In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.2121}

By December 31, 2025, Visa will require full compliance to Visa Fleet 2.0 requirements. Please work with your service provider to ensure your software is updated accordingly.

In addition, merchants who accept Visa Fleet cards must provide enhanced data for Visa Fleet card transactions under the following merchant category codes (MCCs):

• MCC 4468—Marinas, Marine Service, and Supplies
• MCC 5499—Miscellaneous Food Stores—Convenience Stores and Specialty Markets
• MCC 5541—Service Stations (With or without Ancillary Services)
• MCC 5542—Automated Fuel Dispensers
• MCC 5983—Fuel Dealers—Fuel Oil, Wood, Coal, and Liquefied Petroleum

_{Note: MCC 5552 – Electric Vehicle Charging is currently excluded. Visa Fleet card transactions must provide both cardholder-supplied data and supplemental transaction data for these transactions.}

_{Published November 14, 2025 | P2024.2288}

Visa updated their Service Fee program to include the key changes below:

• Adding MCC 4900—Utilities – Electric, Gas, Water, and Sanitary in the Service Fee program, in addition to the existing permitted MCCs:
  • MCC 8211—Elementary and Secondary Schools
  • MCC 8220—Colleges, Universities, Professional Schools, and Junior Colleges
  • MCC 8244—Business and Secretarial Schools
  • MCC 8249—Vocational and Trade Schools
  • MCC 9211—Court Costs, Including Alimony and Child Support
  • MCC 9222—Fines
  • MCC 9311—Tax Payments
  • MCC 9399—Government Services (Not Elsewhere Classified)

• Registration of or providing a Merchant Verification Value (MVV) is not required
• Government approval processing tax payments with a service fee is no longer necessary
• Payments and service fees can be processed in a single transaction, allowing you to select the most efficient processing method

_{Published December 15, 2025 | P2025.2465}

On October 18, 2025, Visa will add new Spend Qualified Indicator (SQI) values to supplement the existing values shown in the table below.

The new SQI values may be applied to Interchange Reimbursement Fee programs in certain markets, similar to the current values. Future programs may include an expanded level of spend qualification which may utilize the new values.

Please visit our Developer Center for the complete specifications of the SQI values.

Table – Visa New and Existing SQI Indicators

_{Published October 15, 2025 | P2025.0648}

Starting October 18, 2025, Visa will standardize requirements for processing delayed charges for loss, theft, or damages.

A delayed charge transaction for damages, will require merchants to obtain cardholder consent through one of the following:

• Cardholder signature on the same page and near the description of potential charges for delayed charge transactions
• Cardholder signature on the agreement and initials on each page, including the page with the charge description
• Other documentation proving the cardholder's liability for damages

These requirements apply to the following merchant types:

• Vehicle Rental Merchants (Including but not limited to MCCs 3351 – 3441)
• Lodging Merchants (Including but not limited to MCCs 3501 to 3840)
• MCC 7999 – Recreational Services (Aircraft, bicycle, and motorcycle rental)
• MCC 4457 – Boat Rentals and Leasing
• MCC 7296 – Clothing Rental (Costumes, uniforms, and formal wear)
• MCC 4411 – Steamship and Cruise Lines
• MCC 7394 – Equipment, Tool, Furniture, and Appliance Rental and Leasing
• MCC 4789 – Transportation Services
• MCC 7519 – Motor Home and Recreational Vehicle Rentals
• MCC 7033 – Trailer Parks and Campgrounds

_{Published October 15, 2025 | P2025.1574}

On October 17, 2025, Visa will add Visa Stop Payment Service (VSPS) checks in the account verification process. This will notify merchants of stop instructions for a primary account number for recurring and installment transactions.

Please be prepared to receive the following VSPS decline response codes:

• R0 – Stop this payment
• R1 – Stop all future payments
• R3 – Stop all merchants

These VSPS decline response codes indicate that the cardholder has withdrawn their consent to use their card for payment. Please do not attempt to resubmit an authorization request after receiving any of the VSPS decline response codes.

_{Published October 15, 2025 | P2025.0651}

On October 17, 2025, Visa will add response code 78 – Blocked, first used or special condition—new cardholder not activated or card is temporarily blocked to the list of permitted response codes for credit voucher and merchandise return authorization transactions. Updated list show below.

