Compliance Notifications

• October 2022 - American Express Authorization on Credit

  Effective October 14, 2022, American Express® (AMEX) will introduce a new Authorization on Credit functionality that affects how merchants process refunds. This Authorization on Credit will provide the option for Issuers to immediately notify Cardmembers of pending credits. Merchants will have the option to send refund requests to American Express Issuers for authorization. Currently, Moneris authorizes refunds on behalf of the American Express Issuers. 

  The new return authorization process will enable issuers to update cardholders’ online banking statements in real time. This process will help enhance cardholder confidence in the payments system, as the information they receive on purchase returns will better align with what they see on purchases.

  This will offer several key benefits for merchants:

  • Help reduce or minimize related chargebacks
  • Provide real-time issuer account validation
  • Fewer customer service inquiries due to a lack of real-time information

  There is a possibility that merchants may see declined refund transactions due to the following reasons:

  • Expired card
  • Blocked card (due to fraud, breach, etc.)
  • Invalid PIN
  • Invalid card #
  • Original card used for purchase was a prepaid card that has been discarded

  Merchants should closely examine their business processes to ensure that a cardholder can be reached should a refund transaction be declined.

  In the event of a declined refund, merchants have three options to pursue in the following order:

  1. The refund on another card (of the same brand)
  2. Offer the cardholder a store credit/gift card
  3. Offer the cardholder refund in another format (cash, cheque)

  All options are contingent on a declined refund and should be used at the discretion of the merchant based on existing refund policies and risk tolerance for their business. Moneris recommends that merchants avoid refunding to a card (of a different brand) to reduce the risk of fraud.

  _{AMERICAN EXPRESS is a registered trademark of American Express Company.  All other marks or registered trademarks appearing on this page are the property of their respective owners.}

   
• October 2022 - Visa & Mastercard: Revised Standards for Merchant Surcharging at the Point-of-Interaction in the Canada Region

  Effective October 6, 2022, Visa and Mastercard will revise acceptance rules to allow merchants in Canada to include an extra fee (surcharge) for credit card transactions. Under the revised standards, merchants in Canada may apply a surcharge on consumer or commercial Visa and Mastercard credit card transactions, which will be paid by the cardholder. In summary, surcharging:

  • Will require merchant registration with Visa and Mastercard with 30 days’ written notice to Moneris
  • Will be allowed on all credit products (debit and prepaid excluded)
  • Will be allowed for all merchant category codes (MCCs)
  • Will be allowed in all acceptance channels (card-present & card-not-present)
  • Will not be allowed if a convenience fee or service fee is also applied
  • Must not be charged by third party agents on behalf of the merchant
  • Amount must be the lesser of the Effective Merchant Discount Rate or maximum of 2.4%
  • Must be appropriately disclosed at point-of-entry, point-of-interaction and on the cardholder receipt
  • The total amount of the transaction submitted must be inclusive of the surcharge amount
  • The surcharge amount must be included in the corresponding sub-data field in the transaction
  • Will not be allowed in jurisdictions where surcharging is legally prohibited

  More information about enabling surcharging for Visa and Mastercard will be provided as it becomes available.

• October 2022 - Visa: Revised Effective Date for Removing Merchant and Terminal Identification Numbers from Transaction Receipts

  In October 2020, Visa amended its rules to prohibit printing of the full merchant identification numbers (MIDs), terminal identification numbers (TIDs) and card acceptor identification numbers (CAIDs) on cardholder receipts. Printing of all MIDs, TIDs and CAIDs must be limited to the last four digits. Due to the effort required to comply with this mandate, Visa has issued amended dates for this requirement.

  The amended effective dates are as follows:

  • On October 15, 2022, the amendment will apply to newly deployed devices. Please note, this date does not apply to devices currently in use in market.
  • On October 15, 2027, the amendment will apply to all devices deployed and in use in market.
• September 2022 - Mastercard Recurring Billing Requirements

  Mastercard is introducing new requirements for merchants who charge customers via recurring billing (such as monthly subscription) or negative option billing (a subscription that begins with a free or low-cost trial period).

  The new requirements are being implemented by Mastercard to help merchants reduce potential disputes or chargebacks and drive a more positive customer experience.

