@1aboveio/skills 0.20.2 → 0.20.4

package/skills/compliance/compliance-audit/references/vars-checklist.md

@@ -0,0 +1,1068 @@
+```yaml
+name: "Visa Acceptance Risk Standards (VARS) Compliance Checklist"
+regulation: "Visa Acceptance Risk Standards (VARS), October 2024"
+version: "1.0"
+scope: "All control requirements across the five Acquirer archetypes (AACQ, ATPA, AHIR, AATM, AVDC), extracted from the official VARS PDF by the reg-parser skill"
+date: "2026-04-27"
+id_scheme: "source-native"
+summary:
+  categories: 5
+  total_items: 45
+  mandatory: 38
+  recommended: 7
+```
+
+## Contents
+
+- [AACQ — All Acquirers](#aacq-all-acquirers) (22 controls; AACQ.C1.1 – AACQ.C18.1)
+- [ATPA — Acquirers Sponsoring TPAs](#atpa-acquirers-sponsoring-tpas) (15 controls; ATPA.C1.1 – ATPA.C11.1)
+- [AHIR — High Integrity Risk Transactions](#ahir-acquirers-processing-for-high-integrity-risk-transaction-merchants) (1 control; AHIR.C1.1)
+- [AATM — ATM Acquirers](#aatm-atm-acquirers) (5 controls; AATM.C1.1 – AATM.C5.1)
+- [AVDC — Money Movement Entities (Visa Direct)](#avdc-money-movement-entities-visa-direct) (2 controls; AVDC.C1.1 – AVDC.C2.1) — recommended-only
+
+Each control entry contains: Risk Domain, Risk Sub-Domain, Risk Statement, Parent Control, Requirement, Source, Severity (mandatory/recommended), Verification (numbered checklist items, prefixed `(N)` or `(N.x)`; `(Recommended)` marks individually-recommended items inside a mandatory control), and Evidence (suggested artifact types).
+
+## AACQ: All Acquirers
+
+### AACQ.C1.1: Alignment Between Business Plans and Risk Policies
+
+- **Risk Domain:** 4.1.1 Business Risk
+- **Risk Sub-Domain:** Risk Appetite and Policy Framework
+- **Risk Statement:** The absence of a clearly defined Acquirer risk appetite or tolerance, thorough Acquiring policy documents, uniform implementation procedures, and skilled staff could lead to a decline in operational or financial performance, which may result in potential fraud and regulatory noncompliance.
+- **Parent Control:** AACQ.C1
+- **Requirement:** Acquirers must maintain a defined risk appetite/tolerance and risk-management capabilities adequate for their business model.
+- **Source:** AACQ.C1.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Risk tolerance/appetite covers merchant activity segments (permissible, conditionally restricted, prohibited) and countries of operation
+  - [ ] **(2)** Risk policies cover roles & responsibilities, underwriting, monitoring, termination, settlement, complaint handling, exception reporting, data security/retention, BCP, and DR — with documented sub-policies:
+    - [ ] **(2.a)** Risk policy aligned with business plan
+    - [ ] **(2.b)** Underwriting policy crafted by business segment
+    - [ ] **(2.c)** TPA policy where applicable
+  - [ ] **(3)** Policies are documented, approved by Board / Executive-Level Committee, version-controlled, and periodically reviewed
+  - [ ] **(4)** Governance process operates to oversee policy implementation across the organisation
+  - [ ] **(5)** KRIs/KPIs track approval rates, decline reasons, dispute/fraud rates, payment volume trends, credit/operational losses, and Visa risk-program noncompliance
+  - [ ] **(6)** Staff competencies and training align with the business plan
+- **Evidence:**
+  - Approved risk appetite statement and policy suite
+  - Board / Executive Committee approval minutes with version history
+  - KRI/KPI dashboard or report
+  - Training records and risk-responsibility organisation chart
+
+### AACQ.C2.1: Merchant Agreement Content
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** The absence of a written agreement for Acquirers can lead to misunderstandings, legal vulnerabilities, insufficient evidence in case of disputes, potential financial losses, and reputational damage.
+- **Parent Control:** AACQ.C2
+- **Requirement:** Acquirers must have contractual binding agreements with Merchants/TPAs that assure compliance with the acquiring strategy.
+- **Source:** AACQ.C2.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer has a Merchant Agreement with each Merchant accepting Visa payments. The agreement requires the Merchant to:
+    - [ ] **(1.a)** Adhere to the Acquirer's policies and procedures per the defined risk tolerance, including training received and acknowledged
+    - [ ] **(1.b)** Fulfill its responsibilities in accordance with applicable laws and regulations
+    - [ ] **(1.c)** Comply with the Visa Rules
+    - [ ] **(1.d)** Refrain from knowingly submitting any transactions that are illegal or that the Merchant should have known were illegal
+    - [ ] **(1.e)** Recognize Visa's right to limit or terminate the Acquirer's agreement with the Merchant
+    - [ ] **(1.f)** In the event of an ongoing investigation at the time the Merchant Agreement is signed, fully cooperate with the investigation until its completion, in compliance with local laws and regulations and per "What to Do If Compromised"
+  - [ ] **(2)** Agreement has a clause allowing revocation of Visa acceptance for any activity that may create harm or loss to the goodwill of the Visa payment system, supporting Acquirer action:
+    - [ ] **(2.a)** After verifying that Visa has prohibited a Merchant from participating in Visa acceptance programs, Acquirer suspends all Visa processing no later than the date specified by Visa (if applicable)
+    - [ ] **(2.b)** Merchant is notified in writing if the Acquirer terminates the Merchant agreement
+    - [ ] **(2.c)** Where the Merchant is terminated for cause, the Merchant is listed on the Terminated Merchant File (e.g. VMSS)
+  - [ ] **(3)** Merchant agreement outlines the following prohibitions:
+    - [ ] **(3.a)** **Resubmission of previously disputed charges:** A transaction that has been previously disputed and returned to the Merchant cannot be resubmitted
+    - [ ] **(3.b)** **Submission or execution of fraudulent or unauthorized transactions:** Knowingly submitting fraudulent or unauthorized transactions into the payment system is not acceptable
+    - [ ] **(3.c)** **Transaction laundering:** Transactions knowingly intended to hide the true source/nature by layering through what appear as low-risk but in fact prohibited goods or services per the Visa Rules
+    - [ ] **(3.d)** **Data security breach:** Unauthorized storage, processing, or transmission of payment data through non-approved software/processes is prohibited, as is failure to enforce data security requirements for Merchants/TPAs
+  - [ ] **(R1)** (Recommended) Merchant agreement also considers the following elements:
+    - [ ] **(R1.a)** **Transaction terms:** Conditions necessary for completion of payment delivered directly to the Merchant; details of the financial institution where the Acquirer deposits Visa transaction funds
+    - [ ] **(R1.b)** **Fee Differentiation:** Section separating fees associated with Visa transactions from those linked to other card transactions, for clarity
+    - [ ] **(R1.c)** **Acquirer Disclosure:** Disclosure page or section identifying the Acquirer and its responsibilities when a TPA is part of the agreement
+    - [ ] **(R1.d)** **Information Provision to Visa:** Required and suitable rights under applicable laws/regulations/privacy policies/agreements to share Merchant information with Visa, including use of a Merchant's logo alongside transaction details in digital formats (e.g. cardholder digital statements) to aid identification and reduce unrecognized-transaction disputes
+    - [ ] **(R1.e)** Although not required, Acquirer may reference the Visa risk standards in Merchant agreements; agreements executed on or before October 20, 2024 may reference GARS without update, while agreements executed on or after October 21, 2024 must reference VARS
+- **Evidence:**
+  - Standard Merchant Agreement template and signed copies
+  - VMSS submission log
+  - Sample termination notification letters
+  - Disclosure / fee-differentiation / GARS-vs-VARS clause review
+
+### AACQ.C3.1: Exposure Mitigation
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** Failure to mitigate exposure during an acquisition of new Merchant could lead to financial losses.
+- **Parent Control:** AACQ.C3
+- **Requirement:** Acquirers must have a clause in their contractual binding agreements with Merchants/TPAs that enables exposure-mitigation coverage.
+- **Source:** AACQ.C3.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer's contract with a Merchant outlines the following points to enable exposure mitigation using reserves or other means (personal/bank guarantees, account-level holds, transaction-level holds) for all direct and indirect relationships with the Acquirer:
+    - [ ] **(1.a)** Where the Acquirer uses Merchant reserves, the clause explains that these are collateral that are property of the Merchant, held and controlled by the Acquirer in a unique deposit account in the Merchant's or Sponsored Merchant's name, or other means that ensure segregation of funds
+    - [ ] **(1.b)** Acquirer explains the different types of exposure-mitigation usage and ensures clarity on the reconciliation process
+- **Evidence:**
+  - Standard contract clause language for exposure mitigation
+  - Reserve account segregation procedure
+  - Reconciliation process documentation
+
+### AACQ.C4.1: Settlement of Funds
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** Failure to settle funds timely and as agreed upon in the contractual binding agreements could lead to financial losses, regulatory noncompliance, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C4
+- **Requirement:** Acquirers must settle funds to the Merchant/TPA per the terms in the contractual binding agreement and apply any applicable withholdings.
+- **Source:** AACQ.C4.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Merchant Agreement stipulates that the Acquirer settles funds in accordance with regulations to the signing party:
+    - [ ] **(1.a)** Acquirer promptly pays or credits the Merchant's, Marketplace's, Sponsored Merchant's, PayFac's, DWO's, or Ramp Provider's account after transaction deposit; payments equal Transaction totals less Credit Transactions or Original Credit Transactions, relevant discounts, Disputes, other agreed fees, or Merchant reserve funds (where applicable) accumulated to secure the entity's payment-system obligations to the Acquirer
+    - [ ] **(1.b)** Acquirer settles within market-based timelines, provided there are no mandated holding periods (e.g. Future Service Merchants) or ongoing investigations; Acquirer retains settlements to offset any Disputes or financial losses directly associated with the Merchant
+    - [ ] **(1.c)** Merchant Agreement states that the Acquirer is responsible for providing settlement funds to the Merchant; ensuring the security and proper handling of Merchant funds is a fundamental Acquirer responsibility
+- **Evidence:**
+  - Settlement timeline policy
+  - Sample settlement reports / reconciliation logs
+  - Merchant Agreement settlement clause
+
+### AACQ.C5.1: Underwriting Policy
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** Acquirers that have ineffective onboarding standards could onboard Merchants involved in illegal activities, deceptive practices, and/or have elevated Dispute activity. This could lead to financial losses, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C5
+- **Requirement:** Acquirers must have an onboarding standard that enables risk-based due-diligence processes.
