On June 1, 2026, Visa will introduce new branding requirements to all new executions for the following payment experiences:

• Tap to Peer-to-Peer (P2P)
• Visa Tap to Add Card
• Tap to Activate
• Tap to Confirm

Visa will also require Enabled by Visa as the brand endorsement messaging for Visa Direct, including Visa+ and Visa Tap to P2P. More information can be found in the Visa Brand Center page.

_{Note: Effective June 1, 2027, merchants must adhere to the branding requirements for all executions for the above mentioned payment experiences.} 

_{Published April 15, 2026 | P2025.3418}

Account Funding Transactions (AFTs) will be allowed by Visa to qualify for the Digital Commerce Authentication Program (DCAP) starting the following dates:

Table – DCAP Effective Dates for AFTs

If you process authorization or clearing through a third-party service provider, please contact them to ensure they are able to meet Visa’s AFT authentication requirements for tokenized and PAN-based transactions on the effective dates specified above.

_{Published April 15, 2026 | P2025.2358}

Banque de France recommends merchants globally to enable 3DS authentication coverage for card-not-present transactions using cards issued in France. If you have not yet implemented measures for 3DS authentication, please take immediate action to align with these recommendations.

Visa also recommends reviewing the Banque de France announcement and website for further details.

_{Published April 15, 2026 | P2026.0363}

Visa requires the submission of Tag 9F7C, Customer Exclusive Data in the chip data tag of VisaNet contactless chip transactions, when present on a card or mobile device. Tag 9F7C enables loyalty, rewards, and personalized cardholder experiences through dynamic digital wallet updates.

Please visit our Developer Center for the complete specifications required to ensure your system is able to support the transmission of Tag 9F7C.

_{Published April 15, 2026 | P2026.0361}

Starting April 17, 2026, Visa will make the following changes:

• Introduce the Visa Infinite Privilege Charge and Visa Ultra High Net Worth charge consumer products
• Expand the existing products Visa Infinite Charge, Visa Infinite Privilege Credit and Debit and Visa Ultra High Net Worth Credit and Debit products for issuance in additional regions as shown below

Table – New and Expanded Visa Infinite, Visa Infinite Privilege, and Visa Ultra High Net Worth products

Existing interregional interchange fee programs apply.

^{Published March 13, 2026 | P2025.2354}

Update: To clarify, Visa will start identifying eligible transactions for DCAP on the following effective dates:

• April 17, 2026 – U.S. and Guam
• October 1, 2026 – Puerto Rico and U.S. Virgin Islands

The Digital Commerce Authentication Program (DCAP) is an optional program launched by Visa in order to enhance data sharing for customer-initiated card-not-present transactions. Participating in DCAP requires providing additional enhanced data through messages by Visa approved authentication solution (e.g. Visa Secure, 3DS or Visa Token Service).

With this, transactions eligible for the program will be identified by Visa starting on the effective dates mentioned above through the introduction of the new DCAP indicator. The indicator will be retained during authorization and returned in clearing.

If you process authorization or clearing through a third-party service provider, please contact them to ensure they meet Visa’s requirements.

^{Updated January 15, 2026 | P2025.0641, P2025.0642, P2025.2344
Published December 15, 2025 | P2025.0641, P2025.0642}

Visa strongly recommends that merchants include the Original Transaction ID (OTID) in all PAN- and token‑based standing instruction merchant‑initiated transaction (MIT) authorization. Merchants should:

• Always capture and pass the OTID in every MIT authorization message
• Ensure the initial cardholder-initiated transaction (CIT) includes the correct POS environment code with indicators I, R, or C, using the same credentials intended for future MITs
• Leverage Visa’s MIT Service to securely store, retrieve, and pass the OTID into the MIT authorization message to simplify implementation and ensure accurate linkage to the CIT 

Doing the above enables:

• Precise linkage from the initial CIT to follow‑on MITs at the subscription level, preventing over‑blocking and avoiding declines caused by merchant‑level stop instructions 
• Fewer repeated retries and declines, minimized compliance‑associated fees, and the ability to unlock more Visa value‑added services and insights through improved data integrity
• Merchant visibility into cardholder cancellation and subscription management via notifications

^{Published March 13, 2026 | P2025.3425}

On February 21, 2026, Visa will increase the permitted clearing variance from 20 to 30% for MCC 5812 – Eating Places and Restaurants and MCC 5814 – Fast Food Restaurants. Visa will also be adding MCC 5811 – Caterers to the same permitted clearing variance.

