Starting April 17, 2026, Visa will make the following changes:

• Introduce the Visa Infinite Privilege Charge and Visa Ultra High Net Worth charge consumer products
• Expand the existing products Visa Infinite Charge, Visa Infinite Privilege Credit and Debit and Visa Ultra High Net Worth Credit and Debit products for issuance in additional regions as shown below

Table – New and Expanded Visa Infinite, Visa Infinite Privilege, and Visa Ultra High Net Worth products

Existing interregional interchange fee programs apply.

^{Published March 13, 2026 | P2025.2354}

Update: To clarify, Visa will start identifying eligible transactions for DCAP on the following effective dates:

• April 17, 2026 – U.S. and Guam
• October 1, 2026 – Puerto Rico and U.S. Virgin Islands

The Digital Commerce Authentication Program (DCAP) is an optional program launched by Visa in order to enhance data sharing for customer-initiated card-not-present transactions. Participating in DCAP requires providing additional enhanced data through messages by Visa approved authentication solution (e.g. Visa Secure, 3DS or Visa Token Service).

With this, transactions eligible for the program will be identified by Visa starting on the effective dates mentioned above through the introduction of the new DCAP indicator. The indicator will be retained during authorization and returned in clearing.

If you process authorization or clearing through a third-party service provider, please contact them to ensure they meet Visa’s requirements.

^{Updated January 15, 2026 | P2025.0641, P2025.0642, P2025.2344
Published December 15, 2025 | P2025.0641, P2025.0642}

Visa strongly recommends that merchants include the Original Transaction ID (OTID) in all PAN- and token‑based standing instruction merchant‑initiated transaction (MIT) authorization. Merchants should:

• Always capture and pass the OTID in every MIT authorization message
• Ensure the initial cardholder-initiated transaction (CIT) includes the correct POS environment code with indicators I, R, or C, using the same credentials intended for future MITs
• Leverage Visa’s MIT Service to securely store, retrieve, and pass the OTID into the MIT authorization message to simplify implementation and ensure accurate linkage to the CIT 

Doing the above enables:

• Precise linkage from the initial CIT to follow‑on MITs at the subscription level, preventing over‑blocking and avoiding declines caused by merchant‑level stop instructions 
• Fewer repeated retries and declines, minimized compliance‑associated fees, and the ability to unlock more Visa value‑added services and insights through improved data integrity
• Merchant visibility into cardholder cancellation and subscription management via notifications

^{Published March 13, 2026 | P2025.3425}

On February 21, 2026, Visa will increase the permitted clearing variance from 20 to 30% for MCC 5812 – Eating Places and Restaurants and MCC 5814 – Fast Food Restaurants. Visa will also be adding MCC 5811 – Caterers to the same permitted clearing variance.

This update aims to reduce dispute risks should merchants need to process a final transaction amount with a clearing variance of more than 20%.

^{Published January 15, 2026 | P2025.2026}

In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.2121}

By December 31, 2025, Visa will require full compliance to Visa Fleet 2.0 requirements. Please work with your service provider to ensure your software is updated accordingly.

In addition, merchants who accept Visa Fleet cards must provide enhanced data for Visa Fleet card transactions under the following merchant category codes (MCCs):

• MCC 4468—Marinas, Marine Service, and Supplies
• MCC 5499—Miscellaneous Food Stores—Convenience Stores and Specialty Markets
• MCC 5541—Service Stations (With or without Ancillary Services)
• MCC 5542—Automated Fuel Dispensers
• MCC 5983—Fuel Dealers—Fuel Oil, Wood, Coal, and Liquefied Petroleum

_{Note: MCC 5552 – Electric Vehicle Charging is currently excluded. Visa Fleet card transactions must provide both cardholder-supplied data and supplemental transaction data for these transactions.}

_{Published November 14, 2025 | P2024.2288}

Visa updated their Service Fee program to include the key changes below:

• Adding MCC 4900—Utilities – Electric, Gas, Water, and Sanitary in the Service Fee program, in addition to the existing permitted MCCs:
  • MCC 8211—Elementary and Secondary Schools
  • MCC 8220—Colleges, Universities, Professional Schools, and Junior Colleges
  • MCC 8244—Business and Secretarial Schools
  • MCC 8249—Vocational and Trade Schools
  • MCC 9211—Court Costs, Including Alimony and Child Support
  • MCC 9222—Fines
  • MCC 9311—Tax Payments
  • MCC 9399—Government Services (Not Elsewhere Classified)

• Registration of or providing a Merchant Verification Value (MVV) is not required
• Government approval processing tax payments with a service fee is no longer necessary
• Payments and service fees can be processed in a single transaction, allowing you to select the most efficient processing method

_{Published December 15, 2025 | P2025.2465}

On October 18, 2025, Visa will add new Spend Qualified Indicator (SQI) values to supplement the existing values shown in the table below.