+- **Source:** AACQ.C5.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Onboarding policy is risk-based and segments Merchants into risk categories (e.g. low — small/individual Merchants; medium; high — Future Sales activity, VIRP High Integrity Risk categories, Enterprise entities, Pay-by-link Merchants). All TPAs (regardless of risk level) and Merchants in high-integrity-risk categories are underwritten to confirm:
+    - [ ] **(1.a)** Creditworthiness and that their business model aligns with the Acquirer's defined risk tolerance
+    - [ ] **(1.b)** Controls are in place to detect and prevent activities that may potentially harm the Visa payment system, the Visa brand, or submit illegal transactions to VisaNet
+    - [ ] **(1.c)** Merchants/TPAs operate within allowed jurisdictions and are compliant with all relevant regulations
+    - [ ] **(1.d)** Merchant Outlet locations are not misrepresented
+  - [ ] **(2)** Acquirer assigns the MCC to a Merchant Outlet that most accurately describes its business
+  - [ ] **(3)** Acquirer assigns 2 or more MCCs to a Merchant Outlet if either:
+    - [ ] **(3.a)** The Merchant Outlet has deployed an automated fuel dispenser and sells fuel or other goods/services in a face-to-face environment
+    - [ ] **(3.b)** Separate lines of business are located at the same Merchant Outlet AND one or more of the following applies:
+      - [ ] **(3.b.i)** A separate Merchant agreement exists for each line of business
+      - [ ] **(3.b.ii)** Multiple Merchant Outlets on the same premises display different Merchant names
+      - [ ] **(3.b.iii)** An e-commerce Merchant Outlet contains a link to a separate e-commerce website, and each website qualifies for a different MCC
+  - [ ] **(4)** Acquirer assigns a unique Card Acceptor Identification (CAID) number to each Merchant/TPA, as specified in the Visa Rules
+  - [ ] **(5)** Acquirer consults both internal lists of terminated/declined profiles and external resources such as the Terminated Merchant File (e.g. VMSS) before finalizing a contract with a prospective Merchant. If a match is found, the Acquirer:
+    - [ ] **(5.a)** Conducts the search using Legal Entity name, contacts, and owner details as available
+    - [ ] **(5.b)** Verifies whether the Merchant in question is the same one for whom the inquiry was made
+    - [ ] **(5.c)** Engages with the Acquirer who listed the Merchant to understand the reasons for inclusion in the file
+    - [ ] **(5.d)** Makes an informed decision about accepting the merchant via thorough investigation using the Terminated Merchant File, credit reports, local business registries, and other relevant sources
+  - [ ] **(6)** Acquirer develops a risk-based underwriting process to identify, assess, and manage the risks of onboarding new Merchants — automated or via enhanced due-diligence review. Policy and process are reviewed and updated periodically to reflect regulatory changes, industry best practices, and the organization's risk appetite.
+    - [ ] **(6.a)** Underwriting is enhanced via automated systems and diverse models that verify merchant identity, evaluate credit ratings, conduct fraud checks, and validate business intent. The process must include:
+      - [ ] **(6.a.i)** Robust verification: confirm seller authenticity (name, address, email, phone, business registration, document verification)
+      - [ ] **(6.a.ii)** Creditworthiness assessment: credit history, financial statements, performance, existing debts, public records
+      - [ ] **(6.a.iii)** Business activity assessment: business plan, URLs (where applicable), goods/services, delivery methods, return policies, detection of templated/counterfeit websites; HIR Merchants may require additional VIRP due diligence
+      - [ ] **(6.a.iv)** Compliance assessment: laws/regulations including data security, privacy, and card-network rules
+      - [ ] **(6.a.v)** Business location assessment: locations may present higher risks based on local laws and fraud levels
+      - [ ] **(6.a.vi)** Service-provider assessment: identify the service provider(s) used by the Merchant; ensure registration as a TPA with Visa and PCI DSS compliance per AISP
+      - [ ] **(6.a.vii)** Business history assessment: previous merchant accounts, processing history, terminations (VMSS / TMF screening), excessive chargebacks, fraud, or illegal activity
+      - [ ] **(6.a.viii)** Issue decision on the Merchant application: Approve, Decline, or Conditional approval (which may include reserves, holds, business-activity limitations, or guarantees)
+      - [ ] **(6.a.ix)** Auto-boarding (automated onboarding): when decision/risk models (including AI) are used, evaluate model risk and apply a fit-for-purpose model-risk-management framework; if Acquirer contracts with a TPA for auto-boarding, comply with regulatory requirements and refer to Visa's Payment Facilitator and Marketplace Risk Guide
+      - [ ] **(6.a.x)** On a significant risk event involving an auto-boarded or manually onboarded Merchant, Acquirer assesses whether onboarding-process deficiencies contributed and remediates findings to prevent recurrence
+- **Evidence:**
+  - Onboarding/underwriting policy with merchant risk-segmentation matrix and periodic-review log
+  - MCC assignment rules and sample multi-MCC outlet records (fuel-dispenser, multi-line-of-business cases)
+  - VMSS / Terminated Merchant File screening logs with match-investigation case files
+  - Sample underwriting case files showing identity verification, creditworthiness, business activity, compliance, location, service-provider, and history checks; final decision (approve/decline/conditional)
+  - Model-risk-management framework for auto-boarding decisions
+  - Post-incident reviews documenting onboarding-process remediation
+
+### AACQ.C6.1: KYC/KYB Data Collection
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** A lack of KYC/KYB procedures could lead to an increase in illegal activities, which may result in financial losses, potential fraud, regulatory noncompliance, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C6
+- **Requirement:** Acquirers must execute KYC/KYB checks in accordance with applicable jurisdictional laws and regulations.
+- **Source:** AACQ.C6.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer collects (and provides to Visa on request) for each Merchant/Marketplace/Sponsored Merchant/Ramp Provider: T/A or DBA name, full legal name, outlet address, telephone, CAID, business registration / tax ID, PayFac name (where applicable), PayFac and Sponsored-Merchant identifiers, Ramp Provider identifiers
+- **Evidence:**
+  - KYC/KYB data dictionary and intake forms
+  - Sample merchant master records showing all required fields populated
+
+### AACQ.C6.2: KYC/KYB Verifications
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** A lack of KYC/KYB procedures could lead to an increase in illegal activities, which may result in financial losses, potential fraud, regulatory noncompliance, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C6
+- **Requirement:** Acquirers must execute KYC/KYB verifications in accordance with applicable jurisdictional laws and regulations.
+- **Source:** AACQ.C6.2 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer conducts KYC/KYB verifications, including:
+    - [ ] **(1.a)** **Collecting and Verifying Principal/Director information:** Obtain name, address, government identification number, email, and telephone number of each principal/director; where applicable under law, collect nationality and residency; use Identity Verification Services to cross-check provided information against multiple data sources
+    - [ ] **(1.b)** **Ownership information:** Obtain percentage of ownership held by each principal representing at least material ownership
+    - [ ] **(1.c)** **Business license or registration:** Obtain a business license or registration certificate; where appropriate, search the relevant business bureaus to verify the Merchant owns or operates a legitimate business
+  - [ ] **(2)** Acquirer screens Merchants against all applicable economic and government trade-sanction watch-lists in accordance with applicable laws and regulations
+  - [ ] **(3)** Acquirer collects and verifies additional elements for e-Commerce Merchants, including:
+    - [ ] **(3.a)** A listing of URLs used by the Merchant to promote its business, sell products, and accept payments
+    - [ ] **(3.b)** Verification that the Merchant is the registered owner of these domains and websites
+- **Evidence:**
+  - KYC/KYB verification logs with timestamps and source-data references
+  - Sanctions-screening run records
+  - Domain-ownership verification reports for e-commerce merchants
+
+### AACQ.C7.1: Fraud Detection and Prevention
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** Onboarding processes that lack proper underwriting could lead to onboarding, transactional, and overall fraud, which may result in financial losses, operational damage, and reputational damage.
+- **Parent Control:** AACQ.C7
+- **Requirement:** Acquirers must conduct fraud checks when onboarding a Merchant.
+- **Source:** AACQ.C7.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Onboarding fraud-detection systems linked to merchant records flag fraudulent behaviour during onboarding
+  - [ ] **(2)** Fraud-prevention tooling deployed: AVS, CVV, Visa Secure, ML-based fraud scoring, geolocation, velocity checking, biometric authentication
+  - [ ] **(R1)** (Recommended) Layered tooling adds 2FA, IP tracking, device fingerprinting, behavioural biometrics, risk-based authentication
+  - [ ] **(R2)** (Recommended) First/third-party data verifications via web crawling, negative-news scanning, beneficial-owner research, Merchant industry/geography checks
+  - [ ] **(R3)** (Recommended) Fraud-incident evidence retained for audit per local law
+  - [ ] **(R4)** (Recommended) URL-redirect controls in place for Pay-by-link and similar checkout flows
+- **Evidence:**
+  - Onboarding fraud-rules / scoring configuration
+  - Sample fraud-investigation case files
+  - Tooling inventory (AVS, CVV, Visa Secure, fraud-scoring system)
+
+### AACQ.C8.1: Portfolio Monitoring
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Lack of portfolio oversight across processed transactions and Merchant activity could lead to processing transactions that may be fraudulent/illegal, which may result in financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AACQ.C8
+- **Requirement:** Acquirers must monitor transaction and Merchant activity to detect threats and unusual or suspicious activity, and use exception reporting to act on deviations.