This update aims to reduce dispute risks should merchants need to process a final transaction amount with a clearing variance of more than 20%.

^{Published January 15, 2026 | P2025.2026}

In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.2121}

By December 31, 2025, Visa will require full compliance to Visa Fleet 2.0 requirements. Please work with your service provider to ensure your software is updated accordingly.

In addition, merchants who accept Visa Fleet cards must provide enhanced data for Visa Fleet card transactions under the following merchant category codes (MCCs):

• MCC 4468—Marinas, Marine Service, and Supplies
• MCC 5499—Miscellaneous Food Stores—Convenience Stores and Specialty Markets
• MCC 5541—Service Stations (With or without Ancillary Services)
• MCC 5542—Automated Fuel Dispensers
• MCC 5983—Fuel Dealers—Fuel Oil, Wood, Coal, and Liquefied Petroleum

_{Note: MCC 5552 – Electric Vehicle Charging is currently excluded. Visa Fleet card transactions must provide both cardholder-supplied data and supplemental transaction data for these transactions.}

_{Published November 14, 2025 | P2024.2288}

Visa updated their Service Fee program to include the key changes below:

• Adding MCC 4900—Utilities – Electric, Gas, Water, and Sanitary in the Service Fee program, in addition to the existing permitted MCCs:
  • MCC 8211—Elementary and Secondary Schools
  • MCC 8220—Colleges, Universities, Professional Schools, and Junior Colleges
  • MCC 8244—Business and Secretarial Schools
  • MCC 8249—Vocational and Trade Schools
  • MCC 9211—Court Costs, Including Alimony and Child Support
  • MCC 9222—Fines
  • MCC 9311—Tax Payments
  • MCC 9399—Government Services (Not Elsewhere Classified)

• Registration of or providing a Merchant Verification Value (MVV) is not required
• Government approval processing tax payments with a service fee is no longer necessary
• Payments and service fees can be processed in a single transaction, allowing you to select the most efficient processing method

_{Published December 15, 2025 | P2025.2465}

On October 18, 2025, Visa will add new Spend Qualified Indicator (SQI) values to supplement the existing values shown in the table below.

The new SQI values may be applied to Interchange Reimbursement Fee programs in certain markets, similar to the current values. Future programs may include an expanded level of spend qualification which may utilize the new values.

Please visit our Developer Center for the complete specifications of the SQI values.

Table – Visa New and Existing SQI Indicators

_{Published October 15, 2025 | P2025.0648}

Starting October 18, 2025, Visa will standardize requirements for processing delayed charges for loss, theft, or damages.

A delayed charge transaction for damages, will require merchants to obtain cardholder consent through one of the following:

• Cardholder signature on the same page and near the description of potential charges for delayed charge transactions
• Cardholder signature on the agreement and initials on each page, including the page with the charge description
• Other documentation proving the cardholder's liability for damages

These requirements apply to the following merchant types:

• Vehicle Rental Merchants (Including but not limited to MCCs 3351 – 3441)
• Lodging Merchants (Including but not limited to MCCs 3501 to 3840)
• MCC 7999 – Recreational Services (Aircraft, bicycle, and motorcycle rental)
• MCC 4457 – Boat Rentals and Leasing
• MCC 7296 – Clothing Rental (Costumes, uniforms, and formal wear)
• MCC 4411 – Steamship and Cruise Lines
• MCC 7394 – Equipment, Tool, Furniture, and Appliance Rental and Leasing
• MCC 4789 – Transportation Services
• MCC 7519 – Motor Home and Recreational Vehicle Rentals
• MCC 7033 – Trailer Parks and Campgrounds

_{Published October 15, 2025 | P2025.1574}

On October 17, 2025, Visa will add Visa Stop Payment Service (VSPS) checks in the account verification process. This will notify merchants of stop instructions for a primary account number for recurring and installment transactions.

