For issuers, card processors and banking apps in Germany and Switzerland
Visa mandate 2027:
comply, then use the data.
✓
Timeline, fields and scope of both mandates at a glance
✓
One data foundation for compliance, PFM and Next Best Action
✓
Hosted in Frankfurt, consent per purpose, SOC 2 Type I certified
Mandate check in two weeks. Last updated: October 20, 2026
One posting
Example
Raw data
SUMUP *BLUMEN K MANNHEIM 34.90
Customer does not recognise it
Enriched
Blumen Kaiser, Mannheim · Florist · Phone · Website · 2nd visit
Visa fields met ✓
○
Illustrative concept
Your rules
Personal Finance Management
Next Best Action
Top of Wallet
Transaction data
EUDI Wallet
Virtual advisor
Customer Data Platform
Hosted in Frankfurt
Consent first
23 Jan 2027
deadline for enhanced merchant data in digital channels (Visa, Europe)
48%
of consumers have disputed a charge that turned out to be legitimate
Timeline
Four deadlines, one data problem.
The schemes are prescribing, one after the other, what banking apps must show and do. Every deadline needs the same foundation: clean, understood transaction data.
Mastercard AN4569 in force
Issuers in Europe must display cleaned merchant data: trading name, address, contact details. The mandate has applied since October 2023 (Tapix, 2026).
Visa: subscription management and card controls
In 13 European markets, including France, Italy, Poland and the UK, Visa issuers must identify recurring payments, allow stop instructions per merchant and let customers freeze or limit cards in the app (Tapix, 2026). Germany, Austria and Switzerland are not on this list.
Visa: enhanced merchant data
For Visa consumer cards in most European markets, Germany and Switzerland included, Austria excluded: merchant trading name, street address for card-present payments, phone and website, easy to find in app and web (Tapix, Meniga, 2026).
EUDI Wallet: acceptance obligation
Banks must accept the EU's state digital identity wallet as proof of identity. Not part of the Visa mandate, but the same pattern: obligation first, benefit for those who prepared.
As of October 2026, based on the public summaries by Tapix and Meniga. The scheme bulletins from your Visa and Mastercard contacts are authoritative; this page is not legal or compliance advice.
What Visa requires
Four fields, two transaction types.
The minimum requirement is manageable. The difficulty is data quality: the trading name is not in any authorisation message, it has to be resolved.
Merchant trading name
The name the merchant trades under (doing-business-as), not the acquirer descriptor, no gateway prefix such as PAYPAL or SUMUP, no legal-form suffix. For card-present and online payments.
Street address
Card-present only: the store the customer was in, not head office. Not required for online payments.
Phone number
The merchant's primary number, where available. The customer should be able to reach the merchant before calling the bank.
Website
Where available, for card-present and online payments. Visa does not require a logo; almost all issuers show one anyway because it raises recognition most (Tapix, 2026).
Compliant. Then what?
Three reasons compliance alone is not worth a project.
Most banks will meet the mandate with an enrichment provider. That is the right call. It stays a display obligation, though, unless someone plans the second step.
01 · Data that is only displayed
Trading name and logo in the transaction list answer “what was that?”. They do not answer “what does it mean for me?”. Categories, series and signals only emerge in the next stage.
02 · Two projects, two data models
Compliance sits with the cards team, personalisation with marketing. If both buy separately, the same data exists twice, without a consent model and without a path back into the CRM.
03 · Subscription stop without advice
In some markets Visa requires that customers can stop subscriptions. A bank that learns nothing from it loses the moment: price increase detected, alternative offered, customer retained.
From obligation to value
One data layer, four stages, no duplicate work.
An enrichment provider or your own module delivers the mandatory fields. ACCELERAID takes exactly this data as input and builds on it: categories, signals, decisions, actions.
Stage 1 meets the mandate. Stages 2 to 4 turn it into engagement. All stages use the same dataset and the same consent model.
Stage 1: mandatory fields
Trading name, address, phone, website, logo. From your enrichment provider or from the ACCELERAID data-quality module.
Stage 2: categories and series
The bank's taxonomy, subscription and instalment detection, price changes, anomalies. Data quality is measured, not assumed.
Stage 3: signals with consent
Life events, merchant patterns, outflow indicators, each signal with purpose, legal basis and consent status.
Stage 4: action
Next Best Action in app, push, email and with the advisor. Path back into the CRM, log per decision.
What it produces
Four applications that pay for the mandate.
The same data Visa wants to see reduces inquiries and carries the use cases customers notice.
Fewer inquiries and disputes
When customers recognise the charge, they do not call. According to Mastercard (2026), 48% of consumers have already disputed a legitimate charge. Trading name, logo and context in the app are the first lever.
