By 23 January 2027, the Visa mandate requires issuers across most European markets to display enhanced merchant data in their digital banking channels: the merchant's doing-business-as (DBA) name, street address for card-present transactions, primary phone number, and website. A separate Visa requirement, subscription management and cardholder controls, has already been in force since 18 April 2026 across 13 markets. This guide covers what each requirement obliges issuers to do, which countries are in scope, how it lines up against Mastercard's AN4569, and where the practical work actually needs to be done.
The short version: the constraint is data quality. Meeting the deadline means attaching a clean, recognisable merchant identity to every transaction so cardholders know what they are looking at the moment they open the app. Tapix supplies that identity layer at production scale across both Visa and Mastercard.
What the Visa mandate requires issuers to do by 2027
Visa's European issuer requirements come in several waves with different deadlines and different country scopes. Treat them as two projects that share one data foundation.
Enhanced merchant data - by 23 January 2027: Issuers must show enhanced merchant data in digital channels: the merchant name, the street address for card-present transactions, and the merchant's primary phone and website where applicable. This applies to both card-present and card-not-present transactions, and it must be easy to find inside mobile or web banking.
Excluded countries: Andorra, Austria, Bear Island, Channel Islands, Cyprus, Estonia, Faroe Islands, Gibraltar, Greenland, Iceland, Isle of Man, Israel, Latvia, Liechtenstein, Lithuania, Malta, Monaco, San Marino, Türkiye and Vatican City.
Subscription management - since 18 April 2026: Issuers must identify recurring, instalment, and unscheduled credential-on-file transactions, let customers place and remove stop instructions against specific merchants, and return the correct decline responses when a stop causes a refusal. Issuers must also tell users when contractual cancellation with the merchant is still required.
Included countries: Belgium, Croatia, Czech Republic, France, Hungary, Italy, Luxembourg, Poland, Republic of Ireland, Romania, Slovakia, Slovenia and the United Kingdom.
Cardholder controls - since 18 April 2026: Customers need to freeze and unfreeze cards and temporarily block, unblock, or limit card-present and ATM cash transactions from the app or web interface. These must be presented as user-driven controls, not issuer declines.
For the subscription requirement at implementation depth, such as transaction-type classification, stop-instruction logic, and the cardholder disclosure, see the Visa subscription management implementation guide.
Visa enhanced merchant data: the required data points at a glance
A merchant name: The trading-as/DBA name that the cardholder recognises as the public-facing brand, rendered in digital banking for both card-present and card-not-present transactions. This is not an acquirer descriptor, gateway string, or legal entity suffix. Visa requires it to support post-purchase clarity and dispute reduction.
Merchant street address: The physical street address of the merchant location, required for card-present transactions and presented in digital channels so the cardholder can verify place-of-purchase. Not required for card-not-present.
Primary phone number: The merchant’s primary phone number, where applicable, surfaced in digital banking so cardholders can contact the merchant directly. Visa lists this as a required enhanced data element “as applicable” alongside name, address (CP only), and website.
Merchant website: The merchant website, where applicable, exposed in digital channels to help the cardholder confirm the merchant and self-serve tasks like cancellations or returns. Required as part of the enhanced-merchant-data package for both CP and CNP transactions.
Notice what is not on the list: Visa does not mandate merchant logos. But logos are one of the highest-leverage recognition tools in a transaction list, which is why most issuers building for compliance add them anyway. Recognition is the real goal.
The Visa mandate makes merchant identity and contact data non-negotiable, but cardholder recognition still suffers when banks rely on MCC codes as the category layer. MCC is useful for networks, pricing, and risk, yet it often fails at purchase-intent categorisation and consistent customer-facing labels. Tapix closes this gap by combining compliance-ready enhanced merchant profiles with category normalisation that goes beyond MCC, so banks can show a clear merchant, stable category, and a reason for the charge in the same UI flow.
With Tapix-enriched transaction-level data, issuers can:
- Comply with Visa Enhanced Merchant Data while improving customer-facing category accuracy
- Reduce unrecognised charge confusion driven by generic MCC groups
- Improve dispute flows with clearer merchant + category context per transaction
- Build subscription and recurring-payment controls on top of stable merchant identity
Visa mandate vs Mastercard AN4569: how they compare
Visa is not the first network here. Mastercard's AN4569 has required enhanced merchant data since October 2023, so many issuers already hold part of the data layer the Visa mandate calls on. The two mandates share one goal: the cardholder should recognise every transaction in their banking app. But they differ in timing, country scope, and breadth.
AN4569 covers a broader European country list, including markets outside Visa's scope such as Austria, Estonia, Latvia, and Lithuania, and it explicitly includes the merchant logo. Visa adds two things AN4569 does not: subscription management and cardholder controls. For issuers already compliant with AN4569, the January 2027 Visa deadline builds on existing infrastructure instead of just starting a separate project. The open question for you is whether current coverage and accuracy meet Visa's data-point requirements.
For the full side-by-side breakdown of both mandates, including the data points, deadlines, country scope, and where they overlap, see Visa and Mastercard transaction data mandates.
How to go beyond the requirements?
Banks can go beyond the requirements by going deeper. The Visa mandate fixes minimum clarity, but the real gains come from richer context that prevents confusion before it becomes a ticket or a dispute. Specialised transaction enrichment companies like Tapix provide this context through additional data points. See how you can go beyond the requirements if you choose the specialised provider:
- GPS location
- Purchase category (grocery, footwear, restaurant, etc.)
- Payment gateway attribution
- Google Place ID
- CO2 footprint
More payment context means higher transparency, fewer “unrecognised” claims, fewer disputes, better UX and loyalty, and clear economic upside for issuers.
Visa’s enhanced-data, subscription, and control requirements raise the baseline. Meeting them is necessary; exceeding them with richer context is what actually makes a difference.
Where the work actually starts
Visa and Mastercard have moved clarity and control from optional to mandatory. Compliance now means accurate merchant identity and contacts, reliable subscription labelling with precise stops, and deterministic cardholder controls. The real constraint is data quality. Fix the data at the source, meet the deadlines, cut disputes, and convert post-purchase ambiguity into durable trust and operational efficiency.
For a bank, the cleanest way to read the combined picture is as one data layer serving two networks: recognisable merchant identity across Visa and Mastercard, from a single integration, with headroom to build subscription management, personal finance features, and card-linked offers on top. That is the practical scope of Visa and Mastercard mandate compliance.
For more details on how enrichment solutions can benefit your bank, explore the Tapix offerings.