+- **Source:** AACQ.C8.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Documented monitoring process/procedure exists with a dedicated competent team
+  - [ ] **(2)** Monitoring covers:
+    - [ ] **(2.a)** Anomalies in transaction velocity, rounded sales drafts, forced transactions, dormant/new merchant activity, contact-info changes, authorization spikes, sales-volume changes, card-present vs card-absent ratios, and cross-border discrepancies
+    - [ ] **(2.b)** Models or analytical methods alert on sudden/unexpected merchant activity changes against an updated baseline of normal daily activity
+    - [ ] **(2.c)** Daily merchant data retained: gross sales volume, average transaction amount, number of transactions, settlement-time average, dispute count
+    - [ ] **(2.d)** Ongoing AML due diligence: sanctions/PEP/derogatory-media screening, regulatory-license monitoring, AML-responsibility oversight
+    - [ ] **(2.e)** Business activity reviewed (URLs, products/services, delivery methods) and hyperlinks scanned for Visa Rules / legal violations
+    - [ ] **(2.f)** VMSS alerts compared against active merchant portfolio
+  - [ ] **(3)** Acquirer reviews payment-intelligence security alerts, Payment Threat Disruption biannual reports, and Pressure Gauge
+- **Evidence:**
+  - Monitoring runbook / procedure document
+  - Anomaly-rules configuration and alert dashboards
+  - AML / sanctions screening logs
+  - Periodic Visa-bulletin review log
+
+### AACQ.C8.2: Portfolio Monitoring – Fraud Risk
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Lack of portfolio oversight across processed transactions and Merchant activity could lead to processing transactions that may be fraudulent/illegal, which may result in financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AACQ.C8
+- **Requirement:** Acquirers must monitor transaction and Merchant activity to detect threats and unusual or suspicious fraud-related activity.
+- **Source:** AACQ.C8.2 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer possesses the following capabilities to detect and prevent fraudulent activity:
+    - [ ] **(1.a)** **Fraud Detection:** Acquirer is equipped with rules or models that can identify suspicious or confirmed fraudulent behavior
+    - [ ] **(1.b)** **Fraud Prevention:** Throughout the Merchant's lifecycle, Acquirer employs tools and techniques to curtail fraudulent activity, including AVS, CVV2, machine-learning algorithms, fraud scoring, geolocation, velocity checking, and biometric authentication
+  - [ ] **(R1)** (Recommended) Acquirer uses a comprehensive multi-layered approach to prevent fraud, checking Merchant data and profile at onboarding and continuously through the Merchant lifecycle:
+    - [ ] **(R1.a)** Security measures from AACQ.C7.1 (Fraud Detection and Prevention) are utilized for a robust fraud-prevention strategy
+    - [ ] **(R1.b)** **Data Verification:** Web crawling, negative-news scanning, beneficial-owner research, and checks on Merchant domicile, activities, industry, and geography to verify first- and third-party data
+    - [ ] **(R1.c)** **Attack Detection:** Monitor for enumeration or BIN attacks via inconsistencies in Merchant IP addresses, identifiers, total fraud rate, and differences in authorization vs clearing data elements; watch transaction velocity and authorization/authentication alerts
+    - [ ] **(R1.d)** **Visa Ecosystem Utilization:** Adopt Visa's ecosystem-level best practices and alerting resources, including Visa Account Attack Intelligence Service, Account Testing and Enumeration Procedures, Anti-Enumeration and Account Testing Best Practices, and Visa Ecosystem Alerting
+    - [ ] **(R1.e)** **First-Party Fraud Monitoring:** Work with Visa to identify suitable fraud solutions (e.g. Issuers'/Prepaid Clearinghouse Service ICS/PCS) and leverage Order Insight from Verifi to validate sales and combat first-party fraud
+- **Evidence:**
+  - Fraud-detection rule sets and ML model documentation
+  - Sample fraud-investigation case files
+  - Visa ecosystem alert subscription/registration evidence
+
+### AACQ.C8.3: Exception Reporting and Investigation
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Lack of portfolio oversight across processed transactions and Merchant activity could lead to processing transactions that may be fraudulent/illegal, which may result in financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AACQ.C8
+- **Requirement:** Acquirers must investigate Merchants flagged on exception reports and act on findings.
+- **Source:** AACQ.C8.3 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Merchants surfaced on exception reports investigated immediately, with results and actions reported to Visa
+  - [ ] **(2)** Where investigation reveals illegal/fraudulent activity, Acquirer takes legal action to minimise losses, cooperates with Visa/Issuers/law enforcement, holds available settlement funds (where contractually permitted), pursues merchant liability, and initiates criminal/civil proceedings as applicable
+- **Evidence:**
+  - Exception report investigation log
+  - Sample case files including Visa notification, settlement holds, legal-action records
+
+### AACQ.C9.1: Assistance with Fraudulent Activity Investigation
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Not assisting with fraudulent activity investigations could lead to undetected fraud, which may result in financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AACQ.C9
+- **Requirement:** Acquirers must support fraudulent investigations by providing comprehensive details on the Merchant and/or transactions to the relevant party/authorities.
+- **Source:** AACQ.C9.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer aids other Visa Clients in fraud investigations through interviews with merchants/sponsored merchants, evidence collection in support of law enforcement, lawful information sharing (e.g. device fingerprinting), additional reasonable assistance, and (where appropriate) suspension of merchant settlement during investigation
+- **Evidence:**
+  - Investigation cooperation policy
+  - Sample interview / evidence-collection / settlement-suspension records
+
+### AACQ.C10.1: Reporting of Suspicious Activity
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Failure to report suspicious activity could lead to an increased risk of fraudulent transactions, which may result in financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AACQ.C10
+- **Requirement:** Acquirers must report suspicious activity to help prevent fraud, comply with regulations, and maintain reputation.
+- **Source:** AACQ.C10.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer immediately reports any data breaches with a remediation plan, in the format specified by "What to Do If Compromised"
+- **Evidence:**
+  - Incident-reporting playbook referencing "What to Do If Compromised"
+  - Past breach-report submissions (if any)
+
+### AACQ.C11.1: Portfolio Monitoring – Credit Risk
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Ineffective monitoring of changes in Merchant creditworthiness could lead to the Merchant being unable to fulfil their committed goods/services to Cardholders, which may result in Acquirers facing financial losses, operational damage, and reputational damage.
+- **Parent Control:** AACQ.C11
+- **Requirement:** Acquirers should have the ability to proactively monitor and act on changes in merchant credit risk.
+- **Source:** AACQ.C11.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** When monitoring Merchant credit risk, the Acquirer:
+    - [ ] **(1.a)** **Evaluates Creditworthiness:** Assesses financial and credit reports (e.g. bankruptcy, liquidation, increased payment defaults) with external vendors and establishes an enhanced due-diligence process for review and necessary action
+    - [ ] **(1.b)** **Monitors Merchant Performance:** Watches for anomalies in specific MCCs, downward trends in Purchase Volume (PV), increases in refunds/disputes, unusual cardholder/issuer concentration, inconsistencies in business activity vs history, and changes to delivery periods vs initial underwriting
+    - [ ] **(1.c)** **Tailors Review Process:** Adjusts the review process based on Merchant category, type (online vs brick-and-mortar), projections, and jurisdiction; emphasizes enhanced due diligence for high-risk segments
+    - [ ] **(1.d)** **Aligns Mitigation Strategy:** Ensures the Merchant's exposure-mitigation strategy is in line with risk appetite and policies; where Merchant credit policies fall short, compensates by increasing reserves or applying other mitigation options
+    - [ ] **(1.e)** **Adjusts Settlement Procedures:** Revises settlement procedures where needed to better manage risk
+    - [ ] **(1.f)** **Periodic Credit Exposure Assessment:** Evaluates the Acquirer-portfolio credit exposure on a monthly, quarterly, and yearly basis
+    - [ ] **(1.g)** **Monitors Dispute Patterns:** Ensures Merchant dispute patterns align with operating sectors (e.g. non-future-service or cryptocurrency merchants should not have elevated disputes/refunds)
+- **Evidence:**
+  - Credit-risk monitoring report
+  - Reserve / hold adjustment log
+  - Periodic credit-exposure assessment minutes
+
+### AACQ.C12.1: Dispute Management Process
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Chargeback/Dispute
+- **Risk Statement:** Inadequate dispute management throughout the transaction process could lead to considerable financial vulnerability, which may result in financial losses.
+- **Parent Control:** AACQ.C12
+- **Requirement:** Acquirers must have access to dispute-management solutions and manage/respond to disputes within Visa-specified timelines.
+- **Source:** AACQ.C12.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer adheres to Visa Rules dispute requirements: handling procedures during dispute resolution and Acquirer dispute timelines
+  - [ ] **(R1)** (Recommended) Dispute management platform (in-house or 3rd-party), TC40 fraud-report use, documented SOPs, dispute-team training on VBNs, merchant education programs, VAMP threshold flagging with monthly reporting
+  - [ ] **(R2)** (Recommended) Investigation details retained ≥2 years (or longer per local law)
+  - [ ] **(R3)** (Recommended) Marketplace controls: retailer country disclosure within purchase flow, retailer details (name/date/amount) and contact-point available to cardholder for ≥120 days from Processing Date
+  - [ ] **(R4)** (Recommended) Merchants with high dispute rates reviewed for deceptive sales/marketing or misaligned MCC
+- **Evidence:**
+  - Dispute SOP and timeline tracker
+  - Sample dispute case files showing investigation documentation
+  - VAMP threshold report
+  - Marketplace retailer-disclosure UX evidence
+
+### AACQ.C13.1: Consistency in Merchant Data Elements
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Data Integrity/Quality
+- **Risk Statement:** Failure to validate Merchant's data elements with the Merchant's registered details could lead to accepting transactions from unlawful or previously terminated Merchants. This may result in financial losses, potential fraud, operational damage, and reputational damage.
+- **Parent Control:** AACQ.C13
+- **Requirement:** Acquirers must implement controls on Merchant names and identifiers to maintain consistency throughout the transaction lifecycle.
+- **Source:** AACQ.C13.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer and TPAs maintain uniform key identifiers (Registered Merchant Names, Logos, CAID, MCC, Merchant ID, DBA, Terminal ID, performance data) across authentication, authorization, clearing, settlement, collections, fraud, and dispute reporting
+- **Evidence:**
+  - Merchant master-data dictionary with field-by-field rules
+  - Cross-system reconciliation report comparing identifiers across stages
+
+### AACQ.C14.1: PCI DSS Compliance
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Data Security
+- **Risk Statement:** Ineffective data management procedures and supervision, in accordance with the Visa Rules and jurisdictional requirements, can lead to data loss, theft, or compromise, which may result in financial losses, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C14
+- **Requirement:** Acquirers must comply with the Visa Account Information Security Program and jurisdictional regulations for data handling.
