Mastercard's age verification mandate: What card issuers and acquirers must do

Mastercard’s 2nd June network processing release introduced near real-time age verification. In the same release, there were updates regarding the TLID enhancement that we have covered separately. In this article, we dive into the age verification capabilities and requirements for issuers and acquirers.

What Mastercard’s age verification mandate entails

This change is designed to support secure, frictionless experiences for age-restricted goods, services, online accounts, and disbursements, as outlined in Mastercard's Identity Attribute Verification Feature.

While this update brings convenience for cardholders, it comes with key requirements for issuers and acquirers.

For full technical specifications, message layouts, and testing guidelines, refer to Mastercard Global Operations Bulletin 11738.1 and the System Release 26.Q2 Combined Dual and Single Message Annex.

For issuers and acquirers using Kajo, our scheme compliance solution, the full overview of the reference document and the related bulletin and the impacted area of business can be found in your Kajo environment.

What are the impacts on issuers and acquirers

Acquirers must be prepared to support the new fields that allow merchants to request age verification. Issuers must be prepared to provide age verification results in response to these requests.

Mastercard has updated message layouts, data element definitions, and system edits to accommodate these new flows.

From an issuer’s perspective, this update is likely to involve multiple stakeholders or systems at issuers:

• Authorisation: The change directly impacts the Dual Message Authorisation System and the Single Message System. Authorisation teams will need to update message processing logic to handle the new age verification requests and ensure the correct responses are populated in the right fields.
• IT: Developers and systems architects must review the updated message layouts and data element definitions. They will need to integrate these changes into the core authorisation platforms and ensure compliance with the new requirement.
• Testing & Quality Assurance (QA): Mastercard strongly recommends testing; the QA team needs to execute the required test cases to verify that your systems accurately process these transactions.
• Compliance & Risk: This team should be involved to understand the regulatory and policy implications of verifying age thresholds, particularly for age-restricted goods, gambling payouts, or government benefits. They will need to ensure that the data handling aligns with internal privacy and security policies.
• Product & Business Operations: These teams should be aware of the new capability to determine how it can be leveraged to improve customer experiences, such as streamlining account creation or managing access to age-restricted content.

From an acquirer’s perspective, this update requires coordination across several technical and operational teams to ensure that merchant requests are correctly captured and transmitted to the network.

• Technical Integration & Gateways: These teams are responsible for the merchant-facing interfaces. They will need to update the payment gateways and APIs to allow merchants to submit age verification requests. They must also ensure that these requests are correctly mapped into the Dual Message Authorisation System or Single Message System formats.
• Authorisation: These teams must ensure that your host systems are configured to handle the updated message layouts and data element definitions. They are responsible for ensuring that the age verification data is correctly passed from the merchant to Mastercard.
• Testing & Quality Assurance (QA): As Mastercard mandates testing for this release, the QA team must utilise the System Release 26.Q2 v1 Combined Dual and Single Message Annex. The team will need to validate that the systems correctly process these transactions and handle the corresponding responses from issuers.
• Merchant Services & Support: This team needs to be informed about the new capability so they can advise merchants on how to utilize the age verification feature. They may also need to update merchant documentation or integration guides to reflect the new functionality.
• Compliance & Risk Management: This team should review the new capability to ensure that the transmission of age-related data complies with regional data privacy regulations and internal security standards. They should also monitor how this data is used to ensure it aligns with your merchant onboarding and risk policies.

If you are an issuer, acquirer or processor using our scheme compliance solution, Kajo, you can see the exact impacted areas of business and the stakeholders under the bulletin covering this new requirement.

If you are not using Kajo and want to know more about it, check out a demo to see it in action.