Electronic Commerce fields are invalid or blank Mastercard will monitor to ensure when an Ecommerce transaction contains the POS Entry Mode of 10 (Credential on File) that the other point-of-sale fields/values consistently identify Ecommerce

 Edit Number 21 (Dual Message) and 14 (Single Message) COF Indicator for Recurring Payments Mastercard will monitor recurring transactions to ensure the transactions contain the POS Entry Mode of 10

Mastercard has updated the compliance dates for Edit 21 and Edit 14

Effective Dates: January 1, 2019 Monitoring begins February 1, 2019 Reports become available April 1, 2019 Edit 10 Comply by date May 1, 2019 Edit 10 Noncompliance assessments begin July 1, 2019 Edit 21 and 14 Comply by date August 1, 2019 Edit 21 and 14 Noncompliance assessments begin

[REMINDER] Mastercard Updates Symbol Branding on Physical and Digital Cards CP/CNP/eComm

The Change: Effective November 1, 2019, the full color (red and yellow) Mastercard Brand Mark will be featured on cards without the word “mastercard”. This will be referred to as the “Mastercard Symbol”.

Note: The transition to Mastercard Symbol branding will not apply to the use of Mastercard branding in marketing materials.

The Impact: Cardholders may begin to present cards with the Mastercard Symbol without the word “mastercard” at merchant locations.

The Timing: November 1, 2019 11

[REMINDER] Mastercard Introduces IIAS Real-Time Substantiation for Vision Enhancement CP

The Change: Mastercard is adding a vision prescription (Rx) total amount for the Real-time Substantiation service that supports substantiation at the point of sale (POS) for qualified healthcare expenses in accordance with the Special Interest Group for IIAS Standards (SIGIS) for the Inventory Information Approval System (IIAS).

The Impact:

Phase 1: Mastercard will increase field lengths to support additional amounts for substantiated vision transactions.

Phase 2: Worldpay and merchants will make updates to support the vision healthcare-related amounts and the new value 12 (Vision Rx Eligibility Amount).

Phase 3: The new process is now available in production

[REMINDER] Mastercard Introduces Transaction Integrity Classifications (TIC) for Interchange Rates CP/CNP/eComm

The Program: Mastercard has introduced Transaction Integrity Classification to provide a mechanism to evaluate the safety and security of a transaction. The intent of the Transaction Integrity Classification (TIC) indicator is to assess both the validity of the card and the cardholder.

The Change: Mastercard will review transaction characteristics to assess the validity of the card and the cardholder and will provide these results to issuers to assist them in making authorization decisions.

Mastercard will require merchants to receive the TIC indicator value in the authorization response message and to return this value in the clearing message in order to qualify for the appropriate interchange. The TIC indicator will be mandatory for specific interchange programs in the U.S. region.

NEW UPDATE

 Mastercard has delayed the use of the TIC value for interchange qualification until at least April 2020  Merchants in the process of making updates to support the MC TIC should continue their efforts  Worldpay is on track to fully support this mandate as originally planned

Mastercard will be mandating the use of the TIC value in all settlement messages, chargebacks and arbitration chargebacks. Mastercard may override interchange rates based on the TIC indicator in a future Release.

Valid Values for the Transaction Integrity Class Card and Cardholder Present EMV/Token in a Secure, Trusted Environment A1 Card and Cardholder Present EMV/Chip Equivalent B1 Card and Cardholder Present Mag Stripe C1 Card and Cardholder Present Key Entered E1 Card and Cardholder Present Unclassified U0 Card and/or Cardholder Not Present Digital Transactions A2 Card and/or Cardholder Not Present Authenticated Checkout B2 Card and/or Cardholder Not Present Transaction Validation C2 Card and/or Cardholder Not Present Enhanced Data D2 Card and/or Cardholder Not Present Generic Messaging E2 Card and/or Cardholder Not Present Unclassified U0

 Specifications have been updated to support the TIC indicator in both authorization response and clearing messages between merchants and Worldpay

 Worldpay is updating our systems to ensure proper interchange qualification based upon the TIC indicator received

[REMINDER] Mastercard Claims Manager (MCM) for Disputes CP/CNP/eComm

The Program: Mastercard announced plans to make changes to their disputes resolution process for its network participants during the second half of 2019, followed by additional changes in April 2020.