The new SQI values may be applied to Interchange Reimbursement Fee programs in certain markets, similar to the current values. Future programs may include an expanded level of spend qualification which may utilize the new values.

Please visit our Developer Center for the complete specifications of the SQI values.

Table – Visa New and Existing SQI Indicators

_{Published October 15, 2025 | P2025.0648}

Starting October 18, 2025, Visa will standardize requirements for processing delayed charges for loss, theft, or damages.

A delayed charge transaction for damages, will require merchants to obtain cardholder consent through one of the following:

• Cardholder signature on the same page and near the description of potential charges for delayed charge transactions
• Cardholder signature on the agreement and initials on each page, including the page with the charge description
• Other documentation proving the cardholder's liability for damages

These requirements apply to the following merchant types:

• Vehicle Rental Merchants (Including but not limited to MCCs 3351 – 3441)
• Lodging Merchants (Including but not limited to MCCs 3501 to 3840)
• MCC 7999 – Recreational Services (Aircraft, bicycle, and motorcycle rental)
• MCC 4457 – Boat Rentals and Leasing
• MCC 7296 – Clothing Rental (Costumes, uniforms, and formal wear)
• MCC 4411 – Steamship and Cruise Lines
• MCC 7394 – Equipment, Tool, Furniture, and Appliance Rental and Leasing
• MCC 4789 – Transportation Services
• MCC 7519 – Motor Home and Recreational Vehicle Rentals
• MCC 7033 – Trailer Parks and Campgrounds

_{Published October 15, 2025 | P2025.1574}

On October 17, 2025, Visa will add Visa Stop Payment Service (VSPS) checks in the account verification process. This will notify merchants of stop instructions for a primary account number for recurring and installment transactions.

Please be prepared to receive the following VSPS decline response codes:

• R0 – Stop this payment
• R1 – Stop all future payments
• R3 – Stop all merchants

These VSPS decline response codes indicate that the cardholder has withdrawn their consent to use their card for payment. Please do not attempt to resubmit an authorization request after receiving any of the VSPS decline response codes.

_{Published October 15, 2025 | P2025.0651}

On October 17, 2025, Visa will add response code 78 – Blocked, first used or special condition—new cardholder not activated or card is temporarily blocked to the list of permitted response codes for credit voucher and merchandise return authorization transactions. Updated list show below.

Table 1 – Visa Valid Card Issuer-Provided Approve Response Codes

Table 2 – Updated Visa Valid Card Issuer-Provided Decline Response Codes

<sup>1. Applies only to non-reloadable prepaid cards that do not support credit transaction types, or certain healthcare-related prepaid products where transactions are restricted to certain merchant categories. Response code 57 is not valid for general credit or debit card transactions.
2. This is not a new response code; it already exists for other transactions, but it is now being leveraged for merchandise return and credit vouchers.</sup>

^{Published September 15, 2025 | P2025.0649}

Visa modified their Custom Payment Service (CPS) Program to remove the transaction amount and MCC requirement from unattended terminals for the following interchange categories:

• CPS/Retail
• CPS/Restaurant
• CPS/Supermarket
• CPS/Retail Service Station
• CPS/Hotel – Card Present
• CPS/Car Rental – Card Present
• CPS/Passenger Transport – Card Present
• CPS/Retail Key Entry

^{Published September 15, 2025 | P2024.2008}

Please visit our Developer Center for Visa’s updated Address Verification Service (AVS) result code definitions and descriptions. Please note that there are no changes to AVS result codes.