Please be prepared to receive the following VSPS decline response codes:

• R0 – Stop this payment
• R1 – Stop all future payments
• R3 – Stop all merchants

These VSPS decline response codes indicate that the cardholder has withdrawn their consent to use their card for payment. Please do not attempt to resubmit an authorization request after receiving any of the VSPS decline response codes.

_{Published October 15, 2025 | P2025.0651}

On October 17, 2025, Visa will add response code 78 – Blocked, first used or special condition—new cardholder not activated or card is temporarily blocked to the list of permitted response codes for credit voucher and merchandise return authorization transactions. Updated list show below.

Table 1 – Visa Valid Card Issuer-Provided Approve Response Codes

Table 2 – Updated Visa Valid Card Issuer-Provided Decline Response Codes

<sup>1. Applies only to non-reloadable prepaid cards that do not support credit transaction types, or certain healthcare-related prepaid products where transactions are restricted to certain merchant categories. Response code 57 is not valid for general credit or debit card transactions.
2. This is not a new response code; it already exists for other transactions, but it is now being leveraged for merchandise return and credit vouchers.</sup>

^{Published September 15, 2025 | P2025.0649}

Visa modified their Custom Payment Service (CPS) Program to remove the transaction amount and MCC requirement from unattended terminals for the following interchange categories:

• CPS/Retail
• CPS/Restaurant
• CPS/Supermarket
• CPS/Retail Service Station
• CPS/Hotel – Card Present
• CPS/Car Rental – Card Present
• CPS/Passenger Transport – Card Present
• CPS/Retail Key Entry

^{Published September 15, 2025 | P2024.2008}

Please visit our Developer Center for Visa’s updated Address Verification Service (AVS) result code definitions and descriptions. Please note that there are no changes to AVS result codes.

For effective AVS results, follow these best practices:

• Send genuine address data provided by the cardholder
• Do not send dummy or repeat data
• Do not send exclusively spaces, blanks or non-printable characters
• Provide both street address and postal / ZIP code whenever possible
• Ensure the billing address is sent in AVS requests when the shipping and billing addresses are different

^{Published September 15, 2025 | P2025.1593}

The advisory period for the Visa Acquirer Monitoring Program (VAMP) enhancements has been extended to September 30, 2025. During this period, you must continue to monitor fraud and dispute metrics and improve risk controls where necessary prior to the VAMP enforcement on October 1, 2025.

Avoid potential fines under VAMP by consulting your JPMorganChase representative for advice on risk improvement measures, and more information on Visa’s monitoring thresholds.

_{Published June 13, 2025 | P2025.0593}

Visa has updated their Visa Acquirer Monitoring Program (VAMP) ratio to include fraud disputes, in addition to non-fraud disputes.

Merchants exceeding VAMP ratio thresholds and minimum monthly counts to enter the program will be assessed a merchant excessive fee of 8 USD by Visa, multiplied by each instance of fraud and each dispute, beginning October 1, 2025.

It is recommended to take the following measures to reduce being identified in VAMP:

• Implement fraud prevention and security tools to detect and prevent unauthorized transactions
• Use advanced dispute mitigation tools, such as Real-time Dispute Resolution (RDR) systems
• Conduct thorough analyses of chargebacks to yield insights on underlying causes of disputes

_{Published August 15, 2025 | P2025.1030}

Update: The Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1408-bit public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

Visa has extended the expiration date of the Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1984-bit public key to December 31, 2034 as shown in the below table. The expiration date of the 1408-bit public key remains the same.

