White Paper Guidance Document for GSA (Dept. of Defense) Purchasing Card Sales (Update Oct

White paper guidance document for GSA (Dept. of Defense) Purchasing Card sales (update Oct. 2020) BSC Store operators

I. Standardization In order to provide more uniformity across all BSCs in the way purchases appear on Pcard Cardholder spend files:

A. DBA Name (Doing Business As) – each BSC store’s merchant account (i.e., credit card processing account) will always have two (2) name designations. The Legal Name of the business, and the DBA (Doing Business As) name. This would allow all 155 BSC stores to name their location “AbilityOne BSC – Location”

See attached example on Appendix 1 for how the DBA name for all BSCs can be standardized regardless of the legal name of the NIB Agency.

B. MCC Codes – each BSC merchant account is assigned an MCC (Merchant Category Code) when their account is set up with the service provider (credit card processor). Only one MCC code is allowed per account and it is generally not changed once it is established. The MCC code generally corresponds to the SIC industry category code of the business.

One of the two categories below should be used for consistency across all BSC stores: - 5111 – Wholesale stationery, office supply, writing and printing paper - 5943 – Stationery, office or school supply store

1 | Page Prepared by Wade Tetsuka, CPA (703) 717-3339 The reason that it is important for the BSC to utilize a business- activity-appropriate MCC code to its account is because the government purchasing card holder spending activity is monitored and controlled based upon where they use the Pcard for spending. A Pcard administrator for the government agency can prohibit a cardholder from making purchases with certain businesses that do not fall into appropriate MCC categories. Therefore using MCC codes that are different than the above may create problems for the Pcardholder Some processor service providers may advise the BSC to use an MCC code that corresponds to charities or not-for-profit organizations since NIB Agencies are so legally defined. However, there is no “cost” advantage for the BSC store to use a MCC code corresponding to charities because there is no lower charity interchange fee for Pcards (only for consumer credit cards). Using a charity MCC code would also potentially confuse the federal agency because the Pcard holders would generally not be authorized to make charitable contributions with their Pcards. The Pcard administrator is looking to see that Pcard holders are using the card for intended and government authorized purchases which in this case would be stationery and office supplies, not charitable contributions. See attached example on Appendix 1 for how the MCC category code is assigned to a BSC location.

II. Detailed Reporting – Level-3 information Level-3 data consists of Line item information from the invoice for purchases made by the Pcard holder. In simple terms, when the BSC store provides Level-3 data to the payment processor as part of the credit card authorization and settlement, it means that a replication of the itemized invoice is being sent to the Pcard holder’s bank (in the case of Department of Defense, the Pcard holder’s bank is U.S. Bank). When U.S. Bank receives this data, they are able to provide detailed line item reporting of purchased items back to the Pcard administrator of the

2 | Page Prepared by Wade Tetsuka, CPA (703) 717-3339 government agency. Line item detail is the best validation for the government agency that the Pcard holder is purchasing items that are appropriate and authorized.

See Appendix 2 for a detail of fields in Level-3 data. See Appendix 3 for an example of a Pcard transaction which was processed with Level-3 data.

III. Lower Cost for the BSC – Level-3 information The standard credit card swipe or chip reader (EMV) terminal at the store register is not equipped or certified to provide Level-3 data. Standard POS software is also not certified to provide Level-3 data.

In either case additional IT programming is involved in order to transfer line item invoice details from the POS system/software to the Payment processor.

Anecdotally, we believe about 60% of the BSC stores are set up to provide Level-3 line item details from their POS system to the payment processor. The other 40% of BSC’s are not providing Level-3 data.

Why does this matter from a cost perspective?

Those BSC’s who provide Level-3 data to the payment processor are paying about 0.8% less in fees to the merchant service provider.

So factually, the more [proper and complete] data which the BSC can provide to the payment processor, the lower the fees /cost that the BSC will pay.