For effective AVS results, follow these best practices:

• Send genuine address data provided by the cardholder
• Do not send dummy or repeat data
• Do not send exclusively spaces, blanks or non-printable characters
• Provide both street address and postal / ZIP code whenever possible
• Ensure the billing address is sent in AVS requests when the shipping and billing addresses are different

^{Published September 15, 2025 | P2025.1593}

The advisory period for the Visa Acquirer Monitoring Program (VAMP) enhancements has been extended to September 30, 2025. During this period, you must continue to monitor fraud and dispute metrics and improve risk controls where necessary prior to the VAMP enforcement on October 1, 2025.

Avoid potential fines under VAMP by consulting your JPMorganChase representative for advice on risk improvement measures, and more information on Visa’s monitoring thresholds.

_{Published June 13, 2025 | P2025.0593}

Visa has updated their Visa Acquirer Monitoring Program (VAMP) ratio to include fraud disputes, in addition to non-fraud disputes.

Merchants exceeding VAMP ratio thresholds and minimum monthly counts to enter the program will be assessed a merchant excessive fee of 8 USD by Visa, multiplied by each instance of fraud and each dispute, beginning October 1, 2025.

It is recommended to take the following measures to reduce being identified in VAMP:

• Implement fraud prevention and security tools to detect and prevent unauthorized transactions
• Use advanced dispute mitigation tools, such as Real-time Dispute Resolution (RDR) systems
• Conduct thorough analyses of chargebacks to yield insights on underlying causes of disputes

_{Published August 15, 2025 | P2025.1030}

Update: The Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1408-bit public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

Visa has extended the expiration date of the Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1984-bit public key to December 31, 2034 as shown in the below table. The expiration date of the 1408-bit public key remains the same.

Visa has extended the expiration date of the Visa Smart Debit / Credit (VSDC) Certificate Authority (CA) keys for the 1984-bit public key.

Please reach out to your point-of-sales (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain Visa public keys with the updated expiration dates shown below. Take note to not use expired keys or keys past their expiration date.

Table – Visa Extended Expiration Date for VSDC CA Key

_{Updated June 13, 2025 | P2025.0233
Updated December 13, 2024 | P2024.1949
Published  November 15, 2024 | P2022.1122}

Starting May 25, 2025, Visa will increase the retry attempt to 20 times for both cardholder-initiated transactions (CITs) and merchant-initiated transactions (MITs), up from the previous limit of 15 times, within 30 days after a category 2, 3 or 4 response code decline.

Please ensure to comply with the allowed number of retry attempts to avoid transaction declines.

_{Published May 15, 2025 | P2024.2594}

Update: This communication applies to receiving the new response codes in authorization requests.

On April 11, 2025, Visa will introduce the following new response codes under category 2:

1.    Transaction not supported/blocked by Issuer.

2.    Blocked by cardholder/contact cardholder.

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide” in our Developer Center to avoid system failures and to ensure your systems are able to receive the new authorization response codes.

_{Updated May 15, 2025 | P2024.1963
Published March 14, 2025 | P2024.1963}

On April 15, 2025, Visa will activate 3-D Secure (3DS) server service providers of acquired merchants to receive the Visa Protect Authentication Intelligence (VPAI) score, formerly known as the Visa Risk Based Authentication Score. The VPAI score can help you manage fraud risk by providing more data for analysis and simplifying the checkout process for low-risk customers.

Please contact your 3DS server service providers to learn how to use and access the VPAI score to your advantage.

_{Published April 15, 2025 | P2025.0396}

On April 15, 2025, Visa will activate 3-D Secure (3DS) servers for merchants to receive the Visa Protect Authentication Intelligence (VPAI) score in authentication response messages for Visa Data Only (VDO) authentication requests.

VDO is an information-only authentication data exchange between the merchant and card-issuer through Visa Secure messages wherein complete authentication is not performed for VDO transactions, which makes merchants unaware of the risk level of the data they supply. The VPAI score, formerly known as the Visa Risk Based Authentication Score can help you manage fraud risk by providing more data for analysis and simplifying the checkout process for low-risk customers.

Please contact your 3DS server service providers to learn how to access and use the VPAI score to your advantage.