Table 1 – Visa Valid Card Issuer-Provided Approve Response Codes

Table 2 – Updated Visa Valid Card Issuer-Provided Decline Response Codes

<sup>1. Applies only to non-reloadable prepaid cards that do not support credit transaction types, or certain healthcare-related prepaid products where transactions are restricted to certain merchant categories. Response code 57 is not valid for general credit or debit card transactions.
2. This is not a new response code; it already exists for other transactions, but it is now being leveraged for merchandise return and credit vouchers.</sup>

^{Published September 15, 2025 | P2025.0649}

Visa modified their Custom Payment Service (CPS) Program to remove the transaction amount and MCC requirement from unattended terminals for the following interchange categories:

• CPS/Retail
• CPS/Restaurant
• CPS/Supermarket
• CPS/Retail Service Station
• CPS/Hotel – Card Present
• CPS/Car Rental – Card Present
• CPS/Passenger Transport – Card Present
• CPS/Retail Key Entry

^{Published September 15, 2025 | P2024.2008}

Please visit our Developer Center for Visa’s updated Address Verification Service (AVS) result code definitions and descriptions. Please note that there are no changes to AVS result codes.

For effective AVS results, follow these best practices:

• Send genuine address data provided by the cardholder
• Do not send dummy or repeat data
• Do not send exclusively spaces, blanks or non-printable characters
• Provide both street address and postal / ZIP code whenever possible
• Ensure the billing address is sent in AVS requests when the shipping and billing addresses are different

^{Published September 15, 2025 | P2025.1593}

The advisory period for the Visa Acquirer Monitoring Program (VAMP) enhancements has been extended to September 30, 2025. During this period, you must continue to monitor fraud and dispute metrics and improve risk controls where necessary prior to the VAMP enforcement on October 1, 2025.

Avoid potential fines under VAMP by consulting your JPMorganChase representative for advice on risk improvement measures, and more information on Visa’s monitoring thresholds.

_{Published June 13, 2025 | P2025.0593}

Visa has updated their Visa Acquirer Monitoring Program (VAMP) ratio to include fraud disputes, in addition to non-fraud disputes.

Merchants exceeding VAMP ratio thresholds and minimum monthly counts to enter the program will be assessed a merchant excessive fee of 8 USD by Visa, multiplied by each instance of fraud and each dispute, beginning October 1, 2025.

It is recommended to take the following measures to reduce being identified in VAMP:

• Implement fraud prevention and security tools to detect and prevent unauthorized transactions
• Use advanced dispute mitigation tools, such as Real-time Dispute Resolution (RDR) systems
• Conduct thorough analyses of chargebacks to yield insights on underlying causes of disputes

_{Published August 15, 2025 | P2025.1030}

Update: The Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1408-bit public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

Visa has extended the expiration date of the Visa Smart Debit/Credit (VSDC) Certificate Authority (CA) 1984-bit public key to December 31, 2034 as shown in the below table. The expiration date of the 1408-bit public key remains the same.

Visa has extended the expiration date of the Visa Smart Debit / Credit (VSDC) Certificate Authority (CA) keys for the 1984-bit public key.

Please reach out to your point-of-sales (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain Visa public keys with the updated expiration dates shown below. Take note to not use expired keys or keys past their expiration date.

Table – Visa Extended Expiration Date for VSDC CA Key

_{Updated June 13, 2025 | P2025.0233
Updated December 13, 2024 | P2024.1949
Published  November 15, 2024 | P2022.1122}

Starting May 25, 2025, Visa will increase the retry attempt to 20 times for both cardholder-initiated transactions (CITs) and merchant-initiated transactions (MITs), up from the previous limit of 15 times, within 30 days after a category 2, 3 or 4 response code decline.

Please ensure to comply with the allowed number of retry attempts to avoid transaction declines.

_{Published May 15, 2025 | P2024.2594}

Update: This communication applies to receiving the new response codes in authorization requests.

On April 11, 2025, Visa will introduce the following new response codes under category 2:

1.    Transaction not supported/blocked by Issuer.

2.    Blocked by cardholder/contact cardholder.

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide” in our Developer Center to avoid system failures and to ensure your systems are able to receive the new authorization response codes.

