Visa Europe Operating Regulations — Scheme United Kingdom and Gibraltar 15 October 2016 THIS PAGE INTENTIONALLY LEFT BLANK Summary of Changes Summary of Changes

This Summary of Changes describes revisions that are included in this edition of the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar. Significant revisions are identified by change bars.

Visa Digital Enablement Program

Background Effective from 20 April 2016, the Visa Digital Enablement Program is available to Issuers.

Regulation Changes The following has been added:  Section 1.22.

Supersedes Member Letter  UK 06/16

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 3 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar THIS PAGE INTENTIONALLY LEFT BLANK About the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

The Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar apply only to Domestic Transactions in the United Kingdom and Gibraltar. The Visa Core Rules and Visa Product and Service Rules and the Visa Europe Membership Regulations will apply to all Transactions involving Members in the United Kingdom and Gibraltar, including Domestic Transactions, unless an exception is provided in the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar. This document must therefore be used in conjunction with the other Visa publications.

Interchange Reimbursement Fees for Domestic Transactions are set out in the Interchange Reimbursement Fees, Cash Disbursement Fees and Qualification Criteria Guide.

This section describes the purpose and function of the Visa Europe Operating Regulations—Scheme— United Kingdom and Gibraltar. It provides an overview of the structure and contents and explains the stylistic conventions used.

Where a translation of the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar is available and in the case of any ambiguities or inconsistencies, the wording, interpretation, intent and meaning of the original version in English will prevail.

Conventions

Grammar and Usage The following conventions apply with regard to grammar and usage throughout the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar:  Effective dates are inclusive. For example, “Effective until 31 December 2016” means effective until and including 23:59 on 31 December 2016 and “Effective from 1 January 2017” means effective from 00:00 on 1 January 2017.  The singular means the plural, and the plural means the singular. For example: “A Merchant must …,” implies that “All Merchants must...”  The masculine means the feminine, and the feminine means the masculine. For example: “A Cardholder may present his Card …,” implies that any Cardholder, regardless of gender, may present a Card.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 5 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Symbols and Style In the Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar, special symbols and conventions are used as follows:  Words that appear with initial capitalisation have a special meaning beyond, or in lieu of, their dictionary meaning, these terms are defined in the Visa Core Rules and Visa Product and Service Rules and Appendix B, "Defined Terms".  References to other documents and sections within the document are in italics.

3-6 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations— Scheme—United Kingdom and Gibraltar

1.1 OVERVIEW ...... 11

1.2 MOBILE PHONE AIRTIME PRE-PAYMENT ...... 11 Merchant Responsibilities ...... 11 Card Registration Restrictions ...... 11 Transaction Restrictions ...... 11 Recurring Transactions for Pre-Paid Mobile Phone Airtime ...... 12 CVV2/AVS Checks After the Initial Transaction ...... 12 CVV2/AVS Checks For Renewed or Replaced Cards ...... 12

1.3 VISA CARD AND VISA ELECTRON CARD SPECIFICATIONS ...... 12 Visa Electron Card Issuers ...... 12 Visa Electron Debit Cards ...... 12 Account Number ...... 12 Debit Cards ...... 12 BIN Requirements ...... 12 Platinum Card Issuers ...... 13 BIN Requirements ...... 13 Visa Issuers ...... 13 General Requirements ...... 13 BIN Requirements ...... 13 Visa Select Card Issuers ...... 13 General Requirements ...... 13 BIN Requirements ...... 14 Proximity Payment Device Requirements ...... 14

1.4 GLOBAL SUPPORT SERVICE ...... 14 Global Customer Assistance Services ...... 14

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 7 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.5 PAYMENT SERVICE STANDARDS ...... 14 Authorization Standards ...... 14 Referral Responses ...... 14 Minimum Monthly Approval Rates ...... 14

1.6 CARDHOLDER STATEMENTS ...... 15

1.7 NON-MEMBER REQUIREMENTS ...... 15

1.8 VALIDATION OF EXPIRY DATE ...... 15 Issuer Requirements ...... 15 Acquirer Requirements ...... 15 Merchant Category Code Requirements ...... 15 Certification Requirements ...... 16 Routing of Card Present Key Entered Transactions to Issuers ...... 16

1.9 ELECTRONIC COMMERCE ...... 16 Verified by Visa (VbV) Enrolment Policy ...... 17 Verified by Visa Passwords ...... 17

1.10 VISA ACCOUNT UPDATER ...... 17

1.11 UNATTENDED ACCEPTANCE TERMINALS ...... 17

1.12 AUTOMATED FUEL DISPENSERS ...... 18

1.13 CHIP CARD TRANSACTIONS ...... 18 Chip-Reading Devices ...... 18 Fallback at Point-of-Transaction Terminals ...... 18 Fallback at Unattended Acceptance Terminal Transactions ...... 18

1.14 DEBT REPAYMENTS ...... 19

1.15 INSTALMENT TRANSACTIONS ...... 19 General Requirements ...... 19

1.16 QUASI CASH TRANSACTIONS ...... 19 Gaming Chips ...... 19

1.17 CASH-BACK SERVICES ...... 19

1.18 BETTING ...... 20 Acceptance ...... 20 Payment of Winnings ...... 20

1.19 MANUAL CASH DISBURSEMENTS ...... 20 Validation of Cardholder Identity ...... 20

8 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.20 VISA PURCHASING PROGRAM ...... 21 Penalties for Failure to Comply with the Visa Purchasing Program ...... 21

1.21 CARD LINKED OFFERS SERVICE ...... 22 Registration and Eligibility ...... 22 Transaction Processing ...... 22 Transaction Data ...... 22 Marketing ...... 22 Use of Marks ...... 22 Notice ...... 23

1.22 VISA DIGITAL ENABLEMENT PROGRAM ...... 23 of Engagement and Third Party Beneficiary Rights ...... 23 Visa Approval ...... 24 Engagement and Testing Period ...... 24 Participation Timeframe ...... 24 Termination and Notice ...... 24 Material Breach ...... 25 Technical Support ...... 25 Service Support ...... 25 Brand Requirements ...... 25 Intellectual Property ...... 25 Use of an Issuer’s Intellectual Property by Visa ...... 25 Use of an Issuer’s Intellectual Property by Token Requestor ...... 26 Use of a Token Requestor’s Intellectual Property ...... 26 Uniform Services ...... 27 Data Protection ...... 27 Data Security ...... 27 Escalation and Visa Arbitration ...... 27 Liability ...... 27

1.23 RESOLUTION ...... 28 Dispute Group 1—Request For Information ...... 28 Reason Code 75—Transaction not Recognized ...... 28 Dispute Group 2—Fraud ...... 28 Reason Code 57—Fraudulent Multiple Transactions ...... 28 Reason Code 81—Fraud—Card-Present Environment ...... 29 Reason Code 83—Fraud—Card-Absent Environment ...... 31 Reason Code 93—Effective until 30 June 2016, Merchant Fraud Performance Program, and effective from 1 July 2016, Visa Fraud Monitoring Program ...... 31 Dispute Group 3—Authorization ...... 32 Reason Code 70—Card Recovery Bulletin or Exception File ...... 32 Reason Code 71—Declined Authorization ...... 32 Reason Code 72—No Authorization ...... 34 Reason Code 73—Expired Card ...... 35 Reason Code 78—Service Code Violation ...... 35

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 9 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 4—Processing Error ...... 36 Reason Code 74—Late Presentment ...... 36 Reason Code 76—Incorrect Currency or Transaction Code or Domestic Transaction Processing Violation ...... 36 Reason Code 77—Non-Matching Account Number ...... 37 Reason Code 80—Incorrect Transaction Amount or Account Number ...... 37 Reason Code 82—Duplicate Processing ...... 38 Reason Code 86—Paid by Other Means ...... 38 Dispute Group 5—Cancelled/Returned ...... 39 Reason Code 53—Not as Described or Defective Merchandise ...... 39 Reason Code 85—Credit Not Processed ...... 39 Dispute Group 6—Non-Receipt Goods/Services ...... 40 Reason Code 30—Services Not Provided or Merchandise Not Received ...... 40 Reason Code 90—Non-Receipt of Cash or Load Transaction Value at ATM or Load Device ...... 41

10 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.1 OVERVIEW

The Visa Core Rules and Visa Product and Service Rules and the Visa Europe Membership Regulations apply to all Transactions involving Members in the United Kingdom and Gibraltar. The exceptions provided in the sections below apply only to Domestic Transactions in the United Kingdom and Domestic Transactions in Gibraltar, unless otherwise specified. 1.2 MOBILE PHONE AIRTIME PRE-PAYMENT The regulations set out below must be complied with in order to reduce fraud that results from compromised Account Numbers used to purchase pre-paid mobile phone airtime. This Section 1.2 does not apply to Acquirers of Domestic Transactions in Gibraltar or Acquirers of Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Acquirers.

1.2.1 Merchant Responsibilities A Transaction occurring in a Card Not Present Environment at a permitted Merchant Outlet is allowed only if the Visa Card or Visa Electron Card used to purchase the pre-paid mobile phone airtime has been previously registered at the Merchant Outlet for this purpose.

1.2.1.1 Card Registration Restrictions When a Merchant registers a Visa Card or Visa Electron Card with a service provider for the purchase of pre-paid mobile phone airtime, the following registration restrictions apply:  No more than two Visa Cards or Visa Electron Cards can be registered per mobile phone account;  No more than two mobile phone accounts can be registered per Visa Card or Visa Electron Card; and  The Merchant must obtain the Cardholder's name and home address.

