Gov't Relations Newsletter: Vol 14 Iss 3 - “Recordkeeping to Avoid or Minimize Acquiring Headaches”

Government Relations Newsletter: Vol 14, Issue 3

“Recordkeeping to Avoid or Minimize Acquiring Headaches”

By: Tony Ogden, BankCardLaw In over 32 years of practicing electronic payments law, I have observed that: one of the most important merchant acquiring best practices is good recordkeeping.   In the labyrinth of seemingly ever – changing, ever – increasing compliance directives, mandated recordkeeping burdens remain constant.  An acquirer and its related third – parties must document all material aspects of their merchant relationships. Moreover, under the various compliance regimes (card brand, legal, and regulatory) you must remain able to produce documentary proof of compliant practices at a moment’s notice. Acquirers

and third – party service providers neglect this mandate at their own peril. Nothing suggests noncompliance like the inability to timely respond with mandated document production.

Defining Question:  When a card brand, regulator, law enforcement, or counsel for an adverse party seeks documentary evidence regarding a merchant or third – party relationship, how prepared are you to produce this evidence given short notice?

Best Practices Answer:  Our documents and recordkeeping are so well organized and accessible, that we can locate and produce material information in short order.

Effective recordkeeping may seem like an undue burden best delegated or outsourced and forgotten until needed.  However, well organized recordkeeping, and easily accessible documentation and can simplify your compliance burden and make risk management more efficient.  It facilitates your ability to demonstrate compliance, good risk management practices, and substantiate the reasonableness of your acquiring actions.

The Problem:  Insufficient acquirer recordkeeping creates unnecessary confusion, time – consuming use of acquirer resources to locate material records, regulatory problems, card brand compliance problems, legal problems, and merchant disputes. All of which create risk of loss, substantial penalty assessments, fines, sanctions, arbitration awards, and judgments. If you cannot document it, you will pay for it.

Select Areas Where Insufficient Documentation Can Cause Major Problems: 

1. 1. Due Diligence, Underwriting & Onboarding of Merchants & Third - Parties
   2. Documentation of Risk Management Activities (Operations, Monitoring, Mitigation)
   3. Documentation of Compliance with Laws, Regs., Card Brand Rules
   4. Documentary Basis for Taking Actions both Positive & Punitive:

(Onboarding, Risk, Termination, MATCH, Reserves Withholding)

1. 5. Post Merger & Acquisition Documentation re: Coordination of Tasks, Compliance, Recordkeeping Systems, Assigning Roles, Risk Assessment & Risk Management
   6. How the Acquirer or Payments Company changed policies and procedures to comply with new card brand, legal, and regulatory requirements.
   7. Third – Party Registration (specialty merchants, such as crypto, gaming, pharma, etc.)

 Select Recordkeeping Requirements.  (Mastercard Examples)

I selected a few Mastercard recordkeeping requirements to illustrate the importance of good recordkeeping and the cost of noncompliance.

Mastercard Security Rules and Procedures—Merchant Edition • 4 August 2026.

 7.1.1 Required Screening Procedures. The Acquirer of a prospective Merchant or ATM owner, and any Payment Facilitator of the Acquirer with respect to a prospective Sponsored Merchant, must ensure that certain screening procedures are performed.

 7.1.2 Retention of Investigative Records. The Acquirer must retain all records concerning the investigation of a Merchant, Sponsored Merchant, or ATM owner for a minimum of two years after the date that the Merchant Agreement, Sponsored Merchant Agreement, or ATM Owner Agreement, as applicable, is terminated or expires. NOTE: Mastercard recommends that the Acquirer retain all records, in the event that Mastercard conducts an audit as necessary to verify compliance with the screening procedures described in this chapter.

 7.1.3 Assessments for Noncompliance with Screening Procedures.  If Mastercard determines that an Acquirer has not complied with these screening procedures...Mastercard may assess the Acquirer up to USD 100,000 for each 30-day period following the aforementioned period, with a maximum aggregate assessment of USD 500,000 during any consecutive 12-month period.

 11.10 MATCH Pro Record Retention.  The Authorized User must retain all MATCH Pro records concerning a Merchant, Sponsored Merchant, or other Acceptor for a minimum of two years after the date that the Merchant Agreement, Sponsored Merchant Agreement, or other Mastercard acceptance agreement, as applicable, is terminated or expires.

