Mastercard scheme rules: A UK and EEA merchant's guide

Severe breaches of Mastercard's scheme rules can end a UK or EEA merchant's ability to accept card payments. Acquirers pass scheme fines through to merchants, monitoring programme entry triggers remediation costs, and persistent non-compliance leads to account termination and a five-year MATCH listing that most acquirers treat as a hard onboarding signal.

Mastercard scheme rules, sometimes called Mastercard guidelines, are the binding standards every merchant accepting Mastercard payments must follow. They cover authorisation, chargebacks, recurring payments, fraud monitoring, and merchant categorisation, and they interact with PSD2, SCA, and FCA expectations in ways US-focused guides rarely address.

This guide covers what UK and EEA merchants need to operate compliantly across the full scheme.

What Mastercard scheme rules are

Mastercard scheme rules are the binding standards, processing requirements, and dispute rules every merchant accepting Mastercard payments must follow.

They are contractually enforceable, but the contract sits between the merchant and its acquirer, not between the merchant and Mastercard directly—the structural fact most merchants miss when they assume scheme compliance is something Mastercard polices itself.

Mastercard publishes the rules across four main documents UK and EEA merchants should know by name:

•  Mastercard Rules: The core rule book.
•  Transaction Processing Rules: Authorisation, clearing, and settlement.
•  Chargeback Guide: Dispute reason codes and process.
•  Security Rules and Procedures: Data protection and PCI DSS interaction.

Mastercard chargeback and dispute rules

Mastercard's chargeback rules sit in the Chargeback Guide, separate from the Transaction Processing Rules. A transaction can clear in full compliance and still be chargeback-eligible if the cardholder disputes it within the prescribed window.

Reason codes and dispute windows

Mastercard groups its chargeback reason codes into broad categories:

• Authorisation disputes: Reason code 4808
• Fraud disputes: Reason codes 4837 and 4870
• Processing errors: Reason code 4834
• Cardholder disputes: Reason codes 4853, 4850, and 4854

Fraud disputes cover unauthorised transactions. Processing errors cover late presentment, incorrect amounts, and duplicates. Cardholder disputes cover the substantive complaints: goods not received, services not as described, recurring billing the cardholder claims to have cancelled, and credit not processed. The standard cardholder dispute window is 120 calendar days from the transaction's settlement date for most reason codes.

For services or goods not received, the clock starts on the latest anticipated delivery date specified by the merchant rather than the transaction date. For recurring payments disputes, the window runs from the settlement date of each individual billing.

Pre-arbitration and arbitration

A chargeback is the start of a process, not a single event. The merchant can challenge it through second presentment by submitting Mastercard's prescribed compelling evidence, which varies by reason code: proof of delivery, signed contracts, IP and device matching, prior undisputed transactions on the same card, or cardholder communications.

Submitting the wrong evidence type for the reason code produces a rejected second presentment, which lets the issuer escalate.

If the issuer disagrees with the merchant's second presentment, the dispute escalates to pre-arbitration. The merchant either accepts the chargeback or rejects the case with further documentation; taking no action results in automatic acceptance after 30 calendar days.

Pushing through to formal arbitration carries direct financial risk: filing fees and administrative costs apply to the losing party regardless of the dispute amount. For lower-value disputes, the arbitration economics frequently make accepting the chargeback the rational commercial choice.

Chargeback ratio thresholds

Mastercard tracks chargeback activity at the merchant level. Ratios are count-based, calculated as chargebacks in the current month divided by transactions in the prior month. The prior-month denominator means a merchant whose transaction volume drops sharply will see its chargeback ratio rise even if the absolute chargeback count stays flat, a known operational hazard for seasonal businesses.

Individual chargeback costs are operational. Crossing scheme ratio thresholds is existential, because it triggers entry into Mastercard's merchant monitoring programmes covered in the next section.

Mastercard recurring payments rules for UK and EEA merchants

Mastercard recurring payments rules apply to any UK or EEA merchant billing on a subscription, instalment, or auto-replenishment basis. They sit in TPR Section 5.4 and cover the full lifecycle of a subscription from enrolment through cancellation.