1.2.1.2 Transaction Restrictions When a Merchant undertakes a Transaction for the purchase of pre-paid mobile phone airtime, the following Transaction restrictions apply:  Authorization must be obtained from the Issuer for all Transactions;  Card Verification Value 2 (CVV2) and Account Verification Service (AVS) data must be checked for Authorization Requests on all CNP pre-paid mobile phone top up Transactions; and  All Transactions must contain the Merchant Category Code 4814 — Telecommunication Services.

If an Issuer charges back a Transaction because of fraudulent use:  The Acquirer must inform the Merchant; and  The Merchant must: — Bar the mobile phone account(s) for which the fraudulent pre-payment was made, thus preventing further calls; — Cancel the Visa Card or Visa Electron Card registration; and — Not re-register a Visa Card or Visa Electron Card which has the same Account Number.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 11 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.2.2 Recurring Transactions for Pre-Paid Mobile Phone Airtime If a Cardholder enters a Recurring Transaction agreement with a Merchant for pre-paid mobile phone airtime, the initial Transaction must be positively authenticated by either:  Verified by Visa (VbV)—Electronic Commerce Indicator (ECI) 5; or  CVV2/AVS checks.

1.2.2.1 CVV2/AVS Checks After the Initial Transaction CVV2/AVS checks are not required on subsequent Transactions under the Recurring Transaction agreement when all of the following criteria are met:  Only one Recurring Transaction agreement per mobile phone account is permitted;  The account of the Visa Card or Visa Electron Card is one of the two registered to that mobile phone account, as specified in Section 1.2.1.1;  CVV2/AVS data was submitted as part of a previous Transaction for pre-paid mobile phone airtime, made on the same account of the registered Visa Card or Visa Electron Card, and confirmed as matched by the Issuer at least three months prior to setting up the Recurring Transaction; and  The maximum amount of £30 per calendar month is not exceeded.

1.2.2.2 CVV2/AVS Checks For Renewed or Replaced Cards If a Cardholder receives a renewed or replaced Visa Card or Visa Electron Card, a new CVV2/AVS data check must be carried out and confirmed as matched by the Issuer, before the new Visa Card or Visa Electron Card may be used for the Recurring Transaction. In these circumstances, the three month waiting requirement, as specified in Section 1.2.2.1, does not apply. 1.3 VISA CARD AND VISA ELECTRON CARD SPECIFICATIONS This section specifies the regulations with which Issuers must comply when issuing Visa Cards and Visa Electron Cards. Design specifications for all Cards must comply with the Visa Product Brand Standards.

1.3.1 Visa Electron Card Issuers The Visa Core Rules and Visa Product and Service Rules is amended as follows:

1.3.1.1 Visa Electron Debit Cards An Issuer, when issuing Visa Electron Cards to its Cardholders in the United Kingdom, must only issue those Visa Electron Cards as Debit Cards.

1.3.1.2 Account Number An Issuer, when issuing Visa Electron Cards to its Cardholders in the United Kingdom, must print the entire Account Number on the front of those Visa Electron Cards.

1.3.2 Debit Cards The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

1.3.2.1 BIN Requirements Each Issuer, when issuing Debit Cards to its Cardholders in the United Kingdom, must:  Use a unique BIN for its program. The Issuer must either: — Choose a BIN from a BIN range previously assigned to it by Visa; or — Request a new BIN assignment from Visa.  If using a previously assigned BIN or BIN range, notify Visa of the selected BIN or BIN range before any Debit Cards can be issued on that BIN; and  Send a Visa Interchange Directory Update Form and a BIN Licensing Agreement Form to Visa.

12 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.3.3 Platinum Card Issuers An Issuer, when issuing Visa Platinum Cards to its Cardholders in the United Kingdom, may optionally offer those Cardholders of Visa Platinum Cards to any of the following:  A line of credit;  A depository account; or  Other Cardholder assets available through the Issuer.

1.3.3.1 BIN Requirements The Visa Core Rules and Visa Product and Service Rules is amended to include the following Visa Platinum Card requirements:

An Issuer, when issuing Visa Platinum Cards to its Cardholders in the United Kingdom, must send a Visa Interchange Directory Update Form and a BIN Licensing Agreement Form to Visa.

1.3.4 Visa Charge Card Issuers An Issuer may offer its Cardholders in the United Kingdom a Visa Charge Card as a payment device.

1.3.4.1 General Requirements

1.3.4.1.1 A Visa Charge Card must be capable of Proximity Payments.

1.3.4.1.2 Issuers of Visa Charge Cards must:  Direct their Cardholders of Visa Charge Cards, at least once a year, to a website containing details of Visa Charge Card retail offers; and  Give their Cardholders of Visa Charge Cards an interest free period of at least 15 days from the date that the statement is issued.

1.3.4.2 BIN Requirements A Visa Charge Card must use either:  A discrete account range within a BIN designated for credit; or  A separate BIN designated for the Visa Charge Card.

1.3.5 Visa Select Card Issuers An Issuer may offer its Cardholders in the United Kingdom a Visa Select Card as a payment device.

1.3.5.1 General Requirements

1.3.5.1.1 A Visa Select Card must be capable of Proximity Payments.

1.3.5.1.2 Issuers of Visa Select Cards must:  Offer a minimum credit line of: — £3,000 to 85 percent or more of their Cardholders of a Visa Select Card; and — £2,000 to ten percent or less of their Cardholders of a Visa Select Card;  Direct their Cardholders of Visa Select Cards, at least three times a year, to a website containing details of Visa Select Card retail offers;  Give their Cardholders of Visa Select Cards an interest free period of at least 15 days from the date that the statement is issued;  Provide Cardholders of Visa Select Cards a customer support service, 24-hours a day, seven days a week; and  Provide Value-Added Services to their Cardholders of a Visa Select Card, totalling a minimum of 20 points, as defined in Appendix A, "Exhibits", Exhibit UK10A, Table A-1, “Value-Added Services”.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 13 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.3.5.1.3 An Issuer may offer a credit line of below £2,000 to five percent or less of their Cardholders of a Visa Select Card.

1.3.5.2 BIN Requirements A Visa Select Card must use a separate account range within an existing credit BIN designated for the Visa Select Card.

1.3.6 Proximity Payment Device Requirements The Visa Core Rules and Visa Product and Service Rules is amended as follows:

An Issuer, when issuing Proximity Payment Devices to its Cardholders in the United Kingdom, must submit 10 sample Cards to be used for Proximity Payments to Visa for personalization and performance validation prior to issuance. Submitted Cards will be retained by Visa for future interoperability testing. Subsequent personalization or changes to a Card will require re-submission of the Card to Visa. 1.4 GLOBAL SUPPORT SERVICE This section governs the global support services offered by Visa for use with Visa Platinum Cards issued to Cardholders in the United Kingdom. This section does not apply to Visa Platinum Cards issued to Cardholders in Gibraltar.

1.4.1 Global Customer Assistance Services The Visa Core Rules and Visa Product and Service Rules is amended to include the requirements for Visa Platinum Cards. 1.5 PAYMENT SERVICE STANDARDS

1.5.1 Authorization Standards This Section 1.5 specifies the payment service standard requirements for Visa Card Programs. This Section 1.5 does not apply to Visa Card Programs in Gibraltar and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Visa Card Programs.

1.5.2 Referral Responses

1.5.2.1 Minimum Monthly Approval Rates The Visa Core Rules and Visa Product and Service Rules, Table 7-4 “Minimum Monthly Approval Rates” is amended as follows to include Transactions using a Visa Select Card. Table 1-1 Minimum Monthly Approval Rates

Category of Merchants / Transactions Visa Select Cards

Retail 98% Airlines 98% Hotels 98% Cruise Lines 98% Car Rentals 98% Mail/Phone Order Not applicable Quasi-Cash Not applicable ATM Disbursements 65% Manual Cash Disbursements 85%

14 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.6 CARDHOLDER STATEMENTS The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

An Issuer of Visa Cards and/or Visa Electron Cards must print an Airline ticket number on the Cardholder’s statement, where it has been provided in the Merchant name field of the Clearing Record.

This Section 1.6 does not apply where the Card is issued to a Cardholder in Gibraltar and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply in relation to such Cards. 1.7 NON-MEMBER REQUIREMENTS The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

An Issuer, when issuing Cards to its Cardholders in the United Kingdom must print that Issuer’s name prominently on the Cardholder’s statement where the Cards are issued in accordance with the provisions of the Visa Core Rules and Visa Product and Service Rules. The determination as to whether the Issuer’s name is sufficiently prominent will be made by Visa. 1.8 VALIDATION OF EXPIRY DATE This Section 1.8 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

1.8.1 Issuer Requirements Issuers must:  Have the systems capability of validating expiry dates for all Authorization Requests and Authorization Reversals. This includes both Domestic Transactions and International Transactions; and  Not approve Authorization Requests with an incorrect expiry date if the MCC is listed in Table 1-2. This requirement also applies to Recurring Transactions.

1.8.2 Acquirer Requirements Acquirers must include correct expiry dates in both:  Authorization Requests; and  Authorization Reversals.

