Systems & Operations | Visa Rules 4 May 2017 Designer Drugs Are Prohibited in the Visa Payments System AP, Canada, CEMEA, Europe, LAC, U.S. | Acquirers, Issuers, Processors, Agents Overview: Acquirers must comply with Visa’s updated rules that prohibit merchants from accepting Visa cards for the purchase of designer drugs. Effective 1 October 2017, Visa will begin identifying acquirers with merchants that sell designer drugs; Visa may penalize those acquirers via the Global Brand Protection Program. Best practices for identifying rogue merchants selling these products are provided. Designer drugs are synthetic, chemical analogs of controlled substances, intended Mark Your Calendar: to imitate their psychoactive effects. The resulting products are structurally similar (often within one or two molecules) to illegal psychoactive drugs. Often marketed • Acquirers must comply with as street drug alternatives or as “legal” highs, designer drugs typically result in new rules that prohibit hallucinogenic, stimulative or opioid-like effects for the users. designer drugs in the Visa system (1 July 2017) In response to the growing threat of designer drugs to public health and safety, • GBPP enforcement of and to the Visa brand, Visa updated its rules effective 30 March 2017 to prohibit prohibited merchants take the use of Visa cards to purchase designer drugs. Acquirers must: effect (1 October 2017) Ensure that a Merchant, Payment Facilitator, Sponsored Merchant, or Staged Related Training From Digital Wallet Operator does not accept Visa Cards for, or display a Visa- Visa Business School: Owned Mark on a website that is used in relation to products that claim or • Fraud and Risk imply a similar efficacy as prescription drugs, controlled substances, or recreational / street drugs, irrespective of claims of legality or any other media or activities (ID#s: 0026379, 0005067, 0008355). Acquirers should review their portfolios and ensure compliance with the new rules before 1 July 2017, at which point they must ensure their portfolios do not contain merchants selling designer drugs, as defined in the updated Visa Rules. Why Designer Drugs Commonly Sold Online Are Dangerous Unlike traditional “street drugs” or controlled substances, which generally have a known composition, designer drugs contain almost any combination of chemicals in unknown quantities. The chemicals may be existing analogs or entirely new compositions that are unsafe and untested, and can lead to unpredictable, or even fatal, effects on the user. Manufacturers constantly alter the chemical formations to stay one step ahead of law enforcement officials, and they continue to market their products as so-called “legal” highs. Despite governmental efforts to ban these products and efforts by law enforcement to enforce such bans, these products are still readily available for purchase online: AI06528 • Synthetic Marijuana: Commonly known as “Spice” or “K2,” synthetic marijuana is a mixture of herbs and spices that are sprayed with a THC-like chemical. • Synthetic Lysergic Acid Diethylamide (LSD): Better known as “N-Bomb” or “Smiles,” synthetic LSD is a phenethylamine. This type of synthetic drug mimics the effects of LSD and can cause hallucinations and paranoia. • Synthetic Stimulants: Also known as “cathinones,” synthetic stimulants mimic the effects of 3,4- methylenedioxy-methamphetamine (MDMA), better known as “ecstasy” or “Molly.” Bath salts are also an example of cathinones. • Synthetic Phencyclidine (PCP) or Methoxamine (MSE): A synthetic compound that mimics the effects of PCP and can cause delusions, psychoses and a feeling of detachment. Consequences for Non-compliant Acquirers To protect the integrity of the payments system, Visa operates a Global Brand Protection Program (GBPP) to identify the acquirers of merchants that submit illegal or prohibited transactions into VisaNet. Effective 1 October 2017, via the GBPP, Visa will begin proactively identifying merchants selling designer drugs, as defined in the updated Visa Rules. Acquirers that process transactions for merchants that submit illegal or prohibited transactions are in violation of the Visa Rules and may be penalized under the GBPP. Initial identifications are subject to a non-compliance assessment of up to USD 25,000 per merchant or sponsored merchant, or per merchant URL or sponsored merchant URL, per calendar month of non-compliance. Subsequent violations are subject to a non-compliance assessment of up to USD 50,000 per merchant or sponsored merchant, or per merchant URL or sponsored merchant URL, increasing by up to USD 25,000 for each subsequent calendar month of non-compliance, up to a maximum of USD 100,000. Due Diligence Reviews Visa recommends that acquirers incorporate the Global Acquirer Risk Standards and the Global Brand Protection Program Guide for Acquirers, which outline underwriting, monitoring and control processes that must be in place as part of acquirers’ due diligence requirements. Acquirers should also routinely review the business models of their merchants, including all relevant products, services and marketing materials. They should periodically review their merchants' websites to ensure that all laws are followed, and, in particular, that restricted substances are not offered or sold. Acquirers may want to consider use of a third party agent to supplement their internet-monitoring efforts and must ensure that any utilized sales agents do not attempt to board this activity. Best Practices for Identifying Rogue Merchants To prevent the onboarding of designer-drug merchants, acquirers and agents should be aware of merchants that: • Label products "Not for Human Consumption" but actually target consumers AI06528 • Package products that are designed to attract consumers or are notably makeshift (e.g., packaged in sandwich bags) • Do not accompany products labeled as "research chemicals" with significant scientific data points (e.g., chemical structures and characteristics) • Use a frictionless checkout mechanism (typically, legitimate chemical suppliers require purchase orders and vendor agreements) • Use websites that include categories such as “herbal blends,” “aromas,” “bath salts,” “cannabinoids,” “cathinones,” “blotters,” “benzodiazepines” or “nootropics” • Post FAQs declaring that they will not answer questions about human use • Advertise "discreet" shipping To ensure compliance with applicable laws, acquirers are reminded to conduct initial and ongoing monitoring of their merchants. In addition, acquirers are encouraged to consult their legal advisors to ensure their merchants are compliant with all applicable laws and regulations. Update to the Global Brand Protection Program Guide and Requirements (Advance Copy) Visa Global Brand Protection Program Guide for Acquirers Visa Global Acquirer Risk Standards Global Visa Acquirer Quick Reference Guide—Best Practices for Managing Card-Absent Acceptance Risk Note: For Visa Online resources, you will be prompted to log in. Email [email protected]. Third party agents should contact their issuer or acquirer. Notice: This Visa communication is furnished to you solely in your capacity as a customer of Visa Inc. (through its operating companies of Visa U.S.A Inc., Visa International Service Association, Visa Worldwide Pte. Ltd, Visa Europe Ltd., Visa International Servicios de Pago España, S.R.L.U. and Visa Canada Corporation) or its authorized agent, or as a participant in the Visa payments system. By accepting this Visa communication, you acknowledge that the information contained herein (the "Information") is confidential and subject to the confidentiality restrictions contained in the Visa Rules, which limit your use of the Information. You agree to keep the Information confidential and not to use the Information for any purpose other than in your capacity as a customer of Visa Inc. or as a participant in the Visa payments system. You may disseminate this Information to a merchant participating in the Visa payments system if: (i) you serve the role of “acquirer” within the Visa payments system; (ii) you have a direct relationship with such merchant which includes an obligation to keep Information confidential; and (iii) the Information is designated as “affects merchants” demonstrated by display of the storefront icon ( ) on the communication. A merchant receiving such Information must maintain the confidentiality of such Information and disseminate and use it on a “need to know” basis and only in their capacity as a participant in the Visa payments system. Except as otherwise provided, the Information may only be disseminated within your organization on a need-to-know basis to enable your participation in the Visa payments system. Visa is not responsible for errors in or omissions from this publication. AI06528 .