Some time ago we had gotten involved in the merchant services business in order to drive down our own costs as far as possible.
As merchant services agents we received a disturbing email this morning related to Mastercard's new rules for e-cigarette and vapor merchants. We'll quote the full email further below, but here is a quick run down of why these rules suck for both vendors and consumers.
Adult signature delivery required
The FDA's vagueness about what is and is not acceptable age verification for online orders did not go unnoticed by the credit card associations. They are going above and beyond simple age verification services like Bluecheck and Veratad. Mastercard will now require adult signature on shipments as well.
The added cost
The age verification services already add large up front registration costs as well as per-transaction charges for vendors. Adult signature required delivery adds another $2.50 for UPS and $6.50 for USPS! What was once a $3.50 First Class shipment would now be $10+.
Vendors offering free shipping options will have to increase the minimum order size, pass along the cost to you, and/or face significant hardship in absorbing the increased cost.
Adult Signature delivery will cause a lot of inconvenience for customers since most people are not at home when the mail carrier delivers the mail. Customers would have to drive to the post office to pick up their vape mail, which would at least reduce lost and stolen shipments. Some customers might start shipping to their workplace where they are available to sign. However, that option will cause many of them to fail the automated age verification process because it is unlikely that your workplace address will appear in public record searches.
Legal age to vape? Nope must be 21 now
UPS and USPS have better things to do than tracking what age they should be checking for, they set it simply to 21+ for all adult ID required shipments. So if you are fully legal 18 year old vapor consumer in both your state and the federal level, you will be unable to sign for your vape mail.
Age verification was a hurdle for business. Signature required delivery is a bullet.
Compliance with all state regulations
Those of you unfortunate to live in states like Utah or Indiana know that larger vendors with targets on their backs will not ship there due to your states' laws. However, now even the smaller vendors skirting those laws will have to stop as well or risk losing their merchant accounts.
Significant registration costs
Mastercard is not only requiring a $500 registration fee, but also a third party "certification" that the vendor is meeting all requirements. Such a letter from an attorney is likely to cost another $500 to $1000 at a minimum. Larger vendors may be able to easily absorb this one time cost, but for smaller vendors that are already struggling this is yet another financial burden on top of all the regulatory burdens they are facing already.
When does this take effect?
Mastercard will require compliance by January 15, 2017. Our ISO is requiring registration applications to be complete by December 15, 2016 or they will lose their accounts on January 15, 2017.
See the email below:
Effective August 2016, MasterCard revised their Business Risk Assessment and Mitigation (BRAM) compliance program to include electronic nicotine delivery systems, such as e-cigarettes and vape pens. This revision was made in light of the recent extension of the US FDA’s authority to all tobacco products including electronic nicotine delivery systems a.k.a. ENDS (such as e-cigarettes and vape pens), liquids, nicotine gels, and more.
In order to avoid potential BRAM violations, a review of all existing and new e-cigarette and vape merchants must be conducted to ensure that the following requirements are met:
- Age Restrictions are implemented– merchants must perform physical age verifications in stores and electronic verifications online
- Merchant Category Code (MCC) must be 5993
- Merchants must meet all new FDA requirements for labeling, marketing, advertising, promotion, and manufacturing. More information on FDA requirements can be found here: www.fda.gov/TobaccoProducts
- Ensure merchants selling e-cigarettes and vape products meet all state and federal law requirements. Please note that state laws may vary. More information can be found here: http://publichealthlawcenter.org/resources/us-e-cigarette-regulations-50-state-review
- Additional requirement for Card-Not-Present (e-commerce and mail order/telephone order) e-cigarette and vape merchants:
- Registration will be required with MasterCard which costs $500/year per merchant, effective January 15, 2017
- Merchant must have a health warning label visible on the website on the harms of nicotine usage
- Adult signature required upon delivery
- Billing terms must be clearly disclosed on the merchant’s website
Each merchant will require the following in order to be eligible for registration:
- Legal Compliance Verification – This is a written opinion from an independent, reputable, and qualified attorney or accreditation by a recognized third party, i.e. FDA, TVECA, or state agencies. The Legal Compliance Verification must indicate that the merchant’s business practices have been reviewed and comply fully with all laws applicable to the merchant’s business type.
- Acceptance of an annual $500 registration fee required by MasterCard; an approved agreement will be available for merchant signature.
- Implementation of real-time batch procedures to monitor continually simultaneous multiple transactions using the same account number and consecutive or excessive attempts using the same account number.
- Merchant must maintain a total chargeback to interchange sales volume ratio below ECP thresholds.
Edited on 01/13/2017 to add:
There's been a lot of talk among vendors since we originally wrote this, and we've also dug deeper since then with no update to this original article.
- Mastercard is leaving enforcement to acquiring banks.
- It is unenforceable. Acquirers are not going to do sting operations on merchants.
- Mastercard is basically trying to avoid liability if a merchant were caught shipping to a minor
- Some agents like Best Rate are spreading lies that its not required, in order to grab more business. They are not even an acquiring bank, they are agents like us. Its required, its just not enforceable.
If you're one of the unfortunate vendors with a bank that responded to this update by dropping you altogether, contact us about getting processing again.