Visa has extended the expiration date of the Visa Smart Debit / Credit (VSDC) Certificate Authority (CA) keys for the 1984-bit public key.

Please reach out to your point-of-sales (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain Visa public keys with the updated expiration dates shown below. Take note to not use expired keys or keys past their expiration date.

Table – Visa Extended Expiration Date for VSDC CA Key

_{Updated June 13, 2025 | P2025.0233
Updated December 13, 2024 | P2024.1949
Published  November 15, 2024 | P2022.1122}

Starting May 25, 2025, Visa will increase the retry attempt to 20 times for both cardholder-initiated transactions (CITs) and merchant-initiated transactions (MITs), up from the previous limit of 15 times, within 30 days after a category 2, 3 or 4 response code decline.

Please ensure to comply with the allowed number of retry attempts to avoid transaction declines.

_{Published May 15, 2025 | P2024.2594}

Update: This communication applies to receiving the new response codes in authorization requests.

On April 11, 2025, Visa will introduce the following new response codes under category 2:

1.    Transaction not supported/blocked by Issuer.

2.    Blocked by cardholder/contact cardholder.

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide” in our Developer Center to avoid system failures and to ensure your systems are able to receive the new authorization response codes.

_{Updated May 15, 2025 | P2024.1963
Published March 14, 2025 | P2024.1963}

Update: The effective date of this change has been postponed until further notice by Visa.

Starting July 31, 2025, Visa will no longer honor the tokenized standing instruction merchant-initiated transactions (MIT) listed below, sent with a newly generated device token. These transactions will receive the decline reason code 530 (Do Not Honor).

• Installment Payments
• Recurring Payments
• Unscheduled Stored Credential

Visa will continue accepting standing instruction MITs from your existing cardholders with device tokens that were generated prior to August 1, 2025.

To avoid any payment disruptions, please work with your token service providers to replace the device tokens with card-on-file tokens for standing instruction MITs. You may also contact your JPMorganChase representative to find the right token solution for you.

_{Updated April 15, 2025 | P2025.0360
Updated December 13, 2024 | P2024.0093
Updated June 14, 2024 | P2024.0093
Updated December 15, 2023 | P2023.2173
Published August 15, 2023 | P2021.1143a}

Effective June 2, 2026, for merchants in states that prohibit MCC 5723 (Firearms and Ammunition), Mastercard will send MCC 5941 (Sporting Goods Stores) instead in the authorization and clearing messages if MCC 5723 is incorrectly submitted by the bank. All related lifecycle messages will also show MCC 5941.

_{Published April 15, 2026 | P2025.2773}

Effective April 17, 2026, Mastercard will reinstate the Fraudulent Processing of Transactions Chargeback as a compliance case.

This change addresses fraud schemes where customers are tricked into approving additional fraudulent, face-to-face, card-read transactions shortly after a legitimate purchase. These transactions can appear under a different merchant name or location.

A common fraud scheme works like this:

1. A cardholder tries to pay at the pump.

2. The attendant claims the transaction didn’t go through and brings the cardholder inside to pay (or offers to take the card inside for them).

3. Inside, the attendant uses a fraudulent or tampered merchant terminal to run an in-person, card-read transaction under a different merchant name and location than what the cardholder authorized.

As a result of this change, you may see an increase in dispute compliance cases related to above fraudulent activity scenarios.

_{Published April 15, 2026 | P2025.2063}

Starting April 17, 2026, Mastercard will no longer allow full primary account numbers (FPAN) to appear in any document used for disputes. With this, merchants should NOT upload documents for Mastercard containing the FPAN, as this would violate Mastercard rules and may result in fines or additional fees. This rule also applies if the same document is sent again in a later¹ dispute and still shows the FPAN.

To avoid the violation, merchants should only show the last four digits of the card number in any document. Here are some ways to mask the rest of the numbers to ensure that the FPAN cannot be read or reconstructed:

• Cover the other digits with black ink
• Use a software to block out the digits
• Replace the digits with symbols like X, *, or #

Whatever method is used, make sure the FPAN cannot be read or reconstructed.

