Mastercard Merchant Rules: What the Manual Says
Mastercard merchant rules are not one rulebook but a set of checkable requirements. Here is what Mastercard's own manual asks of a business that takes its cards.
A shop that takes Mastercard signs up to more than a card brand. It signs up to a set of rules written in Mastercard's own merchant manual. "Mastercard merchant rules" sounds like one thick book. In practice it is a list of specific things a merchant can be held to. This page walks through the ones a business is most likely to run into, using only what Mastercard's manual and rules state. If you are new to the terms, start with the site's definition of merchant.
PCI DSS compliance by merchant level
The first set of rules is about card data security. Mastercard sorts merchants into levels, and the level decides what a merchant must do.
For a small business, the manual has good news and a catch. Mastercard's manual says compliance with the PCI DSS is required for a Level 4 Merchant, although validation of compliance to Mastercard is not required. So you must meet the standard. You just may not have to prove it to Mastercard itself.
If you do want to validate, there are two roads. Mastercard's manual says a Level 4 Merchant may validate compliance with the PCI DSS by successfully completing an annual SAQ. That is a self-assessment form, filled out once a year.
The other road uses an outside expert. Mastercard's manual says Level 4 Merchants may engage a PCI SSC-approved QSA to complete a ROC instead of performing an SAQ. A QSA is a qualified security assessor. A ROC is a report on compliance.
Bigger merchants outside the U.S. get a third option. Mastercard's manual says a qualifying Level 1 or Level 2 Merchant outside the U.S. Region may use the PCI DSS Risk-based Approach. If that is your level and region, ask your acquirer whether you qualify.
Conduct and content policies
The next set of rules is about what happens on your website, not on your card reader.
Mastercard's manual says a merchant must have policies that prohibit using its website to promote or facilitate human trafficking, sex trafficking or physical abuse. It is a policy your business must have in place.
The manual also asks for proof on a schedule. Mastercard's manual says a merchant must give its acquirer monthly reports on flagged content, complaints and take-down requests. So a customer complaint about a listing, or a page you take down, goes in a monthly report to your acquirer.
There is a rule about disagreements, too. Mastercard's manual says a merchant must allow disagreements to be resolved by a neutral body at the merchant's expense.
The extra rules for gambling merchants
A gambling business faces a second layer. Mastercard's rules name category codes for it. Mastercard's rules say MCC 7801 covers non-face-to-face gambling, including sports betting and casino gambling. Mastercard's rules say MCC 7802 covers government licensed horse and dog racing.
Before an acquirer can register a U.S. gambling merchant, it must do its own homework. Mastercard's rules say an Acquirer registering a U.S. gambling Merchant must show it did an adequate due diligence review. Mastercard's rules say an Acquirer must provide a copy of the Merchant's license for each Merchant identified with MCC 7801. So a gambling merchant should expect to hand its acquirer a copy of its license.
There is a third-party check as well. Mastercard's rules say a qualified independent third party must certify that the Merchant's gambling systems include effective age and location verification. The merchant cannot vouch for itself here. An outside party has to sign off.
The site has a page on whether you can dispute gambling transactions if a customer wants money back.
How this fits with Visa's rules
For Visa, see the site's page on Visa merchant category codes.
The site's merchant examples page shows how these rules apply to different kinds of business.
Where to read the current rules
Mastercard's manual changes. Levels, deadlines and forms get updated, and a summary like this one can go stale. So treat this page as a map, not the law. For the current text, go to Mastercard's own website and download the current merchant manual. Your acquirer can also tell you which parts apply to your business, since it is the one that holds your agreement.