_{Updated May 15, 2025 | P2024.1963
Published March 14, 2025 | P2024.1963}

On April 15, 2025, Visa will activate 3-D Secure (3DS) server service providers of acquired merchants to receive the Visa Protect Authentication Intelligence (VPAI) score, formerly known as the Visa Risk Based Authentication Score. The VPAI score can help you manage fraud risk by providing more data for analysis and simplifying the checkout process for low-risk customers.

Please contact your 3DS server service providers to learn how to use and access the VPAI score to your advantage.

_{Published April 15, 2025 | P2025.0396}

On April 15, 2025, Visa will activate 3-D Secure (3DS) servers for merchants to receive the Visa Protect Authentication Intelligence (VPAI) score in authentication response messages for Visa Data Only (VDO) authentication requests.

VDO is an information-only authentication data exchange between the merchant and card-issuer through Visa Secure messages wherein complete authentication is not performed for VDO transactions, which makes merchants unaware of the risk level of the data they supply. The VPAI score, formerly known as the Visa Risk Based Authentication Score can help you manage fraud risk by providing more data for analysis and simplifying the checkout process for low-risk customers.

Please contact your 3DS server service providers to learn how to access and use the VPAI score to your advantage.

_{Published April 15, 2025 | P2025.0395}

Effective April 1, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be converted to the new domestic currency, XCG/532 (Carribbean Guilder) by Visa. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published Janaury 10, 2025 | P2024.2017, P2024.1198}

Last April 15, 2023, Visa implemented the following limits and fee to their Automated Fuel Dispenser (AFD) authorizations:

• Status check authorization limit: $175 for non-fleet card transactions; $1,000 for fleet card transactions
• Real-time pre-authorization limit: $500 for non-fleet card transactions; $1,000 for fleet card transactions
• Partial Authorization Non-Participation Fee: a $0.01 fee will be assess on all AFD authorization request messages that do not support partial authorization responses

On April 16, 2025, initial authorizations for fixed amounts will only be permitted at AFDs. If you use non-AFD MCCs, you can use estimated and incremental authorizations instead.

_{Republished December 13, 2024 | P2022.1437a
Published March 15, 2023 | P2022.1437}

Update: The effective date of this change has been postponed until further notice by Visa.

Starting July 31, 2025, Visa will no longer honor the tokenized standing instruction merchant-initiated transactions (MIT) listed below, sent with a newly generated device token. These transactions will receive the decline reason code 530 (Do Not Honor).

• Installment Payments
• Recurring Payments
• Unscheduled Stored Credential

Visa will continue accepting standing instruction MITs from your existing cardholders with device tokens that were generated prior to August 1, 2025.

To avoid any payment disruptions, please work with your token service providers to replace the device tokens with card-on-file tokens for standing instruction MITs. You may also contact your JPMorganChase representative to find the right token solution for you.

_{Updated April 15, 2025 | P2025.0360
Updated December 13, 2024 | P2024.0093
Updated June 14, 2024 | P2024.0093
Updated December 15, 2023 | P2023.2173
Published August 15, 2023 | P2021.1143a}

Visa is reminding everyone that transaction identifiers from previous merchant-initiated transaction (MIT) can no longer be used for new token MIT series. Instead please do the following:

• Use the transaction ID from the initial cardholder-initiated transaction (CIT), and
• include the correct POS Environment Code in the initial CIT.

Visit our Developer Center for the complete specifications required to be compliant with this change.

_{Published April 15, 2025 | P2025.0426a}

Update: Visa extended their Visa Flexible Credential (VFC) service, formerly known as Visa Multiple Account Access Service (VMAAS) to Guam.

On April 12, 2024, Visa will introduce the Visa Multiple Account Access Service (VMAAS) which will enable cardholders to access multiple funding sources from the same card issuer, through a single Visa credential.

Please visit our Developer Center for the complete specifications related on VMAAS.

_{Updated April 15, 2025 | P2024.1958
Published March 15, 2024 | P2023.2062}

In 2026, Bulgaria will adopt the euro as their national currency. This change will affect transactions outlined below.

