Prove the initial review happened
Capture when merchant information was received, when the initial scan ran, what was reviewed and when the result became available.
Mastercard Merchant Monitoring Program
The first transaction
is now a control point.
The 2026 MMP changes raise the operating standard from periodic public-page checks to documented pre-transaction review and complete, persistent coverage of the merchant’s digital selling experience.
What changed
Monitoring can no longer begin after risk enters the portfolio.
See the complete selling environment
Cover payment pages and merchant-authorized restricted areas—not only publicly indexable marketing pages.
Maintain persistent evidence
Continue reviewing the merchant footprint and document changes, alerts, investigation and resolution over time.
Requirement-to-capability map
Turn the standard into an operating workflow.
SUPWM’s seven-engine architecture is designed to support the evidence, orchestration and review work surrounding MMP participation.
01
Scan before processing
What the standard requires
The 2026 MMP framework introduced an initial-scan requirement before a newly onboarded merchant’s first transaction. Mastercard’s current published standards require the initial MMSP report before the merchant becomes eligible for MMP mitigation.
How SUPWM is designed to support it
SUPWM is designed to create a pre-transaction control gate: accept the merchant record, discover and validate URLs, complete the initial website review, preserve evidence and return a review status before processing is enabled.
02
Submit complete merchant data
What the standard requires
Acquirers must provide the MMSP with information needed for monitoring, including the merchant legal name, DBA name, address and all merchant URLs.
How SUPWM is designed to support it
Merchant Discovery and Identity / KYB are designed to normalize submitted identifiers, locate missing candidate domains and maintain a versioned inventory of known and approved URLs.
03
Monitor the complete experience
What the standard requires
Monitoring must cover merchant URLs completely. The current standards explicitly include the payment page and restricted or members-only areas where products, digital content or services are offered, unless monitoring is prohibited by law.
How SUPWM is designed to support it
SUPWM’s architecture is designed for merchant-authorized, credentialed scanning of restricted areas, authenticated journey mapping and evidence capture across public pages, gated catalogs and payment acceptance flows.
04
Monitor persistently
What the standard requires
MMP participation requires persistent monitoring for potential BRAM content, product or service violations and/or merchant transaction laundering.
How SUPWM is designed to support it
Continuous Monitoring is designed to revisit the full approved footprint, compare new observations with prior evidence and prioritize material changes in products, policies, business model and domain relationships.
05
Report and resolve on time
What the standard requires
The standards require potential violations to be reported to the acquirer within five business days. The acquirer then has 15 calendar days from notification to investigate, stop violating activity and report resolution to the MMSP.
How SUPWM is designed to support it
SUPWM’s intended workflow attaches detection and notification timestamps, routes cases by severity, tracks the investigation deadline and preserves remediation evidence and final disposition.
06
Maintain audit-ready reporting
What the standard requires
Participating acquirers must provide monthly MMSP-generated reports, and incident responses may require dates for merchant submission, initial scan, monitoring, alerts and acquirer action.
How SUPWM is designed to support it
The shared merchant record is designed to preserve scan dates, monitored URLs, MCC, services, findings, notification dates and resolution history for structured monthly and incident reporting.
Restricted and members-only coverage
Authenticated monitoring—without unsafe credential handling.
Complete coverage requires more than a conventional crawler. SUPWM’s intended design treats restricted access as a controlled merchant-onboarding workflow.
- 01
Merchant-authorized access
The merchant or acquirer provides dedicated monitoring access under an agreed legal and operational basis.
- 02
Secure credential isolation
Credentials are intended to be encrypted, tightly permissioned, auditable and separated from analyst visibility.
- 03
Authenticated journey coverage
Monitoring maps gated catalogs, digital content, subscription offers and the payment acceptance path.
- 04
Evidence and access health
SUPWM records what was reachable, preserves relevant evidence and flags expired or blocked access as a coverage exception.
Intended control timeline
One record from onboarding through resolution.
An important qualification
Mastercard states that an acquirer participating in the MMP must engage a Mastercard-approved Merchant Monitoring Service Provider and register that provider appropriately. SUPWM does not currently represent that it is Mastercard-approved, an MMSP, or able by itself to establish MMP eligibility or compliance.
The capabilities described here are SUPWM’s intended product direction and may support an acquirer’s control environment, an approved provider relationship, or a future approval path. Mastercard owns and may change its standards; customers must confirm current requirements with Mastercard and qualified counsel.
Build the workflow before the deadline becomes the problem.
Talk with SUPWM about pre-transaction gating, complete URL inventories, authenticated monitoring and evidence-driven case operations.
sales@supwm.com ↗