See attached Appendix 4 for the interchange rate for Pcards (Level-3 vs. Level-1 data).

IV. Modernization and Security – EMV Terminals

3 | Page Prepared by Wade Tetsuka, CPA (703) 717-3339 For card present transactions that would be performed at the BSC store locations, the most secure and modern method of acceptance would be to utilize an EMV device. EMV stands for Eurocard, MasterCard, Visa, but is used as the acronym to designate when a credit card is processed using the chip reader instead of the traditional card swipe method where the magnetic stripe on the back of the card is “read”.

Appendix 5 explains the background why EMV devices are the most secure and therefore the best for cardholder protection as well as protection for the BSC.

While there is no mandate for any BSC location to utilize an EMV device vs. a card swipe device, the risk to the BSC location associated with breach of cardholder data is much higher. Since BSC stores are dealing with federal government Pcards, it is recommended that the most modern and secure technology and method is utilized to accept payment at the BSC location.

While there are many EMV devices on the market (priced in the range of $200 to $800+ per unit) these EMV devices are only able to transmit Level-1 or Level-2 data to the payment processor.

As of July 2019, there is only 1 source for procuring EMV devices which have the ability to provide Level-3 data to the payment processor.

As of July 2019, all BSCs that currently utilize an EMV device (approximately 15%-20% of the 155 BSCs in the U.S. utilize an EMV device) are providing only Level-1 and Level-2 data. There are no BSC locations with EMV devices that transmit Level-3 data to their payment processor.

See Appendix 5 for EMV equipment sourcing with Level-3 data capability.

4 | Page Prepared by Wade Tetsuka, CPA (703) 717-3339 Appendix 1

mxisoagent.com https://mxisoagent.com/mx/Merchants/ManageMerchant.aspx?Merchant...

Wade Tetsuka (Wade Tetsuka) [Last Login 7/12/2019 12:17PM] LIVE CHAT | WHAT'S NEW? | APP | HOME | LOG OUT SEARCH

AbilityOne BSC - Andrews - 87392907003xxxxx TSYS 5943 - STATIONERY,OFFICE,SCHOOL SUPPLY Close PCI SAQ C-VT - PASSED MCC Code - 5943 TIN Validation: 07 - VALID (05/22/2019)

General Underwriting Pricing Funding Boarding History Reports Attachments MX Merchant Compliance

Merchant DBA Name ... Corporation Same as Merchant Business Name (DBA)* AbilityOne BSC - Andrews Corporate/Legal Name* Blind Industries & Services of Maryland Address* 3066 E PERIMETER RD RM 101 Corporate Address* 3345 WASHINGTON BLVD City* JB ANDREWS City* BALTIMORE State* ZIP* 20762 State* ZIP* 21227 Location Phone* (301) 599-0316 Contact Name* Melissa Lindsay Location Fax Contact Phone* (410) 737-2670 Customer Service # (301) 599-0316 Business E-mail* [email protected] Federal Tax ID* **-***1664 Tax Type* Web Site Address www.bism.org Tax Filing Name* Blind Industries & Services of Maryland Date Business Started* 04/1908 (MM/YYYY) D & B Number Current Ownership* 108 Years 12960 Months Seasonal Merchant Corporation Type* State Filing* Products & Services Sold* Prior Security Breech Prior Bankruptcies? Return Policy* Date Discharged Multiple Locations # Locations More than two owners with 25% ownership? Add to existing MID Reference ID

Receipt Header Same as Merchant

Business Name (DBA) AbilityOne BSC - Andrew Delivery Addresses Address 3066 E PERIMETER RD Retrieval/Chargeback Requests City JB ANDREWS Monthly Merchant Statements State ZIP 20762

