Global Security Bulletin No. 4, 15 April 2016 ©2016 Mastercard
Total Page:16
File Type:pdf, Size:1020Kb
Updates for the Business Risk Assessment and Mitigation Program Topic(s): E-Commerce, Fraud/Risk, MCC, Merchant, Rules/Standards, Security May Apply To: Acquirers Processors Summary: MasterCard requires compliance with its Standards that prohibit the use of MasterCard® cards and systems for illegal or brand-damaging activities and adherence to Standards that support the Business Risk Assessment and Mitigation (BRAM) compliance program. This article: • Reminds acquirers of their obligations under the Standards and the MasterCard BRAM program; • Identifies certain illegal or brand-damaging products and services that are being added to the BRAM program, and others that are not being added at this time but have the potential to create brand risk or fraud in the payments system; • Provides a reminder of acquirers’ responsibilities for coding card-not-present (CNP) gambling transactions, as well as contains information on recent regulatory actions regarding Internet gambling transactions in Norway and Germany; • Contains information on recent regulatory actions regarding financial merchants, such as foreign exchange traders, in Japan; • Reminds acquirers of the recent changes to the BRAM program: – The elimination of the BRAM Monitoring Program (BMP), – The expiration of the letters of understanding (LOUs), and – The launch of the Merchant Monitoring Program (MMP) with Merchant Monitoring Service Provider (MMSP) registration requirements; and • Provides tips for responding to BRAM noncompliance notifications. Action Indicator: A Attention warranted Effective Date: Immediately Background The MasterCard Standards require each customer to comply with all applicable laws and the Standards, and not to engage in or facilitate any action that is illegal or that, in the opinion of MasterCard, damages or may damage the goodwill or reputation of MasterCard. Updates for the Business Risk Assessment and Mitigation Program 8 Global Security Bulletin No. 4, 15 April 2016 ©2016 MasterCard. Proprietary. All rights reserved. Production Review—Due The BRAM program is intended to help ensure that MasterCard systems and marks are not used in any action that is illegal or that damages or may damage the goodwill or reputation of MasterCard. In the spirit of keeping the industry informed of new trends in the marketplace, MasterCard has identified certain additional products that are either illegal or brand-damaging, and other products, services, and merchant models that may pose risk to our collective brands. The products, services, and merchant models mentioned in this article do not represent an exhaustive list of illegal or brand-damaging activities. Each acquirer is reminded to review each of its merchants and their services on an ongoing basis to determine the legality and legitimacy of the goods or services being offered for sale. Regulatory Information Regarding Internet Gambling MasterCard is providing the following updated regulatory information from the Norwegian and German governments as it relates to Internet gambling transactions. Internet gambling in jurisdictions where it is illegal is deemed by MasterCard as a BRAM violation. Norwegian Gaming Authority (Gambling Act in Norway) The state-owned company, Norsk Tipping (betting and lotteries), and the state-controlled foundation, Norsk Rikstoto (horse betting), are the only two gambling operators that may legally operate online gambling in Norway. In 2010, the Norwegian government implemented a payment ban to block transactions of gambling merchants that do not hold a permit in Norway. Financial institutions in Norway are prohibited from acquiring stakes and prizes for gambling merchants that do not hold a Norwegian license. Therefore, any gambling merchant operating within Norway must be licensed by the Norwegian government. German Gambling Authority (Gambling Regulation in Germany) The German Gambling Interstate Treaty from 2012 bans most online gambling activities, such as real money slot machines, casino and poker games. In particular, offering such games on the Internet under a German domain or path (i.e. “xyz.com/DE”) or in German language may be deemed a violation of the Internet ban. Only sports betting, horserace betting and commercial lottery brokers are allowed to conduct online gambling activity, provided that the operator holds a valid license. Updates for the Business Risk Assessment and Mitigation Program Global Security Bulletin No. 4, 15 April 2016 9 ©2016 MasterCard. Proprietary. All rights reserved. Production Review—Due A certain number of licenses for remote gambling and betting were issued by the Ministry of Internal Affairs and Federal Matters of Schleswig-Holstein between 2012 and 2013. These will remain