  Effective dates and corresponding requirements have been outlined below:

  Effective Date	Billing Type	Requirements
  September 22, 2022	Recurring and negative option	An email confirmation (or other electronic message) must be sent at time of enrollment outlining subscriptions terms (price, frequency of billing, and applicable trial period details), as well as cancel instructions. An email receipt (or other electronic message) must be sent after each billing and include cancelation instructions. An electronic cancellation option must be provided. For plans that bill less frequently than 6 months (180 days), a notification must be sent no less than three days and no more than seven days before the billing date, and include subscription terms and cancelation instructions. Subscription terms (price, frequency of billing, and trial period details) must be disclosed at payment. Customer acceptance of the terms must be obtained. For ecommerce merchants, disclosure must be done on the checkout page directly. Re-directing to a separate page will not satisfy the requirement.
  	Negative option	A reminder notice must be sent no less than three days and no more than seven days before the end of trial period to inform the customer that the full subscription plan will apply if they do not cancel. The notice must include the subscription terms and cancelation instructions. Trial period terms must be disclosed including any initial charges and length of trial.

• April 2022 - 8 Digit BIN

  Effective April 2022, 8-digit Bank Identification Numbers (BIN) will be used for newly issued Mastercard, Visa, Discover, and Amex cards.

  Why are we moving to 8-digit BIN?

  Today, a 6-digit BIN for debit and credit cards is the standard but as the payment card industry continues to grow and more cards are being issued, the number of unique 6-digit BIN available are being depleted. To accommodate further growth, the International Organization for Standardization and payments industry are introducing 8-digit BIN for new cards effective April 2022. Moving to 8-digits allows for millions of additional new accounts to be introduced in the years to come.

  How does this impact Moneris systems?

  The move to 8-digit BIN will not have any impact on how payments are processed today. However, there may be implications for reporting that is tied to the current 6-digit BIN format. Moneris is looking further into the matter and will be in touch with impacted merchants if any actions are required on their part.

  What do merchants need to do?

  Before 8-digit BINs are introduced, merchants should look at their existing systems and contact their partners (if applicable) to determine if any processes currently rely on 6-digit BINs. For example, custom reporting logic based on the 6-digit BINs will need to be updated.

  To minimize disruption to your business we recommend that you update any 6-digit BIN dependencies in your technical environment as soon as possible. You may need to contact your integration partner or a web developer if you do not have dedicated technical support.

• February 2022 - New Decline Codes

  Visa and Mastercard have introduced new response codes which will appear during declined transactions. Moneris will be implementing the below decline codes and messages on February 22, 2022.

  If a transaction is declined with one of the following response codes and decline messages, please follow the appropriate action noted below or a fee may apply. More details are provided below.

  Response Code	Decline Message	Action	Related Fee(s)
  416	Declined Use updated card	Verify card information provided is correct or request a different payment method.	· Mastercard Decline Reason Code Service · Mastercard Credential Continuity Fee
  421	Card Declined Do Not Retry	Do not retry transaction. Request a different payment method from the cardholder.	· Visa Category 1 Decline Fee · Mastercard Decline Reason Code Service · Mastercard Merchant Advice Code Fee
  422	Stop Payment Do Not Retry	Do not retry transaction. Request a different payment method from the cardholder.	· Visa Repeat Authorization Decline Fee · Mastercard Merchant Advice Code Fee
  423	Decline Verif Failed	Applicable to Visa Direct transactions only. Cardholder verification has failed, revalidate cardholder information.	· No fees currently applicable

   

  Developer Specifications

  If your development or IT support team need to update the response codes in your technical environment, please see the new updated response code table on our Developer Portal for further details.

  Please visit our Payment Card Network Fee Updates page for more details on the above Card Brand related fees.

• October 2021 - 3DS 1.0 End of Support

  As of October 2021, a majority of issuers will no longer support 3DS 1.0 due to following upcoming changes to card brand mandates.

  Moneris is committed to supporting the payment industry’s transition from 3DS 1.0 to 3DS 2.0. Moneris Checkout is fully integrated with 3DS 2.0 and 3DS 2.0 API specifications are available. Please see our 3DS 2.0 Integration Guides on our Developer Portal for more details.

  Effective October 15, 2022, Moneris will retire 3DS 1.0 and any 3DS 1.0 authentications submitted will receive an error response.

   

  3DS 1.0 End of Support Timeline:

  Visa

  • October 16, 2021: Visa will continue to support 3DS 1.0 transaction processing but will stop support of the 3DS 1.0 Attempts Server for non-participating issuers. Visa will respond with a Verify Enrollment Response (VERes) = N to all authentication requests when the issuer does not support 3DS 1.0.
  • October 15, 2022: Visa will decommission their 3DS 1.0 platform and will no longer process any 3DS 1.0 transactions for cardholder authentication. Merchants will receive error responses if they attempt to send authentication requests to the 3DS 1.0 Directory Server.

