9 September 2026. Root acquisition is closed for review. These are public rules, not operational records, an individual merchant's status or an ALERT-PAY agreement. The specific route connecting WIPO's programme to Mastercard remains unacquired.
Source and version
The successful official reader now displays Security Rules and Procedures, Merchant Edition, dated 4 August 2026, with 236 pages: http[local research file] . The initial search extract described 3 February 2026; that older indexed date must not govern the following passages. The ordinary GET returned 403 HTML, correctly named rules-spme2026.error.html. No original PDF was retained and that route is closed.
Root read the title and continuous Chapter 11 text, PDF pages 147–158, reader lines 5380–5822, across the two saved overlapping reader files. The coverage check proves retained text continuity only. No page image, live system or complete 236-page manual was inspected. Tables are reader-supported, without a facsimile check.
The public rules index also failed ordinary GET but succeeded in the official reader: http[local research file] . Root read its complete substantive rules, disclaimer and programme sections. It warns that public documents may not be entirely current and that Mastercard's authoritative standards prevail. This is therefore a dated public edition, not a certified complete current contract set. Chapter 11 ends with a privacy heading and a short introductory sentence; Chapter 12 is expressly omitted. This does not establish why material is omitted or that no other privacy rules exist. The separate public privacy notice is covered by the remedy lane.
Who reports, and who admits the next merchant
Sections 11.1–3 describe a mandatory acquirer system carrying reports about certain terminated merchants and their owners. Authorized roles include approved acquirers and appropriately registered processors, payment facilitators and data-storage providers. Service-provider access requires acquirer approval and appropriate registration/provisioning. No actual authorization was inspected.
Sections 11.2 and 11.6.4 explicitly permit an acquirer to onboard a listed merchant; section 11.2 also permits a payment facilitator to onboard a listed sponsored merchant. Section 11.6 requires an inquiry before signing an agreement or enabling acceptance. Mandatory inquiry is not mandatory rejection. The chapter supplies noncompliance consequences for failures to use, report or inquire. A provider may adopt a stricter admission policy, as Stripe's separate guidance illustrates. A processor service, an acquiring relationship, card acceptance and ordinary bank-account access remain different things.
Entry, timing and responsibility
Section 11.5 combines an act to terminate by either the acquirer or merchant with the acquirer's reason to believe a listed condition exists. It specifies five calendar days from the earlier of its enumerated events: the acquirer's termination decision, receipt of the merchant's termination decision, or awareness of an issue meeting a reason code. The third item must not be detached from the opening condition. The effective termination date is explicitly not controlling. A merchant-initiated exit can still qualify; every exit does not.
Section 11.4 leaves accuracy responsibility with the acquirer even when a service provider handles work. It requires good faith and reasonable conduct, prohibits using MATCH as a collection threat for minor discretionary activity, and requires a defined reason to be met or suspected at the termination decision. Failure to correct erroneous data within a reasonable period can attract assessments. It also requires supplying the listing acquirer identifier and reason code to the merchant or another acquirer, and maintaining working contacts. These are duties, not observed compliance.
Removal requests require a response within 30 calendar days; questions about a listing require a response within seven. A response is not a removal guarantee. Section 11.5.1 expressly permits a merchant to request removal without legal counsel and identifies the required information. No request was prepared or sent.
How the record travels
The system can associate up to five principal owners with a merchant and search using exact or phonetic/spelling-variant matches. Those are possible identity matches, not findings of new misconduct. Section 11.4 requires checking relevance, with special care for identity-theft reason code 14: a legitimate owner may not know someone previously used their identity. No person's record was queried.
Section 11.6.4 describes retroactive alerts when another authorized user adds information after an initial inquiry, within the following 365 days. The alert remains visible for 30 days and is reported once in batch results. Recipients assess appropriate next steps; the text again allows onboarding. This is a documented route for later information to reach other institutions, not a demonstrated cascade of closures. No API, testing facility or production service was operated. The chapter's test-environment rules do not establish that this investigation performed any test.
Several different retention and correction clocks
Section 11.10 provides five-year retention and automatic purge for merchant listings. Separately, authorized users must retain their own relevant MATCH records for at least two years after the underlying agreement ends; system inquiry records last 365 days. Database purge therefore cannot by itself prove deletion of every recipient's records, reversal of its assessment or restored processing.
Section 11.13 permits early removal when an authorized user reports an erroneous addition, or when reason-code-12 PCI security noncompliance has been remedied with specified confirmation and validation. For the PCI route, the merchant can apply directly if the acquirer is unwilling or unable, with the same proof requirements. This is a narrow alternative, not a general bypass for every dispute. The chapter does not expressly make later business reform a removal ground for every other reason code; it also does not establish that external privacy, contractual or judicial remedies are unavailable.
Correcting a report, removing a listing and obtaining new processing are distinct outcomes. The public case and privacy lane tests the latter stages separately.
Scope and source differences
Table 11.4 covers several kinds of risk and misconduct, including compromised data, transaction laundering, chargebacks/fraud, coercion, insolvency, standards violations, PCI compliance, illegal transactions and identity theft. Some descriptions expressly address American Express reports. That is evidence of a cross-network reporting category, not proof of Visa sharing or every brand's rules. The table does not identify which code an ALERT-PAY or IP case would actually use.
Stripe's undated public guidance summarizes a one-working-day reporting requirement and different chargeback/fraud periods or thresholds; the August manual specifies five calendar days under its listed triggers and different table wording. This is a documented source mismatch. No amendment notice or exact change date was acquired. A stricter provider deadline could coexist with a network limit; each statement needs its own attribution. The dated manual is stronger evidence for the public network rule than a provider's general summary, subject to the manual's own currency caveat.
What this changes
The shared system combines mandatory reporting and inquiry with recipient discretion, possible identity matches, conditional removal and separate retention rules. It can affect access across institutions without a universal instruction to refuse every listed business. Its explicit duties also provide concrete standards against which practice can be tested. The revealing missing evidence is a worked report, recipient assessment, challenge and outcome, including whether correction reached the recipient. There is no established universal loss of banking, automatic account closure or intent to target a particular group in this packet.