1.8.3 Merchant Category Code Requirements Expiry date validation must be in place at least for the following Merchant Category Codes set out in Table 1-2. Table 1-2 Merchant Category Code Requirements

MCC Merchant Type

4812 Te lecom Eq uipme nt 5310 Discount Stores 5331 Variety Stores 5399 Miscellaneous General Merchandise 5533 Auto Parts 5611 Mens Wear 5621 Ladies Wear 5631 Women’s Accessory Shops 5641 Children’s Wear

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Table 1-2 Merchant Category Code Requirements (Continued)

MCC Merchant Type

5651 Family Clothing 5655 Sports Wear 5661 Foot Wear 5691 Mens/Womens Clothing 5712 Furniture 5722 Household Appliance Stores 5732 Electronic Sales 5813 Bars and Night Clubs 5921 Off Licences 5940 Bicycle Shops 5941 Sporting Goods 5944 Jewellers 5946 Cameras 5948 Luggage and Leather Goods 5967 Direct Marketing - Inbound Service 5999 Speciality Stores 6010 Cash Advances 6051 Foreign Currency 7299 Miscellaneous Personal Services 7372 Computers and Data Processing 7538 Auto Repair Shops

1.8.4 Certification Requirements New Members must confirm to Visa that they can comply with the systems capability requirements for expiry date validation for all their Card programs.

1.8.5 Routing of Card Present Key Entered Transactions to Issuers Issuers in the United Kingdom that receive Authorization Requests or Authorization Reversals must ensure that all Authorization Requests and Authorization Reversals containing POS Entry Mode code “01” are automatically routed to Issuers when their systems are available. Use of this parameter will facilitate expiry date checking. 1.9 ELECTRONIC COMMERCE The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

All Visa Members that accept Debit Cards for the payment of bills are required to implement Verified by Visa.

16 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.9.1 Verified by Visa (VbV) Enrolment Policy Issuers must comply with the 3-D Secure Issuer Guide—Activation During Shopping (ADS) Implementation Guide. The levels at which Issuers can change their Verified by Visa (VbV) enrolment policy are as follows: Table 1-3 Verified by Visa Enrolment Policy

Level of Cardholder Number of Opt Outs Enrolment1

60% Issuer would be allowed to move to two opt outs as a minimum requirement 70% Issuer would be allowed to move to one opt out as minimum requirement 75% Issuer would be able to request from Visa a move to forced enrolment if they could provide additional information that would demonstrate that they are taking action to increase enrolment numbers, such as a customer mailing, or a prize promotion 80% Issuer would be allowed to move to forced enrolment

1. Fully Verified by Visa (VbV) authenticated Transaction count (ECI 5) as a percentage of total VbV Transaction count (ECI 5 + ECI 6).

Visa will monitor each Issuer’s level of VbV authentication negative (N) responses. If the level of N responses exceeds five per cent, the Issuer will be required to revert to the previous level of opt outs.

1.9.2 Verified by Visa Passwords Issuers must not use static passwords for authenticating their Cardholders that are registered to use VbV.

This requirement can be fulfilled by deploying:  Partial passwords, for example the first, third and fifth digits of the full password;  Passive authentication, where authentication takes place in the background with no cardholder participation; or  One-time passwords. 1.10 VISA ACCOUNT UPDATER

1.10.1 All Issuers, when issuing Cards to its Cardholders in the United Kingdom are required to participate in the Visa Account Updater. The Visa Account Updater is optional for Issuers when issuing Cards to its Cardholders in Gibraltar.

1.10.2 All Acquirers are required to participate in the Visa Account Updater other than Acquirers of Domestic Transactions in Gibraltar only, for whom the Visa Account Updater is optional. 1.11 UNATTENDED ACCEPTANCE TERMINALS

1.11.1 The Visa Core Rules and Visa Product and Service Rules is amended as follows:

All Unattended Acceptance Terminals deployed in the United Kingdom, except those that only accept Telephone Service Transactions or those that are ATMs, must operate as Point-of-Transaction Terminals. Such Unattended Acceptance Terminals must meet all of the following requirements:  Automated Fuel Dispensers (AFDs) must not accept Visa Electron Cards;  Online PIN Verification is prohibited for Magnetic Stripe Transactions;  Offline and Online PIN Verification is permitted for Chip Transactions;  Magnetic-Stripe only terminals must retain Cards on receipt of a Pickup Response from the Issuer or the Issuer’s nominated agent; and  Retention of Cards is optional at an Unattended Acceptance Terminal that accepts both Chip Cards and Magnetic-Stripe Cards.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 17 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.11.2 Effective from 15 April 2016, where an Acquirer chooses to deploy an Unattended Acceptance Terminal without a PIN pad, as specified in the Visa Core Rules and Visa Product and Service Rules the maximum permitted Transaction Amount is the country-level limit defined in the Visa Core Rules and Visa Product and Service Rules. 1.12 AUTOMATED FUEL DISPENSERS The rules that applied to Domestic Transactions processed at Automated Fuel Dispensers deployed within the United Kingdom and Gibraltar are no longer variances to the Automated Fuel Dispenser rules in the Visa Core Rules and Visa Product and Service Rules, with the following exceptions:

1.12.1 Effective from 15 April 2016, an Issuer must be certified by Visa to receive an Acquirer Confirmation Advice.

1.12.2 Effective from 14 October 2016, a Merchant must estimate the Transaction Amount for Authorization based on either the Cardholder’s pre-selected fuel amount or the maximum amount.

1.12.3 Effective from 15 April 2016, an Issuer must be certified by Visa to support Partial Authorization at an Automated Fuel Dispenser. 1.13 CHIP CARD TRANSACTIONS

1.13.1 Chip-Reading Devices The Visa Core Rules and Visa Product and Service Rules is amended as follows:

All Chip-Reading Devices that are newly-deployed in the United Kingdom since 1 January 2005 must support both “Plaintext PIN verified offline” and “Enciphered PIN verified offline”. This Section 1.13.1 does not apply to Chip-Reading Devices deployed in Gibraltar and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Chip-Reading Devices.

1.13.2 Fallback at Point-of-Transaction Terminals The criteria for processing Fallback Transactions are listed in Table 1-4. This Section 1.13.2 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions. Table 1-4 Fallback Transaction Criteria

Point-of-Transaction Card Fallback Te rminal Type

Chip-Reading Device Chip Card Magnetic Stripe, Zero Key entry/Imprint Chip-Reading Device or Card bearing a Magnetic Key entry Zero Chip and PIN Stripe Imprint Magnetic Stripe Terminal Chip Card or Card Key entry Zero bearing a Magnetic Imprint Stripe

1.13.3 Fallback at Unattended Acceptance Terminal Transactions Fallback Transactions must not be processed for either Chip Card Transactions or Magnetic Stripe Transactions in Chip-Reading Devices that are Unattended Acceptance Terminals.

18 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.14 DEBT REPAYMENTS The Visa Core Rules and Visa Product and Service Rules is amended as follows:

1.14.1 Visa Cards and Visa Electron Cards may be used for the repayment of debt.

This Section 1.14 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

1.14.2 When accepting a Visa Card or Visa Electron Card for the repayment of debt:  The principal business of the Merchant must be the collection of overdue debts;  The Merchant should be a member of their recognized professional body or association;  All Transactions must have a Zero Floor Limit;  All Transactions must use Merchant Category Code 7299 - “Miscellaneous Personal Services”; and  Authorization Requests and Clearing Records must be flagged to indicate the Transaction type. 1.15 INSTALMENT TRANSACTIONS The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

1.15.1 General Requirements If a Merchant offers an Instalment Transaction option, that Merchant must write ‘Instalment Transaction’ on the signature line of the Transaction Receipt.

This Section 1.15 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions. 1.16 QUASI CASH TRANSACTIONS The Visa Core Rules and Visa Product and Service Rules is amended as follows:

1.16.1 Gaming Chips A casino may accept a Card as payment for the purchase of gaming chips. Authorization for the entire Transaction Amount must be requested for each Transaction.

The Visa Core Rules and Visa Product and Service Rules is amended as follows:

The validation of a Cardholder’s identity using secondary identification is not required for the purchase of gaming chips in casinos in the United Kingdom. 1.17 CASH-BACK SERVICES The Visa Core Rules and Visa Product and Service Rules is amended as follows:

1.17.1 A Merchant may provide Cash-Back to Cardholders of Visa Debit Cards and Visa Electron Cards at the option of the Acquirer. This Section 1.17 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 19 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.17.2 As well as the Cash-Back rules in the Visa Core Rules and Visa Product and Service Rules, if Cash-Back is provided the Merchant must:  Offer a maximum value of £100 Cash-Back for a single Transaction;  For a Visa Debit Card where the Cash-Back element of the Transaction exceeds £15, obtain an Online Authorization;  For all Transactions using a Visa Electron Card, obtain Authorization;  Complete electronic data-capture of the Transaction; and  Electronically process all Visa Electron Card Transactions and transmit the full Chip data and the Magnetic Stripe Data in the Authorization Request. 1.18 BETTING This section specifies rules relating to the use of Visa Cards or Visa Electron Cards for Transactions when placing a bet. This Section 1.18 does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

1.18.1 Acceptance Transactions used for placing a bet must have a Zero-Floor Limit.

1.18.2 Payment of Winnings When a bet is placed with a Merchant (in both a Card-Present Environment and a Card-Not-Present Environment) using a Visa Card or Visa Electron Card, any winnings or returns must be paid using an Original Credit Transaction processed to the Account Number that was used in the Transaction which placed the winning bet. 1.19 MANUAL CASH DISBURSEMENTS The Visa Core Rules and Visa Product and Service Rules is amended as follows:

A Member or its foreign Branch may make Manual Cash Disbursements to Cardholders, provided it follows the requirements of this section.