_{Published April 15, 2025 | P2025.0395}

Effective April 1, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be converted to the new domestic currency, XCG/532 (Carribbean Guilder) by Visa. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published Janaury 10, 2025 | P2024.2017, P2024.1198}

Last April 15, 2023, Visa implemented the following limits and fee to their Automated Fuel Dispenser (AFD) authorizations:

• Status check authorization limit: $175 for non-fleet card transactions; $1,000 for fleet card transactions
• Real-time pre-authorization limit: $500 for non-fleet card transactions; $1,000 for fleet card transactions
• Partial Authorization Non-Participation Fee: a $0.01 fee will be assess on all AFD authorization request messages that do not support partial authorization responses

On April 16, 2025, initial authorizations for fixed amounts will only be permitted at AFDs. If you use non-AFD MCCs, you can use estimated and incremental authorizations instead.

_{Republished December 13, 2024 | P2022.1437a
Published March 15, 2023 | P2022.1437}

Update: The effective date of this change has been postponed until further notice by Visa.

Starting July 31, 2025, Visa will no longer honor the tokenized standing instruction merchant-initiated transactions (MIT) listed below, sent with a newly generated device token. These transactions will receive the decline reason code 530 (Do Not Honor).

• Installment Payments
• Recurring Payments
• Unscheduled Stored Credential

Visa will continue accepting standing instruction MITs from your existing cardholders with device tokens that were generated prior to August 1, 2025.

To avoid any payment disruptions, please work with your token service providers to replace the device tokens with card-on-file tokens for standing instruction MITs. You may also contact your JPMorganChase representative to find the right token solution for you.

_{Updated April 15, 2025 | P2025.0360
Updated December 13, 2024 | P2024.0093
Updated June 14, 2024 | P2024.0093
Updated December 15, 2023 | P2023.2173
Published August 15, 2023 | P2021.1143a}

Visa is reminding everyone that transaction identifiers from previous merchant-initiated transaction (MIT) can no longer be used for new token MIT series. Instead please do the following:

• Use the transaction ID from the initial cardholder-initiated transaction (CIT), and
• include the correct POS Environment Code in the initial CIT.

Visit our Developer Center for the complete specifications required to be compliant with this change.

_{Published April 15, 2025 | P2025.0426a}

Update: Visa extended their Visa Flexible Credential (VFC) service, formerly known as Visa Multiple Account Access Service (VMAAS) to Guam.

On April 12, 2024, Visa will introduce the Visa Multiple Account Access Service (VMAAS) which will enable cardholders to access multiple funding sources from the same card issuer, through a single Visa credential.

Please visit our Developer Center for the complete specifications related on VMAAS.

_{Updated April 15, 2025 | P2024.1958
Published March 15, 2024 | P2023.2062}

Starting April 17, 2026, Mastercard will no longer allow full primary account numbers (FPAN) to appear in any document used for disputes. With this, merchants should NOT upload documents for Mastercard containing the FPAN, as this would violate Mastercard rules and may result in fines or additional fees. This rule also applies if the same document is sent again in a later¹ dispute and still shows the FPAN.

To avoid the violation, merchants should only show the last four digits of the card number in any document. Here are some ways to mask the rest of the numbers to ensure that the FPAN cannot be read or reconstructed:

• Cover the other digits with black ink
• Use a software to block out the digits
• Replace the digits with symbols like X, *, or #

Whatever method is used, make sure the FPAN cannot be read or reconstructed.

^{1. If a document is sent with the FPAN, Mastercard will not cancel the dispute, but the fee will be assessed.}

^{Published February 13, 2026 | P2025.1932}

Starting March 31, 2026, Mastercard will update their processing requirements for outbound transactions made with Mainland China-issued cards as outlined in the tables below.

These changes are designed to comply with Mainland China’s regulatory standards and may impact how certain transactions are processed. Expect these changes to be enforced at both the authorization request stage and the clearing stage.

Table 1 – Prohibited or invalid card acceptor business codes (MCCs) for which all transactions will be rejected

Table 2 – Restricted or invalid MCCs for which transactions more than 5,000 USD will be rejected

^{Published January 15, 2026 | P2025.3056}

Mastercard has shared the following best practices for preventing enumeration attacks. These attacks involve fraudsters systematically testing card numbers and credentials to identify valid card details.