^{1. If a document is sent with the FPAN, Mastercard will not cancel the dispute, but the fee will be assessed.}

^{Published February 13, 2026 | P2025.1932}

Starting March 31, 2026, Mastercard will update their processing requirements for outbound transactions made with Mainland China-issued cards as outlined in the tables below.

These changes are designed to comply with Mainland China’s regulatory standards and may impact how certain transactions are processed. Expect these changes to be enforced at both the authorization request stage and the clearing stage.

Table 1 – Prohibited or invalid card acceptor business codes (MCCs) for which all transactions will be rejected

Table 2 – Restricted or invalid MCCs for which transactions more than 5,000 USD will be rejected

^{Published January 15, 2026 | P2025.3056}

Mastercard has shared the following best practices for preventing enumeration attacks. These attacks involve fraudsters systematically testing card numbers and credentials to identify valid card details.

• Capture and validate CVC2. Always require and validate the CVC2 code when adding a card or processing transactions. This is mandatory for card add in the Europe region and strongly recommended elsewhere.
• Enable EMV 3-D Secure authentication. Ensure EMV 3-D Secure is performed for all card adds and e-commerce transactions to provide an additional layer of security and prevent unauthorized card use.
• Implement CAPTCHA technology. Use CAPTCHAs during card add and checkout to block bots and automated attacks.
• Use Address Verification Service (AVS). Where supported, use AVS to verify the cardholder’s address and further reduce fraud risk.
• Monitor for unusual activity. Watch for spikes in transaction declines, multiple card adds from the same IP address or account, and increases in high-dollar, cross-border transactions. Set up internal alerts for higher than usual failure rates in card adds and authorization transactions.
• Limit transaction velocity. Detect and prevent multiple card adds or transactions per user account or IP address within short time frames. Implement throttling to restrict the number of actions from a single user account or IP address.
• Meet PCI DSS Standards. Ensure your business and all third-party service providers (e.g., payment gateways and shopping cart providers) comply with PCI DSS requirements and have mechanisms to detect and prevent enumeration attacks.
• Report suspicious activity. Immediately report any suspected account takeover or enumeration attack to your bank.
• Remediation plan. Have a documented and actionable remediation plan to address enumeration attacks within 72 hours of detection or notification by your bank or Mastercard.

Implementing these measures will help reduce fraud losses, protect cardholder data, and maintain trust with your customers. Please review your current processes and update them as necessary to comply with Mastercard’s recommendations.

^{Published March 13, 2026 | P2025.3018}

Mastercard is no longer requiring merchants to collect CVC 2 data for all card-not-present authenticated transactions. You may refer to the table for guidance on transaction authentication.

Table – Mastercard Expected Merchant Action During Authorization

^{Published January 15, 2026 | P2023.2190u1, P2023.2190a}

In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.1973}

Effective November 4, 2025, Mastercard will apply Merchant Advice Code (MAC) to card-present transactions. This change will allow you to receive MAC value 02 (Cannot approve at this time, try again later) that will not be limited to deferred authorizations. This will help manage resubmissions for deferred authorizations.

_{Published October 15, 2025 | P2025.0809}

Mastercard advises merchants to ensure that PIN entry bypass is disabled or removed from all payment terminals, regardless of card brand (either Mastercard or Metro) unless specifically required by regulatory mandates or banking association guidelines.

This suggestion is to help enhance cardholder security and reduce the risk of fraud from lost or stolen cards and helps protect cardholders from unauthorized transactions to maintain a secure payment environment.

