# September 2026 Pre-Release Notes source: https://developer.mastercard.com/mdes-pre-digitization/documentation/pre-release-notes/prereleasenote_sept_pendingbinding/index.md MDES is enhancing the Pre-Digitization API to notify issuers about the new Account Binding and Token Binding status through the Notify Token Updated (NTU) API. ### Impacted APIs: {#impacted-apis} * Notify Token Updated (NTU) ## Release Dates {#release-dates} * MTF - 7 September 2026 * Production - 25 September 2026 ### Impacted Market {#impacted-market} * Availability: Global ## Change 1 {#change-1} Following changes are applicable to the Notify Token Updated (NTU) API: * Introducing new status `PENDING_ACTIVATION` for `ACCOUNT_BINDING` and `TOKEN_BINDING` reason codes to indicate the binding has been created but it is not activated it will be activated after the cardholder authentication. * Introducing new parameters for `ACCOUNT_BINDING` and `TOKEN_BINDING` reason codes that provide more context on binding. | Field and Description | Data Type | Min Length | Max Length | Presence | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|------------|------------|---------------------------------------------------------------------------| | **bindingStatus** Status of Token Binding or Account Binding. Possible values are * ACTIVE - Token or Account is bound with bindId * DEACTIVATED - Token or Account is NOT bound with bindId * **PENDING_ACTIVATION** - Token or Account binding with bindId is not activated yet, waiting for the cardholder authentication to be performed and binding to be activated. | String | 1 | 32 | Conditional -- Present when reasonCode = ACCOUNT_BINDING OR TOKEN_BINDING | | **authenticationMetadata** The authentication related metadata. | AuthenticationMetadata | NA | NA | Conditional -- Present when reasonCode = ACCOUNT_BINDING OR TOKEN_BINDING | | **bindingConsentAcceptedDateTime** The DateTime when the binding consent was accepted. Expressed in 8601 extended format as one of the following: YYYY-MM-DDThh:mm:ss\[.sss\]Z YYYY-MM-DDThh:mm:ss\[.sss\]±hh:mm Where \[.sss\] is optional and can be 1 to 3 digits. | String | 20 | 30 | Conditional -- Present when reasonCode = ACCOUNT_BINDING OR TOKEN_BINDING | | **boundedDeviceInfo** The information of the device which is bound with the token or account. | BoundedDeviceInfo | NA | NA | Conditional -- Present when reasonCode = ACCOUNT_BINDING OR TOKEN_BINDING | ### AuthenticationMetadata {#authenticationmetadata} | Field and Description | Data Type | Min Length | Max Length | Presence | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|------------|------------|----------| | **authenticationRequestId** The authentication requestId. | String | 1 | 64 | Optional | | **authenticationMethod** The authentication method performed for the binding. Possible values are: **CARDHOLDER_TO_USE_MOBILE_APP** - Authentication performed through mobile app **TEXT_TO_CARDHOLDER_NUMBER** - Authentication performed through SMS OTP **EMAIL_TO_CARDHOLDER_ADDRESS** - Authentication performed through email OTP **CARDHOLDER_TO_VISIT_WEBSITE** - Account holder to visit a website.Value will be the website URL. **PUSH_NOTIFICATION_TO_MOBILE_APP** - Push Notification to mobile app instance of cardholder to receive authentication code **EMV_3DS** - 3DS will be used to authenticate the cardholder.Value will be replaced by issuer ACS URL. **RISK_BASED_AUTHENTICATION** - Issuer risk-based authentication, facilitated through Mastercard Digital Enablement Service **CARDHOLDER_TO_USE_AUTHORIZED_DEVICE_CREDENTIAL** - The cardholder has been authenticated through an authorized wallet, and the wallet-presented token credential has been validated by Mastercard **ISSUER_PROPRIETARY_AUTHENTICATION** - Cardholder is authenticated by the issuer with issuer preferred method and issuer has shared authenticated proof through Issuer Authentication Assurance Value (IAAV) | String | 1 | 64 | Optional | ### BoundedDeviceInfo {#boundeddeviceinfo} | Field and Description | Data Type | Min Length | Max Length | Presence | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|------------|------------|----------| | **deviceName** The name of the device. | String | 1 | 32 | Optional | | **deviceOS** The name of the device operating system. | String | 1 | 32 | Optional | | **browserName** The name of the browser. | String | 1 | 32 | Optional | | **deviceType** The type of the device. | String | 1 | 32 | Optional | | **deviceIpAddress** The IP address of the device through which the device reaches the internet. This may be a temporary or permanent IP address assigned 3DS will be used to authenticate the cardholder.Value will be replaced by issuer ACS URL. to a home router, or the IP address of a gateway through which the device connects to a network. \