Compliance

MyCheckout hosted payment pages provide a secure, friction-free payment experience that keeps you compliant. Our hosted payment pages are fully PCI DSS-certified and support key mandates your business needs to process payments.

PCI DSS on MyCheckout hosted pages

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for organizations that handle cardholder data. Developed and maintained by the PCI Security Standards Council (founded by Visa, Mastercard, Amex, Discover, JCB).

MyCheckout hosted payment pages are designed to be PCI SAQ-A compliant, which means you don't handle any card data yourself, and your PCI scope is significantly reduced.

Other clauses of the EAA, which are about voice communication, video content, hardware requirements, and emergency services, are not applicable to the hosted payment pages. Read more about EU Accessibility Act and WCAG 2.2.

Accessibility scope for MyCheckout hosted pages

We have upgraded the MyCheckout hosted payment pages to conform to WCAG 2.2 Level AA and EAA. As a result, the pages are:

Fully compliant with WCAG 2.1 Level AA,
And therefore fully compliant with Clauses 9.1 to 9.4 and Clause 9.6 of the EU Accessibility Act

In addition, MyCheckout hosted payment pages meet the following clauses of EU Accessibility Act:

Clause 5 (Generic Requirements): General accessibility principles are integrated throughout the design and technical development.
Clause 12 (Documentation and Support Services): Support materials and documentation are made available and in accessible formats.

Other clauses of the EAA, which are about voice communication, video content, hardware requirements, and emergency services, are not applicable to the hosted payment pages.

Overview of changes for WCAG 2.2 compliance

We validated and enhanced the MyCheckout hosted payment pages according to WCAG 2.2 Success Criteria (Level A and AA). This means that your payment pages:

Can be used with screen readers: all icons, buttons, and input fields are announced correctly to assistive technologies.
Are fully keyboard accessible: consumers can navigate and interact with the entire payment page using only a keyboard.
Are responsive and mobile-friendly: the page layout adjusts to different screen sizes and orientations, making the experience accessible across devices.
Support zooming up to 400% without loss of content or functionality: consumers can enlarge the page without horizontal scrolling or hidden content.
Use clear labels and instructions: all input fields are properly labeled, avoiding placeholder-only designs, helping users complete payment forms accurately.
Provide accessible error handling: if users make mistakes, errors are announced and explained in a way that is understandable and accessible.
Follow strong compatibility standards: the pages are coded to ensure they can be accurately processed by assistive technologies and different browsers.

If you would like more technical details or need accessibility-related support, please contact your account manager.

Look & feel variant: tools to check accessibility compliance

If you use the MyCheckout Editor to change the look and feel of your checkout page (e.g. adjusting colors, fonts, or contrast to match your brand), we recommend validating your design choices using the WAVE Accessibility Evaluation Tool. This helps ensure that your color combinations and visual elements remain accessible, and that you continue to meet the requirements of the EU Accessibility Act. To start validating your design choices, download the WAVE browser extension.

Mastercard recurring payments mandate

Mastercard’s mandate for recurring payments mandates transparency, consent, and timely notifications for subscriptions and auto-renewals. It aims to guard cardholders against hidden charges and negative option billing, where a free trial auto-converts to a paid subscription without explicit cancellation. The mandate came into effect on September 22, 2022, with an added extension in March 21, 2023 for non-profits and certain organizations.

Key requirements:

Clear disclosures: Show subscription terms (price, billing frequency, trial details) on the checkout page before the purchase is completed.
Active consent: Cardholders must explicitly accept the terms (for example, via a checkbox) before their card can be stored and charged for recurring payments.
Digital receipts: Send an email or SMS confirmation right after the initial purchase, including the terms, amount, and straightforward cancellation instructions.
Pre-billing alerts: For subscriptions billed every six months or more, issue a reminder 3–7 days before the billing date, with cancellation instructions.
Simple cancellation: Provide an easy online cancellation option, accessible regardless of how the service was bought.

This requirement doesn't apply to high-risk negative option billing models if you offer a free or low-cost trial period for a physical good, such as dietary supplements and healthcare products. Please read section 5.4.1 of the Transaction Processing Rules of Mastercard.

How to comply with mandate using MyCheckout hosted pages?

If you offer subscriptions or recurring payments and use MyCheckout hosted payment pages, ensure you include the required data in your Create hosted checkout request. Your consumers will see their subscription details in the order overview.

For more information, see the Subscription details guide for MyCheckout hosted pages.

Unscheduled-credential-on-file (UCOF) Visa mandate

UCOF stands for Unscheduled Credential-on-File, a Visa mandate requiring merchants and PSPs to properly flag and link transactions when card credentials are stored for future use without a fixed schedule. It applies to merchant-initiated transactions (MIT) where the cardholder has consented to store their card for future charges. The flow works as follows:

Initial transaction: cardholder explicitly consents to store credentials; this transaction is flagged as the "original" credential-on-file transaction.
Transaction ID: Visa returns a unique transaction ID that must be stored.
Subsequent transactions: when the merchant initiates a follow-up charge, they must reference the original transaction ID and use correct MIT indicators to link the chain.

UCOF compliance with MyCheckout hosted pages

MyCheckout hosted pages support executing UCOF rules to help you stay compliant.

Mandate rule	MyCheckout hosted pages functionality
Obtain and capture cardholder consent for storing credentials.	"Remember my details" checkbox consent consumer ticks when choosing to store credentials. View Card payment flow features section for more details The consent is stored and can be retrieved by calling Get hosted checkout status to see the isCheckedRememberMe property in the response.
Store the transaction ID from the initial authorization response.	The cardPaymentMethodSpecificOutput of the Get hosted checkout status response contains the initialSchemeTransactionId that you should store to identify the original transaction and reference it in the future ones made by the same consumer.
Pass correct flags in subsequent transactions: MIT indicator (merchant-initiated). Credential-on-file indicator. Original transaction ID reference. Merchant customer ID reference.	When creating a hosted checkout: The unscheduledCardOnFileSequenceIndicator must be set to "subsequent". The unscheduledCardOnFileRequestor has to be set to "merchantInitiated". The initialSchemeTransactionId must be submitted. The merchantCustomerId must be submitted. More details on the required properties can be found on our API Reference for Create hosted checkout.

Co-badged cards compliance

Regulation (EU) 2015/751 Article 8 requires merchants in the European Economic Area to let co-badged cardholders choose their preferred card network and to process both the initial and any recurring payments using that selection. MyCheckout’s hosted payment pages for Connect deliver a user-friendly implementation that meets these requirements. Here is how MyCheckout works:

The moment a card number is entered, MyCheckout recognizes all available networks without any additional integration effort.
Each network’s logo and text label are displayed with identical size, clarity and prominence, ensuring customers immediately see all supported options.
When multiple networks are detected, selections appear beneath the card input. Customers select their preferred network with a single click, and MyCheckout processes the payment according to that choice.

This end-to-end solution keeps your integration fully compliant with EU regulations while providing a seamless checkout experience to your consumers.

Swedish Payment Services Act & Finnish Consumer Protection Act

If you process payments in Sweden or Finland with MyCheckout hosted pages and Payment product selection page, be aware of the relevant local regulations:

Swedish Payment Services Act - requires that the first payment product presented on the checkout page is not credit.
Finnish Consumer Protection Act - requires a specific order for displaying online payment products:
- Non-credit payment products
- Payment products that may include credit (e.g., combined debit/credit cards)
- Payment products that involve applying for or using credit

To meet these regulations, the Payment product ordering feature in Configuration Center includes tailored rules for Sweden and Finland.