1.19.1 Validation of Cardholder Identity Where a Member or its foreign Branch makes a Manual Cash Disbursement to its Cardholders, that Member or its foreign Branch must review positive Cardholder identification bearing the Cardholder’s photograph and signature. This Section 1.19.1 does not apply to Manual Cash Disbursements that are Domestic Transactions in Gibraltar or Extended Domestic Transactions, and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

1.19.1.1 Identification must be an unexpired official government document bearing the Cardholder's signature, such as a:  Passport;  Driver's licence; or  Identification (ID) card.

1.19.1.2 Details of the identification document, type of document, serial number and expiry date must be recorded on the Transaction Receipt of the Cash Disbursement.

1.19.1.3 In the absence of an appropriate form of identification, the Transaction must be declined.

20 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.20 VISA PURCHASING PROGRAM The Visa Core Rules and Visa Product and Service Rules is amended to include the following:

Acquirers of Visa Purchasing Cards must comply with the requirements as specified in:  VGIS Data Processing Requirements;  Visa Purchasing Processing Requirements; and  Country Specific Reporting Requirement.

1.20.1 Penalties for Failure to Comply with the Visa Purchasing Program An Acquirer that does not comply with the criteria specified in Section 1.20 is subject to the penalties in Table 1-5. Table 1-5 Acquirer Penalties for Non-Compliance with the Visa Purchasing Program

Violation Time Period Visa Action or Fine

Problem Not Resolved or Resolution Plan Not Provided

Problem not resolved or resolution 60 calendar days €5,000 plan not provided after receipt of notification Problem not resolved or resolution 90 calendar days €10,000 plan not provided after receipt of notification Problem not resolved or resolution 120 calendar days every 30 €25,000, and €25,000 every 30 plan not provided after receipt of calendar days thereafter until calendar days thereafter until notification compliance is achieved compliance is achieved Problem not resolved or resolution 180 calendar days Visa discretion plan not provided after receipt of notification

Agreed Resolution Date Not Met

Problem not resolved by the Agreed-upon resolution date €5,000 agreed-upon date Problem not resolved Within 30 calendar days of the €10,000 agreed-upon resolution date Problem not resolved Within 60 calendar days of the €25,000, and €25,000 every 30 agreed-upon resolution date plus calendar days thereafter until every 30 calendar days thereafter compliance is achieved until compliance is achieved Problem not resolved Within 180 calendar days of the Visa discretion agreed-upon resolution date

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 21 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.21 CARD LINKED OFFERS SERVICE

1.21.1 Registration and Eligibility

1.21.1.1 An Issuer may, at its own option, register with Visa to join the Card Linked Offers Service. An Issuer that joins the Card Linked Offers Service must provide Visa with the details of all BINs that Issuer wishes to include.

1.21.1.2 An Issuer will determine which of its Cardholders are eligible to join the Card Linked Offers Service. Those eligible Cardholders may then register with Visa and join the Card Linked Offers Service.

1.21.2 Transaction Processing

1.21.2.1 An Issuer must process all payments associated with the Card Linked Offers Service as Original Credit Transactions to the Account Number of the Cardholder’s registered Card.

1.21.2.2 An Original Credit Transaction associated with the Card Linked Offers Service will not carry an Interchange Reimbursement Fee.

1.21.3 Transaction Data

1.21.3.1 Where a Cardholder has registered with Visa for the Card Linked Offers Service, that Cardholder’s Issuer will be required to provide Transaction data to Visa, including:  All Transaction data linked to that Cardholder's Card for the 18 months before the date of registration; and  On a daily basis, all Transaction data linked to that Cardholder's Card after the date of registration, as set out in the Card Linked Offers On-us Data Transfer Member Implementation Guide.

1.21.3.2 Visa may, at the Issuer's option and on the Issuer's behalf, receive the Transaction data described in Section 1.21.3.1 from the Issuer's third-party.

1.21.3.3 The Transaction data that Visa receives as part of the Card Linked Offers Service will be used in line with Visa's privacy policy, as provided to Cardholders before registering for the Card Linked Offers Service.

1.21.4 Marketing

1.21.4.1 An Issuer is responsible for marketing activities and communications associated with the Card Linked Offers Service provided to that Issuer’s Cardholders, in line with the Visa Product Brand Standards.

1.21.4.2 Visa reserves the right to review and amend such communications, set out in Section 1.21.4.1, and coordinate such communications with Merchants that provide offers, as agreed with an Issuer.

1.21.5 Use of Marks

To the extent that Visa has permission from a Merchant, Visa shall provide a Member with a licence to use that Merchant’s branding. Such licence must only be used:  In association with the Card Linked Offers Service;  In accordance with that Merchant’s brand guidelines, as communicated by Visa; and  Subject to Visa instruction, as determined from time to time.

22 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.21.6 Notice

1.21.6.1 An Issuer must provide Visa with 90 calendar days’ written notice of its wish to withdraw from participating in the Card Linked Offers Service.

1.21.6.2 Visa reserves the right to withdraw the Card Linked Offers Service from a Cardholder, without prior notice to the Cardholder or the Issuer of that Cardholder. 1.22 VISA DIGITAL ENABLEMENT PROGRAM

1.22.1 Choice of Engagement and Third Party Beneficiary Rights

1.22.1.1 The Visa Digital Enablement Program provides an Issuer with two alternative options for engaging any given Token Requestor.

1.22.1.2 Effective from 20 April 2016, option one is programmatic engagement. An Issuer must agree to all the terms set out in this Section 1.22, to apply to that Issuer and engaged Token Requestor. Where an Issuer chooses to agree to all terms set out in this Section 1.22, Visa shall make:  That Issuer a third party beneficiary, for the duration that that Issuer is engaged with that Token Requestor, with the power to enforce the following terms: — The intellectual property provisions at Section 1.22.12 and Section 1.22.13; — Data protection and data security at Section 1.22.15 and Section 1.22.16 respectively; — Participation Timeframe at Section 1.22.4; and — Termination and Notice at Section 1.22.5.  That Token Requestor a third party beneficiary, for the duration that that Token Requestor is engaged with that Issuer, with the power to enforce the following terms: — The intellectual property provisions at Section 1.22.12 and Section 1.22.13; — Data protection and data security at Section 1.22.15 and Section 1.22.16 respectively; — The provisions regarding use of authentication methods at Section 1.22.7.2; — Participation Timeframe at Section 1.22.4; and — Termination and Notice at Section 1.22.5.

1.22.1.3 Effective from 20 April 2016, option two is bi-lateral engagement. Any bi-lateral agreement, agreed between an Issuer and Token Requestor must support the following terms, for the period that that Issuer is engaged with any given Token Requestor:  Visa Approval as at Section 1.22.2;  Engagement and Testing Period at Section 1.22.3;  Call centre requirements at Section 1.22.8.2;  Provisioning requirements at Section 1.22.7.2; and  Data protection and data security at section 9.4 of the Visa Digital Enablement Program Legal and Commercial Guide.

Where an Issuer chooses to adopt option two and bi-lateral engagement, it must enter into a bi-lateral agreement with that Token Requestor. That Issuer must:  Promptly notify Visa, in writing, of that bi-lateral agreement; and  Ensure that that bi-lateral agreement does not include a participation timeframe between that Issuer and Token Requestor that is less than two years, from point of commercial launch.

This Section 1.22.1.3 sets out the only Visa requirements, where an Issuer adopts bi-lateral engagement. All other terms, agreed in that bi-lateral agreement, are at the Issuer and Token Requestor’s discretion and do not need to mirror any other provisions set out in this Section 1.22.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 23 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.22.2 Visa Approval

1.22.2.1 Effective from 20 April 2016, Visa will approve any given service, offered by a Token Requestor, through the Visa Digital Enablement Program. Visa reserves the right to withdraw approval of a service, at any time, to be communicated to that Token Requestor and an engaged Issuer.

1.22.3 Engagement and Testing Period

1.22.3.1 Effective from 20 April 2016, where an Issuer has engaged with a Token Requestor through the Visa Digital Enablement Program, that Issuer will work, with Visa and that Token Requestor, to enable its Card Portfolio to support the Token Requestor Service. The duration of this engagement and testing period will be agreed between an Issuer, Token Requestor and Visa on a case by case basis and will begin at the point at which the Issuer communicates its intention to join the Visa Digital Enablement Program by technical integration or otherwise.

1.22.3.2 At the end of such engagement period, an Issuer will:  Have the majority of its Card portfolio eligible to be associated with a Token, through the Token Requestor service (to be maintained for the duration of that Issuer’s participation in the program); and  Commercially launch the tested service with its Cardholders by making it available to its Cardholders.

1.22.4 Participation Timeframe

1.22.4.1 Effective from 20 April 2016, an Issuer will support a Token Requestor service, for a minimum of two years, from the point of commercial launch.

1.22.4.2 Effective from 20 April 2016, Visa will, following an Issuer’s initial two year participation term in a Token Requestor service:  Automatically renew that Issuer’s participation for a further 12 months, in that Token Requestor service; and  Repeat such automatic renewal at the end of each consecutive 12 month period.

1.22.5 Termination and Notice

1.22.5.1 Effective from 20 April 2016, following the initial two year period of participation, an Issuer must provide Visa with 90 calendar days’ written notice of its wish to withdraw from supporting the Token Requestor service. For the avoidance of doubt, the earliest point that notice of termination can be given by an Issuer, is 90 days before the initial two year period of participation ends.