1st Owner 2nd Owner

Name* Ken Barnett Name Title* Vice President Title Ownership* 0 % Ownership 0 % Address* 3345 WASHINGTON BLVD Address City* BALTIMORE City State* ZIP* 21227 State ZIP Phone* (202) 809-9056 Phone SSN* ***-**-1664 SSN Date of Birth Date of Birth Cell Phone (302) 236-5710 Cell Phone Email [email protected] Email Prior Bankruptcies? Prior Bankruptcies? Date Discharged Date Discharged Control Prong Control Prong

Trade Reference

Business Name Contact Name Business Address Telephone City Account # State ZIP

Assignment

Portfolio: Sales Representative: Labels: Scott McHenry Scott McHenry [PLEASE SELECT]

1 of 2 7/16/2019, 1:55 PM Appendix 2

Appendix 3

425 Randolph BSC | The secure advantage. https://www.paytrace.com/view.pay?b=274703469

Help

View Invoice Print

Transaction ID Type Card Number

274703469 Sale 556862xxxxxx9392

Expiration Date Amount Approval Code

10/23 $80.81 042211

Approval Message Reference Number AVS Result

APPROVAL 013730 Zip Match Only

Method Email Customer Reference

API-Swiped 274703469

Invoice Tax Customer Name

274703469 Exempt YBARRA/DAVID N

Billing Address Billing Address 2 Billing City

Billing State Billing ZIP Customer ID

78150

Billing County Billing Country

United States

Remaining Balance Original Amount

Attention Shipping Address Shipping Address 2

Shipping City Shipping State Shipping ZIP

1 of 4 7/21/2019, 10:16 AM 425 Randolph BSC | The secure advantage. https://www.paytrace.com/view.pay?b=274703469

Transaction ID Type Card Number

78150

Shipping County Shipping Country Card-Level Results

United States Not Applicable

Description

Status Transaction Time IP Address

Settled 1091 7/19/2019 2:23:03 PM 70.251.201.66

Shipping Amount ACI Approval Source Code

$0.00 A

Response Code Transaction Identifier Validation Code

Approved and completed 0719MGFN7G40B

Transaction Date Transaction Time Card Subset

0719 192303 MasterCard business

Server CSC Result Phone Number

LocatiionXXAPI

National Tax

Merchant VAT Customer VAT Commodity Code

741339051 9392 7399

Discount Amount Freight Amount Duty Amount

0 00

Source ZIP VAT Tax Amount VAT Tax Rate

78210 0 0

Line Item Level-3 Description Commodity Code Product Code

Detailed data GLOVES,SMOOTH GRAIN COWHIDE MD 4400 EDWMWG688M starts here ...... Debit/Credit Indicator Net/Gross Indicator Quantity

2 of 4 7/21/2019, 10:16 AM 425 Randolph BSC | The secure advantage. https://www.paytrace.com/view.pay?b=274703469

Transaction ID Type Card Number

D N 1.0000

Measure Unit Cost Tax Amount

PR 26.83 0.00

Discount Total Item Amount

0 26.83

Description Commodity Code Product Code

SHEET,LAM,CR ADHEER,9X12 4400 CLI65001

Debit/Credit Indicator Net/Gross Indicator Quantity

D N 1.0000

Measure Unit Cost Tax Amount

BX 26.99 0.00

Discount Total Item Amount

0 26.99

Description Commodity Code Product Code

SHEET,LAM,CR ADHEER,9X12 4400 CLI65001

Debit/Credit Indicator Net/Gross Indicator Quantity

D N 1.0000

Measure Unit Cost Tax Amount

BX 26.99 0.00

Discount Total Item Amount

0 26.99

Questions, comments or feedback? Let us know what you think.