+- **Source:** AACQ.C14.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Account/transaction information access restricted to authorised personnel per PCI DSS
+  - [ ] **(2)** TPA/Merchant contracts define PCI obligations, noncompliance liability, and inspection rights for the Acquirer/Visa
+  - [ ] **(3)** PCI DSS compliance enforced for all TPAs and Merchants with access to account/transaction information
+  - [ ] **(4)** Post-authorization storage of full magnetic-stripe data, CVV2, PIN/PIN block, TAVV, DTVV, and CAVV is prevented
+  - [ ] **(5)** All Merchants/TPAs use PCI Software Security Framework (SSF)–compliant Payment Applications
+  - [ ] **(6)** On Visa request, Acquirer certifies TPA/Merchant PCI compliance
+  - [ ] **(7)** Account Information Security Program requirements applied to Merchants, TPAs, and other third parties with access to data
+- **Evidence:**
+  - PCI DSS attestation register
+  - Merchant/TPA contract clauses on PCI compliance and audit rights
+  - Periodic Visa AISP certification submissions
+
+### AACQ.C15.1: Business Continuity and Resilience Plan
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Data Security
+- **Risk Statement:** Lack of business continuity planning could lead to disruptions in operations, which may result in financial losses and reputational damage.
+- **Parent Control:** AACQ.C15
+- **Requirement:** Acquirers should have a business continuity plan and resume operations within their specified timeline in case of unforeseen events.
+- **Source:** AACQ.C15.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Acquirer outlines:
+    - [ ] **(1.a)** A business continuity plan to protect and preserve sensitive and vital data, regain critical systems, and resume normal operations following unforeseen incidents
+    - [ ] **(1.b)** Well-defined recovery point objectives (RPOs) and recovery time objectives (RTOs)
+    - [ ] **(1.c)** A plan incorporating the use of a secondary site, designed to ensure that critical IT systems can resume operations within pre-defined RPO and RTO requirements following disruptive events
+  - [ ] **(2)** Acquirer maintains geographically dispersed recovery sites adhering to legal and regulatory requirements and conducts routine checks to test recovery plans and mechanisms (scope may depend on the Acquirer's size and recovery processes)
+- **Evidence:**
+  - BCP/DR plan document with RPO/RTO targets
+  - Disaster-recovery test reports
+  - Recovery-site location and contract documentation
+
+### AACQ.C16.1: Visa's Requirement & Policies
+
+- **Risk Domain:** 4.1.2 Operational Risk
+- **Risk Sub-Domain:** Network and Scheme Compliance
+- **Risk Statement:** Failure to ensure ongoing compliance to Visa Rules or technical standards, which are updated periodically, can result in financial losses, operational damage, and reputational damage.
+- **Parent Control:** AACQ.C16
+- **Requirement:** Acquirers must ensure their operational, sales, and technical functions remain compliant with all Visa requirements as regularly updated.
+- **Source:** AACQ.C16.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Visa's requirements and policies embedded into the Acquirer's overall operating structure and risk appetite, as updated periodically
+  - [ ] **(2)** Acquirer and all parties in its ecosystem remain compliant with Visa's technical standards, as updated periodically
+  - [ ] **(3)** Updated Visa Rules and technical standards are adopted in line with the Effective Dates communicated in applicable Visa communications
+  - [ ] **(R1)** (Recommended) Acquirer establishes a dedicated group of employees responsible for understanding Visa's requirements and policies; this group:
+    - [ ] **(R1.a)** Acts as SMEs for other groups to ensure business policies and operational structures support Visa's requirements, including:
+      - [ ] **(R1.a.i)** Access to Visa Online, with regular reviews of which internal employees have access and the level of access they hold; remove colleagues who no longer need access
+      - [ ] **(R1.a.ii)** Access to Visa Online from each region in which the Acquirer operates
+      - [ ] **(R1.a.iii)** Regular interaction with local Visa representatives in each country/region of operation, providing foresight to forthcoming Visa announcements not yet advertised on Visa Online
+      - [ ] **(R1.a.iv)** Knowledge of Visa Online content, including the range of Visa products available to support the Acquirer's business needs
+      - [ ] **(R1.a.v)** Information on Visa Training courses (online or via Visa University) located on Visa Online
+    - [ ] **(R1.b)** Acts as the dedicated contact point for receiving Visa's regular (weekly) communications announcing forthcoming updates to Visa Rules, requirements, and technical standards (typically retrieved via Visa Online; access regional Visa Online for each region the Acquirer acquires in)
+    - [ ] **(R1.c)** Develops measures and controls to periodically review and circulate announcements of updated Visa Rules, technical standards, and other requirements across the Acquirer's organization so upcoming updates are known and understood by business owners
+    - [ ] **(R1.d)** Develops internal communication practices to share Visa documentation (which may be confidential) with relevant stakeholders such as Merchants and other third parties without circumventing Visa confidentiality controls
+  - [ ] **(R2)** (Recommended) Acquirer continuously ensures business policies and operational structures support Visa's requirements, as updated periodically, through periodic internal audits and analysis
+- **Evidence:**
+  - Visa-rules monitoring SOP and SME-group charter
+  - Visa Online access register with periodic-review log
+  - Regional Visa Online access map (one per region of operation)
+  - Local Visa representative engagement log
+  - Internal circulation records for Visa announcements / weekly communications
+  - Internal audit reports confirming operational-structure support of Visa requirements
+
+### AACQ.C17.1: Monitoring Illegal Transactions
+
+- **Risk Domain:** 4.1.3 Legal & Regulatory Risk
+- **Risk Sub-Domain:** Miscoding/Transaction Laundering
+- **Risk Statement:** Processing illegal transactions (or transactions related to prohibited goods and services) that may be caused by miscoding or transaction laundering could lead to financial losses, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C17
+- **Requirement:** Acquirers should implement controls during underwriting and monitoring to detect potentially concealed illegal transactions.
+- **Source:** AACQ.C17.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Effective monitoring for illegal transactions, including web crawling tools where needed, with controls including:
+    - [ ] **(1.a)** **Regularly Review Transaction Data:** Review for unusual patterns (high transaction volumes, similar amounts, transactions that do not match the underwritten Merchant's nature)
+    - [ ] **(1.b)** **Website and cyber-analytics-based tools:** Identify transaction tunnels (mobile apps, fraudulent mobile payments) via cyber intelligence
+    - [ ] **(1.c)** **Behavioural analytics-based tools:** Real-time monitoring of Merchant behaviour and traffic flow with alerting; advanced analytics and ML to identify patterns indicating transaction laundering (e.g. recurring transactions from the same IP/geographic location)
+    - [ ] **(1.d)** **Verify Merchant Websites:** Regularly verify Merchants' websites confirm declared products/services only and have a working checkout/payment-processing capability — transaction laundering often involves selling undisclosed products/services
+    - [ ] **(1.e)** **Database and website analytics-based tools:** External databases for pattern detection within traffic, websites, and transactions
+    - [ ] **(1.f)** **Additional monitoring requirements:** Monitor for mismatches in Merchant identifiers (Merchant names, MCC), suspicious URL/backlink connections, and conduct investigation upon violation
+- **Evidence:**
+  - Web-crawler / behavioural-analytics tool inventory
+  - Merchant-website verification log
+  - Transaction-laundering investigation case files
+
+### AACQ.C17.2: Transaction Laundering/Miscoding Knowledge and Skills
+
+- **Risk Domain:** 4.1.3 Legal & Regulatory Risk
+- **Risk Sub-Domain:** Miscoding/Transaction Laundering
+- **Risk Statement:** Processing illegal transactions caused by miscoding or transaction laundering could lead to financial losses, reputational damage, and legal issues.
+- **Parent Control:** AACQ.C17
+- **Requirement:** Acquirers should keep stakeholders trained and up to date on transaction-laundering and miscoding developments.
+- **Source:** AACQ.C17.2 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Acquirer subscribes to Visa PFD communications, V-Alerts, Pressure Gauge, Payment Threat Disruption biannual report, and additional Legal-team-recommended sources
+- **Evidence:**
+  - Subscription / distribution-list register for Visa fraud comms
+  - Training materials on transaction-laundering trends
+
+### AACQ.C18.1: Compliance with all Applicable Jurisdictional Laws, Regulations, and the Visa Rules
+
+- **Risk Domain:** 4.1.3 Legal & Regulatory Risk
+- **Risk Sub-Domain:** Regulatory Risk
+- **Risk Statement:** Acquirer's acquiring and risk policies that are not aligned to jurisdictional and regulatory requirements could lead to financial losses and regulatory noncompliance.
+- **Parent Control:** AACQ.C18
+- **Requirement:** Acquirer's acquiring and risk policies must align with all applicable jurisdictional laws and regulations, and these must be shared with Merchants/TPAs.
+- **Source:** AACQ.C18.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquiring and risk policies comply with applicable jurisdictional laws/regs, including AML and sanctions
+  - [ ] **(2)** All transactions verified legal in both Merchant and Cardholder jurisdictions
+- **Evidence:**
+  - Jurisdictional-compliance matrix
+  - AML/sanctions program documentation
+  - Transaction-legality screening procedure
+
+## ATPA: Acquirers Sponsoring TPAs
+
+### ATPA.C1.1: TPA Agreement
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** The absence of written agreements between Acquirers and TPAs could lead to misunderstandings, legal vulnerabilities, insufficient evidence in case of disputes, which may result in financial losses and reputational damage.
+- **Parent Control:** ATPA.C1
+- **Requirement:** Acquirers must have contractual binding agreements with TPAs that assure compliance with their acquiring strategy.