_{Published November 14, 2025 | P2025.2304}

On October 17, 2025, Mastercard will revise the following standards:

• Authorization resubmission requirements. Resubmitted requests must include the same merchant details and POS condition values as the original, unless exceptions apply (e.g., transit debt recovery). They must also include the original PAN and expiration date, a tokenized-stored credential obtained through Secure Remote Commerce tokenization, or new account information from the cardholder or Automatic Billing Updater.
• Token cryptogram exception. If token cryptogram data is used in a declined merchant-initiated transaction (MIT) authorization request, it must not be reused in subsequent resubmissions.
• CNP transaction restrictions. Declined card-not-present (CNP) cardholder-initiated transactions must not be resubmitted as an MIT, except for transit debt recovery.
• Merchant advice codes. Merchants should use the decline reason and merchant advice code from the issuer's response in their resubmission strategies for MITs.
• Prohibition of data manipulation. Merchants must not manipulate transaction data in resubmissions to evade payment arrangement cancellations. This includes altering the acceptor ID or acceptor name used in the merchant's transaction messages, or shifting the merchant's transaction volume to a different acceptor ID.
• Response code restrictions. If any of the following response codes are received in the issuer’s authorization response for a merchant-initiated CNP transaction, do not make additional authorization requests for the same transaction with the same account information (PAN and expiration date combination) at any time:
  • 04 (Capture card)
  • 14 (Invalid card number)
  • 15 (Invalid issuer)
  • 41 (Lost card)
  • 43 (Stolen card)
  • 54 (Expired card)
• Resubmission strategy. The authorization resubmission strategy for MITs must consider both the decline reason code and MAC, as shown below:

Table – Mastercard Authorization Resubmission Strategy for MITs

Please visit our Developer Center for the complete specifications.

^{Published September 15, 2025 | P2025.0437}

Mastercard will require an online authorization for all refund transactions submitted for clearing starting October 1, 2025. This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511), contactless aggregated transit transactions, and commercial card transactions.

_{Published June 13, 2025 | P2025.0302}

Merchants with sales of online gift cards as their primary activity are now permitted to use MCC 6051 (Quasi Cash) as purchase transactions, following Mastercard’s revision of their standards.

They may still use MCC 6540 for funding transactions, but it must be coded with the appropriate Transaction Type Identifier (TTI) values and additional transaction reference data.

To avoid potential data integrity fines, visit our Developer Center for the complete specifications for funding transactions. You may also contact your JPMorganChase representative for more information.

_{Published October 15, 2025 | P2025.1967}

Mastercard has revised their standards to cover the following use cases for domestic Account Funding Transactions (AFTs):

• Transfer Funds to Own Securities Account
• Transfer Fiat Currency Funds to Own Cryptocurrency Account
• Transfer Funds to Own Gaming and Gambling Account/Wallet

To avoid non-compliance and potential fines from Mastercard, it is recommended to refrain from using purchase transactions for the above AFTs.

Please visit our Developer Center for the complete requirements and specifications on these transactions.

^{Published September 15, 2025 | P2025.0840}

Update: Mastercard has extended the 1984-bit Payment System public key expiration date to December 31, 2035, as shown in the table below.

The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Payment System public key expiration date has been extended to December 31, 2034 by Mastercard. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – Mastercard, Maestro and Cirrus Extended Expiration Date for the Payment System Public Key

_{Updated December 15, 2025 | P2024.1842u1
Updated June 13, 2025 | P2024.1842
Published February 14, 2025 | P2024.1842}

On July 11, 2025, Mastercard will introduce InControl clearing controls for cards enrolled by their issuing banks. To avoid deposit rejects under InControl, please ensure that the merchant category codes (MCCs) and transaction amounts match in both submission and approved authorization.

_{Published June 13, 2025 | P2024.2032}

On June 3, 2025, Mastercard will introduce the following new decline response code values:

1. Closed account. When a card issuer, or cardholder permanently closes a credential, or underlying account, and no further authorization requests will be approved.

2. Account not yet activated. When an authorization request is received but cannot be approved because the account has not been activated (e.g. a newly issued account).

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide”, appendix B in our Developer Center to make sure you are able to receive the new authorization decline response codes, and their corresponding values to your systems to avoid system failures.