1.22.5.2 Effective from 20 April 2016, where an Issuer provides 90 calendar days’ written notice of its intention to no longer support a Token Requestor service through the Visa Digital Enablement Program, that Issuer will continue to offer the service for a period of no less than 180 days (or as agreed between an Issuer and its engaged Token Requestors) to ensure the orderly winding-down of associated services. For the avoidance of doubt, the winding-down period of 180 days shall begin 90 calendar days after the written notice of termination has been provided, by an Issuer, to Visa.

1.22.5.3 Effective from 20 April 2016, an Issuer must terminate its engagement with a Token Requestor, through the Visa Digital Enablement Program, where Visa has terminated its agreement with that Token Requestor, as communicated to the Issuer by Visa. Where an Issuer wishes to continue participating in a Token Requestor service outside of the Visa Digital Enablement Program, where the agreement between Visa and that Token Requestor has been terminated, the regulations set out in this Section 1.22 will not apply to that participation.

24 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.22.6 Material Breach

1.22.6.1 Effective from 20 April 2016, an Issuer may, at any time and including the initial two year term of any given service, terminate its agreement with a Token Requestor, by written notice to Visa and such Token Requestor (at the address given in the corresponding legal and commercial guide), in the event of a material breach by that Token Requestor of any regulation set out in this Section 1.22. An Issuer must give a Token Requestor 30 days to remedy a material breach, from the date that notice of that breach is given, by the Issuer to that Token Requestor.

1.22.6.2 Effective from 20 April 2016, a Token Requestor may, at any time and including the initial two year term of any given service, terminate its agreement with an Issuer, by written notice to Visa and such Issuer (at the address provided to the Token Requestor from time to time by Visa or that Issuer or, if no address has been provided, at that Issuer’s registered address), in the event of a material breach by that Issuer of any regulation set out in this Section 1.22. A Token Requestor must give an Issuer 30 days to remedy a material breach, from the date that notice of that breach is given, by the Token Requestor to that Issuer.

1.22.7 Technical Support

1.22.7.1 Effective from 20 April 2016, an Issuer must comply with all requirements of the Visa Europe Payment Token Service, as set out in the Visa Core Rules and Visa Product and Service Rules.

1.22.7.2 Effective from 20 April 2016, an Issuer is responsible for Cardholder eligibility decisions, provisioning and managmenent of Tokens, approving or declining Transactions and managing its Card portfolio and associated accounts.

1.22.8 Service Support

1.22.8.1 Effective from 20 April 2016, an Issuer will work and cooperate reasonably with Visa and the Token Requestor to define and implement customer support methods associated with a Token Requestor service, including back office coordination, data exchange (if any) and customer facing communications, amongst other methods.

1.22.8.2 Effective from 20 April 2016, an Issuer must provide call centre support, for any service provided to its Cardholders through the Visa Digital Enablement Program, as a verification option for that Issuer to verify Cardholders, for the term of that Issuer’s participation in the program.

1.22.9 Brand Requirements Effective from 20 April 2016, an Issuer that has joined the Visa Digital Enablement Program must comply with the requirements as set out in the Visa Product Brand Standards.

1.22.10 Intellectual Property Effective from 20 April 2016, all Intellectual Property rights in the Visa Digital Enablement Program, all components of the Visa Digital Enablement Program including the Visa Europe Payment Token Service, and any future enhancements to and adaptations of the Visa Digital Enablement Program are and shall be owned by Visa and/or its licensors, as determined by Visa. This regulation is an extension of the Visa Europe Technology License.

1.22.11 Use of an Issuer’s Intellectual Property by Visa

1.22.11.1 Effective from 20 April 2016, an Issuer hereby grants Visa a non-exclusive, license to use, reproduce and display the Issuer-provided Card art, trademarks, service marks and logos within the Visa Digital Enablement Program, for as long as that Issuer is engaging in the program.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 25 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Visa will only use an Issuer’s Card art, trademarks, service marks and logos in line with that Issuer’s guidelines to the extent defining the appearance and manner of display of the Issuer’s Card art, trademarks, service marks and logos in connection with, and to market, advertise and promote the availability of the Visa Digital Enablement Program.

1.22.11.2 Effective from 20 April 2016, any other use, by Visa, of an Issuer’s Card art, trademarks, service marks and logos, different to the permissions set out in this Section 1.22.11 shall be subject to the written approval of that Issuer

1.22.12 Use of an Issuer’s Intellectual Property by Token Requestor

1.22.12.1 Effective from 20 April 2016, an Issuer, engaged with a Token Requestor through the Visa Digital Enablement Program, hereby grants that Token Requestor a non-exclusive, license to use, reproduce and display the Issuer-provided Card art, Trademarks, service marks and logos within the Visa Digital Enablement Program, for as long as that Issuer or Token Requestor is participating in the program.

A Token Requestor must only use an Issuer’s Card art, trademarks, service marks and logos in line with that Issuer’s guidelines to the extent defining the appearance and manner of display of the Issuer’s Card art, trademarks, service marks and logos in connection with, and to market, advertise and promote the availability of that Token Requestor’s service, as provided through the Visa Digital Enablement Program.

1.22.12.2 Effective from 20 April 2016, any other use, by a Token Requestor, of an Issuer’s Card art, trademarks, service marks and logos, different to the permissions set out in this Section 1.22.12 shall be subject to the written approval of that Issuer. Any other use of an Issuer’s Card art different to the permissions set out in this Section 1.22.12 shall also be subject to the written approval of Visa.

1.22.12.3 Effective from 20 April 2016, nothing set out in this Section 1.22.12 shall give a Token Requestor any right, title or interest in an Issuer’s Card art, trademarks, service marks and logos or any goodwill associated with that Issuer’s Card art, trademarks, service marks and logos; any and all uses by a Token Requestor of an Issuer’s Card art, trademarks, service marks and logos shall inure to the benefit of that Issuer; a Token Requestor or its Affiliates will not adopt, use, or register any corporate name, trade name, trademark, service mark or trademark containing an Issuer’s Card art, trademarks, service marks and logo; and nothing in this Section 1.22.12 shall limit an Issuer’s rights to use its Card art, trademarks, service marks and logos to freely market the Program or the Issuer’s own products and services.

1.22.12.4 Effective from 20 April 2016, after the period of winding-down of services after termination or expiration of a Token Requestor's agreement with Visa, that Token Requestor will cease to have rights to use Issuer’s Card art, trademarks, service marks and logos pursuant to this Section 1.22.12

1.22.12.5 Effective from 20 April 2016, Visa will not monitor Token Requestor use of an Issuer’s Card art, trademarks, service marks and logos. An Issuer shall be solely responsible for ensuring Token Requestor compliance with that Issuer’s guidelines.

1.22.13 Use of a Token Requestor’s Intellectual Property

1.22.13.1 Effective from 20 April 2016, a Token Requestor hereby grants an Issuer a non-exclusive license to use, reproduce and display the Token Requestor's name, trademarks, service marks and logos, name of the service, and other indicia of origin of the Token Requestor and its Affiliates in connection with that Token Requestor’s participation in the Program. An Issuer and its Affiliates will only use a Token Requestor's name, trademarks, service marks and logos, name of the service, and other indicia of origin of the Token Requestor and its Affiliates in connection with that Token Requestor’s participation in the program in accordance with that Token Requestor's guidelines as set out in the legal and commercial guide.

26 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.22.13.2 Effective from 20 April 2016, any variation to a Token Requestor's name, trademarks, service marks and logos, name of the service, and other indicia of origin of the Token Requestor and its Affiliates in connection with that Token Requestor’s participation in the Program outside of that Token Requestor's guidelines requires prior approval in writing from that Token Requestor.

1.22.13.3 Effective from 20 April 2016, after the period of winding-down of services after termination or expiration of a Token Requestor's agreement for any Token service with Visa, an Issuer will cease to have rights to use that Token Requestor's name, trademarks, service marks and logos, name of the service, and other indicia of origin of the Token Requestor and its Affiliates in connection with that Token Requestor’s participation in the program pursuant to this Section 1.22.13.

1.22.13.4 Effective from 20 April 2016, Visa will not monitor Issuers' use of a Token Requestor's name, trademarks, service marks and logos, name of the service, and other indicia of origin of the Token Requestor and its Affiliates in connection with that Token Requestor’s participation in the Program. A Token Requestor shall be solely responsible for ensuring Issuers' compliance with that Token Requestor’s guidelines.

1.22.14 Uniform Services Effective from 20 April 2016, where an Issuer engages with more than one Token Requestor through the Visa Digital Enablement Program, and offers its respective services to its Cardholders, it must:  Feature a Token Requestor Service as least as prominently as any other similar Token Requestor Service in any marketing, signage or customer communications which feature multiple Token Requestors; and  Not use identification and verification decisions, to steer a Cardholder towards any given Token Requestor Service or across Token Requestor platforms.

1.22.15 Data Protection Effective from 20 April 2016, an Issuer must comply with both:  The data protection requirements set out in the Visa Digital Enablement Program Legal and Commercial Guide; and  The data protection requirements set out in Visa Core Rules and Visa Product and Service Rules.

1.22.16 Data Security

1.22.16.1 Effective from 20 April 2016, an Issuer must comply with the data security requirements set out in the Visa Digital Enablement Program Legal and Commercial Guide.

1.22.16.2 Effective from 20 April 2016, to the extent that an Issuer accesses the networks, systems or devices (including corporate email accounts, equipment or facilities) of a Token Requestor to access personal data or confidential information, the Issuer must follow the written instruction and policies of that Token Requestor.