+- **Source:** ATPA.C1.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Written agreement with each TPA performing cardholder/merchant solicitation, or storing/processing/transmitting cardholder or transaction data, containing the following provisions:
+    - [ ] **(1.a)** **Standards:** Agreement incorporates Visa minimum standards (policies, procedures, service levels, performance standards)
+    - [ ] **(1.b)** **Visa's Rights and Authority:** Agreement permits Visa to conduct financial/procedural audits and reviews, requires TPA to make cardholder/merchant information accessible to Visa and regulatory agencies, includes termination-notice clause, grants Visa right to impose risk conditions, and grants Visa right to limit or terminate the Acquirer–TPA agreement
+    - [ ] **(1.c)** **Compliance:** TPAs do not knowingly submit illegal transactions
+      - [ ] **(1.c.i)** TPA complies with Visa Rules and applicable laws/regulations
+      - [ ] **(1.c.ii)** TPA adheres to Acquirer policies/procedures and the Visa Account Information Security Program (AISP) and any relevant data security standard
+    - [ ] **(1.d)** **Cooperation:** TPA fully cooperates with forensic investigation until completion per "What to Do If Compromised"
+    - [ ] **(1.e)** **Security Compliance:** TPA complies with PCI DSS where applicable
+    - [ ] **(1.f)** **Termination:** Provision triggered by Visa Rules violations or insolvency
+      - [ ] **(1.f.i)** After Visa prohibits a Sponsored Merchant or PayFac from participating, Acquirer ensures Visa processing for the PayFac is suspended no later than the date specified by Visa
+      - [ ] **(1.f.ii)** Sponsored Merchant or PayFac is notified in writing of termination (direct or tri-party agreement)
+    - [ ] **(1.g)** **Settlement of Funds:** Acquirer pays/credits TPA's account promptly after transaction deposit; deposits on behalf of another TPA prohibited; in tri-party scenarios where the Acquirer also contracts with the PayFac, Acquirer pays the Sponsored Merchant directly for its portion
+    - [ ] **(1.h)** TPA contact name, phone number, and logo on merchant application are not more prominent than the Acquirer's contact information and do not discourage merchants from contacting the Acquirer; if the TPA logo is present, the Acquirer logo is also present
+  - [ ] **(R1)** (Recommended) Contractually binding agreement with TPAs:
+    - [ ] **(R1.a)** **Primary Party:** Identifies Acquirer as primary party; defines duties/responsibilities of TPA and Acquirer (transaction monitoring, website monitoring, transaction-laundering detection)
+    - [ ] **(R1.b)** **Transfer/Assignment:** Allows transfer or assignment of a Sponsored Merchant/TPA agreement to another Acquirer
+    - [ ] **(R1.c)** **Merchant Agreements:** Establishes a method for examining merchant agreements used by the TPA
+    - [ ] **(R1.d)** **Responsibilities:** Clearly defines duties (transaction monitoring, website monitoring, transaction-laundering detection)
+    - [ ] **(R1.e)** **Addendum:** Modifications documented in an addendum signed by the TPA's principal owner or compliance officer; addendum used for staff training
+    - [ ] **(R1.f)** **Restrictions:** Restricts TPAs from registering other TPAs (PayFac, Marketplace, Ramp Provider) not permissible by Visa Rules
+- **Evidence:**
+  - Standard TPA Agreement template
+  - Sample executed TPA agreements
+  - Forensic-cooperation procedure
+  - PCI compliance attestation register
+
+### ATPA.C1.2: TPA Agreement for PayFac or DWO
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** The absence of written agreements between Acquirers and TPAs could lead to misunderstandings, legal vulnerabilities, insufficient evidence in case of disputes, which may result in financial losses and reputational damage.
+- **Parent Control:** ATPA.C1
+- **Requirement:** Acquirers must have contractual binding agreements with PayFacs/DWOs that meet additional VARS provisions.
+- **Source:** ATPA.C1.2 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** PayFac and DWO agreements contain the following provisions:
+    - [ ] **(1.a)** PayFac, its Sponsored Merchants, or the DWO must adhere to the Visa Rules
+    - [ ] **(1.b)** PayFac is obligated to establish a contract with each Sponsored Merchant
+    - [ ] **(1.c)** Acquirer reserves the right to immediately terminate an agreement with a Sponsored Merchant, PayFac, DWO, or a retailer under a DWO for valid reasons, fraudulent actions, other activities, or upon Visa's request
+    - [ ] **(1.d)** The PayFac or DWO must:
+      - [ ] **(1.d.i)** Accept liability for all actions, neglect, cardholder disputes, and other cardholder customer-service issues caused by the PayFac's Sponsored Merchants or the retailer under a DWO
+      - [ ] **(1.d.ii)** Take responsibility and financial liability for each transaction processed for the Sponsored Merchant, or any disputed transaction or credit
+      - [ ] **(1.d.iii)** Refrain from transferring its financial liability by asking or requiring cardholders to waive their dispute rights
+      - [ ] **(1.d.iv)** Prevent a Sponsored Merchant from transferring its financial liability via cardholder dispute-rights waiver
+      - [ ] **(1.d.v)** Not process transactions on behalf of another PayFac; PayFacs deposit a transaction between the cardholder and a Sponsored Merchant of the PayFac only
+      - [ ] **(1.d.vi)** Avoid contracting with a Sponsored Merchant or DWO retailer whose contract was terminated by Visa or a government agency
+      - [ ] **(1.d.vii)** Provide names of principals and country of domicile for each Sponsored Merchant / DWO retailer, and transaction reports to the Acquirer and Visa upon request
+      - [ ] **(1.d.viii)** Ensure Sponsored Merchants adhere to PCI DSS and PCI SSF Standards
+      - [ ] **(1.d.ix)** Ensure PayFacs and SDWOs do not process transactions from Sponsored Merchants or DWO retailers outside the Acquirer's jurisdiction
+  - [ ] **(2)** Acquirers contracted with a PayFac establish a direct Merchant Agreement with any Sponsored Merchant whose annual transaction volume exceeds USD 1 million, as follows:
+    - [ ] **(2.a)** For a new Sponsored Merchant application
+    - [ ] **(2.b)** For an existing Sponsored Merchant due for renewal or within 2 years after annual transaction volume exceeds USD 1 million
+    - [ ] **(2.c)** PayFac may continue to provide payment services (including settlement) to the Sponsored Merchant
+- **Evidence:**
+  - PayFac / DWO agreement template differing from standard merchant agreement
+  - Sponsored-merchant volume monitoring report
+  - Direct-merchant-agreement transition procedure for >USD 1M sponsored merchants
+
+### ATPA.C1.3: TPA Agreement for Marketplaces
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** The absence of written Marketplace agreements could lead to misunderstandings, legal vulnerabilities, insufficient evidence in case of disputes, financial losses, and reputational damage.
+- **Parent Control:** ATPA.C1
+- **Requirement:** Acquirers must have contractual binding Marketplace agreements meeting Marketplace-specific VARS provisions.
+- **Source:** ATPA.C1.3 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Marketplace agreements contain the following provisions:
+    - [ ] **(1.a)** Marketplace and its retailers comply with the Visa Rules
+    - [ ] **(1.b)** Marketplace enters into a contract with each retailer before depositing transactions on the retailer's behalf
+    - [ ] **(1.c)** Acquirer's right to prohibit individual retailers from the Visa system and to immediately stop depositing transactions for any individual retailer for good cause or upon Visa request
+    - [ ] **(1.d)** Statements specifying that the Marketplace:
+      - [ ] **(1.d.i)** May process transactions for retailers in a different country only where the transaction is legal in both the Marketplace's and the retailer's country
+      - [ ] **(1.d.ii)** Is liable for all acts, omissions, cardholder disputes, and other cardholder customer-service issues caused by its retailers
+      - [ ] **(1.d.iii)** Is responsible and financially liable for each transaction processed on behalf of a retailer
+      - [ ] **(1.d.iv)** Must not transfer (or permit a retailer to transfer) its financial liability via cardholder dispute-rights waiver
+      - [ ] **(1.d.v)** Deposits transactions only on behalf of retailers using the Marketplace's website or application
+      - [ ] **(1.d.vi)** Does not knowingly contract with a retailer whose acceptance contract was terminated at the direction of Visa or a government agency
+- **Evidence:**
+  - Marketplace agreement template
+  - Sample executed Marketplace agreements
+  - Retailer-onboarding control evidence
+
+### ATPA.C2.1: TPA Reporting Terminated Merchants
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** Delayed recording of terminated TPAs, especially those terminated for just cause due to misuse, deception, and/or processing illegal transactions, may result in potential fraud, operational damage, reputational damage, and legal issues.
+- **Parent Control:** ATPA.C2
+- **Requirement:** Acquirers should have a contractually binding agreement with TPAs that requires terminated-for-cause TPAs to be reported per Visa practice.
+- **Source:** ATPA.C2.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Acquirers ensure TPAs check the Terminated Merchant File (e.g. VMSS) for any match to Sponsored Merchants. On positive match, the TPA:
+    - [ ] **(1.a)** Verifies the merchant in question is the same one for whom the inquiry was made
+    - [ ] **(1.b)** Engages with the Acquirer who listed the merchant to understand the reasons behind their inclusion
+    - [ ] **(1.c)** Makes an informed decision about accepting the merchant using the Terminated Merchant File, credit reports, local business registries, and other relevant sources
+- **Evidence:**
+  - TPA-side VMSS screening procedure
+  - Sample TPA decision logs after VMSS hits
+
+### ATPA.C3.1: TPA Underwriting Requirements
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** When participating in the acquiring of TPAs, Acquirers have lower visibility into the end Merchant, which could lead to potential gaps in policy implementation and may result in financial losses, operational damage, reputational damage, and legal issues.
+- **Parent Control:** ATPA.C3
+- **Requirement:** Acquirers must have a TPA-specific onboarding process and underwrite all TPAs prior to onboarding.
+- **Source:** ATPA.C3.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Comprehensive underwriting process completed for each TPA before signing the contract and integrating for onboarding, complying with the Third-Party Agent Due Diligence Risk Standards, including:
+    - [ ] **(1.a)** Enhanced due-diligence review (site visit or other suitable alternative)
+    - [ ] **(1.b)** Creditworthiness assessment via credit history, financial statements, previous processor history (chargeback performance), business operations, existing debts, and public records
+    - [ ] **(1.c)** Background investigation verifying principals' identities and ensuring no significant derogatory information; documented alternative due-diligence procedures where checks are prohibited by law
+    - [ ] **(1.d)** Check TPA listing in the Terminated Merchant File (e.g. VMSS)
+    - [ ] **(1.e)** Examine TPA's business strategy, considering past merchant accounts, terminations, chargebacks, fraud, or illicit activities
+    - [ ] **(1.f)** Verify TPA's onboarding procedures for Sponsored Merchants and scrutinize sample files to confirm both Acquirer's and TPA's policies are followed (outlet location accuracy, legal presence in Acquirer's jurisdiction)
+    - [ ] **(1.g)** Control approval/review of merchants, cardholder application approval, and merchant-fee setting (e.g. via shadow onboarding)
+    - [ ] **(1.h)** Confirm TPA's capability to provide Visa with quarterly reports on goods/services each Sponsored Merchant is doing business on its behalf, if requested
+    - [ ] **(1.i)** Verify TPA's compliance with laws and regulations including data security, privacy, and card-network rules
+    - [ ] **(1.j)** Ensure TPA has policies and procedures (merchant onboarding, activity monitoring, written agreements) aligned with their business plan; training provided to Sponsored Merchants
+    - [ ] **(1.k)** Review TPA's solicitation materials (advertisements, stationery, business cards, sales brochures, website/application promotional content)
+- **Evidence:**
+  - TPA underwriting case file
+  - Site-visit / due-diligence reports
+  - Background-check / sanctions records for TPA principals
+  - Sample-merchant-file review log
+
+### ATPA.C4.1: TPA Underwriting Requirements for PayFacs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** When participating in the acquiring of TPAs, Acquirers have lower visibility into the end Merchant, which could lead to potential gaps in policy implementation and may result in financial losses, operational damage, reputational damage, and legal issues.
