Acquirers
- Obtain MMSP approval from Mastercard to perform monitoring internally
- Engage an approved third-party MMSP
- Ensure pre-transaction scans are completed without delaying merchant onboarding
Related Questions
.png)
Mastercard's Merchant Monitoring Program (MMP) has introduced stricter requirements for brand integrity compliance. Starting January 1, 2026, all newly onboarded merchants must undergo an initial scan before their first transaction, and acquirers must demonstrate persistent monitoring capabilities. This article explains what these requirements mean for payment providers, acquirers, Payment Service Providers (PSPs), and Payment Facilitators (PayFacs).
Merchant Monitoring Service Provider (MMSP) refers to approved service providers that perform monitoring activities on behalf of acquirers to detect Brand Risk Assessment and Mitigation (BRAM) violations and transaction laundering.
Mastercard requires acquirers to either develop internal MMSP capabilities or engage an approved third-party MMSP.
Mastercard's brand integrity framework centers on two key regulatory sections:
Rule 3.7: Integrity of Brand and Network This rule requires all participants in the Mastercard ecosystem to protect the brand's reputation and maintain network integrity.
Rule 5.12.7: Illegal or Brand-Damaging Transactions This rule states: "A Merchant must not submit to its Acquirer, and a Customer must not submit to the Interchange System, any Transaction that is illegal, or in the sole discretion of the Corporation, may damage the goodwill of the Corporation or reflect negatively on the Marks."
Violations of these rules trigger the BRAM program, which can result in fines up to $150,000 per violation.
Mastercard published revised standards in July 2025 that fundamentally change how acquirers must approach merchant onboarding and monitoring:
Any merchant onboarded on or after January 1, 2026 must undergo an initial scan prior to the first transaction. This pre-transaction scan must be completed by an approved MMSP.
Acquirers must collect and submit complete merchant information to their MMSP, including:
Monitoring must extend beyond publicly accessible website content to include:
This requirement addresses a previous gap where merchants could hide non-compliant content behind authentication walls.
Acquirers must maintain evidence of:
This documentation must be audit-ready and available for review by Mastercard.
Any issues identified through monitoring must be investigated and resolved within 15 days of detection. This timeline applies to both BRAM violations and transaction laundering indicators.
MMSP scans detect several categories of prohibited or restricted content:
Direct acquiring banks must either:
Payment facilitators and service providers must:
Independent Sales Organizations and processors should:
Meeting these requirements requires operational changes across the merchant lifecycle:
Effective MMSP compliance requires specific technical capabilities:
Challenge: Slowing Down Onboarding
Traditional manual review processes cannot complete pre-transaction scans quickly enough.
Solution: Automated scanning tools that complete initial reviews in minutes rather than days.
Challenge: Gated Content Visibility
Many monitoring tools cannot access password-protected areas.
Solution: Purpose-built MMSP platforms with authentication capabilities for member-exclusive content.
Challenge: Scale and Volume
Manual monitoring becomes unmanageable as merchant portfolios grow.
Solution: AI-powered scanning that identifies violations automatically and prioritizes cases by risk severity.
Challenge: Audit Documentation
Scattered evidence across multiple systems fails audit requirements.
Solution: Centralized platforms that maintain complete evidence trails with timestamps and decision documentation.
Merchant risk assessments must now include an ecosystem section mapping other storefronts and domains operated by the same entity or people.
This addresses transaction laundering schemes where merchants operate multiple businesses under a single merchant account or hide restricted activity across related domains.
MMSP scans should identify:
Mastercard enforces BRAM rules through its compliance programs:
These penalties make MMSP compliance a financial imperative, not just a regulatory checkbox.
Payment providers should take these steps now:
As a leading recognized MMSP provider, Ballerine meets Mastercard's revised MMP standards with technology that operates at the speed and depth your business demands.
Payment providers face a practical challenge: completing thorough pre-transaction scans without delaying onboarding, accessing member-only content that manual reviews miss, and maintaining audit-ready documentation across thousands of merchants.
Our MMSP compliance solution integrates with existing merchant onboarding systems, allowing to maintain current workflows while adding the monitoring capabilities the revised standards require.
Mastercard's revised MMP standards represent a significant shift toward proactive, continuous merchant monitoring.
The requirement for pre-transaction initial scans and persistent monitoring of gated content raises the compliance bar for all payment providers.
Organizations that treat these requirements as an operational priority rather than a compliance burden can gain competitive advantages. Faster, more thorough initial scans enable quicker merchant underwriting decisions. Better monitoring reduces exposure to fines and brand damage. Complete documentation streamlines audits and demonstrates program maturity.
The January 1, 2026 effective date is approaching. Payment providers should evaluate their current MMSP capabilities now and implement the necessary technology and process changes to meet these requirements.
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