1.22.17 Escalation and Visa Arbitration Effective from 20 April 2016, where an Issuer and Token Requestor are in dispute over termination rights, as set out in Section 1.22.5, an Issuer may escalate the matter to Visa. The request must be made in writing, including a summary of the disagreement and clear description of the assistance requested of Visa. Visa will consider such request in good faith but has no obligation to respond.

1.22.18 Liability Effective from 20 April 2016, an Issuer will agree to the liability provisions, as set out in the Visa Digital Enablement Program Legal and Commercial Guide.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 27 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23 DISPUTE RESOLUTION This chapter governs the and Representment processes for Domestic Transactions in the United Kingdom where these differ from the Visa Core Rules and Visa Product and Service Rules.

This section does not apply to Domestic Transactions in Gibraltar or Extended Domestic Transactions and the provisions of the Visa Core Rules and Visa Product and Service Rules will therefore apply to such Transactions.

1.23.1 Dispute Group 1—Request For Information A Transaction Receipt or T&E Document Fulfilment was illegible, or the Cardholder does not recognize the Transaction.

1.23.1.1 Reason Code 75—Transaction not Recognized Reason code 75 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 75. 2. Chargeback is invalid for Cardholder-Activated Transactions.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 75.

1.23.2 Dispute Group 2—Fraud Effective until 30 June 2016, a fraudulent Transaction was processed, or the Account Number used to process the Transaction was fictitious or no longer valid, or a Merchant was identified by the Merchant Fraud Performance Program.

Effective from 1 July 2016, a fraudulent Transaction was processed, or the Account Number used to process the Transaction was fictitious or no longer valid, or a Merchant was identified by the Visa Fraud Monitoring Program.

1.23.2.1 Reason Code 57—Fraudulent Multiple Transactions Reason code 57 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 57. 2. Chargeback is invalid for ATM and Mail/Phone Order Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 57.

28 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.2.2 Reason Code 81—Fraud—Card-Present Environment

Dispute Group 2 Reason Code 81 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 81. 2. For Cardholder-Activated Transactions, Account Number must both: a) Be listed on the Exception File with a Pickup Response on or below the Processing date of the Chargeback; and b) Remain on the Exception File for a minimum of 90 calendar days following the Chargeback. 3. Chargeback is invalid for an Automated Fuel Dispenser Transaction that both: a) Originated with a Counterfeit Card; and b) Received an Approval Response that included a “90” or “91” in the POS Entry Mode code field. 4. Chargeback minimum for a T&E Transaction is £20. 5. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 81.

Dispute Group 2 Reason Code 81 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules Reason Code 81. 2. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 81.

Dispute Group 2 Reason Code 81 Condition 3 Condition 3 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 81. 2. Chargeback minimum for a T&E Transaction is £20.

Documentation For Representation condition 3: The Electronic Documentation Transfer Method questionnaire and one of the following: 1. Evidence of both: a) A valid imprint for the Transaction in question; and b) PIN. 2. For a below-Floor Limit Transaction, evidence of signature or PIN and internal record or log proving Magnetic-Stripe read or Chip-Initiated, with explanation of fields. 3. For an above-Floor Limit Transaction that was key-entered following a Referral Response, all of the following: a) Referral Authorization record proving Magnetic-Stripe read or Chip- Initiated within 24 hours of the Transaction; b) International Automated Referral Service log; and c) Evidence of PIN.

Additional Information “Signature on file” notation is not an acceptable signature.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 29 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 2 Reason Code 81 Condition 4 Condition 4 applies to Domestic Transactions in the United Kingdom-only and as follows:

A T&E Transaction occurred at an Unattended Acceptance Terminal.

Chargeback Rights and Limitations

1. Chargeback does not apply to delayed charges related to a Transaction in which the Cardholder participated. 2. Chargeback does not apply to Chip-Initiated Transactions containing a valid Cryptogram with either: a) PIN obtained Online or Offline; or b) Cardholder Certificate. 3. Chargeback minimum for a T&E Transaction is £20. 4. The Issuer must meet all of the following conditions prior to or on the Chargeback Processing Date: a) Close the Cardholder account; b) List the Account Number on the Exception File with a Pickup Response, for a minimum of 30 calendar days; and c) Report the fraud activity in the fraud advice reports.

Chargeback Member Message Text

Not required

Chargeback Documentation

The Electronic Documentation Transfer Method questionnaire certifying that the Issuer completed all of the following on or before the Chargeback Processing Date: 1. Closed the Account Number; 2. Listed the Account Number on the Exception File with a pickup Response, for a minimum of 30 calendar days; and 3. Report the fraud activity in the fraud advice reports.

Representment Rights and Limitations

1. For a Representment due to an Issuer failing to meet the requirements specified in Chargeback Rights and Limitations 4 the Acquirer must provide information/documentation to support this claim such as evidence indicating Card Account Number was not listed on the Exception File, or account was not closed, or Transactions were not reported as fraud. 2. Representment is invalid if Acquirer failed to respond to Retrieval Request or responded with a Nonfulfillment Message code “03” or “04”.

Representment Condition Member Message Text Documentation

1. Credit or Reversal was Either that applies: None required processed. 1. CRED MMDDYY ARN X..X (23 or 24 digits) 2. REVERSAL MMDDYY 2. Issuer did not meet the X..X (Specify the reason) None required applicable Chargeback conditions.

Additional Information

1. “Signature on file” notation is not an acceptable signature

30 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.2.3 Reason Code 83—Fraud—Card-Absent Environment There is no Chargeback right under Reason Code 83—Fraud—Card-Absent Environment. The Issuer will be liable for Transactions showing a CVV2 response code ‘U’ and/or AVS response code ‘U’, as specified in Table 1-6. Issuers will be liable for Transactions they have authorized that show a CVV2 response code ‘N’.

Table 1-6 Card Not Present Transactions Dispute Liability

Authorization Request Issuer Response Response Code Chargeback Liability Data

CVV2 only CVV2 checked M—Match Acquirer P—Not Processed CVV2 only CVV2 checked N—No Match Issuer CVV2 only CVV2 not checked U—Not Certified Issuer AVS only AVS checked F—Exact Match Acquirer N—No Match A—Address Match Only Z—Postcode Match Only AVS only AVS not checked U—Unavailable Issuer CVV2 and AVS CVV2 checked M—Match Acquirer N—No Match P—Not Processed AVS checked F—Exact Match N—No Match A—Address Match Only Z—Postcode Match Only CVV2 and AVS CVV2 checked M—Match Issuer N—No Match P—Not Processed AVS not checked U—Unavailable CVV2 and AVS CVV2 not checked U—Not Certified Issuer AVS checked F—Exact Match N—No Match A—Address Match Only Z—Postcode Match Only CVV2 and AVS CVV2 not checked U—Not Certified Issuer AVS not checked U—Unavailable No Data None None Acquirer

1.23.2.4 Reason Code 93—Effective until 30 June 2016, Merchant Fraud Performance Program, and effective from 1 July 2016, Visa Fraud Monitoring Program Reason code 93 is amended as follows:

Chargeback Rights and The first Chargeback Right and Limitation, as specified in Visa Core Rules and Limitations Visa Product and Service Rules, Reason Code 93.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 93.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 31 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.3 Dispute Group 3—Authorization A Merchant or Member failed to follow the proper Authorization procedures.

1.23.3.1 Reason Code 70—Card Recovery Bulletin or Exception File

Dispute Group 3 Reason Code 70 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 70. 2. Chargeback is invalid for: a) ATM Transactions. b) Chip-initiated, Offline-authorized Transactions. 3. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 70.

Dispute Group 3 Reason Code 70 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 70. 2. Chargeback is invalid for: a) ATM Transactions. b) Chip-initiated, offline-authorized Transactions. 3. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 70.

Additional Information A bi-lateral EMV Liability Shift Agreement applies between the Territory and Visa Inc.

1.23.3.2 Reason Code 71—Declined Authorization

Dispute Group 3 Reason Code 71 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 71. 2. Chargeback is invalid for: a) ATM Transactions. b) Chip-initiated, Offline-authorized Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 71.

32 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 3 Reason Code 71 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 71. 2. Chargeback is invalid for: a) ATM Transactions. b) Chip-initiated, Offline-authorized Transactions. 3. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 71.

Dispute Group 3 Reason Code 71 Condition 3 Condition 3 is amended as follows:

Chargeback Rights and Chargeback minimum for a T&E Transaction is £20. Limitations

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 71.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 33 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.3.3 Reason Code 72—No Authorization Reason code 72 is amended as follows:

Authorization was required for a Transaction, but the Merchant did not obtain Authorization and either:  Transaction exceeded the Floor Limit and Authorization was not obtained on the Transaction Date; or  Card was a Visa Electron Card used in an Automated Fuel Dispenser where a Status Check Authorization was used.

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 72. 2. Chargeback is invalid for: a) Transactions authorized through the Emergency Payment Authorization Service. b) No-Show and Advanced Lodging Deposit Service Transactions. c) ATM Transactions. 3. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10 (£15 for Cash-Back Transactions). 4. Chargeback does not apply to Transactions where the Transaction Currency was not US dollars and the Transaction amount is within 10% of the authorized amount (to allow for currency conversion fluctuations). 5. The Issuer must ‘status’ the account internally on or before the Processing Date of the Chargeback. 6. Chargeback minimum for a T&E Transaction is £20. 7. Effective from 15 September 2014 and effective until 13 October 2016, Chargeback is invalid if a Status Check Authorization was obtained and the Transaction Amount is £100 or less. 8. Effective from 15 September 2014 and effective until 13 October 2016, Chargeback is valid only for the amount exceeding the £100 represented by the Status Check Authorization.