+- **Parent Control:** ATPA.C4
+- **Requirement:** Acquirers must conduct additional underwriting for PayFacs prior to onboarding (in addition to ATPA.C3.1).
+- **Source:** ATPA.C4.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** When the Acquirer partners with a PayFac, the Acquirer:
+    - [ ] **(1.a)** Confirms with the PayFac that they are in good standing in all Visa risk-management programs
+    - [ ] **(1.b)** Ensures the PayFac is financially stable and creditworthy (credit history, financial statements, performance, existing debts, public records)
+    - [ ] **(1.c)** Ensures PayFac registration (including the due-diligence review attestation) is confirmed by Visa before submitting transactions on behalf of the PayFac or its Sponsored Merchants; high-integrity-risk PayFacs are registered as High-Risk Internet PayFacs (even if previously registered)
+    - [ ] **(1.d)** Obtains a unique PayFac identifier from Visa and assigns it to each PayFac for transaction processing
+    - [ ] **(1.e)** Ensures the PayFac assigns a unique identifier to each Sponsored Merchant
+    - [ ] **(1.f)** Ensures every transaction contains the PayFac and Sponsored Merchant identifiers as follows:
+      - [ ] **(1.f.i)** Authorization records contain both the PayFac identifier and the Sponsored Merchant identifier
+      - [ ] **(1.f.ii)** Clearing records contain only the PayFac identifier
+    - [ ] **(1.g)** Assigns a unique CAID to each PayFac when processing transactions in a card-absent environment, as specified in the Visa Rules
+  - [ ] **(2)** Acquirer assigns the correct location of its PayFac as the country of the PayFac's principal place of business
+- **Evidence:**
+  - PayFac registration confirmation from Visa
+  - PayFac/Sponsored Merchant identifier mapping
+  - Sample auth/clearing records showing identifier presence
+
+### ATPA.C5.1: TPA Underwriting Requirements for DWOs and SDWOs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** When participating in the acquiring of TPAs, Acquirers have lower visibility into the end Merchant, which could lead to potential gaps in policy implementation, financial losses, operational/reputational damage, and legal issues.
+- **Parent Control:** ATPA.C5
+- **Requirement:** Acquirers must conduct additional underwriting for DWOs and SDWOs prior to onboarding (in addition to ATPA.C3.1).
+- **Source:** ATPA.C5.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirers partnering with a DWO that runs an SDWO adhere to the following requirements:
+    - [ ] **(1.a)** Maintain good standing in all Visa risk-management programs
+    - [ ] **(1.b)** Register the SDWO as a TPA with Visa
+    - [ ] **(1.c)** Assign a unique CAID number to the SDWO for processing transactions in a card-absent environment, as specified in the Visa Rules
+    - [ ] **(1.d)** Obtain a Merchant Verification Value (MVV) for each SDWO
+    - [ ] **(1.e)** Deposit the proceeds from transactions conducted via the SDWO into a bank account located in the SDWO's country of operation
+  - [ ] **(2)** Acquirer sets the primary location of an SDWO as the country of the SDWO's principal place of business
+  - [ ] **(3)** Acquirer assigns an additional SDWO location only where all of the following conditions are met in that country:
+    - [ ] **(3.a)** The SDWO has a permanent location where it manages tasks related to the digital wallet
+    - [ ] **(3.b)** The SDWO is taxed on revenue earned from providing wallet services to cardholders and acceptance services to retailers signed up by the SDWO, where such taxes are applicable
+    - [ ] **(3.c)** The SDWO is subject to the local laws and regulations
+- **Evidence:**
+  - SDWO TPA registration evidence
+  - CAID/MVV assignment records
+  - Settlement-account country verification
+
+### ATPA.C6.1: TPA Underwriting Requirements for Marketplaces
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** When participating in the acquiring of TPAs, Acquirers have lower visibility into the end Merchant, which could lead to potential gaps in policy implementation, financial losses, operational/reputational damage, and legal issues.
+- **Parent Control:** ATPA.C6
+- **Requirement:** Acquirers must conduct additional underwriting for Marketplaces prior to onboarding (in addition to ATPA.C3.1).
+- **Source:** ATPA.C6.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Marketplace qualification confirmed: e-commerce site/app connecting cardholders and retailers; Marketplace name/brand prominently displayed and embedded in URL/app name; Marketplace handles payments and settlement; Marketplace financially responsible for disputes (mutually-binding decision or money-back guarantee)
+  - [ ] **(2)** Marketplace creditworthiness assessed (history, statements, prior-processor performance, debts, public records)
+  - [ ] **(3)** Marketplace Visa Rules compliance verified
+  - [ ] **(4)** Marketplace business strategy examined for past terminations, chargebacks, fraud, illicit activities
+  - [ ] **(5)** Marketplace primary location set to principal place of business
+  - [ ] **(6)** Marketplace's onboarding policies and seller due-diligence reviewed
+- **Evidence:**
+  - Marketplace qualification checklist
+  - Creditworthiness assessment file
+  - Seller-onboarding-policy review notes
+
+### ATPA.C7.1: TPA Underwriting Requirements for Ramp Providers
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** When participating in the acquiring of TPAs, Acquirers have lower visibility into the end Merchant, which could lead to potential gaps in policy implementation, financial losses, operational/reputational damage, and legal issues.
+- **Parent Control:** ATPA.C7
+- **Requirement:** Acquirers must conduct additional underwriting for Ramp Providers prior to onboarding (in addition to ATPA.C3.1).
+- **Source:** ATPA.C7.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer assigns the correct location of a Ramp Provider as the country of the Ramp Provider's principal place of business
+  - [ ] **(2)** Acquirer assigns additional locations for a Ramp Provider only where all of the following conditions are met in that country:
+    - [ ] **(2.a)** The Ramp Provider has a permanent location where its employees or agents conduct business activities directly related to providing services to the Conversion Affiliates
+    - [ ] **(2.b)** Cardholder correspondence and judicial processes are sent to or delivered by the Ramp Provider
+    - [ ] **(2.c)** The Ramp Provider pays taxes on revenue earned from providing services to cardholders and card-acceptance services to Conversion Affiliates, where such taxes are applicable
+    - [ ] **(2.d)** The Conversion Affiliate is subject to the local laws and regulations of the country
+- **Evidence:**
+  - Ramp Provider location-assignment record
+  - Local-site / tax / legal evidence files
+
+### ATPA.C8.1: Portfolio Monitoring of TPAs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate monitoring of transaction-level, Merchant-level and/or TPA-level illegal, suspicious, and/or deceptive practices could lead to financial losses, regulatory/compliance issues, and reputational damage.
+- **Parent Control:** ATPA.C8
+- **Requirement:** Acquirers must monitor TPA transaction activity to detect threats and unusual or suspicious activity and act on identified deviations (in addition to AACQ.C8.1).
+- **Source:** ATPA.C8.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirers implement:
+    - [ ] **(1.a)** **Regular Monitoring:** Analyse TPA transaction patterns and volumes regularly to detect unusual or suspicious activity (sudden volume changes, unusual refund patterns, transactions outside the TPA's normal profile); regular sampling of Sponsored Merchant activity (e.g. monthly/quarterly) to ensure ongoing TPA compliance
+    - [ ] **(1.b)** **Fraud Detection:** Advanced fraud-detection systems (including ML algorithms) to identify potentially fraudulent transactions
+    - [ ] **(1.c)** **Compliance Checks:** TPA adherence to all relevant laws, regulations, and card-network rules including data security standards, AML, and chargebacks/refunds rules
+    - [ ] **(1.d)** **Risk Assessment:** Regularly assess TPA risk profile against risk appetite/KRIs, considering business model, geographic location, and types of transactions processed
+    - [ ] **(1.e)** **Reporting:** Generate regular reports on TPA transaction activity, share with relevant stakeholders, and report suspicious activity to authorities
+  - [ ] **(2)** Settlement of TPA-submitted transaction proceeds occurs in a bank account in the Acquirer's jurisdiction and in line with the TPA / Sponsored Merchant agreement
+  - [ ] **(3)** PayFac contracts with a Sponsored Merchant outside the PayFac's country only if both:
+    - [ ] **(3.a)** The Acquirer and Sponsored Merchant are in the same country
+    - [ ] **(3.b)** Settlement to the Sponsored Merchant is performed in the Acquirer's jurisdiction via one of the following:
+    - [ ] **(3.c)** A local settlement account owned and controlled by the PayFac
+    - [ ] **(3.d)** A local settlement account owned by the Acquirer but controlled by the PayFac (e.g. an "on-behalf-of" account)
+    - [ ] **(3.e)** Direct settlement from the Acquirer to the Sponsored Merchant
+  - [ ] **(4)** TPA granted access to the Terminated Merchant File (e.g. VMSS) and similar tools to monitor for changes in their merchant portfolio in case of positive matches
+  - [ ] **(5)** Sponsored Merchants verified to use the correct MCC and registered with Visa where applicable
+  - [ ] **(6)** Acquirer confirms TPA only submits transactions into interchange within the Acquirer's jurisdiction, from DWOs, Merchants, Marketplaces, and Sponsored Merchants within that jurisdiction
+  - [ ] **(7)** Annual TPA review confirms ongoing compliance with applicable regional due-diligence standards, laws, and regulations:
+    - [ ] **(7.a)** **Financial Statements:** Review TPA's most recent financial statements to determine financial condition
+    - [ ] **(7.b)** **Ownership Changes:** Document any changes in ownership and perform due diligence on new owners
+    - [ ] **(7.c)** **Use of Acquirer's Policies and Procedures:** Examine TPA's internal policies/procedures and how they align with the Acquirer's; conduct tests to verify PayFac compliance with Acquirer's onboarding and monitoring policies/requirements
+    - [ ] **(7.d)** **PCI DSS Compliance:** If the TPA handles cardholder data, review the most recent compliance report; TPAs attest to PCI DSS compliance and other data-security requirements
+    - [ ] **(7.e)** **Review of Merchant Complaints:** Review TPA's complaint log, written merchant complaints, and online complaint boards
+  - [ ] **(8)** Remediation plans implemented to mitigate any imminent risk to Visa Payment System; reports shared with Visa per AACQ.C12.1 recommended controls
+- **Evidence:**
+  - TPA monitoring runbook
+  - Annual TPA review reports
+  - Settlement-jurisdiction reconciliation evidence
+  - Sponsored-Merchant MCC and Visa-registration records
+
+### ATPA.C8.2: Monitoring Fraud Risk for TPAs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate monitoring of transaction-level, Merchant-level and/or TPA-level illegal, suspicious, and/or deceptive practices could lead to financial losses, regulatory/compliance issues, and reputational damage.