valid until their expiration, but only for the territory of the German Federal State of Schleswig-Holstein. Any other offering of online gambling without a license is prohibited. Regulatory Information Regarding Financial Organizations Offering or Advertising Services in Japan MasterCard is providing the following updated regulatory information from the Japanese government as it relates to financial organizations, such as foreign exchange traders, that are offering or advertising services to consumers in Japan. Financial Services Agency of Japan The Financial Services Agency of Japan (“FSA”) has identified an increase of financial merchants that are not licensed by the FSA. These include foreign exchange traders that are offering or advertising excessive high leverage deals to consumers in Japan, mainly over the Internet. The Financial Instruments and Exchange Act, which became effective June 2006 and was reformed in 2007, requires financial merchants that transact with, or advertise to consumers in Japan, to obtain a license from the FSA. For example, merchants that facilitate the selling or buying of financial securities or insurance policies to consumers in Japan without permission from the FSA will be in violation of the Act. To help ensure compliance, acquirers can check the merchant’s licensed status by accessing the FSA’s list of licensed (registered) financial organizations at: http://www.fsa.go.jp/en/regulated/licensed/ Illegal/Brand-Damaging Products (Added to BRAM Program) In addition to previously published products/services, MasterCard is alerting acquirers that the following products/services are illegal or brand-damaging and are prohibited products as outlined in the BRAM program. Medical and Dental Devices Effective immediately, medical and dental devices that are counterfeit, not approved by regulatory entities, or are expired, are added to the BRAM program. Updates for the Business Risk Assessment and Mitigation Program 10 Global Security Bulletin No. 4, 15 April 2016 ©2016 MasterCard. Proprietary. All rights reserved. Production Review—Due Medical devices include, but are not limited to, the following: • Condoms; • Prescription and colored contact lenses; • Diagnostic testing kits for HIV, diabetes, pregnancy, etc.; • Intravascular catheters; • Implants for breast and other parts of the body; and • Instruments and machines for hospitals, doctors, and dentists. NOTE Medical/dental devices cover a large spectrum of products. The United States regulates medical devices to ensure that they meet safety standards. The U.S. Food, Drug and Cosmetic Act (“FDC Act”) requires approval of diagnostic testing kits before they are imported or marketed in the United States and prohibits the promotion of devices for unapproved uses. Specifically, introducing unapproved (adulterated or misbranded) medical devices into interstate commerce is a violation of the FDC Act, and importing and/or facilitating the sale or distribution of imported merchandise contrary to law is a criminal violation. Contact lenses (including decorative/theatrical/color and corrective lenses) are also regulated as medical devices pursuant to the FDC Act. The sale of contact lenses to consumers without a valid prescription is also unlawful. The European Union (E.U.) and the United Kingdom (U.K.) also regulate medical devices to ensure that they meet E.U. and U.K. safety standards. Medical devices sold in the E.U. must meet the requirements of the E.U. Medical Devices Directives. Medical devices sold in the U.K. must meet the requirements of the U.K. Medical Devices Regulations 2002. Further, unauthorized use of a trademark in the U.K. would be considered counterfeiting and an offense under the Trade Marks Act 1994. Updates for the Business Risk Assessment and Mitigation Program Global Security Bulletin No. 4, 15 April 2016 11 ©2016 MasterCard. Proprietary. All rights reserved. Production Review—Due Mobile Repeaters (United Kingdom Only) Effective immediately, mobile (cellular phone) repeaters that are sold without the proper license in the United Kingdom are added to the BRAM program as part of the Illegal Electronic Devices category. The U.K. Office of Communications (Ofcom) has a duty to manage and protect the radio spectrum. Ofcom investigates companies that illegally sell and distribute mobile repeaters. Mobile repeaters increase the cellular signal of a mobile network operator (MNO) in areas that suffer from poor coverage. However, although the repeater may increase the signal for the owner, the use of such a device can increase the amount of dropped calls within the rest of the mobile signal area, which is detrimental to the majority of users within that area. These devices are in high demand by consumers. However, the use of these devices is illegal in the U.K., absent a license to