Posted: November 03, 2026
Mastercard has introduced a new method to verify stored-card payments and link them to the cardholder’s prior consent. This method is the Transaction Link Id (TLID). This will change how businesses store and process payments with a Mastercard credential. The Merchant Requirement takes effect on October 23, 2026.
According to Gr4vy and Merchant Cost Consulting, the compliance date for Mastercard’s Data Integrity Monitoring is December 1, 2026. Assessments begin on January 31, 2027.
Mastercard creates and returns the TLID as part of the response for authorization. In Stripe’s documentation, the TLID is described as 22 characters, case-sensitive, consisting of letters, digits, underscores, and hyphens. Gr4vy states the Trace ID (the older identifier) is created by the acquirer.
The TLID serves two major functions. The first is to link authorizations, captures, refunds, reversals, and chargebacks together in a sequence, through their shared TLID. Each item in this sequence is processed independently by the corresponding acquirer. The second, and most critical to a merchant and their billing system, is economic linking. The TLID associated with the first CIT (Cardholder-Initiated-Transaction) is saved, and any subsequent transactions, charged to the same Cardholder, are linked back to the first TLID.
The Trace ID and TLID serve their functions in conjunction. All three (Braintree, Adyen, and Stripe) mention the retirement of legacy references in conjunction with the TLID becoming the sole identifier of MITs (merchant-initiated transactions).
The economic-linking rule regulates MITs for Mastercard credentials stored on file. According to Solidgate, the rule encompasses CNP (card-not-present) MITs globally, and includes both scheduled and unscheduled charges for CNP transactions, across Maestro, Mastercard, and Debit Mastercard. As per Checkout.com, this rule is in effect everywhere that Mastercard is in operation.
Stripe
According to Stripe, it stores TLIDs and forwards them for MITs for cards saved by customers on Stripe. Stripe also says customers may have to provide TLIDs if Stripe does not have that information.
Adyen
As per Adyen, merchants utilizing Adyen Tokenization do not have to make any changes to their integrations. Adyen’s statement addresses merchants who perform MITs using their own token vaults or tokenization services.
Braintree
Braintree states Vault users need not take any action. For non-Vault users, the recommendation is to include the TLID from the actual CIT with every MIT. Braintree also notes that for one-time payments, no action is required of the merchant.
Checkout.com
Checkout.com also permits the inclusion of previous_payment_id with both the CIT and MIT. Similar to Braintree, for one-time payments, no action is required, according to Checkout.com.
PPRO’s developer documentation states that the December 1, 2026, compliance date is for PPRO and its acquiring partners to support the lifecycle TLID. According to Stripe, Adyen, Braintree, and Checkout.com, the requirement for merchants to send the TLID on MITs started on October 23, 2026. Solidgate has a different date for this requirement than Stripe, Adyen, Braintree, and Checkout.com. In practice, merchants and their acquiring partners should be sending the TLID with MITs by December 1, 2026.
This begins with the CIT that creates a stored credential or account status inquiry. As of June 2, according to Stripe and Xendit, Mastercard requires processors to retain the TLID for these transactions. The merchant or gateway stores the value with the card record.
Each subsequent MIT carries the TLID from the first CIT. As mentioned by Braintree, the TLID is taken from the first CIT or a zero-dollar authorization, not the TLID from the last renewal. As mentioned by Solidgate, each MIT carries the new TLID, with the first TLID taken as a reference.
Cards saved before June 2 this year will not have original TLIDs. Stripe will send the TLID of the earliest authorized MITs after that date. Adyen and Braintree will fall back to the same behavior. On the next renewal, the TLID will be read from that response and saved for future use. Checkout.com will point to the TLID from the most recent authorized MIT, which is less than 3 months old.
Braintree says a case-sensitive field of at least 22 characters, which is specific to a card, will meet the requirement.
A missing TLID does not result in an automatic block. Braintree states that Mastercard will not decline a transaction due to a missing or incorrect TLID. If a submitted TLID is incorrect, Mastercard will fill in the correct value and set a flag on the transaction. According to PPRO, in a direct communication with Mastercard, the TLID does not impact approval rates. Adyen states that issuers may decline a MIT without a TLID.
Per Gr4vy and Merchant Cost Consulting, fees are assessed as of January 2027 by Mastercard as part of the Data Integrity Monitoring Program. PPRO states that the compliance by date of December 1 of this year is for PPRO and its acquirers. Evaluate your processing agreements for how scheme assessments are charged.
Solidgate states that, for chargebacks due to merchant failures, if an authenticated CIT contains a TLID and that is linked to the MIT for the charge, then evidence for that chargeback is preserved. Otherwise, evidence is preserved for only one transaction.
Merchants will need to get these answers from the payment processors.
Per Merchant Cost Consulting, for the TLID to move with a payment, a billing system would need to identify the payment as a merchant-initiated payment.
According to Braintree, the TLID is information that does not impact a processor’s fees or the interchange. Most merchants using a processor’s own vault are covered. Others have work to do. The merchant-side rule is already in effect. The assessment deadlines of December 1, 2026, and January 31, 2027, provide a limited period to correct gaps.
Not usually, as long as the gateway also stores the card. For cards saved in their vaults, Stripe, Adyen, and Braintree will take care of the TLID.
Mastercard issues a 22-character unique code for each transaction. That code links all related transactions and charges back to the original authorization.
No. It applies to merchant-initiated charges on a stored credential, including unscheduled credential-on-file MITs. Braintree also states that merchants that only take one-time payments need not do anything.