^{Published September 15, 2025 | P2025.1973}

Effective November 4, 2025, Mastercard will apply Merchant Advice Code (MAC) to card-present transactions. This change will allow you to receive MAC value 02 (Cannot approve at this time, try again later) that will not be limited to deferred authorizations. This will help manage resubmissions for deferred authorizations.

_{Published October 15, 2025 | P2025.0809}

Mastercard advises merchants to ensure that PIN entry bypass is disabled or removed from all payment terminals, regardless of card brand (either Mastercard or Metro) unless specifically required by regulatory mandates or banking association guidelines.

This suggestion is to help enhance cardholder security and reduce the risk of fraud from lost or stolen cards and helps protect cardholders from unauthorized transactions to maintain a secure payment environment.

_{Published November 14, 2025 | P2025.2304}

On October 17, 2025, Mastercard will revise the following standards:

• Authorization resubmission requirements. Resubmitted requests must include the same merchant details and POS condition values as the original, unless exceptions apply (e.g., transit debt recovery). They must also include the original PAN and expiration date, a tokenized-stored credential obtained through Secure Remote Commerce tokenization, or new account information from the cardholder or Automatic Billing Updater.
• Token cryptogram exception. If token cryptogram data is used in a declined merchant-initiated transaction (MIT) authorization request, it must not be reused in subsequent resubmissions.
• CNP transaction restrictions. Declined card-not-present (CNP) cardholder-initiated transactions must not be resubmitted as an MIT, except for transit debt recovery.
• Merchant advice codes. Merchants should use the decline reason and merchant advice code from the issuer's response in their resubmission strategies for MITs.
• Prohibition of data manipulation. Merchants must not manipulate transaction data in resubmissions to evade payment arrangement cancellations. This includes altering the acceptor ID or acceptor name used in the merchant's transaction messages, or shifting the merchant's transaction volume to a different acceptor ID.
• Response code restrictions. If any of the following response codes are received in the issuer’s authorization response for a merchant-initiated CNP transaction, do not make additional authorization requests for the same transaction with the same account information (PAN and expiration date combination) at any time:
  • 04 (Capture card)
  • 14 (Invalid card number)
  • 15 (Invalid issuer)
  • 41 (Lost card)
  • 43 (Stolen card)
  • 54 (Expired card)
• Resubmission strategy. The authorization resubmission strategy for MITs must consider both the decline reason code and MAC, as shown below:

Table – Mastercard Authorization Resubmission Strategy for MITs

Please visit our Developer Center for the complete specifications.

^{Published September 15, 2025 | P2025.0437}

Mastercard will require an online authorization for all refund transactions submitted for clearing starting October 1, 2025. This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511), contactless aggregated transit transactions, and commercial card transactions.

_{Published June 13, 2025 | P2025.0302}

Merchants with sales of online gift cards as their primary activity are now permitted to use MCC 6051 (Quasi Cash) as purchase transactions, following Mastercard’s revision of their standards.

They may still use MCC 6540 for funding transactions, but it must be coded with the appropriate Transaction Type Identifier (TTI) values and additional transaction reference data.

To avoid potential data integrity fines, visit our Developer Center for the complete specifications for funding transactions. You may also contact your JPMorganChase representative for more information.

_{Published October 15, 2025 | P2025.1967}

Mastercard has revised their standards to cover the following use cases for domestic Account Funding Transactions (AFTs):

• Transfer Funds to Own Securities Account
• Transfer Fiat Currency Funds to Own Cryptocurrency Account
• Transfer Funds to Own Gaming and Gambling Account/Wallet

To avoid non-compliance and potential fines from Mastercard, it is recommended to refrain from using purchase transactions for the above AFTs.

Please visit our Developer Center for the complete requirements and specifications on these transactions.

^{Published September 15, 2025 | P2025.0840}

Update: Mastercard has extended the 1984-bit Payment System public key expiration date to December 31, 2035, as shown in the table below.