KPI: “what was that?” inquiries
Subscription management as a service
Detected series, price changes and cancellation help in the app, not just a stop button. Mandatory in the 13 Visa markets, a differentiator in Germany and Switzerland.
KPI: retention
Personal Finance Management
Spending insights, due-date forecasts and subscription tracker need stages 1 and 2.
KPI: app sessions per month
Next Best Action
Merchant patterns and life events deliver the moment for an offer, a service or advice.
KPI: conversion per contact
Division of roles
Enrichment providers and ACCELERAID: who delivers what.
Not either-or. Specialised providers resolve merchant data, ACCELERAID decides and acts. Together they cover mandate and value.
Core offering, global merchant graph
Via partner integration or own data-quality module
Yes, as a compliance package
Yes, as input for everything else
Standard categories
Bank's taxonomy, quality measured
Partly
Yes, as a series with a signal
Not in focus
Yes, with confidence and consent
Not in focus
Core of the Customer Data Platform
Not in focus
CLM engine, path back into the CRM
Not in focus
Yes, with Context Layer and PII filter
Depends on provider
Frankfurt, private cloud or on-premise
Simplified view of typical scope based on public product pages (October 2026). For a specific provider we review the split together.
Offer
Mandate check in two weeks.
We run a sample of your card transactions against the Visa and Mastercard fields and show where you stand and what the data makes possible beyond display.
✓
Coverage of the four mandatory fields per transaction type, with a gap list by merchant type and gateway
✓
Quality of categories, series and signals, measured with the data-quality module
✓
Roadmap “obligation + value”: enrichment partner or module, CDP integration, two use cases for 2027
✓
Consent and data-protection model for use beyond display
Timeframe
2 weeks
From data export to results report. Fixed price, creditable against a follow-on project.
Data protection
Merchant data is factual data. Everything after it is personal.
The mandatory fields describe the merchant. Categories, series and signals describe the customer. That is why ACCELERAID separates the two levels technically and legally.
01 · Merchant data without personal reference
Trading name, address and website are resolved at transaction level. No customer data is needed for that, and it stays that way.
02 · Signals only with a purpose
Every category, series or life-event statement carries purpose, legal basis and consent status. No promotional use without consent; service notices remain possible.
03 · Frankfurt and a log
Processing in Germany, private cloud or on-premise, GDPR data processing agreement. Every decision is traceable with its input data, including for access requests.
Data protection & security
Privacy is architecture. Built for regulated banking.
Data protection is architecture, not a feature. The platform connects to core banking, card processor, CRM and app and runs where your supervisor expects it to.
Privacy by design
✓
Consent per purpose
✓
Hosted in Frankfurt
✓
PII filter before the model
✓
No cross-tenant training
01
GDPR & DPA
A data processing agreement, purpose limitation and deletion concepts are part of every project, with a joint data protection impact assessment on request. Every use of customer data is tied to a documented purpose and a consent.
02
Hosted in Frankfurt
Private cloud in the ISO 27001 certified data center in Frankfurt, on-premise optional. Data stays in Germany.
03
PII filter before the model call
Personal data is detected and masked before a language model sees a request. No cross-tenant training: customer data only trains the bank's own models.
04
Tenant separation
Each bank runs in its own logically separated environment with its own keys, roles and logs.
05
SOC 2 Type I certified
ACCELERAID is SOC 2 Type I certified; the report is available under NDA. Audit-proof logging is standard.
06
Enterprise hosting
Enterprise hosting in the PCI DSS certified data center. The ISO 27001 and PCI DSS certifications apply to the data center.
Merchant data is resolved without reference to customers. Customer-related signals are only used with consent and within defined rules. Automated individual decisions within the meaning of Art. 22 GDPR are not intended; assessing individual processing activities is up to your data protection officer.
The agreed configuration, the contract and the related evidence, such as the SOC 2 Type I report, are authoritative.
FAQ
Frequently asked questions about the Visa mandate.
What issuers want to know before the deadline.
What exactly does the Visa mandate 2027 require?
When does it apply, and in which countries?
What is Mastercard AN4569 about?
Does the subscription-management requirement apply in Germany?
Do we need a specialised enrichment provider?
How does ACCELERAID differ from enrichment providers?
How is data protection handled?
How do we start, and how long until the deadline?
Read on
Where to go next.
From the blog
Data & Technology
Mastercard AN4569 and Visa's Enhanced Merchant Data: When the Bank Has to Explain Every Transaction
CLM & CVM
The Banking App as a Financial Hub: Personal Finance Management, CLM, Service and a Virtual Advisor from One Data Loop
CLM & CVM
Customer Lifecycle and Customer Value Management 3/5: Engage
Request the mandate check.
Two weeks, a sample of your card transactions, one report: where you stand on Visa and Mastercard and what the data makes possible beyond that.