_{Published May 15, 2025 | P2024.2031}

On May 12, 2025, Mastercard will generate Mastercard Digital Enablement Service (MDES) static tokens along with cloud tokens to support Click to Pay payments with the following benefits:

• Lessen the use of funding primary account numbers (PANs)
• Allows you to reduce instances of PAN data transmission for guest checkout transactions

If you currently do not support cloud tokens or DSRP-based checkout transactions in Click to Pay, Mastercard will provide static tokens in place of the cardholder’s PAN. A single-use dynamic token verification code (DTVC) may accompany these credentials during payment authorization.

_{Published April 15, 2025 | P2024.2355}

On May 1, 2025, Mastercard will introduce edit criteria to the fields listed below under their Data Integrity Monitoring Program (DIMP). Please note that sending non-compliant fields in deposit transactions submitted to the bank will be subjected to Mastercard’s DIMP fees. To avoid this fee, visit our Developer Center.

Table – New Mastercard Requirements for DIMP Travel Addendum Data

_{1. Mastercard defines airline travel transactions if the MCC is 4511 or between 3000-3350.}

_{Published February 14, 2025 | P2024.0259}

Beginning May 1, 2025, merchants utilizing a Merchant Payment Gateway (MPG)1 will be required to send the MPG Identifier (MPG ID) for Mastercard card-not-present authorizations and non-financial transactions (e.g., account verification and balance inquiry) to avoid non-compliance fees. Mail order/telephone order (MOTO) authorizations are exempt from this.

In preparation for future compliance mandates, Mastercard recommends including the MPG ID on card-present authorizations as well.

Please work with your vendor/service provider to ensure the MPG ID field is populated in authorizations prior to May 1, 2025. Please refer to the Developer Center for current Chase technical specifications.

_{1. An MPG is a Mastercard registered service provider that captures and sends transaction data to an acquirer, on behalf of a merchant, for processing. The MPG ID is a unique ID provided by Mastercard for each registered MPG. With the MPG ID, merchants will benefit from higher approval rates, lower fraud, and improved compliance with Mastercard Standards.}

_{Published December 13, 2024 | 2022.1533, P2022.0738, P2022.1244}

Update: Mastercard moved the effective date for this update to April 30, 2025 from April 23.

On April 23, 2025, Mastercard will replace the device type value or form factor for Virtual Reality headset, headsets, or glasses to 34 from 99.

The Virtual Reality Headset device type/form factor is now supported by Mastercard Digital Enablement Service (MDES). Please visit our Developer Center for the complete specifications.

_{Updated May 15, 2025 | P2023.2426u2
Updated March 14, 2025 | P2023.2426a
Published March 15, 2024 | P2023.2426}

Update: Refunds to commercial card account transactions are excluded from the online authorization requirement.

Effective October 18, 2024, Mastercard will require an online authorization for all refund transactions submitted for clearing.This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511) and contactless aggregated transit transaction refunds.

From November 1, 2024, this requirement will be included in Mastercard’s Data Integrity Monitoring Program and will help ensure that all refund transactions submitted for clearing contain the proper transaction data needed for issuers to link to corresponding refund authorizations.

_{Updated June 13, 2025 | P2025.0302
Published July 15, 2024 | P2024.0493}

Starting April 17, 2026, American Express OptBlue will require the below merchant profile data fields during the OptBlue Program merchant registration. Those with inaccurate or incomplete required data may be blocked or canceled from the OptBlue Program, resulting in ineligibility and not being able to process authorization and clearing transactions.

Required Merchant Profile Data Fields:

• Seller ID
• Seller Legal Name
• Seller DBA Name
• Seller Street Address
• Seller City Name
• Seller Region Code
• Seller Postal Code
• Seller Country Code
• Seller Currency Code
• Language
• Authorized Signer First Name
• Authorized Signer Last Name
• Authorized Signer Country Code

If you are blocked or canceled, please reach out to your JPMorganChase representative to resolve the issue and ensure your profile data is updated, complete, and compliant with the required merchant user profile data fields.