• Capture and validate CVC2. Always require and validate the CVC2 code when adding a card or processing transactions. This is mandatory for card add in the Europe region and strongly recommended elsewhere.
• Enable EMV 3-D Secure authentication. Ensure EMV 3-D Secure is performed for all card adds and e-commerce transactions to provide an additional layer of security and prevent unauthorized card use.
• Implement CAPTCHA technology. Use CAPTCHAs during card add and checkout to block bots and automated attacks.
• Use Address Verification Service (AVS). Where supported, use AVS to verify the cardholder’s address and further reduce fraud risk.
• Monitor for unusual activity. Watch for spikes in transaction declines, multiple card adds from the same IP address or account, and increases in high-dollar, cross-border transactions. Set up internal alerts for higher than usual failure rates in card adds and authorization transactions.
• Limit transaction velocity. Detect and prevent multiple card adds or transactions per user account or IP address within short time frames. Implement throttling to restrict the number of actions from a single user account or IP address.
• Meet PCI DSS Standards. Ensure your business and all third-party service providers (e.g., payment gateways and shopping cart providers) comply with PCI DSS requirements and have mechanisms to detect and prevent enumeration attacks.
• Report suspicious activity. Immediately report any suspected account takeover or enumeration attack to your bank.
• Remediation plan. Have a documented and actionable remediation plan to address enumeration attacks within 72 hours of detection or notification by your bank or Mastercard.

Implementing these measures will help reduce fraud losses, protect cardholder data, and maintain trust with your customers. Please review your current processes and update them as necessary to comply with Mastercard’s recommendations.

^{Published March 13, 2026 | P2025.3018}

Mastercard is no longer requiring merchants to collect CVC 2 data for all card-not-present authenticated transactions. You may refer to the table for guidance on transaction authentication.

Table – Mastercard Expected Merchant Action During Authorization

^{Published January 15, 2026 | P2023.2190u1, P2023.2190a}

In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.1973}

Effective November 4, 2025, Mastercard will apply Merchant Advice Code (MAC) to card-present transactions. This change will allow you to receive MAC value 02 (Cannot approve at this time, try again later) that will not be limited to deferred authorizations. This will help manage resubmissions for deferred authorizations.

_{Published October 15, 2025 | P2025.0809}

Mastercard advises merchants to ensure that PIN entry bypass is disabled or removed from all payment terminals, regardless of card brand (either Mastercard or Metro) unless specifically required by regulatory mandates or banking association guidelines.

This suggestion is to help enhance cardholder security and reduce the risk of fraud from lost or stolen cards and helps protect cardholders from unauthorized transactions to maintain a secure payment environment.

_{Published November 14, 2025 | P2025.2304}

On October 17, 2025, Mastercard will revise the following standards:

• Authorization resubmission requirements. Resubmitted requests must include the same merchant details and POS condition values as the original, unless exceptions apply (e.g., transit debt recovery). They must also include the original PAN and expiration date, a tokenized-stored credential obtained through Secure Remote Commerce tokenization, or new account information from the cardholder or Automatic Billing Updater.
• Token cryptogram exception. If token cryptogram data is used in a declined merchant-initiated transaction (MIT) authorization request, it must not be reused in subsequent resubmissions.
• CNP transaction restrictions. Declined card-not-present (CNP) cardholder-initiated transactions must not be resubmitted as an MIT, except for transit debt recovery.
• Merchant advice codes. Merchants should use the decline reason and merchant advice code from the issuer's response in their resubmission strategies for MITs.
• Prohibition of data manipulation. Merchants must not manipulate transaction data in resubmissions to evade payment arrangement cancellations. This includes altering the acceptor ID or acceptor name used in the merchant's transaction messages, or shifting the merchant's transaction volume to a different acceptor ID.
• Response code restrictions. If any of the following response codes are received in the issuer’s authorization response for a merchant-initiated CNP transaction, do not make additional authorization requests for the same transaction with the same account information (PAN and expiration date combination) at any time:
  • 04 (Capture card)
  • 14 (Invalid card number)
  • 15 (Invalid issuer)
  • 41 (Lost card)
  • 43 (Stolen card)
  • 54 (Expired card)
• Resubmission strategy. The authorization resubmission strategy for MITs must consider both the decline reason code and MAC, as shown below:

Table – Mastercard Authorization Resubmission Strategy for MITs

Please visit our Developer Center for the complete specifications.

^{Published September 15, 2025 | P2025.0437}

Mastercard will require an online authorization for all refund transactions submitted for clearing starting October 1, 2025. This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511), contactless aggregated transit transactions, and commercial card transactions.