Representment Rights and No Representment Rights and Limitations. Limitations

Member Message Text Any of the following that apply: 1. Any of the Representment Conditions, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 72. 2. For Representment Condition 3, CASH-BACK NOT GIVEN-DOCS TO FOLLOW.

Documentation Any of the following that apply: 1. Any of the Representment Conditions, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 72. 2. For Representment Condition 3, evidence that a Cash-Back was not provided and/or the Transaction did not require Authorization.

Additional Information Refer to Visa Core Rules and Visa Product and Service Rules for the maximum authorized Floor Limits and Exhibit UK3D.

34 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.3.4 Reason Code 73—Expired Card Reason code 73 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 73. 2. Chargeback is invalid for ATM and Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 73.

1.23.3.5 Reason Code 78—Service Code Violation Reason code 78 is amended as follows:

A Merchant completed a Magnetic-Stripe or Chip Transaction when the Service Code indicated that the Card was invalid for the Transaction type and both: a) Merchant did not obtain Authorization; and b) Issuer unable to post the Transaction to the Cardholder’s account.

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 78. 2. Chargeback is invalid for: a) ATM and Mail/Phone Order Transactions; and b) Chip-initiated, Offline-authorized Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Member Message Text Any of the following that apply: 1. Any of the Representment Conditions, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 78. 2. UNABLE TO POST TO ACC

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 78.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 35 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.4 Dispute Group 4—Processing Error A Merchant, an Originating Member, or an Acquirer processed a Transaction incorrectly.

1.23.4.1 Reason Code 74—Late Presentment

Dispute Group 4 Reason Code 74 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 74. 2. Chargeback minimum for a T&E Transaction is £20; and 3. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10. 4. Issuer must status the Account internally on or before the Processing Date of the Chargeback. 5. Effective for Transactions with a Processing date up to and including 14 May 2016, for a Recurring Transaction, the Transaction Date is more than six calendar days prior to the Processing Date.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 74.

Dispute Group 4 Reason Code 74 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 74. 2. Chargeback minimum for a T&E Transaction is £20. 3. Issuer must status the Account internally on or before the Processing Date of the Chargeback.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 74.

1.23.4.2 Reason Code 76—Incorrect Currency or Transaction Code or Domestic Transaction Processing Violation

Dispute Group 4 Reason Code 76 Conditions 1 and 2

Conditions 1 and 2 are amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 76. 2. Chargeback minimum for a T&E Transaction is £20. 3. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 76.

36 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 4 Reason Code 76 Condition 3 Condition 3 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 76. 2. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 76.

Dispute Group 4 Reason Code 76 Condition 5 Condition 5 in the Visa Core Rules and Visa Product and Service Rules does not apply in the United Kingdom.

1.23.4.3 Reason Code 77—Non-Matching Account Number

Dispute Group 4 Reason Code 77 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 77. 2. Chargeback minimum for a T&E Transaction is £20.

Member Message Text For Original Credit Transaction Exception Processing: 1. ACCOUNT CLOSED 2. ACCOUNT NOT ON FILE

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 77.

Dispute Group 4 Reason Code 77 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Chargeback minimum for a T&E Transaction is £20. Limitations

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 77.

1.23.4.4 Reason Code 80—Incorrect Transaction Amount or Account Number

Dispute Group 4 Reason Code 80 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 80. 2. For a T&E Transaction, Chargeback is valid only when the difference in the amounts exceeds £20 or local currency equivalent. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 80.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 37 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 4 Reason Code 80 Conditions 2 and 3 Conditions 2 and 3 are amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 80. 2. Chargeback minimum for a T&E Transaction is £20.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 80.

1.23.4.5 Reason Code 82—Duplicate Processing

Dispute Group 4 Reason Code 82 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 82. 2. Chargeback minimum for a T&E Transaction is £20. 3. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10. 4. Minimum waiting period 15 days from the Transaction Date.

Member Message Text Any of the following that apply: 1. Any of the Member Message Text, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 82. 2. DIFF APPL TRNX COUNTERS

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 82.

1.23.4.6 Reason Code 86—Paid by Other Means Reason code 86 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 86. 2. Chargeback is invalid for disputes concerning quality of goods or services, late receipt of tickets or vouchers through postal service or No-Show Transaction. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 86.

38 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.5 Dispute Group 5—Cancelled/Returned A Cardholder properly cancelled a Recurring Transaction or returned merchandise and the Merchant did not process a Credit Transaction Receipt, or a cancelled T&E Transaction or Timeshare Transaction was processed, or an Originating Member sent an Original Credit Transaction that was refused by the Recipient or is prohibited by local law.

1.23.5.1 Reason Code 53—Not as Described or Defective Merchandise

Dispute Group 5 Reason Code 53 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 53. 2. Chargeback is invalid for ATM Cash Disbursements. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10. 5. Issuer may be required to provide proof of shipping of returned merchandise. Proof of receipt of merchandise by Merchant is not required.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 53.

Dispute Group 5 Reason Code 53 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 53. 2. Chargeback is invalid for ATM Cash Disbursements. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10. 5. Issuer may be required to provide proof of shipping of returned merchandise. Proof of receipt of merchandise by Merchant is not required.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 53.

1.23.5.2 Reason Code 85—Credit Not Processed

Dispute Group 5 Reason Code 85 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 85. 2. Chargeback is invalid for ATM Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 85.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 39 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

Dispute Group 5 Reason Code 85 Condition 2 Condition 2 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 85. 2. Chargeback is invalid for ATM Transactions. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 85.

Dispute Group 5 Reason Code 85 Condition 3 Condition 3 is amended as follows:

Chargeback Rights and Chargeback minimum for a T&E Transaction is £20. Limitations

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 85.

1.23.6 Dispute Group 6—Non-Receipt Goods/Services A Cardholder did not receive ordered merchandise or services, or cash from an ATM, or Load Transaction value from a Load Device.

1.23.6.1 Reason Code 30—Services Not Provided or Merchandise Not Received

Dispute Group 6 Reason Code 30 Condition 1 Condition 1 is amended as follows:

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 30. 2. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, Chargeback is invalid for disputes concerning late receipt of tickets or vouchers through postal services. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 30.

40 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar

1.23.6.2 Reason Code 90—Non-Receipt of Cash or Load Transaction Value at ATM or Load Device

Dispute Group 6 Reason Code 90 Condition 1 Condition 1 is amended as follows:

Cardholder did not receive, or received only a portion of cash or Load Transaction value.

Chargeback Rights and Any of the following that apply: Limitations 1. Any of the Chargeback Rights and Limitations, as specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 90. 2. Chargeback is invalid for Proximity Payments. 3. Chargeback minimum for a T&E Transaction is £20. 4. Effective for Chargebacks with a Processing Date up to and including 14 May 2016, minimum Chargeback amount is £10.

Documentation As specified in Visa Core Rules and Visa Product and Service Rules, Reason Code 90.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 41 Visa Europe Operating Regulations—Scheme—United Kingdom and Gibraltar THIS PAGE INTENTIONALLY LEFT BLANK Exhibits

UK3D CERTIFICATE OF AUTHORIZATION ...... 45

UK9A CARD ACCEPTANCE COMPLAINT FORM ...... 46

UK10A VALUE-ADDED SERVICES ...... 47

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 43 Visa Europe Operating Regulations—United Kingdom and Gibraltar THIS PAGE INTENTIONALLY LEFT BLANK Appendix A - Exhibits

Exhibit UK3D CERTIFICATE OF AUTHORIZATION Instructions: This form must be completed for each Representment made in accordance with Chargeback reason code 72 and must accompany the Dispute Resolution Form. This form is not necessary where a Certification of Special Authorization Representment Amount is required (see the Visa Core Rules and Visa Product and Service Rules) or where the Representment is made in relation to a Domestic Transaction in Gibraltar or an Extended Domestic Transaction.

To BI N From BIN

Account Number Estimated Input Date

Acquirer Reference Number Cardholder Name

Chargeback Receipt Date Representment Amount

Authorization Details

Date Amount

Issuer’s Approval Code

Method of Authorization (select one) Manual Authorizer V.I.P. or Visa Europe Authorisation Service Emergency Procedures V.I.P. System User or Visa Europe Authorisation Service System User (see Visa Core Rules and Visa Product and Service Rules)

Issuer’s Authorizing Member Contacted? Yes No (As specified in Visa Core Rules and Visa Product and Service Rules)

Comments

Prepared by

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 45 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix A - Exhibits

Exhibit UK9A CARD ACCEPTANCE COMPLAINT FORM Instructions: Members should complete this form upon the discovery of suspected Card acceptance or Transaction processing violations that may be protected through the enforcement of the Visa Core Rules and Visa Product and Service Rules, but are not covered under Chargeback or Compliance rights. Visa will maintain a record of all complaints received. For possible enforcement action, all supporting documentation must be attached and all fields must be completed in English. This form must be completed by a Member and may not be given to a Cardholder, a Merchant, or any other third party. Members must submit this form and any documentation to Visa. Visa reserves the right to intervene at its discretion. All information must be legibly printed or typed – (* denotes mandatory information).

