1. Increasing approval rates in the digital world
Assurance Framework
Increasing approval rates in the digital world

2. October 29, 2019
The current card-not-present environment is lagging behind the physical world
Online Card Fraud to Rise to USD 7.2bn by
Global Approval Rates (%) 1
US Payment Forum, Card-Not-Present Fraud Analysis 2017.

3. Securing credentials Securing transaction
October 29, 2019
The Assurance Framework focus is to increase approvals of card-not-present transactions and secure the ecosystem
Securing credentials
Securing transaction
Higher Sales – Improved Customer Satisfaction – Loyalty – Lower Fraud – Higher Approvals

4. To achieve this objective, initiatives will be implemented in the US in four different categories
Liability
Relief
Pricing
Compliance
DSRP liability shift removed
3DS transactions maintain liability shift
Account Data Compromise (ADC) protections for tokenized transactions
3DS Price adjustment
Data Only Tx introduction
Introduction of Excessive Fraud Merchant Compliance program EFM

5. Merchant is non-compliant if: Min Ecommerce Tx in clearing
May 25, 2018
EFM was created to reduce CNP fraud and provide alternatives for compliance while increasing approval rates
Merchant is non-compliant if:
Min Ecommerce Tx in clearing
Currency Threshold
Net Fraud Bps
3DS% Threshold
(EMV 3DS + Data Only)
> 1,000 Tx
$50,000
50bps
10%
Assessments start on March 2020
After three months of compliance, the audit closes and the penalties would reset
If a merchant is in both the EFM and Excessive Chargeback Program (ECP) at the same time, EFM would apply and ECP would not. However, if a merchant was compliant with EFM, but still hitting the ECP thresholds, then ECP would apply
NOTE: If a merchant is in both the EFM and Excessive Chargeback Program (ECP) at the same time, EFM would apply and ECP would not. However, if a merchant was compliant with EFM, but still hitting the ECP thresholds, then ECP would apply
Everything is at the MID level
Financial assessments start??
April 2019 – Announcement
October 2019 – Notifications sent begin (based on Sept chargeback data - clearing) acquirers will start getting notification “if the program was live today you would be non-compliant”
01 March 2020 – Assessments begin $0
Acquirers can request a one time 6 month extension period through the (system) Data Integrity platform (Same system that is used for ECP)
Every MID same rule
Compliance is measured at the MID level (like ECP)
Penalties are Assessed through the acquirer like ECP
Penalties are capped at 100K accrual per month
ECP looks at all chargeback not just all “fraud chargebacks”
How do I submit a Data only transaction in authorization – submit it as a security level indicator of 214

6. Operational Reimbursement Relief Operational Reimbursement Relief
May 25, 2018
ADC protection program provides relief to merchants that use tokenization for MC payments transactions
Mastercard transactions using an approved TSP would provide the following:
Relief A
Relief B
MC Tx Tokenized
Operational Reimbursement Relief
> 75%
50%
MC Tx Tokenized
Operational Reimbursement Relief
> 95%
100%
Mastercard may invoke operational reimbursement for an ADC Event impacting 30,000 Mastercard accounts or more
An Account Data Compromise Event is an occurrence that could result, directly or indirectly, in the unauthorized access to, or disclosure of, Account data or the unauthorized manipulation of Account data controls, such as Account usage and spending limits.
The Mastercard ADC Program provides issuers that have been impacted by an ADC Event with partial financial recovery for the losses that they may have suffered as a result of the Event. One component of this recovery is Operational Reimbursement (OR) which reflects an issuer’s card monitoring and/or replacement costs. The reimbursement process occurs after Mastercard has reviewed all available evidence, including the findings listed in a forensic report written by a Payment Card Industry Security Standards Council (PCI SSC) Forensic Investigator (PFI), and conclusively determined that an ADC Event has occurred. Mastercard calculates the amount of OR due to issuers, debits this money from the acquirer for the breached merchant, and distributes the funds to impacted issuers.
Mastercard may invoke OR for an ADC Event impacting 30,000 Mastercard accounts or more.
An ADC Event would not be invoked for merchants with 100% of their annual total e-commerce transactions count tokenized because tokens are not account data.
A merchant’s annual total transaction count is determined based on the merchant’s clearing transactions processed during the twelve (12) months prior to the date of publication of the ADC Alert through the Global Clearing Management System (GCMS).
In the U.S. Region only, Mastercard offers ADC relief to an acquirer’s merchants as an incentive to use chip accepting POS Terminals. The changes proposed in this item will align the U.S. Region only ADC relief constructs in both the physical and digital environments.

7. Assurance Framework timeline
Official announcement
First set of initiatives kick in
Second set of initiatives kick in
Compliance
2019
2020
3DS1 Price
DSRP tokens liability shift elimination
April 2019
October 2019
March 2020
April 2020
EFM Compliance program fees are assessed for the first time
Assurance Framework Bulletin publication
3DS2 Price
Data Only Launch
ADC Relief introduction
Compliance monitoring begins