 Based upon the above Mastercard examples, the importance of good recordkeeping and avoidance of costly mistakes is readily apparent. Consider similar assessment consequences for other Mastercard and Visa compliance mandates. Further consider, that any regulatory or law enforcement investigation will require production of critical documents to evidence compliance. Similarly, when an acquiring dispute is asserted in arbitration or litigation, a complainant can use legal discovery rights to demand that acquirers and related third – parties produce material documents. In each of these instances, failure or inability to produce material documents can lead to monetary and evidentiary sanctions that affect the outcome of the claim.

Examples of How Good Recordkeeping Can Reduce Exposure & Save Costs:

1. Efficient demonstration of documented compliance as relevant
2. Reduce costly resource allocation (no impromptu document search team)
3. Faster Dispute Resolution Out-of-Court and In-Court
4. Efficiently document actions taken to comply with changing mandates

 Document Sufficiency.  How much recordkeeping or documentation is enough?

 It depends on the card brand, legal or regulatory requirements and reasonable compliance.

Ensure that you identify and comply with the recordkeeping requirements for all regimes that affect you as an Acquirer or payments entity based upon the services you provide.  Establish a checklist of the respective recordkeeping requirements and identify how you are compliant. Unfortunately, there are no universal shortcuts that cover all regimes. However, you may identify common areas of overlap that reduce the initial and ongoing recordkeeping burden. Best practices encourage making a demonstrable good faith compliance effort. At a bare minimum, terse documents may be sufficient, produceable and meet the measure where possible. Terse but responsive is good. Something is always better than nothing!

 Document Retention.  How long should you keep merchant acquiring records?

Again, it depends on the card brand, legal or regulatory requirements, and reasonable compliance.

Ensure that you identify the recordkeeping or documentary requirements for all regimes that affect you as an Acquirer or payments entity. Document or Recordkeeping Security.  Take note of the required methods of document storage and encryption levels.  Strictly comply with these mandates. Review your agreements. Don’t overlook your agreements. What additional time periods are mandated in your legal agreements?  Governing Law and Statutes of Limitation for bringing legal action pursuant to a Contract  – best practices dictate retaining material documents for at least the time period during which legal action may be brought against you.

What Do Payments Compliance Experts Think?

Payments Compliance Experts, who generously shared their insight for this article, provided the following useful suggestions:

1.           Acquirers may consider maintaining a card-brand-specific record retention matrix that identifies the records to be retained, where they are maintained, the responsible owner, and the applicable retention period. The matrix should address key compliance areas including underwriting, investigations, monitoring activities, dispute management, PCI compliance, remediation efforts, merchant communications, termination records, and card-brand reporting obligations. Maintaining this information can support timely document retrieval, facilitate audit readiness, and help demonstrate ongoing compliance with card-brand and regulatory requirements.

2.           Good recordkeeping means more than just saving documents. Acquirers should clearly identify who is responsible for important records, how long records must be kept, and how document changes are tracked. Records held internally, and by third parties should also remain easy to access when needed.  Acquirers should periodically test whether important records can be quickly located and produced. Extra attention should be given during system changes, mergers or acquisitions, and staff turnover, when older records are more likely to be lost or become difficult to find.

3.           Due Diligence, Underwriting & Onboarding of Merchants & Third – Parties includes registration requirements for third parties and "specialty merchants" that require registration with the payment network(s), such as crypto, gaming, pharma, etc.  Some organizations separate responsibilities for payment network registrations under "compliance" to not impact "underwriting" service level agreements (SLAs).  (Pay close attention to your adherence with respective payment network registration requirements.)   

4.           Acceptable Types of Documentation Storage.  For example, for ongoing transaction monitoring, the underlying system would have the history of transactions that were flagged and investigated. There is likely a notes component of the system for the analyst to document the results of the investigation. It would be helpful for the audience to know if that level of documentation would be acceptable.

Takeaways:      Review your respective recordkeeping or documentation requirements for all applicable card brands, legal and regulatory purposes. Well organized recordkeeping, and easily accessible documentation can simplify your compliance burden.  It facilitates your ability to quickly demonstrate compliance. It further reduces the likelihood of costly assessments, fines, sanctions, awards, and judgments for noncompliance.

*NOT LEGAL ADVICE:  This article is for informational purposes only. It is not legal advice and should not be relied upon as such.