The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Payment System public key expiration date has been extended to December 31, 2034 by Mastercard. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – Mastercard, Maestro and Cirrus Extended Expiration Date for the Payment System Public Key

_{Updated December 15, 2025 | P2024.1842u1
Updated June 13, 2025 | P2024.1842
Published February 14, 2025 | P2024.1842}

On July 11, 2025, Mastercard will introduce InControl clearing controls for cards enrolled by their issuing banks. To avoid deposit rejects under InControl, please ensure that the merchant category codes (MCCs) and transaction amounts match in both submission and approved authorization.

_{Published June 13, 2025 | P2024.2032}

On June 3, 2025, Mastercard will introduce the following new decline response code values:

1. Closed account. When a card issuer, or cardholder permanently closes a credential, or underlying account, and no further authorization requests will be approved.

2. Account not yet activated. When an authorization request is received but cannot be approved because the account has not been activated (e.g. a newly issued account).

Please refer to the “Authorization Retry Strategy - Orbital, Stratus, and Tandem Supplemental Guide”, appendix B in our Developer Center to make sure you are able to receive the new authorization decline response codes, and their corresponding values to your systems to avoid system failures.

_{Published May 15, 2025 | P2024.2031}

On May 12, 2025, Mastercard will generate Mastercard Digital Enablement Service (MDES) static tokens along with cloud tokens to support Click to Pay payments with the following benefits:

• Lessen the use of funding primary account numbers (PANs)
• Allows you to reduce instances of PAN data transmission for guest checkout transactions

If you currently do not support cloud tokens or DSRP-based checkout transactions in Click to Pay, Mastercard will provide static tokens in place of the cardholder’s PAN. A single-use dynamic token verification code (DTVC) may accompany these credentials during payment authorization.

_{Published April 15, 2025 | P2024.2355}

On May 1, 2025, Mastercard will introduce edit criteria to the fields listed below under their Data Integrity Monitoring Program (DIMP). Please note that sending non-compliant fields in deposit transactions submitted to the bank will be subjected to Mastercard’s DIMP fees. To avoid this fee, visit our Developer Center.

Table – New Mastercard Requirements for DIMP Travel Addendum Data

_{1. Mastercard defines airline travel transactions if the MCC is 4511 or between 3000-3350.}

_{Published February 14, 2025 | P2024.0259}

Beginning May 1, 2025, merchants utilizing a Merchant Payment Gateway (MPG)1 will be required to send the MPG Identifier (MPG ID) for Mastercard card-not-present authorizations and non-financial transactions (e.g., account verification and balance inquiry) to avoid non-compliance fees. Mail order/telephone order (MOTO) authorizations are exempt from this.

In preparation for future compliance mandates, Mastercard recommends including the MPG ID on card-present authorizations as well.

Please work with your vendor/service provider to ensure the MPG ID field is populated in authorizations prior to May 1, 2025. Please refer to the Developer Center for current Chase technical specifications.

_{1. An MPG is a Mastercard registered service provider that captures and sends transaction data to an acquirer, on behalf of a merchant, for processing. The MPG ID is a unique ID provided by Mastercard for each registered MPG. With the MPG ID, merchants will benefit from higher approval rates, lower fraud, and improved compliance with Mastercard Standards.}

_{Published December 13, 2024 | 2022.1533, P2022.0738, P2022.1244}

On April 21, 2025, Mastercard will enable support of Companion Cloud tokens and Recurring Payment Cloud tokens in their Mastercard Digital Enablement Service for digital wallet transactions. Apple Pay will be the first wallet to take advantage of this functionality to provide you with enhanced payment options.

Companion Cloud Tokens facilitate secure eCommerce transactions across multiple devices, while Recurring Cloud Tokens can be stored to continuously support merchant-initiated transactions. Both types offer greater flexibility in managing tokens and reduce dependency on device tokens.

If you choose to support and utilize both Cloud tokens in Apple Pay transactions, please contact Apple Pay for the complete specifications of Companion Cloud tokens and Recurring Payment Cloud token.

_{Published April 15, 2025 | P2024.2614, P2025.0177}

Starting April 11, 2025, Mastercard will allow the following documents to be submitted under their second presentment options when goods were delivered to or picked up by the cardholder.

• Photo proof that the goods were delivered to the address specified by the cardholder
• Documentation that a QR Code, PIN, or similar one-time use passcode was sent to an email address or phone number specified by the cardholder and was subsequently used to access a physical mailbox or merchandise locker where goods were delivered

Additionally, Mastercard will require that documents for all second presentment follow the outlined requirements.

