Monitoring

Not all PSPs provide payment services for what are known as ‘high brand risk’ merchants. These tend to be merchants in certain category codes that supply goods, content or services (such as adult content, weapons, tobacco, liquor or gambling). They are specialist providers who undertake enhanced risk management, monitoring and tracking. As such, the transaction or interchange fees charged tend to be higher.

These PSPs commission monitoring services relevant to the risks applicable to the merchant’s activities. These include fraud, chargeback and card misuse. The AVID monitoring service is used specifically for those merchants that are required to implement age checks on its customers or users for their websites.

On behalf of the whole payment card industry, online marketplaces and network providers, the AVID monitoring service maintains a connection with all of the recognised and certified age verification service providers around the world. This enables a regular check that a website is using one of these services and continuing to use it (so they don’t just switch it on and off for compliance checking).

At periodic intervals, the monitoring service will randomly check whether or not AV processes have been used. It will gather these and provide an annual certificate of conformity for the website back to the relevant PSP, online marketplace or network

No. The system does not verify individual transactions, nor whether or not any individual card holder has gone through an age verification process for any reason. The system does not use any personally identifiable information for carrying out its checks. It works by providing certification that AV is in use by a website and is continuing to be used.

If a merchant’s website ceases to carry out age verification checks, the merchant needs to inform their PSP, online marketplace or network provider immediately in accordance with the terms and conditions of their use of the services (and ideally in advance of switching off the checks). There will then be an assessment of whether or not that is appropriate for the risks presented by the merchant, the nature of the goods, content or services that are supplied and the applicable payment card association rules. If the PSP assesses that age verification checks are not required, it will remove the merchant’s websites from the AVID monitoring process.

Initially, the AVID Monitoring Service will notify the merchant that a monitoring check has failed and seek and explanation. There are many innocent and simple reasons why a check may need to be retaken. It may be that age verification is no longer appropriate for the goods, content or services that the merchant is providing. In which case, the merchant will be advised to contact their PSP to discuss that.

However, if the age verification monitoring checks are failed without explanation or reasonable excuse, the AVID Monitoring Service will notify the PSP that the merchant has apparently withdrawn their age verification checks. The PSP will then assess the impact of that on their risk assessment of the merchant. This can lead to the PSP withdrawing payment services from that merchant.

No. PCI-DSS deals with the global data security standards for the payment card industry. This deals with data protection, encryption, security protocols and interconnectivity. The AVID Monitoring Service has nothing to do with these requirements. Instead, it is responsible only for those merchants that supply age restricted goods, content or services or allow the upload of video content that requires age verification.

The AVID Monitoring Service is paid for by the PSP, online marketplace or network provider and is likely to be passed on to these specialist merchants in registration, licensing, transaction or interchange fees.

The Service is provided free-of-charge to ISO/IEC 27566-1 certified Age Verification Service Providers (they don’t have to be certified by ACCS). AVSPs must be certified or working towards certification to be eligible to participate in the AVID Monitoring Service.

The major card associations (like MasterCard, Visa, Discover, AMEX, etc) all have certain rules in place for merchants that provide age restricted goods, content or services, particularly for ‘high brand risk’ activities (such as adult content, weapons, tobacco, liquor or gambling). This is sometimes called their Integrity Risk Program or Merchant Monitoring Program.

In addition, the major online marketplaces (like Amazon, eBay. TikTok Shop, Google Shopping, etc.) place obligations on merchants to comply with age verification requirements in the jurisdictions that they operate in.

Monitoring is based on risk levels determined by the PSP, online marketplace or network provider. Most merchants will start with standard monitoring, but higher risk merchants could be initially or permanently placed in more enhanced or strict monitoring.

🔵 Level 1 — Standard Monitoring

This level typically involves a compliance check every 5 – 8 days (this is randomised and merchants will not know when they take place). We provide an annual certificate of conformity. This level is suited to the lowest risk, stable merchant with no recent failures and established long-term AVSP usage.

However, the system has automated escalation triggers → Level 2

• 3 failed compliance checks (after system rechecks) during a six month period

• Failure to respond to failed compliance checks

• PSP risk flag

De-escalation would occur after 12 months clean history

🔵 Level 2 — Enhanced Monitoring

This level typically involves a compliance check every 3 – 6 days. We provide a quarterly certificate of conformity. This level is suited to medium risk merchant category codes, where there are recent failures or recent non-conformity.

However, the system has automated escalation triggers → Level 3

• 3 failed compliance checks (after system rechecks) during a three month period

• Failure to respond to failed compliance checks

• PSP risk flag

De-escalation would occur after 12 months clean history

🔵 Level 3 — Intensive Monitoring

This level typically involves a compliance check every 1 – 4 days. We provide a monthly certificate of conformity. This level is suited to high risk merchant category codes, where there are substantial and persistent failures or patterns of switching AV on/off.

Escalation Outcome

For persistent non-conformity, the AVID Monitoring Service will notify the PSP, online marketplace or the network provider. This can result in suspension or withdrawal of service (that is a decision taken by them, not us).

Once the merchant is registered on the AVID Monitoring System by their PSP, online marketplace or network provider, the AVID Monitoring System will generate a Certification of Registration. This may be required for initial onboarding as a merchant (depending on the tier of the integrity risk category or the PSP set up processes). A copy is sent to the merchant.

The Certificate of Conformity is an electronic record that is provided monthly, quarterly or annually depending on the risk level.

The AVID Monitoring Service is provided by AVID Monitoring Services Corporation, a Delaware Registered C-Corp. They also provide the Certificates of Registration.

The Certificates of Conformity are provided independently and impartially in accordance with ISO/IEC 17065 and ISO/IEC 27566 by AVID Certification Services Limited, a UK-based accredited conformity assessment body.

Check out the AVID Monitoring – AVSP API Set Up Guide AVSPs will need to complete a AVID Monitoring – AVSP API Connection Agreement before they will be able to connect to the API engine. This can be completed through the automated onboarding questionnaire.