y registering merchants, an acquirer certifies that a) merchants have used the services of a data security firm of which MasterCard approves for on-site audit evaluations and security scanning, b) it has determined PCI compliance by review of the audit, self-assessment or network scan reports, and c) it will monitor compliance on an ongoing basis. If found noncompliant, the acquirer must notify MasterCard's Site Data Protection department in writing.

For level-1, -2, and -3 merchants who neither store data nor process it in any form (e.g., merchants who outsource to a Web-hosting company or redirect customers to a third-party service provider for payments), registration is still required; however, registration and annual fees are waived. MasterCard defines "data storage" as any entity that stores data temporarily or permanently or accepts payment information via a Web page.

The idea behind this rule is sound. MasterCard wants to know which entities store data and ensure that they are policed accordingly. Unfortunately, the rule requires that every registered merchant pay a $200 annual fee. This means that Internet merchants processing more than 20,000 transactions per year must pay MasterCard $200 annually.

The good news: MasterCard has announced a suspension of the 2006 $200 annual registration fee for merchants. We at Humboldt Merchant Services will take advantage of this opportunity and register appropriate merchants. We will also continue to work with MasterCard and request a termination of the merchant annual fee. I suggest that all acquirers do the same.

Ken Musante is President of Humboldt Merchant Services. E-mail him at kmusante@hbms.com .