_{Published June 13, 2025 | P2025.0302}

Merchants with sales of online gift cards as their primary activity are now permitted to use MCC 6051 (Quasi Cash) as purchase transactions, following Mastercard’s revision of their standards.

They may still use MCC 6540 for funding transactions, but it must be coded with the appropriate Transaction Type Identifier (TTI) values and additional transaction reference data.

To avoid potential data integrity fines, visit our Developer Center for the complete specifications for funding transactions. You may also contact your JPMorganChase representative for more information.

_{Published October 15, 2025 | P2025.1967}

Mastercard has revised their standards to cover the following use cases for domestic Account Funding Transactions (AFTs):

• Transfer Funds to Own Securities Account
• Transfer Fiat Currency Funds to Own Cryptocurrency Account
• Transfer Funds to Own Gaming and Gambling Account/Wallet

To avoid non-compliance and potential fines from Mastercard, it is recommended to refrain from using purchase transactions for the above AFTs.

Please visit our Developer Center for the complete requirements and specifications on these transactions.

^{Published September 15, 2025 | P2025.0840}

Update: Mastercard has extended the 1984-bit Payment System public key expiration date to December 31, 2035, as shown in the table below.

The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Payment System public key expiration date has been extended to December 31, 2034 by Mastercard. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – Mastercard, Maestro and Cirrus Extended Expiration Date for the Payment System Public Key

_{Updated December 15, 2025 | P2024.1842u1
Updated June 13, 2025 | P2024.1842
Published February 14, 2025 | P2024.1842}

On July 11, 2025, Mastercard will introduce InControl clearing controls for cards enrolled by their issuing banks. To avoid deposit rejects under InControl, please ensure that the merchant category codes (MCCs) and transaction amounts match in both submission and approved authorization.

_{Published June 13, 2025 | P2024.2032}

On June 3, 2025, Mastercard will introduce the following new decline response code values:

1. Closed account. When a card issuer, or cardholder permanently closes a credential, or underlying account, and no further authorization requests will be approved.

2. Account not yet activated. When an authorization request is received but cannot be approved because the account has not been activated (e.g. a newly issued account).

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide”, appendix B in our Developer Center to make sure you are able to receive the new authorization decline response codes, and their corresponding values to your systems to avoid system failures.

_{Published May 15, 2025 | P2024.2031}

On May 12, 2025, Mastercard will generate Mastercard Digital Enablement Service (MDES) static tokens along with cloud tokens to support Click to Pay payments with the following benefits:

• Lessen the use of funding primary account numbers (PANs)
• Allows you to reduce instances of PAN data transmission for guest checkout transactions

If you currently do not support cloud tokens or DSRP-based checkout transactions in Click to Pay, Mastercard will provide static tokens in place of the cardholder’s PAN. A single-use dynamic token verification code (DTVC) may accompany these credentials during payment authorization.

_{Published April 15, 2025 | P2024.2355}

On May 1, 2025, Mastercard will introduce edit criteria to the fields listed below under their Data Integrity Monitoring Program (DIMP). Please note that sending non-compliant fields in deposit transactions submitted to the bank will be subjected to Mastercard’s DIMP fees. To avoid this fee, visit our Developer Center.

Table – New Mastercard Requirements for DIMP Travel Addendum Data

_{1. Mastercard defines airline travel transactions if the MCC is 4511 or between 3000-3350.}

_{Published February 14, 2025 | P2024.0259}

Beginning May 1, 2025, merchants utilizing a Merchant Payment Gateway (MPG)1 will be required to send the MPG Identifier (MPG ID) for Mastercard card-not-present authorizations and non-financial transactions (e.g., account verification and balance inquiry) to avoid non-compliance fees. Mail order/telephone order (MOTO) authorizations are exempt from this.

In preparation for future compliance mandates, Mastercard recommends including the MPG ID on card-present authorizations as well.

Please work with your vendor/service provider to ensure the MPG ID field is populated in authorizations prior to May 1, 2025. Please refer to the Developer Center for current Chase technical specifications.