3 of 4 7/21/2019, 10:16 AM Appendix 4

Visa U.S.A. Corporate and Purchasing Interchange Fees Visa USA Interchange Reimbursement Fees

E Visa U.S.A. Corporate and Purchasing Interchange Fees

Rates Effective April 14, 2018

Fee Program Purchasing* & Corporate T&E

Commercial Level III BSC Level-3 Data 1.90% + $0.10

Commercial Level II - Fuel 2.05% + $0.10

Commercial Level II 2.50% + $0.10

Commercial Card Present BSC Level-1 Data 2.50% + $0.10

Commercial Travel Service 2.65% + $0.10

Commercial Card Not Present BSC Level-1 Data 2.70% + $0.10

Commercial Standard Interchange Reimbursement Fee 2.95% + $0.10

Commercial Product Large Ticket 1.45% + $35.00

Fee Program Purchasing Only

Government-to-Government (G2G) 1.65% + $0.10

GSA Large Ticket 1.20% + $39.00 * Includes Fleet cards

Straight Through Processing (STP) Fee Applicable Interchange Rate Program

Tier 1 – Less than $7,000 2.00% + $0.10

Tier 2 – $7,000 - $14,999.99 1.30% + $35.00

Tier 3 - $15,000 - $49,999.99 1.10% + $35.00

Tier 4 - $50,000 - $99,999.99 0.95% + $35.00

Tier 5 - $100,000 and greater 0.80% + $35.00

Why should we use an EMV device On the other hand, the data on chip cards is vs. a traditional card swipe device? constantly changing, making it extremely hard to isolate and extract. To rip it off, someone There are three (3) main reasons: would have to get into the physical chip circuit and manipulate things to get your bank 1) Liability Shift: If the purchase is a information. Not only is this level of data counterfeit transaction, the merchant (i.e., surgery really difficult, but it also requires a set You) generally holds liability, because the of high-tech equipment that can cost north of issuer has made the investment in chip $1 million. That's not the kind of cash your technology to make transactions more average fraudster has handy. 3 secure while the merchant did not invest in 2 upgrading to chip . This Liability Shift rule became effective October 1, 2015. Are there any other EMV devices 2) Customer Requirement: your customer that are certified with Level-3 expects that your retail operation is processing data which will work utilizing the latest technology for card with Counterpoint POS system? integrity and security. The card Chip reader capability makes it virtually impossible to No. intercept full credit card data from the card Counterpoint's own built-in credit card whereas magnetic stripe readers can be processing software (i.e., gateway) is not more easily hacked or data intercepted certified to do Level-3 data with an EMV device. during a transaction. See below. 3) Retail Site Security and Risk Mitigation: there is higher risk that a What is the difference between customer's card data can be stolen from ICT220 and IPP320? your retail site operation when utilizing Here are the two main differences between traditional card swipe devices vs. an EMV these two devices: terminal. Here is the reason why. ICT220 - Sold with Power Supply and built Magnetic-stripe cards are, well, magnetized. in printer When you swipe them, the payment processor reads their magnetic fields and IPP320 - PIN Pad. No printer. Device and matches them to your bank account cables (power supply, and ethernet input) information. The problem with this is that sold separately. the data is static, making it easier for fraudsters to lift your information and clone it onto a new card. In fact, there's What is the price of ICT220 and something called a skimmer - which they IPP320? can get or make for as little as $20 - that Includes the power supply, 3 ICT220 - $172.80 can do this pretty easily. and you would just need an ethernet cable. The printer can be disabled.

2 Source: Visa International Website: IPP320 - $280.80 In order for you to use this https://www.visa.com/chip/merchants/grow-your-business/payme device you have to purchase an IPP cable and nt-technologies/credit-card-chip/docs/VISA LIABILITY SHI FT Fl N AL.pdf the power supply separate. Total for all three components would be $280.80. 3 Source: Square Up: https://squareup.com/townsquare/why-are-chip-cards-more-secur e-than-magnetic-stripe-cards

WHAT YOU’VE BEEN WAITING FOR! THE SOLUTION THAT’S GOING TO SAVE YOU!

BSC’S ♥ EMV

ICT220 IPP320

The ONLY EMV terminal for BSC’s that will guarantee the lowest Level-3 rates when taking the government P-Card with the new microchips!!

Wade Tetsuka (703) 717-3339 Scott McHenry (512) 751-3121