+- **Parent Control:** ATPA.C8
+- **Requirement:** Acquirers must possess fraud-detection/-prevention capabilities (per AACQ.C8.2) for TPA transactions.
+- **Source:** ATPA.C8.2 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer applies AACQ.C8.2 fraud-detection-and-prevention capabilities (rules/models, AVS/CVV2, ML, fraud scoring, geolocation, velocity, biometrics) to TPA transactions
+- **Evidence:**
+  - Fraud-detection rule sets covering TPA traffic
+  - TPA fraud-investigation case files
+
+### ATPA.C8.3: Reporting of Suspicious Activity by TPAs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate monitoring of transaction-level, Merchant-level and/or TPA-level illegal, suspicious, and/or deceptive practices could lead to financial losses, regulatory/compliance issues, and reputational damage.
+- **Parent Control:** ATPA.C8
+- **Requirement:** Acquirers must immediately report TPA-related suspicious activity to Visa with a remediation plan, per "What to Do If Compromised".
+- **Source:** ATPA.C8.3 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer immediately reports loss/theft/compromise/misuse of Visa account info, cardholder info, or transaction info; transaction-information/system/equipment misuse by Merchants/TPAs; and fraud or transaction laundering — with a thorough, complete, format-specified report
+- **Evidence:**
+  - TPA-incident reporting playbook
+  - Submitted incident-report copies (where applicable)
+
+### ATPA.C9.1: Monitoring Credit Risk for TPAs
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate monitoring of TPA-level illegal/suspicious/deceptive practices could lead to financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** ATPA.C9
+- **Requirement:** Acquirers must regularly check the credit risk of TPAs and adjust their exposure-mitigation strategy when needed.
+- **Source:** ATPA.C9.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** On Visa request, within 5 business days, Acquirer provides the following for any Merchant, PayFac, Marketplace, DWO, or other entity for which the Acquirer is responsible:
+    - [ ] **(1.a)** Comprehensive overview of the underwriting process for the given entity
+    - [ ] **(1.b)** Complete breakdown of current Visa exposure and any collateral held against Visa-related positions with Merchants and other entities
+    - [ ] **(1.c)** Detailed breakdown of the risk-monitoring policy, at minimum including:
+      - [ ] **(1.c.i)** Minimum financial requirements for the given entity
+      - [ ] **(1.c.ii)** How an entity's financial position is determined
+      - [ ] **(1.c.iii)** How the Acquirer protects itself against potential failure of the given entity
+      - [ ] **(1.c.iv)** Policy for managing credit risk on the acquiring portfolio and determining collateral taken
+      - [ ] **(1.c.v)** Exact collateral volumes maintained for potential dispute exposure for future-service Merchants
+      - [ ] **(1.c.vi)** Process for terminating a relationship with the given entity
+  - [ ] **(2)** Acquirer has a documented process for withholding funds from an entity where the Acquirer has reason to believe the entity is unable to meet its Visa obligations, provide future service, or is facing insolvency
+- **Evidence:**
+  - Risk-monitoring policy document
+  - Sample exposure-and-collateral report
+  - Withholding-process procedure
+
+### ATPA.C10.1: Reporting Changes in TPA Data
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate TPA performance reviews could lead to financial losses and operational damage.
+- **Parent Control:** ATPA.C10
+- **Requirement:** Acquirers must periodically review TPA data and ensure the accuracy of information entered in Visa systems.
+- **Source:** ATPA.C10.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer notifies Visa via Program Request Management (or appropriate form) of TPA principal/business-relationship changes (ownership, termination) within 5 business days of the change/knowledge; correction requests forwarded to Visa
+- **Evidence:**
+  - Program Request Management submission log
+  - TPA change-management procedure
+
+### ATPA.C11.1: Data Collection and Retention
+
+- **Risk Domain:** 4.2.2 Operational Risk
+- **Risk Sub-Domain:** Data Integrity/Quality
+- **Risk Statement:** Insufficient recordkeeping and retention policies/procedures could impact the ability to manage TPA information and portfolios, which may result in operational damage and legal issues.
+- **Parent Control:** ATPA.C11
+- **Requirement:** Acquirers must have a clearly defined record-keeping and retention policy in line with applicable jurisdiction, pertaining to TPAs as part of their risk management.
+- **Source:** ATPA.C11.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** TPA maintains complete, well-documented Merchant records (incl. investigation-related info) for ≥2 years after Merchant Agreement termination
+  - [ ] **(2)** Acquirer notifies Visa when receiving notice of a TPA forensic investigation
+  - [ ] **(3)** Data and records collected per Visa Rules and retained per local jurisdictional laws/regulations and Dispute resolution standards
+- **Evidence:**
+  - TPA record-retention policy
+  - Forensic-investigation notification procedure
+  - Sample retention-period evidence per record class
+
+## AHIR: Acquirers Processing for High Integrity Risk Transaction Merchants
+
+### AHIR.C1.1: Compliance with the VIRP
+
+- **Risk Domain:** 4.3.3 Legal & Regulatory Risk
+- **Risk Sub-Domain:** Integrity Risk
+- **Risk Statement:** Inadequate controls while processing High Integrity Risk transactions could lead to financial losses, reputational damage, and regulatory noncompliance.
+- **Parent Control:** AHIR.C1
+- **Requirement:** Acquirers and their designated TPAs must maintain proper controls and oversight processes to deter illegal transactions from entering the Visa Payment System, per the VIRP.
+- **Source:** AHIR.C1.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer ensures its TPAs and Merchants operate legally and in compliance with all Visa Rules, including:
+    - [ ] **(1.a)** Comply with all applicable laws, regulations, and other legal requirements
+    - [ ] **(1.b)** Maintain sufficient oversight to ensure each TPA involved in solicitation, onboarding, and servicing of Merchants and Sponsored Merchants (e.g. ISOs, PayFacs, DWOs) complies with all applicable laws, regulations, and legal requirements in each country in which the TPA operates
+    - [ ] **(1.c)** Use and maintain appropriate controls and processes to ensure Merchants and Sponsored Merchants only submit transactions that are legal in both the buyer's and seller's jurisdictions
+    - [ ] **(1.d)** Per the VIRP, establish and implement enhanced due-diligence processes for all High Integrity Risk Merchants for as long as they are able to accept Visa payments
+  - [ ] **(2)** To apply for High Integrity Risk Acquirer Registration, the Acquirer:
+    - [ ] **(2.a)** Completes and submits the High Integrity Risk Acquiring Registration Application and the required documents associated with the chosen registration tier(s)
+    - [ ] **(2.b)** Provides written attestation that no Merchant transactions falling within VIRP categories have been or will be entered into the Visa Payment System until the registration is approved
+    - [ ] **(2.c)** Submits the designated one-time, non-refundable application fee
+    - [ ] **(2.d)** Complies with the Visa Rules, requirements, and policies
+    - [ ] **(2.e)** Is in good standing in all Visa Risk Management Programs
+  - [ ] **(3)** Tier-appropriate controls applied based on the risk tier of the business types the Acquirer is registered for:
+    - [ ] **(3.a)** **Tier 1:** Undergo initial control assessment for the specific HIR Tier 1 category being acquired; subject to periodic reassessment (up to annually at Visa's discretion); complete annual control self-assessment for each approved HIR Tier 1 category
+    - [ ] **(3.b)** **Tier 2:** Undergo initial control assessment for HIR Tier 2 business types; subject to periodic reassessment (up to annually at Visa's discretion); complete annual control self-assessment for HIR Tier 2 acquiring
+    - [ ] **(3.c)** **Tier 3:** Register to process HIR Tier 3 business types with Visa; on Visa request, complete a control self-assessment for HIR Tier 3 acquiring and submit to Visa
+- **Evidence:**
+  - High Integrity Risk Acquirer Registration package
+  - Tier-specific control assessment / self-assessment reports
+  - VIRP enhanced-due-diligence case files
+
+## AATM: ATM Acquirers
+
+### AATM.C1.1: Alignment of Acquirer Risk Policies with ATM Network Risk Profile
+
+- **Risk Domain:** 4.4.1 Business Risk
+- **Risk Sub-Domain:** Risk Appetite and Policy Framework
+- **Risk Statement:** Misaligned acquiring and risk policies with the risk profile of ATM Operators could lead to a decline in performance, potential fraud, and reputational damage.
+- **Parent Control:** AATM.C1
+- **Requirement:** ATM Acquirers must have documented acquiring and risk policies, outlining the applicable controls per the risk profile of ATM Operators.
+- **Source:** AATM.C1.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Risk appetite/tolerance explicitly states ATM-Acquirer activity (including Acquirers processing through a VisaNet Processor with an existing endpoint)
+  - [ ] **(2)** Before acting as ATM Acquirer: applicable licensing/processing requirements met; certified for Custom Payment Services/ATM or as Full-Service Acquirer
+  - [ ] **(3)** Ongoing/periodic monitoring of ATM rates and metrics per Acquirer policies and Visa Rules
+  - [ ] **(4)** Fraud-reporting requirements/policies aligned to Visa Rules so Issuers, ATM Operators, Sponsoring Banks, and other stakeholders are informed
+  - [ ] **(R1)** (Recommended) Risk acceptance tailored to ATM network profile (limits, liability assignment, theft/fraud countermeasures)
+  - [ ] **(R2)** (Recommended) Market-concentration limits monitored across markets/geographies; inter- and intra-jurisdiction concentration risks mitigated
+  - [ ] **(R3)** (Recommended) Performance metrics evaluated per ATM network profile (cash-withdrawal limits, approval rates, decline reasons, fraud rates, suspicious activity); anomaly alerts acted on
+  - [ ] **(R4)** (Recommended) Robust anti-skimming strategies (specialized hardware/software, encryption, regular inspections, consumer education)
+  - [ ] **(R5)** (Recommended) ATM Operator PCI DSS / data-security compliance verified to mitigate jackpotting and similar
+- **Evidence:**
+  - ATM-Acquirer risk policy document
+  - Custom Payment Services / Full-Service certification evidence
+  - ATM monitoring metrics report
+  - Anti-skimming inspection records
+
+### AATM.C2.1: ATM Operator Agreement Content
+
+- **Risk Domain:** 4.4.2 Operational Risk
+- **Risk Sub-Domain:** Written Agreements
+- **Risk Statement:** A lack of contractual binding agreements with ATM Operators could lead to noncompliance and an inappropriate liability assignment, which may result in financial losses, lack of recourse, operational damage, regulatory noncompliance, and legal issues.