Table – Mastercard Second Presentment File Requirements

_{Published March 14, 2025 | P2025.0047}

On April 1, 2025, Mastercard will require the presence of tag 9F34 in all EMV (card-present or card-not-present) authorization and clearing messages. This tag provides indication to the terminal of the cardholder verification method (CVM) used for the transaction (for example, offline PIN, online PIN or signature).

To prevent possible non-compliance fees under Mastercard’s Data Integrity Monitoring Program (DIMP), visit our Developer Center for the specifications required to update your Chase-provided terminals, or contact your terminal provider.

_{Published March 14, 2025 | P2024.1846}

Update: Mastercard moved the effective date for this update to April 30, 2025 from April 23.

On April 23, 2025, Mastercard will replace the device type value or form factor for Virtual Reality headset, headsets, or glasses to 34 from 99.

The Virtual Reality Headset device type/form factor is now supported by Mastercard Digital Enablement Service (MDES). Please visit our Developer Center for the complete specifications.

_{Updated May 15, 2025 | P2023.2426u2
Updated March 14, 2025 | P2023.2426a
Published March 15, 2024 | P2023.2426}

Mastercard will reject transactions based on the conditions described below.

Table – Mastercard Rejections on Unapproved Authorizations and Force Deposits

Please make sure all transactions are approved and authorized to avoid returns on rejections.

_{1. Transit First Ride Risk Program and Refund Transactions are excluded from rejections.}

_{Published February 15, 2025 | P2024.2029, P2024.2033}

Effective March 31, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be updated to the new domestic currency, XCG/532 (Carribbean Guilder) by Mastercard. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published Janaury 10, 2025 | P2024.1578}

Starting March 1, 2025, a null or blank Business Application Identifier (BAI) field for funding transactions may be assessed a non-compliance fee. To prevent this, make sure to provide a valid identifier on the BAI field for all transactions under the following merchant category codes:

• 4829 (Money Transfer)
• 6538 (Funding Transaction for MoneySend)
• 6540 (Funding Transactions)

Please visit our Developer Center for the complete specifications required on these data integrity monitoring edits.

_{Published December 13, 2024 | P2022.0739a}

Mastercard is clarifying procedures for contactless transit aggregated transactions, which occur when:

• A Mastercard or Debit Mastercard contactless-enabled card or contactless payment device is tapped one or more times at the point of entry to a transit system during a 24-hour period (the tap aggregation period), and
• The taps are combined into a total transaction amount, then submitted for authorization on a deferred basis

Transit merchants must follow these guidelines:

• Account Verification (VF) transactions must not include a cryptogram or track data. If sent, the transaction will be considered non-compliant with potential declines/rejects. Instead, retain the cryptogram and track data from the VF transaction to submit in the End of Day Authorization or Conditional Deposit
• For the End of Day Authorization or Conditional Deposit:
  • If there is only one tap during the aggregation period, submit the retained cryptogram and track data from the initial tap (VF)
  • If there are multiple taps (rides taken), submit the cryptogram and track data from the last tap for the combined total amount of taps during the aggregation period

Specifications will be published at a later date.

_{Published February 14, 2025 | P2024.1337}

Update: Refunds to commercial card account transactions are excluded from the online authorization requirement.

Effective October 18, 2024, Mastercard will require an online authorization for all refund transactions submitted for clearing.This excludes refunds conducted by airlines (MCCs 3000 through 3350 and MCC 4511) and contactless aggregated transit transaction refunds.

From November 1, 2024, this requirement will be included in Mastercard’s Data Integrity Monitoring Program and will help ensure that all refund transactions submitted for clearing contain the proper transaction data needed for issuers to link to corresponding refund authorizations.

_{Updated June 13, 2025 | P2025.0302
Published July 15, 2024 | P2024.0493}

Effective July 16, 2025, changes to authorized amounts on American Express transactions may be done by using the following variable authorizations before submitting the transaction:

• Estimated authorizations – allows you to obtain an authorization when the final amount is unknown
• Incremental authorizations – allows you to request an increase in the amount of a previously approved estimated and/or incremental authorization
• Partial reversals – allows a partial reversal for a previously approved estimated and/or incremental authorization

Visit our Developer Center for the complete specifications required to utilize these changes. You may also contact your JPMorganChase representative for more information.

