MasterCard 2009 Annual Report Download - page 34

in legislation that would have an adverse impact on us and our customers. For example, the House of
Representatives has again passed comprehensive data security and data breach notification legislation that could
impose additional regulatory burdens on us and our customers. Similar legislation has not yet passed the Senate
in this Congress, and it is not clear whether legislation of this type will be signed into law. In addition, a large
number of U.S. states have enacted security breach legislation, requiring varying levels of consumer notification
in the event of a security breach. In Europe, the European Parliament and Council passed the European Directive
95/46/EC (the “Directive”) on the protection of individuals with regard to the processing of personal data and on
the free movement of such data, which obligates the controller of an individual’s personal data to take the
necessary technical and organizational measures to protect personal data. The Directive has been implemented
through local laws regulating data protection in European Union member states to which we and our customers
are subject. The Directive establishes general principles with regard to the processing of personal data, including
the legal grounds for processing, the rights of individuals with regard to their personal data, restrictions on
transfers of the personal data outside the European Economic Area, and the obligation of the controller of that
information to take the necessary technical and organizational measures to protect personal data.
Anti-Money Laundering. MasterCard and other participants in the payment industry are also subject to the
regulatory requirements of Section 352 of the USA PATRIOT Act, which applies to certain types of financial
institutions, including operators of credit card systems. Section 352 of the USA PATRIOT Act requires
MasterCard to maintain a comprehensive anti-money laundering program and imposes similar requirements on
some of our customers. Our anti-money laundering program must be reasonably designed to prevent our system
from being used to facilitate money laundering and the financing of terrorist activities. The program must, at a
minimum, include the designation of a compliance officer, provide for the training of appropriate personnel
regarding anti-money laundering responsibilities, as well as incorporate policies, procedures, and controls to
mitigate money laundering risks, and be independently audited.
OFAC and Related Regulations. We are also subject to regulations imposed by OFAC. OFAC regulations
impose restrictions on financial transactions with Cuba, Burma/Myanmar, Iran and Sudan and with persons and
entities included in OFAC’s list of Specially Designated Nationals and Blocked Persons (the “SDN List”). Also
Cuba, Iran, Sudan and Syria have been identified by the U.S. State Department as terrorist-sponsoring states.
While MasterCard has no business operations, subsidiaries or affiliated entities in these countries, a limited
number of financial institutions are licensed by MasterCard to issue cards or acquire merchant transactions in
certain of these countries. MasterCard takes measures to avoid transactions with persons and entities on the SDN
List, however, it is possible that transactions involving persons or entities on the SDN List may be processed
through our payment system. It is possible that our reputation may suffer due to our customer financial
institutions’ association with these countries or the existence of any such transactions, which in turn could have a
material adverse effect on the value of our stock. Further, certain U.S. states have enacted legislation regarding
investments by pension funds and other retirement systems in companies that have business activities or contacts
with countries that have been identified as terrorist-sponsoring states and similar legislation may be pending in
other states. As a result, pension funds and other retirement systems may be subject to reporting requirements
with respect to investments in companies such as ours or may be subject to limits or prohibitions with respect to
those investments that may materially and adversely affect our stock price.
Issuer Practice Legislation and Regulation. The Board of Governors of the United States Federal Reserve
System is in the process of implementing the Credit CARD Act, which was signed into law in May 2009. The
Credit CARD Act will have a significant impact on the disclosures made by our customers and on our customers’
account terms and business practices. The Credit CARD Act, and its implementing regulations, will make it more
difficult for credit card issuers to price credit cards for future credit risk and will have a significant effect on the
pricing, credit allocation, and business models of most major credit card issuers. The new law could reduce credit
availability, or increase the cost of credit to cardholders, possibly affecting MasterCard transaction volume and
revenues.
24