  Mastercard

  • October 1, 2021: Mastercard will no longer generate attempts transactions from the Mastercard 3DS 1.0 network, however 3DS 1.0 fully authenticated transactions will continue to be supported.
  • April 30, 2022: Mastercard will no longer allow 3DS 1.0 account range or Merchant ID enrollments.
  • October 14, 2022: Mastercard will decommission their 3DS 1.0 platform. Mastercard will no longer process any 3DS 1.0 transactions for cardholder authentication and the merchant will receive error responses if they attempt to send authentication requests to the MC 3DS 1.0 Directory Server.

  American Express

  • October 14, 2022: Authentication requests for SafeKey 1.0 will no longer be supported by American Express.
  • Support for AMEX SafeKey 2.0: Moneris does not currently support SafeKey 2.0. In the interim, we recommend you send 3DS 1.0 requests for AMEX authentications only.

  Moneris

  • October 15, 2022: Moneris will retire 3DS 1.0. This means any 3DS 1.0 authentications submitted will receive an error response.
• June 2021 - Visa Purchase Return Authorization Mandate

  Visa has introduced a new Purchase Return Authorization Mandate that affects how all merchants process customer refunds. Effective October 15, 2021, Moneris will be required to send all refund requests to the Visa card issuer for approval. Currently, Moneris authorizes refunds on behalf of the card issuer.

  To make this transition as smooth as possible, we will begin applying the new process in June 2021. This will give businesses time to get familiar with the changes prior to the busy holiday shopping season. No action on the merchant’s part is required.

  With this new process, there are several benefits to the merchant and cardholder:

  • Real-time updates to cardholders’ online banking statements when receiving refunds
  • Direct account validation with issuer reducing potential for fraud
  • Helps reduce or minimize related chargebacks

  Merchants will not see a change in the way they process refunds on a terminal or via Moneris Gateway. However, there is a possibility that merchants may see declined refund transactions due to the following reasons:

  • Expired card
  • Blocked card (due to fraud, breach, etc.)
  • Invalid PIN
  • Invalid card #
  • Original card used for purchase was a prepaid card that has been discarded

  Merchants should closely examine their business processes to ensure that a cardholder can be reached should a refund transaction be declined. In the event of a declined refund, merchants have three options to pursue:

  1. Offer the cardholder a store credit/gift card
  2. Offer the cardholder refund in another format (cash, cheque)
  3. Put the refund on another card (of the same brand)

  
  

  All options are contingent on a declined refund and should be used at the discretion of the merchant based on existing refund policies and risk tolerance for their business. Moneris recommends that merchants avoid refunding to a card (of a different brand) to reduce the risk of fraud.

• December 2020 - Mastercard Contactless Specification (MCL 3.0)

  In November of 2014, Mastercard announced a new mandate that required all contactless readers support the Contactless Terminal Specification version 3.0 (MCL 3.0). As part of this, all readers were required to be compliant by January 1, 2019.
   
  Merchants are still required to comply with this mandate and ensure that all POS terminals which support Mastercard contactless are able to support MCL 3.0. If merchants are unable to achieve compliance by this date Mastercard may, at their discretion, impose non-compliance assessments of up to $100,000 USD per violation, which Moneris will pass on per the terms of the merchant agreement.
  
  If you work with an integrator or an Independent Software Vendor (ISV), please reach out to them to assist in updating your solution. Should you need further clarification or assistance please contact www.moneris.com/support/contact.
  
  Contactless Terminal Specification version 3.0 mandate details:

  • Comply with MCL 3.0 or EMV CL Book C-2;
  • and for POS Terminals only (including MPOS Terminals), be configured to support On-Device Cardholder Verification and the processing of Contactless Transactions that exceed the applicable Cardholder verification method (CVM) limit amount up to the amount that the same POS Terminal supports on its contact interface.

  If you are unable to achieve compliance, Mastercard may, at their discretion impose non-compliance assessments. Below please find a summary of Mastercard’s non-compliance assessment schedule:

  Compliance Category	Assessment Type	Assessment Description
  A	Per violation	Up to USD 25,000 for the first violation Up to USD 50,000 for the second violation within 12 months Up to USD 75,000 for the third violation within 12 months Up to USD 100,000 per violation for the fourth and subsequent violations within 12 months
  	Variable occurrence (by device or Transaction)	Up to USD 2,500 per occurrence for the     first 30 days      Up to USD 5,000 per occurrence for days     31–60      Up to USD 10,000 per occurrence for days     61–90      Up to USD 20,000 per occurrence for     subsequent violations

• September 2020 - INTERAC Transaction Limit Reminder for ISVs and Integrated Merchants

  Between September 10, 2020 and September 16, 2020, all ISVs and integrated merchants will receive the following reminder from Moneris regarding transaction limits for both contact and contactless INTERAC transactions.
  