Subscription billing rules

The standards in TPR Section 5.4.1 apply to any merchant billing recurring services, memberships, physical products, or digital goods. Five rules are non-negotiable:

• Point-of-payment disclosure. Subscription terms must be displayed clearly and prominently on payment and order summary pages, with the cardholder's affirmative acceptance captured before the order completes. Linking to terms on another page or hiding them behind an expandable box does not satisfy the rule.
• Enrolment confirmation. Immediately after order completion, the merchant must send a written subscription order confirmation including the full subscription terms and instructions for cancelling.
• Transaction receipts (recommended, mandatory in some cases). Each approved authorisation should trigger a receipt sent to the cardholder, including amount, billing reason, and cancellation instructions. This becomes mandatory if the merchant is identified as an Excessive Chargeback Merchant, High Excessive Chargeback Merchant, or Excessive Fraud Merchant for four months or more.
• Online cancellation parity. Merchants must provide an online or electronic cancellation method as accessible as the merchant's email unsubscribe equivalent, or clear instructions to cancel that are easily accessible online.
• Long-cycle reminders. For subscriptions billed less frequently than every six months (180 days), merchants must send an electronic pre-billing reminder at least 7 days but no more than 30 days before each charge. The reminder's subject line must clearly reference upcoming charges and be distinct from marketing communications.

These standards do not apply to utilities (gas, electric, water), telecommunications, insurance policies, or existing debt repayments.

Negative option billing rules

TPR Section 5.4.2 governs trial-to-paid conversion. Two rules apply, distinguishing between digital and physical product types:

• Pre-conversion reminder for digital goods. For trials longer than seven days, the merchant must send a reminder no less than three days and no more than seven days before the trial ends, including subscription terms and clear cancellation instructions.
• Explicit consent for physical goods. Before the first paid recurring charge after a trial, the merchant must provide the cardholder with the subscription start date, transaction amount, payment date, merchant name as it will appear on the statement, and cancellation instructions, then receive the cardholder's explicit consent. Inaction does not constitute consent.

BRAM and Mastercard rules for merchants in specialist categories

Mastercard operates the Business Risk Assessment and Mitigation programme (BRAM) to investigate merchants whose activities create fraud, regulatory, legal, or brand-damaging risk to the Mastercard system. Merchants identified by BRAM face additional scheme oversight, additional acquirer due diligence, and a tighter compliance perimeter than general merchant portfolios.

Which merchants attract BRAM scrutiny

BRAM scrutiny applies to merchants in specialist categories  where the goods, services, or business model carry elevated regulatory, legal, or reputational complexity. UK and EEA merchants in the following categories should expect to fall under BRAM oversight:

• Adult physical goods.
• Online dating services.
• Online trading and forex.

The category list is not exhaustive and Mastercard's category coverage updates with mandate cycles. UK and EEA merchants uncertain whether their business falls under programme scope should ask their acquirer directly rather than assume.

What BRAM-flagged merchants are required to do

At onboarding, BRAM-flagged merchants typically provide:

• Enhanced KYC documentation.
• Beneficial ownership disclosure.
• Evidence of regulatory permissions where applicable.
• Marketing and website content reviews.
• Detailed product or service descriptions.

On an ongoing basis, merchants face periodic re-reviews, content monitoring of public-facing websites and marketing, and tighter chargeback ratio scrutiny than standard scheme thresholds. Material changes to the business, product range, or jurisdiction trigger re-review rather than waiting for the next scheduled cycle.

Where to focus your Mastercard scheme rules compliance effort

UK and EEA merchants who treat Mastercard scheme rules compliance as an operational discipline rather than a reactive scramble reduce chargeback exposure, protect their acquirer relationship, and avoid monitoring programme entry. Merchants who lose Mastercard processing capability rarely lose it to a single catastrophic breach; they lose it to a pattern of low-rung enforcement actions that went unaddressed.

Three areas matter most. Monitor your chargeback ratios proactively, not after an acquirer warning arrives. Treat acquirer bulletins as mandatory reading so you catch rule changes before they catch you. If you operate in a specialist category, treat BRAM-scope obligations as standing requirements rather than onboarding paperwork.

Fibonatix (UK) Limited, company number 09738892, is authorised and regulated by the UK Financial Conduct Authority (FCA) as a Payment Institution (FRN 768776).