Rules for authorisation reattempts

Rules for authorisation reattempts

New requirements and fees for unsuccessful reattempts after declined payment transactions with Visa and Mastercard

The card organisations Visa and Mastercard have reviewed their response code logic for declined transactions. Issuers today are quite extensively using a generic response code that does not provide any useful feedback to the merchants on why the payment transaction was declined. There is also no harmonised approach amongst issuers on which response codes to use, and this adds more confusion on how to react.

Now Visa and Mastercard introduced detailed reason codes and new categories. The aim is to reduce unsuccessful reattempts after a declined transaction and to decrease fraud rates. These response codes and categories will define a specific action that merchants need to follow. In addition, Visa and Mastercard charge fees for each forbidden reattempt to ensure that merchants comply with the new response code logic.

We compiled all relevant information about the new requirements, payment protocols and fees for you below. Please read it carefully.

What do you have to do as a Payment Service Provider?

Worldline has implemented the new necessary fields and response codes in the different payment protocols used by partners and Payment Service Providers. This will help you and your customers to understand the actions expected from Visa and Mastercard and to apply them when needed.

We kindly ask you to...

  • analyse the changes and their impact in the relevant payment protocol specifications. Please see below for BXAP, GICC, KAAI, e.Link and ep2. Please contact your Worldline representative for the latest version of the specification, if needed.
  • revert with an implementation and testing plan before 30 November 2022. Please contact your Worldline representative or your partner manager ( to arrange a testing appointment.

Details on the new scheme mandate

Visa and Mastercard defined different approaches to provide a clear guidance to merchants on what is expected to do after a declined authorisation.

The actions can be summarised as follows:

  • The merchant is able to retry
  • Transaction account data needs to be updated before retrying
  • Do not retry  (the issuer will never approve)


What is expected from issuers
Issuers are asked to use the generic 05 code (Do not honor) only up to a maximum of 5% of their transaction volume; fines are expected otherwise.

What is expected from merchants
Merchants are required to follow the action indicated by the given decline reason and either do not retry or limit the retries to the maximum allowed. If the advice is ignored or not followed, new costs on authorisation reattempts will be charged.

Mastercard: What’s new?

Mastercard introduced an additional information field that, in combination with the response code, provides guidance on how to react accordingly. This field is called Merchant Advice Code (MAC).

Response Code + MAC = Recommended Action

The MAC codes that indicate to retry the authorisation or not are:

  • 01 Updated/additional information needed
  • 02 Try again later
  • 03 Do not try again
  • 21 Payment cancellation

Visa: What’s new?

Visa grouped the existing response codes into 4 different categories. Each category defines a specific action that the merchants need to follow.

Scheme Fee Overview

   Domestic / EEA / UK  All other x-border
 Mastercard  EUR 0.50  EUR 0.50
 Visa  USD 0.10  USD 0.15

Worldline implementations (payment protocols)

Here you find an overview of all relevant reason code changes and their implications on the payment protocols. Please find our recommendation below for each protocol as a best practice guidance.

Make sure you have the latest version of the payment protocol specifications. If not, please contact your Worldline representative to send you the latest version.

BXAP protocol (version 2.2.13)

GICC protocol (version 5.9) / KAAI protocol (version 3.8) / e.Link protocol (version 3.3)

*When retry is allowed, it is recommended to limit the maximum attempts to 10 on both schemes.

ep2 protocol (version 8.0.0)

*When retry is allowed, it is recommended to limit the maximum attempts to 10 on both schemes.

Contact us

Do you have further questions regarding the requirements, fees, payment protocols or specifications? Then please contact your Worldline representative or your partner manager by e-mail: