University of Manitoba Merchant FAQ

How do I become a University of Manitoba Merchant?

Revenue, Capital and General Accounting (RCGA) administers the payment card process.

Please contact Alicia Bressani in RCGA 474-9574 or [email protected] to apply for a merchant number. At that time, a form will be sent to you for more information, such as contact info and the method of processing payment data.

Which payment cards are accepted?

The University accepts VISA, Master Card and debit through TD Merchant Services.

Is there more than one option available for accepting credit cards?

Yes. Three processing options are defined. Each of these is described below, along with the associated costs, which are charged directly to the unit/merchant.

1. Interactive Voice Recognition (IVR):

Merchants using IVR process payment transactions using a touch tone telephone. This option is primarily for low volume, card not present (CNP) transactions where cardholder information is received by phone, fax, or internet. No special forms or equipment is required. Transactions are validated/authorized in real time.

Merchant Setup Time: 3-5 days

Merchant Costs:

Monthly Service Fee: $6.00 Per Transaction Fee: $0.15 Visa Discount Rate: 1.76% Master Card Discount Rate: 1.80% Annual Imprinter Rental Fee: $12.00

2. Point of Sale (POS) Terminal:

Merchants use a standalone POS terminal connected to a dedicated phone line to swipe credit and payments if the cardholder is present. If the cardholder is not present (CNP), the merchant keys the transaction manually into the terminal. The POS terminal is generally used for in- person transactions where a higher volume warrants a more efficient and more secure means of processing. Transactions are validated/authorized in real time.

Updated July 2013 Page 1 University of Manitoba Merchant FAQ

Merchant Setup Time: 3-5 days

Merchant Costs:

Terminal Rental: $39 per month Monthly Service Fee: n/a Interac Processing Fee: $0.05 per transaction Visa Discount Rate: 1.76% Master Card Discount Rate: 1.78%

Other Charges

Chargeback Fee: $10 per item Settlement Fees: $.05 per settlement

3. Web or E-Commerce Merchant:

A web merchant will have a web site for its customers to “shop” for goods or services. Web merchants process Card not Present (CNP) transactions, usually in high volume, and require convenient and secure processing.

A web application may accept credit card payment data in one of two ways: 1) The application directs the user to a third party on-line payment services provider. The University contracts with Beanstream, a third party on-line payment services provider. No other third party service providers (such as PayPal) will be accepted. 2) The web application collects credit card information for manual keying to a POS terminal. This type of processing would fall under ‘POS’.

The merchant’s web site will host a web application developed in accordance with guidelines set by the University’s IST department. Click here to view the guidelines.

http://umanitoba.ca/computing/ist/internal/admin_sys/director/guidelines/index.html

These guidelines are critical to ensure compliance with the University’s Merchant Services Agreements with Master Card and VISA and to meet standards set by the Data Security Standards (PCI DSS).

All web sites accepting payment card information must be audited and approved by TD Bank before a merchant number can be issued and the web site can go “live”.

Merchant Setup Time: 1-2 weeks

Updated July 2013 Page 2 University of Manitoba Merchant FAQ

Merchant Costs:

Monthly Terminal Rental n/a Monthly Service Fee $15 + taxes Visa Discount Rate: 1.76% Master Card Discount Rate: 1.78% Beanstream transaction fee: $0.15 per transaction Fee: $10 per item

What is PCI DSS compliance and how can I find additional information?

All U of M merchants must be PCI DSS compliant by July 1, 2010. After that, compliance will be assessed annually. PCI DSS is an acronym for Payment Card Industry Data Security Standards. This is a global initiative intent on securing credit and banking transactions by merchants & service providers through an evolving set of mandatory requirements & guidelines covering security, policies, procedures, network/software design and other critical protective measures.

For more PCI DSS information, click the following : https://www.pcisecuritystandards.org/pdfs/pci_ssc_quick_guide.pdf

Does the University have a Policy in place to govern payments received by credit and debit card?

Yes. The Cash Control Policy and Procedures documents include references to the acceptance of credit cards in terms of receipting and depositing payments, and storage of payment information. In addition, a policy on information security that will address protection of electronic cardholder data is being developed by IST.

To view the Cash Control Policy and Procedures, click here: http://www.umanitoba.ca/admin/governance/governing_documents/financial/389.htm

Whar are the Storage Guidelines for credit and debit card data?

New merchants will be provided with a “Recommended Best Practices” document for payment card processing. This document includes recommended data storage guidelines intended to achieve compliance with PCI DSS.

In addition, PCI DSS requirements for electronic data storage, including technical requirements can be found at:

Updated July 2013 Page 3 University of Manitoba Merchant FAQ

https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf

Merchants will be asked on an annual basis to complete a Self Assessment Questionnaire (SAQ) and sign an Attestation of Compliance form that confirms that no credit or debit card information is being stored, other than in accordance with the PCI DSS requirements for storage of credit card data.

C an I j us t us e another m erc hant’ s number t o proc es s m y s al es? No. This is not advisable as each merchant is individually responsible for compliance with the PCI DSS regulations. You could be taking on risks that you’re not aware of (such as poor storage of records).

Can I process a refund by cash or if I accept payment by credit card? No. According to the TD Merchant Operating Guide this is not acceptable. Refunds must be made by crediting back the cardholder. An exception to this rule exists where there is a refund policy in place that stipulates otherwise, such as where payment has been applied to a student account.

Can I set a minimum purchase amount by credit card? No. This is strictly prohibited. Neither a minimum nor maximum sales limit may be set.

Can I charge customers a fee for payment by credit card? No. This is prohibited by the TD Merchant Services contract.

Updated July 2013 Page 4