a. The servicing bank provides Merchant Authorization Controls (MAC) in the form of Merchant Category Codes (MCC) and Merchant Category Code Groups (MCCG). MCCs and MCCGs categorize merchants by the goods and services they provide. They are used within the servicing bank’s card processing system to authorize or decline purchase transactions based on controls established for each GPC account. An MCC is a four-character numeric code with a corresponding description that reflects the merchant’s primary business. An MCCG is a logical grouping of MCCs.

b. Merchant Category Code (MCC). A code assigned by the merchant’s bank to categorize each merchant according to the type of business in which the merchant is engaged and the kinds of supplies or services provided. These codes are used as authorized transaction codes on a card/account to identify the types of businesses providing authorized supplies or services. DPC maintains the list of DoD-wide blocked MCC codes. The servicing bank uses MasterCard’s Merchant Category Codes (MCCs) to categorize merchants based on the types of goods or services they provide. When an A/OPC adds MCCs to a Cardholder or Managing Account profile, it enables that specific account to make purchases from vendors categorized under that MCC.

c. Tier 1 MCCs. The servicing bank has placed a hard block on merchants with Tier 1 (Very High Risk) MCCs. The bank will decline all attempted transactions from vendors with these MCCs. Tier 1 MCCs may be unblocked upon approval by the Level 2 A/OPC, on a case-by-case basis. All purchases from merchants associated with Tier 1 MCCs will generate a data mining case in IOD.

Table 14-2: Tier 1 Hard Block Merchant Category Codes

c. Tier 2 MCCs. Tier 2 MCCs are considered high risk, and their blocking can be customized within the servicing bank. Level 3 A/OPCs may authorize purchase from vendors with Tier 2 MCCs on a case-by-case basis. Purchases from merchants associated with these MCCs will not automatically generate a case in IOD. A complete list of Tier 1 and 2 MCCs are located at DoD Tier 1 and 2 MCC Codes.

d. MCC Blocking. MCC blocking is a designation attached to an account, which prevents a specified MCC group from being charged (e.g., casinos, pawn shops). The blocking is established by attaching a merchant authorization control to a cardholder and/or managing account. If authorized MCCs are attached and set to approve, then non-authorized MCCs are effectively blocked. If non-authorized MCCs are attached and set to decline, then those MCCs are blocked and all other MCCs are effectively authorized.

e. Requests to Override an MCC Block. When requesting to override an MCC block, the CH or BO must provide the following information to the A/OPC.

1) Merchant name and address

2) Item/service description

3) Exact dollar amount of the transaction

4) Estimated date of the purchase

5) CH name and last four digits of the card account number

6) Justification for the purchase

7) Description of efforts to locate a source other than the merchant with the blocked MCC

8) Blocked MCC, if known

The Level 4 A/OPC will forward the request to the appropriate higher-level A/OPC for approval. Upon approval, the Level 4 A/OPC will update the merchant authorization control in the CH account to allow the transaction to process. The CH asks the vendor to resubmit the charge. After the transaction has processed, the Level 4 A/OPC will reapply the merchant authorization control to the CH account.

f. Erroneous MCCs. When a GPC transaction is declined due to an erroneously identified code, the CH must contact the servicing bank to determine what code is necessary to complete the transaction with the declining merchant. The BO and CH should contact the A/OPC to discuss a change to the CH’s merchant authorization controls. Appropriate authorization is required when Tier 1 or Tier 2 MCC is the concern.