_{1. An MPG is a Mastercard registered service provider that captures and sends transaction data to an acquirer, on behalf of a merchant, for processing. The MPG ID is a unique ID provided by Mastercard for each registered MPG. With the MPG ID, merchants will benefit from higher approval rates, lower fraud, and improved compliance with Mastercard Standards.}

_{Published December 13, 2024 | 2022.1533, P2022.0738, P2022.1244}

On April 21, 2025, Mastercard will enable support of Companion Cloud tokens and Recurring Payment Cloud tokens in their Mastercard Digital Enablement Service for digital wallet transactions. Apple Pay will be the first wallet to take advantage of this functionality to provide you with enhanced payment options.

Companion Cloud Tokens facilitate secure eCommerce transactions across multiple devices, while Recurring Cloud Tokens can be stored to continuously support merchant-initiated transactions. Both types offer greater flexibility in managing tokens and reduce dependency on device tokens.

If you choose to support and utilize both Cloud tokens in Apple Pay transactions, please contact Apple Pay for the complete specifications of Companion Cloud tokens and Recurring Payment Cloud token.

_{Published April 15, 2025 | P2024.2614, P2025.0177}

Starting April 11, 2025, Mastercard will allow the following documents to be submitted under their second presentment options when goods were delivered to or picked up by the cardholder.

• Photo proof that the goods were delivered to the address specified by the cardholder
• Documentation that a QR Code, PIN, or similar one-time use passcode was sent to an email address or phone number specified by the cardholder and was subsequently used to access a physical mailbox or merchandise locker where goods were delivered

Additionally, Mastercard will require that documents for all second presentment follow the outlined requirements.

Table – Mastercard Second Presentment File Requirements

_{Published March 14, 2025 | P2025.0047}

On April 1, 2025, Mastercard will require the presence of tag 9F34 in all EMV (card-present or card-not-present) authorization and clearing messages. This tag provides indication to the terminal of the cardholder verification method (CVM) used for the transaction (for example, offline PIN, online PIN or signature).

To prevent possible non-compliance fees under Mastercard’s Data Integrity Monitoring Program (DIMP), visit our Developer Center for the specifications required to update your Chase-provided terminals, or contact your terminal provider.

_{Published March 14, 2025 | P2024.1846}

Update: Mastercard moved the effective date for this update to April 30, 2025 from April 23.

On April 23, 2025, Mastercard will replace the device type value or form factor for Virtual Reality headset, headsets, or glasses to 34 from 99.

The Virtual Reality Headset device type/form factor is now supported by Mastercard Digital Enablement Service (MDES). Please visit our Developer Center for the complete specifications.

_{Updated May 15, 2025 | P2023.2426u2
Updated March 14, 2025 | P2023.2426a
Published March 15, 2024 | P2023.2426}

Mastercard will reject transactions based on the conditions described below.

Table – Mastercard Rejections on Unapproved Authorizations and Force Deposits

Please make sure all transactions are approved and authorized to avoid returns on rejections.

_{1. Transit First Ride Risk Program and Refund Transactions are excluded from rejections.}

_{Published February 15, 2025 | P2024.2029, P2024.2033}

Update: Refunds to commercial card account transactions are excluded from the online authorization requirement.

Effective October 18, 2024, Mastercard will require an online authorization for all refund transactions submitted for clearing.This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511) and contactless aggregated transit transaction refunds.

From November 1, 2024, this requirement will be included in Mastercard’s Data Integrity Monitoring Program and will help ensure that all refund transactions submitted for clearing contain the proper transaction data needed for issuers to link to corresponding refund authorizations.

_{Updated June 13, 2025 | P2025.0302
Published July 15, 2024 | P2024.0493}

Starting April 17, 2026, American Express OptBlue will require the below merchant profile data fields during the OptBlue Program merchant registration. Those with inaccurate or incomplete required data may be blocked or canceled from the OptBlue Program, resulting in ineligibility and not being able to process authorization and clearing transactions.

Required Merchant Profile Data Fields:

• Seller ID
• Seller Legal Name
• Seller DBA Name
• Seller Street Address
• Seller City Name
• Seller Region Code
• Seller Postal Code
• Seller Country Code
• Seller Currency Code
• Language
• Authorized Signer First Name
• Authorized Signer Last Name
• Authorized Signer Country Code

If you are blocked or canceled, please reach out to your JPMorganChase representative to resolve the issue and ensure your profile data is updated, complete, and compliant with the required merchant user profile data fields.