Mastercard is changing the Dispute Resolution process to address the following concerns:

 Significant increase in improper/invalid chargebacks and representments  Increase in chargebacks under $25 (+15%)  Significant increase in non-fraud disputes  Chargeback timeframes and processes haven’t changed in more than 20 years  To reduce the number of improper compliance cases

The Change: For 2019 Worldpay will enhance systems to facilitate real-time processing with Mastercard. With these enhancements merchants will be able to self-serve and the following dispute deliverables will be updated:

Reporting updates  Dispute Reports  Dispute Notices (DMMD version)  Updating DM Activity File* to include Mastercard dispute data *The DM Activity File currently contains only Visa VCR disputes. Mastercard data is still in the older CHARTS version of the file.

Core iQ updates  Questionnaire added for Mastercard  Population of the Case Status and Ownership field  One new action code (RRER- Retrieval Request Refusal)

The Timing: These changes are scheduled to go into effect on September 26, 2019 (core platform).

What is not changing with the Mastercard Dispute Resolution Initiative?

 Timeframes for merchants to respond . 45 days to represent a chargeback . 30 days to respond to a retrieval request  The dispute process will remain chargeback/representment/second chargeback/pre-arb/arb until 2020.

Please visit www.vantiv.com/disputes for additional dispute program information.

Visa

[NEW] Visa Introduces New Merchant Category Code 9406 – Non U.S. Government Owned Lotteries CP/CNP/eComm

The Program: A new merchant category code (MCC) of 9406 [Government Owned Lotteries, Non-U.S. Only] will be created for non-U.S. government-owned lotteries. This MCC is intentionally separate from MCC 7800 (U.S. Classification).

The Impact: Qualifying non-U.S. lottery merchants (see chart below) that sell tickets will be able to reclassify their gambling transactions from MCC 7995 to the new MCC 9406.

Merchants using MCC 9406 will not be required to include the quasi-cash indicator, and the MCC will not be considered high-brand risk.

If a non-U.S. lottery merchant does not meet the criteria for MCC 9406, the transaction must continue to be classified under MCC 7995.

POS Environment Ticket Seller Terminal Type MCC 5411 – Grocery Stores Card Present Retailer (e.g. grocery) Retailer and Supermarkets Card Present Retailer or Lottery Lottery Provided MCC 9406 Card Absent Lottery Lottery App/website MCC 9406

Registration is not required to participate in the new MCC. Visa will monitor volumes and will assess noncompliance assessments to ineligible merchants.

The Timing: October 18, 2019

[New] Visa Expands Estimated, Initial and Incremental Authorization Processing CP/CNP/eComm

The Program: Under the Visa rules, merchants are required to obtain an authorization only for the final transaction amount. However, exceptions exist and many merchant categories are permitted to obtain estimated, initial, and incremental authorizations when the final amount is unknown.

The Change: Visa will expand the merchant types that are eligible to send estimated, initial, and incremental authorizations to the following merchant category codes:

 5411 – grocery stores and supermarkets, for card-not-present transactions only  5522 – electric vehicle charging  7523 – parking lots, parking meters, and garages

The Timing: October 2019

[UPDATE] Visa Introduces Deferred Authorization Indicator CP

The Program: When a card present merchant’s system experiences a communication issue and an online authorization is not able to be obtained, a merchant will hold onto the authorization message and submit it when the system is back online.

The Change: In an effort to improve authorization approvals, Visa is introducing a new indicator to uniquely identify transactions that are stored and submitted once their system is back online.

The Impact: Visa will require support of a new authorization indicator (existing field 63.3) to identify deferred (store and forward) authorizations (value of 5206).

o Deferred authorizations must be obtained within one (1) day of the transaction date* * Transaction date is the date when the goods/services were provided. Visa understands that there will be exceptions (e.g., natural disasters, etc.) where the submission of the deferred authorization may extend beyond one day.

o MCCs 4111 (Local and Suburban Commuter Passenger Transportation including Ferries), 4122 (Passenger Railways) or 4131 (Bus Lines) must obtain an authorization within four (4) days of the transaction date

The Timing: Visa has revised the effective dates for support of the Deferred Authorization Indicator:

 October 18, 2019 –mandated for acquirers

 April 16, 2021 – mandatory for merchants

[UPDATE] Visa Updates Activation Date for EMV-3D Secure in the U.S. eComm

The Program: EMV-3D Secure (formerly 3DS 2.0) participants should be aware of the phased approach for chargeback protection for merchant-attempted transactions.