^{Published March 13, 2026 | P2025.2646}

Bulgaria will adopt the euro as their national currency in 2026. This change will affect the below transactions.

^{Published January 15, 2026 | P2025.2868}

Effective July 16, 2025, changes to authorized amounts on American Express transactions may be done by using the following variable authorizations before submitting the transaction:

• Estimated authorizations – allows you to obtain an authorization when the final amount is unknown
• Incremental authorizations – allows you to request an increase in the amount of a previously approved estimated and/or incremental authorization
• Partial reversals – allows a partial reversal for a previously approved estimated and/or incremental authorization

Visit our Developer Center for the complete specifications required to utilize these changes. You may also contact your JPMorganChase representative for more information.

_{Published July 15, 2025 | P2023.1893}

Update: The 1408-bit RSA Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit RSA Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by American Express. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – American Express Extended Expiration Date for the RSA Certification Authority Public Key

_{Updated June 13, 2025 | P2024.2097
Published February 14, 2025 | P2024.2097}

The Discover® Network Acceptance Mark has been updated. Please visit Discover’s Signage Site for more details.

_{Published April 15, 2026 | P2026.0620}

Starting January 1, 2026, Discover will require all cards to be compliant with D-Payment Application Specification (D-PAS) Connect. Ensure that your contactless D-PAS terminals have the correct terminal transaction qualifier (TTQ) to avoid terminated transactions. Discover will also discontinue support for offline plaintext PIN (OPTP).

In addition, by December 31, 2025, contactless terminals must cease supporting Zip or CTL-MSD transactions and be updated to support EMV contactless payments. D-PAS Connect transactions will fail if terminals only support CTL-MSD or Zip.

Please visit our Developer Center for the full D-PAS details. If your POS is managed by a third-party provider, please contact them to ensure compliance.

_{Published October 15, 2025 | P2025.1633}

Discover’s D-Payment Application Specification (D-PAS) 1408-bit Certificate Authority (CA) Production public key has expired. This public key should not be loaded on your point-of-sales (POS) devices deployed on and after December 31, 2024.

In addition, CA Production public keys must be removed from all POS devices by June 30, 2025.

Please reach out to your POS service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN is compliant with the requirements above.

_{Published February 14, 2025 | P2023.1014}

Update: Starting March 21, 2026, Accel and STAR fraud chargebacks will be challenged through the Outgoing Pre-Arbitration Cycle, where:

• Status updates will be visible in the Chargeback Management (CBIS) user interface
• Funds will only be transferred if the card issuer accepts the chargeback or does not respond within the required timeframe

On March 21, 2026, Fiserv will migrate the exception processing platform for Accel and STAR to Transaction Research and Exception Processing (TREP). This will lead to a revision in Accel’s timeframe for merchant response to chargebacks/exceptions, while STAR’s will remain unchanged, as shown in the table below. Exception items created before the update will adhere to the current timeframes.

Table – Merchant Response Timeframe for Exception Processing

^{Updated March 13, 2026 | P2024.1160
Published January 15, 2026 | P2024.1457, P2024.1160}

Bulgaria will adopt the euro as their national currency in 2026. This change will affect the below transactions.

^{Published January 15,  2026 | P2025.3181}

Update: The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Root Certificate Authority (CA) public key expiration date has been extended to December 31, 2035 by UnionPay International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – UnionPay Extended Expiration Date for the Root CA Public Key

_{Updated June 13, 2025 | P2024.0007
Published February 14, 2025 | P2024.0007}

Update: The 1408-bit JCB/Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit JCB/Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by JCB International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – JCB Extended Expiration Date for the JCB/CA Public Key

_{Updated June 13, 2025 | P2023.2284
Published February 14, 2025 | P2023.2284}

The card expiration date must be provided for all card-not-present transactions, as clarified by PULSE.

_{Published July 15, 2025 | P2025.0055}