As 2019 goes into full swing, it's important for providers of payment processing services (referred to here as "acquirers") and their merchants or submerchants to prepare for the various regulatory and industry changes coming this year. One such significant change comes in the form of Mastercard's updated rules for negative option billing programs.

Set to take effect on April 12, 2019, Mastercard's new rules will tighten consumer protection requirements for negative option merchants and their acquirers that process Mastercard transactions. Several laws such as the Electronic Fund Transfer Act, the Restore Online Shoppers' Confidence Act, and various state laws already apply to negative option billing programs, but Mastercard's new rules go even further. Among other things, the rules include a requirement for merchants to notify consumers at the end of a trial period before charging the consumer.

I. Applicability

Notably, the new rules cover any card-not-present transaction where the consumer purchases a subscription to automatically receive a physical product (such as cosmetics, healthcare products, or vitamins) on a recurring basis. Fully digital services are not covered.

This means the rules apply to free trial offers and most forms of negative option programs involving product sales. The negative option plan may be initiated by a free trial, nominally priced trial, or no trial at all. However, if a trial is used, special rules apply to ensure the consumer is aware of and consents to subsequent payments at the trial's conclusion.

II. The Rules

High-Risk Classification: Acquirers must use MCC code 5968 (Direct Marketing – Continuity/Subscription Merchants) and TCC T (non-face-to-face) to identify all non-face-to-face negative option billing transactions. These transactions and their merchants will be classified as high-risk.

MRP Registration: Acquirers must register negative option billing merchants, as well as any third-party service providers with access to account data, in the Mastercard Registration Program (MRP).

Verification: At the time of registration, acquirers must verify that the negative option merchant is compliant with all applicable laws, rules, and regulations (including these new Mastercard rules).

Monitoring: In addition to general authorization monitoring requirements, acquirers of negative option merchants must monitor authorizations to identify when the same account number appears across different negative option merchant IDs in the acquirer's portfolio.

Acquirers must ensure that such merchants implement real-time and batch procedures to continually monitor simultaneous, multiple transactions using the same account number and consecutive or excessive attempts using the same account number.

Acquirers must ensure that each negative option merchant complies with Mastercard's fraud control standards and maintains a chargeback ratio below the Excessive Chargeback Program thresholds.

Screening: For prospective high-risk negative option merchants, acquirers must identify any third-party service providers with access to account data, and ensure that the service provider is registered in the MRP system.

Trial Offers: If the merchant offers a trial, after the trial period has expired, the merchant must provide the following information and receive the cardholder's explicit consent before charging the consumer pursuant to the negative option:

  • The transaction amount
  • The payment date of the transaction
  • The merchant's name (as it will appear on the cardholder's statement)
  • Instructions for terminating recurring payments

For E-Commerce transactions, the trial period must begin on the date when the cardholder receives the product.

E-commerce merchants must also provide a direct link to an online cancellation procedure on the same website where the negative option transactions are initiated.

Transaction Information: After each approved authorization request, the negative option merchant must provide the consumer with a transaction information document through email or other electronic means with cancellation instructions. If the authorization is unsuccessful, the merchant must send a document explaining why the transaction failed.

Also, all subsequent recurring payments must be processed using the same merchant ID and merchant name used in the initial payment transaction. The merchant must also provide the cardholder with written confirmation in either hard copy or electronic format when the recurring payments have been terminated.

III. Bottom Line

These requirements demand significant changes to the negative option industry and will likely have a major impact on a range of business models reliant on continuity plans and trial offers. In particular, the requirement that merchants receive explicit authorization to begin recurring payments at the conclusion of a trial period is likely to be disruptive to say the least.

How businesses will adapt remains to be seen. But with April 12th less than 90 days away, negative option merchants and their acquirers must be prepared.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.