The Change: The activation date for EMV-3D Secure (formerly 3DS 2.0) has been changed to August 31, 2020 in order to align with other improvements and regional requirements. Visa will continue to test additional protocol alternatives to help with overall decisioning. The activation dates in other regions remain unchanged.

Additionally, the activation date for e-commerce fraud-related dispute protections are extended to merchants using EMV 3DS from August 15, 2019 to August 31, 2020. All other regions remain unchanged.

o EMV-3D Secure Merchant-attempted to authenticate transactions will begin to have chargeback protection. These transactions will be identified with Electronic Commerce Indicator = 06.

o EMV-3D Secure Issuer-authenticated transactions will receive fraud-related chargeback protection or when an EMV-3D Secure issuer is temporarily unavailable and Visa stands in.

[REMINDER] Visa Updates Requirements for Payment Facilitators and Qualified and Registered Marketplaces CP/CNP/eComm

The Change: Effective October 2019 Visa will require payment facilitators (PFs), sponsored merchants and marketplaces to be identified uniquely using new transaction level identifiers. The identifiers will help monitor the activity of sponsored merchants that operate under a payment facilitator (PF) and transactions that occur at a registered marketplace.

The Impact: Payment facilitators (PFs), sponsored merchants and marketplaces identifiers must be included in all transactions, and will result in more effective monitoring of the activity of sponsored merchants that operate under a payment facilitator (PF) and transactions that occur at a registered marketplace.

Payment Facilitators The business identifier for a PayFac will be assigned by Visa when the acquirer registers the entity as a third party agent, as required, with Visa.

 For PayFacs already registered with Visa, the identifier was provided in the confirmation letter at the time of registration (e.g., 100XXXXX).  Worldpay must ensure that the sub-merchant identifier is assigned; it must be a unique value for each sponsored merchant. The indicator may be numeric or alpha-numeric and up to 15 characters. o This value can be the same sub-merchant ID currently being used for Mastercard transactions.

 Payment Facilitators will still be required to format the merchant name field with the PayFac prefix * sub- merchant name.

Marketplaces The identifier requirements only apply to registered marketplaces with annual Visa volume of USD 5 million or more, or at the direction of Visa. The marketplace identifier will be 8 characters.

Effective October 2018, Visa introduced a specific merchant category code (MCC) dedicated to marketplace transactions described as follows:

MCC 5262–Marketplaces Entities classified with this MCC are online marketplaces that accept Visa and bring together cardholders and retailers on an e-commerce website or mobile application, under a single brand used to identify itself to cardholders. These entities must meet all Visa qualification requirements and be registered with Visa as a marketplace. MCC 5262 must be used when the Marketplace sells a variety of goods and or services.

Marketplaces offering the same type of goods and or services from multiple retailers or service providers are not eligible to use the new MCC. The marketplace must use the MCC that most accurately describes their line of business such as a marketplace selling only shoes should use MCC 5661 (Shoe Stores).

[REMINDER] Visa Updates Merchant Chargeback and Fraud Monitoring Programs CP/CNP/eComm

The Program: VCMP and VFMP identify acquirers of merchant outlets that generate a disproportionate volume of disputes or fraud relative to their sales volume. Typically, entities identified by these programs will have a dispute-to-sales count ration or a fraud-to-sales amount ratio that is at least four to five times greater than the Visa system average.

The Change: Effective October 1, 2019 Visa will reduce fraud and dispute thresholds for the Visa Fraud Monitoring Program, the Visa Chargeback Monitoring Program and the Visa Acquirer Monitoring Program. Visa will lower the VCMP and VFMP standard thresholds from 100 to 90 basis points and VAMP thresholds from 100 to 75 basis points.

The Impact: Merchants are strongly encouraged to review their fraud and dispute mitigation plans. Any merchant currently in one of the identified programs will receive an update on Visa’s plan during this transition. Visa also recommends that merchants carefully review business practices used for free trial periods and/or recurring billing models to ensure the terms and conditions are properly disclosed to consumers and operate in compliance with the Visa rules.