Region Record Number Member Record Number (Visa use) (if applicable, such as Roll Number)

Issuer Details*

Name BIN

Country

Visa Card/Visa Electron Card (delete as appropriate)

Transaction Information*

Cardholder Name* Account Number*

Acquirer Name BIN (For ATM Cash Disbursements, provide disbursing member information.) Country

Acquirer Reference Number Dispute Amount Merchant ID Reference Number MCC

Merchant Name* Merchant Location (Address/City/Country)*

Merchant Acceptance Channel* Face to Face Mail/Telephone Order Internet

Tick most appropriate description of the complaint, provide brief explanation and attach documentation

Surcharge imposed Improper use of service mark Min/max transaction amount imposed Currency conversion issue Merchant rebilling after chargeback Additional ID requested Authorization-related issue Card confiscated Car rental required purchase of CDW Purchase with cash-back Non-acceptance of card Other (provide details)

Explanation (complete for all complaints)*

Results/details of Issuer Base I research*

Complaint submitted by*

Name Member Name Telephone Email Send this form and all appropriate documentation to the [email protected].

46 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix A - Exhibits

Exhibit VALUE-ADDED SERVICES UK10A Table A-1 Value-Added Services

Category Feature Headline Benefit Applicable Points

Home and Motor Roadside assistance UK and Europe assistance and 5 insured benefit, worth up to £200 Homecare service Full service with insured 4 benefits, worth up to £500, including but not limited to call-out, labour, parts and materials for: • Plumbing and drainage; • Electrical and/or gas supply; • Primary heating system (where heating cover is included); • Security and glazing; • Roof damage; and • Pests.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 47 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix A - Exhibits

Table A-1 Value-Added Services (Continued)

Category Feature Headline Benefit Applicable Points

Security Standard purchase • £5,000 per annum 1 protection • £1,000 per incident • £500 per item Enhanced purchase • £25,000 per annum 2 protection • £7,500 per incident • £2,500 per item Shop safe - extended • Up to £5,000 insured 2 warranty, price benefit per annum promise • Up to three years additional cover • Best prices on the high- street guaranteed up to £2,000 difference ID theft protection • Assistance services to repair 2 (Card fraud) credit profile • £7,500 financial losses Text alerts, both £0.03 per text (assuming 50 4 domestic and abroad texts per year = £1.50) Real-time scoring Real-time scoring, where a 5 Transaction is intercepted via the Visa System, diverted out to be scored and then forwarded to the Issuer. Banks receive fully-derived risk scores for each Transaction at the same time as the Authorization Request. Card protection Lost and stolen card and 2 document backup and replacement ATM theft and assault • £500 per annum 1 protection • £250 per incident Mobile phone • £300 per handset 2 insurance • £200 unauthorized calls Credit bureau alerts Access to credit scoring 5 Visa device profiling ATM profiling generates three 2 reports for Members. These reports list all suspicious ATMs identified in the previous 24 hours, and provides details of the Cards used and the associated Transaction details. Safety advice (red 24) N/A 1

48 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix A - Exhibits

Table A-1 Value-Added Services (Continued)

Category Feature Headline Benefit Applicable Points

Travel Usage based Medical expenses, worth up to 6 worldwide travel £1 million insurance for Cardholders of Visa Select Cards and the family of Cardholders of Visa Select Cards, where dependants are under 26 years old Non-usage based Medical expenses, worth up to 9 worldwide travel £1 million insurance for Cardholders of Visa Select Cards and the family of Cardholders of Visa Select Cards, where dependants are under 26 years old Travel accident Up to £250,000 2 insurance Travel inconvenience • £150 benefit for delays 2 benefit • £500 benefit for missed departures Priority pass Associate membership only, no 3 visits included Priority pass Five visits included 10 Worldwide collision £40,000 worldwide cover 4 damage waiver Rewards Rewards at 50 basis N/A 10 points cashback Concierge available 24 Affluent level 8 hours a day, both domestic and overseas Ticket booking for 9am-7pm, Monday to Sunday 3 hospitality and air travel Shopping events Discounts and events exclusive 3 for Cardholders of Visa Select Cards, twice a year Visa premium hotel N/A 1 and lodging discount scheme

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 49 Visa Europe Operating Regulations—United Kingdom and Gibraltar

Table A-1 Value-Added Services (Continued)

Category Feature Headline Benefit Applicable Points

Card pricing No foreign exchange £500 per 0.0275 percent 5 markup or commission No fee • £250 per 2.5 percent 3 • Five percent take up Lower APR than N/A 5 standard Cards (at least 200 basis points)

50 VISA EUROPE CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—United Kingdom and Gibraltar Defined Terms

Visa A full list of Defined Terms is available in the Visa Core Rules and Visa Product and Services Rules. This Definitions appendix contains definitions that are specific to Domestic Transactions or Extended Domestic Transactions (marked [UK]).

B Branch Outlet [UK] An ATM located at a Visa Member’s premises, where Visa Europe Member premises are defined as offices conducting banking services which are branded, managed and staffed by the Visa Europe Member.

C Card Linked Offers Service A service provided by Visa that associates a commercial offer with a Card.

Card-Not-Present Environment [UK] An environment where a Transaction is completed under both of the following conditions:  Cardholder is not present; and  Card is not present.

Transactions in this environment include the following:  Mail/Phone Order Transactions;  Recurring Transactions; and  Telephone Service Transactions.

Transactions in this environment exclude Face-To-Face Transactions.

Cheque [UK] A Travellers Cheque that a Member issues and that bears Visa Marks.

Convenience [UK] An ATM is classified as Convenience if it is not located at a Visa Europe Member premises.

Credit Card A Card that offers the Cardholder a line of credit, specific to that Credit Card account and the ability to revolve part of any outstanding balance, or all of the outstanding balance, on the Credit Card account during each statement cycle.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 51 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix B - Defined Terms

D Debit Card [UK] A Visa Debit Card which accesses a current or deposit/, and displays the Visa Brand Mark with Debit Identifier, in line with the Visa Core Rules and Visa Product and Services Rules requirements.

Deferred Debit Card A Card linked to an account whereby the Transactions are accumulated with other Transactions on a deferred basis, a statement is issued and paid in full.

Direct (Immediate) Debit Card A Card linked to a current (or deposit access) account to which a Transaction is debited immediately (in a maximum of two working days) on receipt of the Transaction by the Issuer.

E Extended Domestic Transactions [UK] A Transaction where:  The Issuer of the Card is located in Gibraltar and the Merchant Outlet or ATM where the Card is used is located in the United Kingdom; or  The Issuer of the Card is located in the United Kingdom and the Merchant Outlet or ATM where the Card is used is located in Gibraltar.

F Foreign Currency [UK] A currency other than the official national currency of the country where the Merchant Outlet or Branch is located.

M Mark [UK] A word, name, design, symbol, or other device, or any combination thereof, that an entity adopts to identify its goods or services. The Visa Core Rules and Visa Product and Services Rules refers to the following categories of Mark:  Acceptance Mark  ATM Acceptance Mark  Design  Hologram  Logotype  Non-Visa Marks  Olympic Marks  Product name  Program mark  Service mark  Symbol  Visa Brand Mark  Visa Brand Name  Visa Marks  Wordmark

Refer to the Visa Product Brand Standards for a description of the Visa Marks.

S Secure Electronic Commerce Provides a common secure method of performing Transactions over open networks (as defined in SET specifications Version 1.0).

Stop Service A file in which an Issuer lists cancelled Recurring Transactions to prevent processing by an Acquirer. Used in conjunction with the Visa Account Updater.

52 VISA CONFIDENTIAL INFORMATION - Member Use Only 15 October 2016 Visa Europe Operating Regulations—United Kingdom and Gibraltar Appendix B - Defined Terms

T Transitional Incentive for Terminalization Fee A fee assessed to Issuers of Visa Purchasing Card to support the implementation of the Transitional Incentive for Terminalization Program.

Transitional Incentive for Terminalization Program A program to encourage Acquirers to install Point-of-Transaction Terminals at Merchant Outlets.

V Value-Added Service [UK] A type of service which is offered by Issuers of a Visa Select Card to their Cardholders, including but not limited to travel, rewards and insurance benefits. The complete list of options and applicable points, as amended from time to time, that can be offered to Cardholders of a Visa Select Card is defined in

Visa Account Updater Effective until 15 April 2016, a file of Account Numbers for which the Issuer has listed all changed primary Account Number or expiry date details. Used in conjunction with the Stop Service.

Effective from 16 April 2016, a service provided by Visa Europe that enables Acquirers and Visa Europe to check for updates to Account Numbers and Card expiry dates.

Visa Charge Card [UK] A Card that offers a Cardholder a line of credit, specific to that Visa Charge Card account, where the outstanding balance during each statement cycle must be paid in full.

Visa Delta Mark [UK] A stand-alone Mark for use on the Visa Delta Card as specified in these operating regulations. The Visa Delta Mark is a Visa Card Program Mark subject to the requirements of the Visa Product Brand Standards.

Visa Debit Cards must not bear the Delta Mark.

Visa Delta Merchant [UK] A Merchant which accepts only those Visa Cards which bear the Visa Delta Mark.

Visa Debit Cards must not bear the Delta Mark.

Visa Select Card [UK] A product name for a Credit Card that has attributes exceeding those of a Visa Platinum Card but does not exceed the attributes for a Visa Infinite Card and offers Value-Added Services totalling a minimum of 20 points, as defined in Appendix A, "Exhibits", Exhibit UK10A, Table A-1, “Value-Added Services”.

15 October 2016 VISA CONFIDENTIAL INFORMATION - Member Use Only 53 Visa Europe Operating Regulations—United Kingdom and Gibraltar THIS PAGE INTENTIONALLY LEFT BLANK