  Under INTERAC Debit Regulations, both ISVs and integrated merchants are not permitted to set a per transaction limit on devices. As a result, we have asked them to check and ensure no transaction size limits are set for INTERAC transactions on the POS solutions they either use or provide.
  
  An altered transaction limit on a POS solution may prevent merchants from taking advantage of any increased limits for contactless transactions INTERAC may set in the future. If the INTERAC transaction limit has been altered, we have requested the ISV reset the limit as soon as possible.

• July 2020 & Oct 2021 (Revised from April 2020) - Purchase Return Authorization Mandate

  Visa, Mastercard, and Discover are introducing a new purchase return authorization mandate that will affect all merchants that process customer returns. Currently, Moneris authorizes merchant returns on behalf of the card issuer.

  • Effective July 17, 2020, Moneris will be required to send Mastercard and Discover return authorization requests to the card issuer for approval. 
  • Effective October 15, 2021, Moneris will be required to send Visa return authorization requests to the card issuer for approval.

  The new return authorization process will enable issuers to update cardholders’ online banking statements in real time. This process will help enhance cardholder confidence in the payments system, as the information they receive on purchase returns will better align with what they see on purchases.
  
  This will offer a number of key benefits for merchants:

  • Help reduce or minimize related chargebacks
  • Provide real-time issuer account validation
  • Fewer customer service inquiries due to a lack of real-time information

  There is a possibility that merchants may see declined refund transactions due to the following reasons:

  • Expired card
  • Blocked card (due to fraud, breach, etc.)
  • Invalid PIN
  • Invalid card #
  • Original card used for purchase was a prepaid card that has been discarded

  Merchants should closely examine their business processes to ensure that a cardholder can be reached should a refund transaction be declined.
  
  In the event of a declined refund, merchants have three options to pursue in the following order:

  1. The refund on another card (of the same brand)
  2. Offer the cardholder a store credit/gift card
  3. Offer the cardholder refund in another format (cash, cheque)
     
     

  All options are contingent on a declined refund and should be used at the discretion of the merchant based on existing refund policies and risk tolerance for their business. Moneris recommends that merchants avoid refunding to a card (of a different brand) to reduce the risk of fraud.

• December 2018 – UnionPay BIN Changes

  Effective December 31, 2018, UnionPay International (‘UnionPay’) is introducing a new series of Bank Identification Numbers (BINs) that begin with ‘81’ (e.g., 810000-817199), as well as expanding all BINs to eight digits (‘8-digit BINs’). To avoid any disruption to your business, you will need to apply the following updates to your systems.
  
  If you are using a Moneris^® standalone payment solution, you are required to:

  • Activate UnionPay 81 series BIN changes on your POS device(s) by reinitializing your terminal. In the event that you do not re-initialize your device by December 31, 2018, the terminal will prompt you to do so.

  
  

  If you are using a Moneris^® integrated or ecommerce payment solution, you are required to:

  • Contact your integration partner, web developer and/or internal IT department to test your payment application and confirm the POS is certified by the December 31, 2018 deadline.
  • Moneris has made UnionPay 81 series and 8-digit BINs available in the production environment for POS testing.

  
  

  As per UnionPay card acceptance policies:

  • All point-of-sale terminals must support the UnionPay 81 series BIN standards.
  • Both card present and card-not-present POS environments (including hard-coded ecommerce sites) must be equipped to recognize and process 81 series BINs, following the same logic and handling as transactions made with Primary Account Numbers (PAN) in the ‘62’ series today.
  • Back office reporting systems must be able to recognize 8-digit BINs in all occurrences where the 6-digit BINs used by card brands today are reported.

  
  

  UnionPay will be monitoring BIN acceptance rates and may impose non-compliance assessment fees to businesses that are unable to accept 81 series and 8-digit BIN cards by the December 31, 2018 deadline.
  
  For businesses using a standalone payment solution, please contact the Moneris Support Center at 1-844-204-8626 with your questions. If you are using an integrated payment solution, please contact your POS integration partner for assistance with re-initializing your payment processing application(s).