Program Threshold Criteria  100 or more in dispute count and VCMP Standard Program  0.9 percent or higher ratio of dispute count-to-sales count  1,000 or more in dispute count and VCMP Excessive Program  1.8 percent or higher ratio of dispute count-to-sales count  USD 75,000 or more in fraud amount and VFMP Standard Program  0.9 percent or higher ratio of fraud dollar-to-sales dollar amount  USD 250,000 or more in fraud amount and VFMP Excessive Program  1.8 percent or higher ratio of fraud dollar-to-sales dollar amount  USD 500,000 or more in fraud amount and/or 750 or more in dispute count and VAMP Standard Program  0.75 percent or higher ratio of fraud dollar-to-sales dollar amount / dispute count-to-sales count

Visa will provide Worldpay with monthly Early Warning notifications when merchants do not exceed the program standard thresholds but have met the following qualifications:

Early Warning Type Qualification Criteria  75 or more disputes and VCMP Early Warning  0.65 percent or higher ratio of dispute count-to-sales count  USD 50,000 or more in fraud amount and VFMP Early Warning  0.65 percent or higher ratio of fraud dollar-to-sales dollar amount  USD 250,000 or more in fraud amount and/or 375 or more in dispute count and VAMP Early Warning  0.45 percent or higher ratio of dispute count-to-sales count / fraud dollar- to-sales dollar amount

Discover®

[NEW] Discover Changes to ProtectBuy Liability Shift CNP/eComm

The Program: Discover has made updates to their Operating Regulations and their Disputes Rules manuals regarding changes to the ProtectBuy liability shift.

The Change: Changes in the verbiage regarding the ProtectBuy liability shift are outlined as follows:

If the Merchant uses Discover ProtectBuy to initiate a ProtectBuy Authentication Request for a Card Not Present Card Sale and receives “Unable to Authenticate” as the ProtectBuy Authentication Response, the Card Sale may be subject to Dispute.

Three new eligible MCCs were added:

Card Not Present Card Sales by Merchants operating in the following MCCs that use Discover ProtectBuy and receive a ProtectBuy Authentication Response of “Authentication Successful” or “Authentication Attempted” may be subject to Dispute:

 6540 – Non-Financial Institutions (e.g. stored value card purchase/load)  7801 – Government Licensed On-Line Casinos (e.g. On-Line Gambling)  7802 – Government Licensed Horse/Dog Racing

The Timing: October 18, 2019

[REMINDER] Discover Revises Arbitration and Representment Timeframes CP/CNP/eComm

The Change: Discover is changing the timeframe to initiate a dispute arbitration request from 30 to 10 days from the notice date of a Pre-Arbitration Inquiry decision.

The timeframe for the Acquirer/merchant to initiate representment is being reduced from 45 to 30 days after the Chargeback Dispute Notice issue date.

The Impact: Merchants should be aware of the changes and update processes to ensure adherence with the new timeframes.

The Timing: October 18, 2019

[REMINDER] JCB Expands Existing BIN Ranges CP/CNP/eComm

The Change: JCB has announced they are expanding their BIN ranges.

The Impact: Merchants and partners should ensure all point of sale devices are able to identify, accept, and process the expanded BIN ranges.

New JCB 8-Digit BIN ranges

Start End Issuing Network 30880000 30949999 JCB 30960000 31029999 JCB 31120000 31209999 JCB 31580000 31599999 JCB 33370000 33499999 JCB

The Timing: The new BINs are expected to be in market October 2022.

American Express

[NEW] American Express Announces Two New Error Codes CP/CNP/eComm

The Change: American Express has announced two new error codes:

Error Code 2077 Online Travel Agencies (OTAs) set maximum transaction limits for their clients, e.g. hotels. If the transaction amount exceeds the limit agreed between the OTA and their client, the transaction will decline.

The client will then need to adjust the amount to be within their assigned limit and resubmit the auth request. If the client attempts to force the transaction, then the transaction will reject and Amex will send them a letter.

Error Code 2078 To reject transactions that do not have proper authorization information included. This means transactions that have been forced or no approval was requested or obtained.

Triggering this Error Code will not result in a Non-Compliance Fee. The purpose of the reject is to stop merchants from forcing transactions through submission without an approved authorization.

The Timing: October 18, 2019