^{Published March 13, 2026 | P2025.2646}

Bulgaria will adopt the euro as their national currency in 2026. This change will affect the below transactions.

^{Published January 15, 2026 | P2025.2868}

Effective July 16, 2025, changes to authorized amounts on American Express transactions may be done by using the following variable authorizations before submitting the transaction:

• Estimated authorizations – allows you to obtain an authorization when the final amount is unknown
• Incremental authorizations – allows you to request an increase in the amount of a previously approved estimated and/or incremental authorization
• Partial reversals – allows a partial reversal for a previously approved estimated and/or incremental authorization

Visit our Developer Center for the complete specifications required to utilize these changes. You may also contact your JPMorganChase representative for more information.

_{Published July 15, 2025 | P2023.1893}

Update: The 1408-bit RSA Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit RSA Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by American Express. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – American Express Extended Expiration Date for the RSA Certification Authority Public Key

_{Updated June 13, 2025 | P2024.2097
Published February 14, 2025 | P2024.2097}

Starting January 1, 2026, Discover will require all cards to be compliant with D-Payment Application Specification (D-PAS) Connect. Ensure that your contactless D-PAS terminals have the correct terminal transaction qualifier (TTQ) to avoid terminated transactions. Discover will also discontinue support for offline plaintext PIN (OPTP).

In addition, by December 31, 2025, contactless terminals must cease supporting Zip or CTL-MSD transactions and be updated to support EMV contactless payments. D-PAS Connect transactions will fail if terminals only support CTL-MSD or Zip.

Please visit our Developer Center for the full D-PAS details. If your POS is managed by a third-party provider, please contact them to ensure compliance.

_{Published October 15, 2025 | P2025.1633}

Discover’s D-Payment Application Specification (D-PAS) 1408-bit Certificate Authority (CA) Production public key has expired. This public key should not be loaded on your point-of-sales (POS) devices deployed on and after December 31, 2024.

In addition, CA Production public keys must be removed from all POS devices by June 30, 2025.

Please reach out to your POS service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN is compliant with the requirements above.

_{Published February 14, 2025 | P2023.1014}

On April 11, 2025, Discover will implement a new requirement for debt repayment transactions. The payment indicator “D” must be included in authorization, authorization reversal, and clearing requests. Additionally, Discover will decline  debt repayment authorization requests for credit card and non-reloadable prepaid card transactions submitted under Merchant Category Code 6051, 6012.

To ensure compliance and prevent interchange reclassification, please visit our Developer Center for complete specifications.

_{Published March 14, 2025 | P2024.0723, P2024.0742}

Update: Starting March 21, 2026, Accel and STAR fraud chargebacks will be challenged through the Outgoing Pre-Arbitration Cycle, where:

• Status updates will be visible in the Chargeback Management (CBIS) user interface
• Funds will only be transferred if the card issuer accepts the chargeback or does not respond within the required timeframe

On March 21, 2026, Fiserv will migrate the exception processing platform for Accel and STAR to Transaction Research and Exception Processing (TREP). This will lead to a revision in Accel’s timeframe for merchant response to chargebacks/exceptions, while STAR’s will remain unchanged, as shown in the table below. Exception items created before the update will adhere to the current timeframes.

Table – Merchant Response Timeframe for Exception Processing

^{Updated March 13, 2026 | P2024.1160
Published January 15, 2026 | P2024.1457, P2024.1160}

Bulgaria will adopt the euro as their national currency in 2026. This change will affect the below transactions.

^{Published January 15,  2026 | P2025.3181}

Update: The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Root Certificate Authority (CA) public key expiration date has been extended to December 31, 2035 by UnionPay International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – UnionPay Extended Expiration Date for the Root CA Public Key

_{Updated June 13, 2025 | P2024.0007
Published February 14, 2025 | P2024.0007}

Update: The 1408-bit JCB/Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit JCB/Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by JCB International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – JCB Extended Expiration Date for the JCB/CA Public Key

_{Updated June 13, 2025 | P2023.2284
Published February 14, 2025 | P2023.2284}

The card expiration date must be provided for all card-not-present transactions, as clarified by PULSE.

_{Published July 15, 2025 | P2025.0055}

Effective April 1, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be updated to the new domestic currency, XCG/532 (Carribbean Guilder) by UnionPay. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published Janaury 10, 2025 | P2024.2115}