• April & October 2018 – Visa and Mastercard Payment Security Changes

  (UPDATED March 2019)

  On April 12, 2018, Visa^® and Mastercard^® implemented policy changes to improve card security and further reduce fraudulent transactions and chargebacks in Canada. This will impact the way merchants accept card present (CP) and card not present (CNP) payments for domestic and international transactions.
  
  Fallback (Visa and Mastercard)
  Visa and Mastercard are enacting a ‘no fallback’ policy for CP transactions, which means that merchants will need to request an alternate method of payment if a customer’s Chip & PIN transaction fails, as the card will not ‘fallback’ to the magnetic swipe. These changes took effect April 12, 2018 for domestic transactions on both card brands, and October 12, 2018 for international transactions using Mastercard.
  
  CVV2 (Visa only)
  Visa introduced a requirement on October 14, 2018 requiring telephone order and e-commerce merchants to capture CVV2 at checkout and include it in the authorization request. This rule does not apply to (updated March 2019):

  • A transaction that uses a stored credential
  • A transaction initiated with a payment token
  • A transaction in which a paper order form is used
  • A transaction involving a recurring or installment payment (second and all subsequent transactions)
  • A transaction conducted through a digital wallet such as Visa Checkout
  • A transaction originating from an indirect sales channel
  • A delayed charge transaction
  • A transaction involving an incremental authorization request
  • A MO/TO transaction where the CVV2 is captured manually and provided in written format
  • A transaction that received a decline response and is resubmitted for authorization, as specified in the Visa Rules (ID#: 0006007)

  
  

  Merchants using the Moneris Gateway are required to make changes to enable CVV2 information capture at payment checkout. Affected services include:

  • Moneris API
  • Batch submissions
  • Hosted Pay Page
  • Hosted Vault
  • Virtual Terminal
  • Merchant Resource Centre
  • Hosted Tokenization

  
  

  Moneris has activated Card Validation Digits (CVD) and Address Verification Services (AVS) for all Gateway Merchants effective May 15, 2018 at no additional fees or costs.
  
  For details on required changes, please see: www.moneris.com/VisaCVD.
  
  Stored Credential Transaction Framework (Visa and Mastercard)
  Visa and Mastercard are updating their security policies for CNP transactions, beginning with the introduction of the Stored Credential Transaction Framework on October 12, 2018, which outlines the requirements for initial storage and subsequent use of payment credentials.
  
  For more information on the respective changes announced by Visa and Mastercard, please visit:
  
  Visa: Moneris.com/VisaSecurity
  Mastercard: Moneris.com/MCSecurity

• April 2018 - Visa Claims Resolution

  Effective April 13 2018, Visa will be implementing the Visa Claims Resolution (VCR) initiative to reduce the number of chargeback disputes and improve the overall efficiency of the dispute resolution process. Information on upcoming changes related to the VCR initiative has been provided below.
  
  
  Reduced Resolution Timeframes
  Chargebacks can typically take anywhere from 46 to 100 days to resolve, depending on their complexity. Visa is streamlining their chargebacks dispute process by eliminating any extra touch points and exchanges of information between parties. Reducing the time and resources it takes to resolve disputes will benefit merchants, issuers and cardholders alike.
  
  Merchants will now be asked to respond to chargeback disputes within seven calendar days from the date of notice.
  
  
  Changes to Chargeback Reason Codes
  The current list of 22 Visa chargeback reason codes will be replaced with new values and grouped into four new categories of disputes: Authorization, Fraud, Processing Errors and Consumer Disputes. For a full list of the new Visa chargeback reason codes and their corresponding dispute categories, please visit the Moneris chargebacks page.

• Visa updated Policy for Subscription Merchants Offering Free Trial or Introductory Promotions

  To enable greater customer transparency and control, easier cancellation and clearer dispute rights, Visa has updated rules related to transactions at merchants that offer free trials introductory offers as part of an ongoing subscription service. Upon review of its existing rules, Visa recognizes that this business model can lead to problems for all stakeholders in the payment echo system, including multimillion-dollar operational cost increases due to high call center, customer complaints, increased chargebacks and a negative cardholder experience.
  
  To address these concerns and help provide clarify for all parties; Visa has updated its acceptance, disclosure and cancellation policies effective April 18, 2020. With these changes, cardholders are provided to clearer information, enabling them to identify, recognize and take on subscription transactions, reducing the number of transactions that result in a dispute.

  Updated Policy for Subscription Merchants Offering Free Trials or Discounted Introductory Promotions FAQ

  Trial Subscription Updates