+- **Parent Control:** AATM.C2
+- **Requirement:** ATM Acquirers must have a contractually binding ATM Operator agreement with each ATM Operator and only process Visa ATM Network Transactions from ATM Operators with valid agreements.
+- **Source:** AATM.C2.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Acquirer has a written agreement with each ATM Operator. The agreement:
+    - [ ] **(1.a)** Includes the ATM Acquirer's name, location, and contact information, and language stating that the ATM Operator may be terminated for failure to comply with the ATM Operator agreement
+    - [ ] **(1.b)** Must not contain contractual details regarding pricing arrangements
+    - [ ] **(1.c)** States that the ATM Operators must comply with the Visa Rules
+- **Evidence:**
+  - Standard ATM Operator agreement template
+  - Sample executed ATM Operator agreements
+
+### AATM.C3.1: Underwriting Requirement for ATM Operators
+
+- **Risk Domain:** 4.4.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** Inadequate KYC and KYB verifications could lead to an increase in susceptibility to money laundering and illegal activities, which could lead to financial losses, regulatory noncompliance, and legal issues.
+- **Parent Control:** AATM.C3
+- **Requirement:** ATM Acquirers must conduct KYO (Know-Your-Operator) verifications for ATM Operators.
+- **Source:** AATM.C3.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** ATM Acquirers maintain documented policies and procedures to manage their TPAs
+  - [ ] **(2)** ATM Acquirers validate their TPAs' compliance with the ATM Acquirer Solicitation and Qualification Standards on a periodic basis
+  - [ ] **(3)** ATM Acquirers collect the following information from each ATM Operator and TPA:
+    - [ ] **(3.a)** DBA name
+    - [ ] **(3.b)** ATM Operator legal name
+    - [ ] **(3.c)** ATM Operator outlet location, including street address, city, state/province, and postal code
+    - [ ] **(3.d)** Full first and last name and middle initial of principals (e.g. of corporations, partnerships, sole proprietors)
+    - [ ] **(3.e)** Incorporation status (e.g. corporation, partnership, sole proprietor, non-profit)
+  - [ ] **(4)** ATM Acquirers ensure that a prospective ATM Operator has no significant derogatory background information about any of its principals
+  - [ ] **(R1)** (Recommended) Acquirers gather additional information for enhanced ATM Operator due diligence, including:
+    - [ ] **(R1.a)** Clear statement of the business model
+    - [ ] **(R1.b)** Outlining of corresponding fee and pricing model
+    - [ ] **(R1.c)** Current ATM network and future ATM network plans, with specific ATM addresses
+    - [ ] **(R1.d)** ATM Operators have appropriate reporting tools for transaction identification (e.g. source TID)
+    - [ ] **(R1.e)** Sponsor Bank relationships and strategies
+    - [ ] **(R1.f)** Annual attestations by Sponsor Banks of their portfolios of TIDs and Transactions
+    - [ ] **(R1.g)** Physical verifications of ATM locations and installation of security measures (e.g. security cameras, ATM-kiosk lighting, location-visibility safety guidelines)
+    - [ ] **(R1.h)** Onboarding KYB/KYC due diligence and validation of responsibility under PCI PIN Transaction Standards
+- **Evidence:**
+  - ATM TPA management policies
+  - ATM Operator onboarding KYO files
+  - Sponsor Bank attestation register
+  - Physical ATM-inspection reports
+
+### AATM.C4.1: Portfolio Monitoring for ATM Terminals
+
+- **Risk Domain:** 4.4.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Inadequate monitoring of ATM-level fraudulent, illegal, suspicious, and/or deceptive practices could lead to financial losses, regulatory noncompliance, and reputational damage.
+- **Parent Control:** AATM.C4
+- **Requirement:** ATM Acquirers must monitor transaction activity to detect threats and unusual or suspicious activity, and use exception reporting to act on deviations.
+- **Source:** AATM.C4.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** All valid cards accepted for elected transaction functions through the Visa Global ATM Network
+  - [ ] **(2)** Suspicious ATM transactions tracked and reported; collaborative monitoring with ATM Operators / banks / TPAs covers unusual deposit/withdrawal patterns at specific ATMs, repeated high-volume withdrawals from a single Issuer, and excessive charges for minor or multi-ATM withdrawals (with investigation/operator-action follow-up)
+  - [ ] **(3)** On incident: real-time / near-real-time ATM-terminal location relayed to law enforcement; ATM video recordings preserved and (where legal) shared with law enforcement
+- **Evidence:**
+  - ATM monitoring runbook
+  - Incident-response playbook including law-enforcement coordination
+  - Sample ATM incident case files
+
+### AATM.C5.1: Compliance with Jurisdictional Laws and Regulations
+
+- **Risk Domain:** 4.4.3 Legal & Regulatory Risk
+- **Risk Sub-Domain:** Regulatory Risk
+- **Risk Statement:** Acquirer's acquiring and risk policies that are not aligned to jurisdictional and regulatory requirements could lead to financial losses and regulatory noncompliance.
+- **Parent Control:** AATM.C5
+- **Requirement:** ATM Acquirers must ensure ATM Operators are compliant with jurisdictional laws and regulations.
+- **Source:** AATM.C5.1 (Visa VARS, October 2024)
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** Visa ATM and Plus Acceptance Marks displayed on all ATMs within 30 days of beginning to accept Visa Cards and Plus-enabled Cards
+- **Evidence:**
+  - ATM signage rollout schedule and audit photos
+  - Visa-mark display compliance log
+
+## AVDC: Money Movement Entities (Visa Direct)
+
+### AVDC.C1.1: Underwriting Requirements for Originators
+
+- **Risk Domain:** 4.5.2 Operational Risk
+- **Risk Sub-Domain:** Onboarding
+- **Risk Statement:** Money Movement Entities that have ineffective onboarding standards could onboard Originators involved in illegal activities, deceptive practices, and/or have elevated Dispute activity. This could lead to financial losses, reputational damage, and legal issues.
+- **Parent Control:** AVDC.C1
+- **Requirement:** Money Movement Entities should have additional onboarding standards for Originators.
+- **Source:** AVDC.C1.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Due-diligence covers the Visa-Direct-specific risk profile
+  - [ ] **(2)** Approved Program Information Form (PIF) obtained from Visa before BINs enabled for OCTs/AFTs
+  - [ ] **(3)** Originator URLs / mobile apps requested; expected volumes and controls (e.g. velocity limits) collected to establish legitimate business model
+  - [ ] **(4)** Service providers used by the Money Movement Entity for cardholder data registered as TPAs and PCI DSS compliant per Visa AISP
+- **Evidence:**
+  - PIF approval evidence per program
+  - Originator onboarding files including URL/app inventory
+  - TPA / PCI DSS register for service providers
+
+### AVDC.C2.1: Portfolio Monitoring for Fraud Risk
+
+- **Risk Domain:** 4.5.2 Operational Risk
+- **Risk Sub-Domain:** Monitoring
+- **Risk Statement:** Increased scam-based fraud in person-to-person use cases places undue liability on Money Movement Entities or other ecosystem stakeholders, which may result in financial losses and legal issues.
+- **Parent Control:** AVDC.C2
+- **Requirement:** Money Movement Entities should monitor for scams and their evolving nature when acquiring Visa Direct transactions to detect targeted scams or Originator-level scams.
+- **Source:** AVDC.C2.1 (Visa VARS, October 2024)
+- **Severity:** recommended
+- **Verification:**
+  - [ ] **(1)** Money Movement Entities deploy monitoring capabilities as outlined in AACQ Monitoring, including behavioural, biometric, digital, authentication, graph analytics, and rules-based decision-making strategies for scam detection, automated decisioning, and near-real-time action
+  - [ ] **(2)** Money Movement Entities monitor for:
+    - [ ] **(2.a)** **Account-opening fraud:** Review trends in personal-information accuracy, card/account details, and behavioural data
+    - [ ] **(2.b)** Scams that may take on several fraud types:
+      - [ ] **(2.b.i)** **Account Takeover (ATO):** Monitor for phishing trends and behaviours (e.g. one-time-passcode usage and behaviours, transaction amounts, transaction types, recipient account, age of recipient account, standing data, changes in cardholder profile); fraud may also present as vishing, smishing, viruses/malware, data breaches, brute force, and man-in-the-middle attacks
+      - [ ] **(2.b.ii)** **Authorized Push Payments (APP):** Monitor for social-engineering trends and behaviours (e.g. login/data-entry velocity, age of recipient account, unrelated recipient account); fraud may also present as romance scams, investment scams, purchase scams, invoice scams, and bank-staff impersonation
+      - [ ] **(2.b.iii)** **Unauthorized Card Usage:** Monitor for suspicious activity, trends, and behaviours (e.g. dark-web monitoring for exposed card details, recently-added wallet cards, IP addresses, geolocation, age of recipient accounts, compromised card credentials)
+  - [ ] **(3)** Monitoring capabilities include email/phone-number reputation analysis, KYC checks, sanctions and PEP checks, ID verification, behaviour analysis, and rule-based decisioning (including predictive models)
+  - [ ] **(4)** Money Movement Entities ensure fraud-reporting procedures are enhanced to capture and report OCT fraud to Visa for Issuer visibility on potentially fraudulent activity, helping prevent further fraud
+  - [ ] **(5)** To ensure the Visa Direct program operates in line with the approved PIF, Money Movement Entities perform continuous monitoring of the Originator's business model and relevant program; if the Originator's business model changes over time, Visa is contacted or the PIF is updated
+- **Evidence:**
+  - Visa Direct fraud-monitoring rule sets and ML model documentation
+  - Scam-typology dashboards
+  - PIF reconciliation log