_{Published July 15, 2025 | P2023.1893}

Update: The 1408-bit RSA Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit RSA Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by American Express. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – American Express Extended Expiration Date for the RSA Certification Authority Public Key

_{Updated June 13, 2025 | P2024.2097
Published February 14, 2025 | P2024.2097}

On March 31, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be updated to the new domestic currency, XCG/532 (Carribbean Guilder) by American Express. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published March 14, 2025 | P2025.0400}

Starting January 1, 2026, Discover will require all cards to be compliant with D-Payment Application Specification (D-PAS) Connect. Ensure that your contactless D-PAS terminals have the correct terminal transaction qualifier (TTQ) to avoid terminated transactions. Discover will also discontinue support for offline plaintext PIN (OPTP).

In addition, by December 31, 2025, contactless terminals must cease supporting Zip or CTL-MSD transactions and be updated to support EMV contactless payments. D-PAS Connect transactions will fail if terminals only support CTL-MSD or Zip.

Please visit our Developer Center for the full D-PAS details. If your POS is managed by a third-party provider, please contact them to ensure compliance.

_{Published October 15, 2025 | P2025.1633}

Discover’s D-Payment Application Specification (D-PAS) 1408-bit Certificate Authority (CA) Production public key has expired. This public key should not be loaded on your point-of-sales (POS) devices deployed on and after December 31, 2024.

In addition, CA Production public keys must be removed from all POS devices by June 30, 2025.

Please reach out to your POS service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN is compliant with the requirements above.

_{Published February 14, 2025 | P2023.1014}

On April 11, 2025, Discover will implement a new requirement for debt repayment transactions. The payment indicator “D” must be included in authorization, authorization reversal, and clearing requests. Additionally, Discover will decline  debt repayment authorization requests for credit card and non-reloadable prepaid card transactions submitted under Merchant Category Code 6051, 6012.

To ensure compliance and prevent interchange reclassification, please visit our Developer Center for complete specifications.

_{Published March 14, 2025 | P2024.0723, P2024.0742}

On March 31, 2025, the domestic currency for Curaçao and Sint Marten will be updated to XCG/532 (Caribbean Guilder) from ANG/532 (Netherlands Antilles Guilder) by Discover. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published March 14, 2025 | P2025.0319}

Update: The 1408-bit Root Certificate Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit Root Certificate Authority (CA) public key expiration date has been extended to December 31, 2035 by UnionPay International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – UnionPay Extended Expiration Date for the Root CA Public Key

_{Updated June 13, 2025 | P2024.0007
Published February 14, 2025 | P2024.0007}

Update: The 1408-bit JCB/Certification Authority (CA) public key must be removed from all terminals by July 1, 2025 to prevent transaction processing failures.

The 1984-bit JCB/Certification Authority (CA) public key expiration date has been extended to December 31, 2034 by JCB International. The 1408-bit public key expiration date remains the same.

Reach out to your point-of-sale (POS) service provider to ensure that all terminals supporting Offline Data Authentication or Offline Enciphered PIN contain public keys with the updated expiration dates. Please do not use keys past their expiration date.

Table – JCB Extended Expiration Date for the JCB/CA Public Key

_{Updated June 13, 2025 | P2023.2284
Published February 14, 2025 | P2023.2284}

The card expiration date must be provided for all card-not-present transactions, as clarified by PULSE.

_{Published July 15, 2025 | P2025.0055}

Effective April 1, 2025, the ANG/532 (Netherlands Antilles Guilder) domestic currency for Curaçao and Sint Marten will be updated to the new domestic currency, XCG/532 (Carribbean Guilder) by UnionPay. This change is in accordance with the Central Bank conversion, and there will be no changes to the ISO Number (532) or minor units.

_{Published Janaury 10, 2025 | P2024.2115}

Card expiration date must be provided for PINless eCommerce and one-time bill payment transactions, as clarified and reminded by Accel and STAR.

_{Published February 14, 2025 | P2024.2300a, P2024.2299a}