MasterCard Rules (PDF)

Service Providers
7.6 Service Provider Registration
7.5.4 Program Receivables
A Service Provider may own Program receivables or participate in a financing
vehicle involving Program receivables so long as the Corporation determines
that the Customer continues to own and control the Program. Ownership of
Program receivables by the Service Provider does not in any way limit the
Customer’s obligation to comply with the Standards.
7.6 Service Provider Registration
The following sets forth Service Provider registration requirement.
7.6.1 Registration Requirements for DSEs, ISOs and Type II TPPs
Each Principal and Association, for itself and each of its Sponsored Affiliates, >>
must use MasterCard Connect to register any Service Provider not designated
by the Corporation as a Type I TPP. A Customer may elect to register a person
as an SPRF for the purpose of having that SPRF perform Service Provider
registration requirements for DSE, ISO and Type II TPP Service Providers on the
Customer’s behalf. The following requirements apply.
1. The Principal and Association must submit all information and material
required by the Corporation in connection with the proposed registration
within 60 days of the registration application submission date.
2. A Service Provider performing TPP Program Service that also wishes to
provide ISO Program Service to one or more Customers must be distinctly
proposed for registration by the Corporation on behalf of each Customer
wishing to receive ISO Program Service from that Service Provider.
3. A Service Provider that performs services involving the storage, transmission,
or processing of Card, Cardholder, or Transaction data must comply with
the MasterCard Site Data Protection (SDP) Program in accordance with
the implementation schedule set forth in section 10.3.4 of the Security
Rules and Procedures manual. Before initiating registration, the Customer
must instruct the proposed Service Provider to contact the Corporation via
e-mail at sdp@mastercard.com and validate its compliance with the SDP
Program using the tools described in section 10.3.2 of the Security Rules and
Procedures manual. For any proposed Type II TPP that is not compliant,
the Corporation must be provided and must approve a compliance action
plan. A Corporation-approved compliance action plan does not exempt the
Principal and Association from responsibility and liability that arises from
the Principal and Association’s or any of its Sponsored Affiliates’ or their
Type II TPP’s noncompliance with any Standard, including those relating
to the disclosure and securing of Card, Cardholder, and Transaction data.
The registration of a proposed DSE will not be deemed complete until
its compliance is validated.
4. The Corporation collects the applicable fee(s) then in effect from the
Customer that proposes the registration via the MasterCard Consolidated
Billing System (MCBS).
©1969–2012 MasterCard. Proprietary. All rights reserved.
7-14 12 December 2012 • MasterCard Rules