SECP News/System Status

Today the PCI Security Standards Council (PCI SSC), an open, global forum for the development of payment card security standards published the PCI Mobile Payment Acceptance Security Guidelines for Merchants as End-Users. The guidance educates merchants on the factors and risks that need to be addressed in order to protect card data when using mobile devices, such as smart phones and tablets, to accept payments.

PCI SECURITY STANDARDS COUNCIL RELEASES GUIDANCE FOR MERCHANTS ON MOBILE PAYMENT ACCEPTANCE SECURITY:

https://www.pcisecuritystandards.org/pdfs/13_02_13_Mobile_Press_Release.pdf

Today the PCI Security Standards Council (PCI SSC), an open, global forum for the development of payment card security standards published the PCI DSS Cloud Computing Guidelines Information Supplement, a product of the Cloud Special Interest Group (SIG). Businesses deploying cloud technology can use this resource as a guide for choosing solutions and third-party cloud providers that will help them secure their customer payment data and support PCI DSS compliance.

PCI SECURITY STANDARDS COUNCIL RELEASES PCI DSS CLOUD COMPUTING GUIDELINES:

https://www.pcisecuritystandards.org/pdfs/pr_130205_Cloud_SIG.pdf

Today the PCI Security Standards Council (PCI SSC), an open, global forum for the development of payment card security standards published the PCI DSS E-commerce Guidelines Information Supplement, a product of the E-commerce Security Special Interest Group (SIG). Businesses selling goods and services over the Internet can use this resource as a guide for choosing e-commerce technologies and third-party service providers that will help them secure customer payment data and support PCI DSS compliance efforts.

PCI SECURITY STANDARDS COUNCIL RELEASES PCI DSS E-COMMERCE SECURITY GUIDELINES:

https://www.pcisecuritystandards.org/pdfs/pr_130130_ecommerce_sig.pdf

2012 E-Commerce Conference
The Office of the State Controller will hold its 2012 E- Commerce Conference on October 30, 2012 at the North Carolina State University McKimmon Center in Raleigh.

E-Commerce Announcement
E-Commerce Conference Agenda

To register for this conference, click on the following link: http://www.zoomerang.com/Survey/WEB22GK9SJST6Y

Wells Fargo EFTs
After reviewing the most recent invoices sent by Well Fargo for Electronic Funds Transfer we believe the majority of the billed items to be accurate.  There are 3 outstanding items that if found to be inaccurate can be credited back to each agency.  Therefore, agencies should pay their outstanding invoices and should not hold payments past the fiscal year.

Communication from Wells Fargo
We want to thank all of the agencies for your work and support.  We are glad to communicate that we have completed the formal aspects of the bank conversion and that all systems and services are performing well.

As expected, we are still working on the billing aspect of the analysis systems.  We want to provide an update to address and eliminate any of the confusion.

• The analysis for the month of January was produced on the Wells Fargo system and is correct.  An agency would have received this in February.  As always there may be some minor adjustments for a particular agency that we will address.  The expectation is that agencies should have paid or should pay their invoice for the month of January.
• As expected, the invoice for the month of February is not 100% accurate and should not be paid at this time.  In some cases, an agency may have received multiple invoices for February.  Regardless, these should not be paid until we provide an update.  If you have already paid, and the final invoice differs from the one that was paid, the agency will receive credit for the amount of the payment.
• We expect invoices for the month of March to be sent prior to the end of April.  However, the invoice for the month of March will not be 100% accurate and should not be paid.
• We expect to provide the final invoices for the months of February and March early during the month of May.
• Please disregard any notices that an agency may receive regarding unpaid invoices for February.
• Remember that when we speak of a particular month, the invoice normally is sent in the following month.  As an example, the invoice for the month of January that an agency would have received in February is accurate.  The invoice that an agency may have received in March for the month of February is the one that is not 100% accurate.
• An agency will have the option of seeing the Account Analysis via CEO.  As these are corrected, we expect the system to be updated with the new information.
• If an agency has paper copies of Account Analysis for the month of February (and for the month of March in the next week or so), our suggestion would be that the agency shred,  or destroy those copies so an agency will not confuse it with the updated Account Analysis.

Visa Announces U.S. Participation in Global Point-of-Sale Counterfeit Liability Shift – Effective October 1, 2015. http://usa.visa.com/download/merchants/bulletin-us-acquirer-mandate-080911.pdf
This policy assigns liability for counterfeit fraud to the party that has not made the investment in EMV chip cards(issuers) or terminals (merchants’ acquirers).  The policy encourages wider deployment of EMV cards and terminals.

Wachovia/Wells Fargo CEO Credential Migration
On December 10th, users on the merchant card and EFT contracts that use Wachovia Connection will transition from the Wachovia Global Connect portal to the CEO portal. You will automatically be prompted to go through the CEO New User Setup process after you log in to the Wachovia Global Connect portal.  The CEO portal will be your new home page, and you will access your Wachovia online services under My Services on that page.   Alerts in Wachovia Connection will begin on November 10, 2011.

In an effort to share with you what this process will look like for you, please ensure that you AND your users review the CEO Portal First-Time User Tour (Flash).

Obtaining  new log-in credentials:
You are scheduled to transition to the CEOportal, the system will prompt you through the CEONew User Setup process after you log in to the Wachovia Global Connectportal. You will complete this process in a few simple steps by creating a password, receiving your new CEOportal credentials (company ID and user ID), and establishing your CEOsecret questions and answers. Please remember your new credentials, as you will need them every time you log in to the CEOportal.

• Your new credentials will replace the Wachovia Global Connect log-in credentials you currently use.
• You will be able to access your Wachovia online services through the Wells Fargo CEO portal using your new credentials.

The New User Set Up process includes a few simple steps:

1. create a password
2. receive your new CEO portal credentials (company ID and user ID)
3. establish your CEO portal secret questions and answers.
4. You will use your new credentials every time you log in to the CEO portal and RDC 2.0. Please print the New User Setup confirmation screen for your records.

Additional CEO Migration Resources:

• CEO Access: New CEO portal credentials guide (PDF)
• CEO Access: Frequently Asked Questions (PDF)

Schedule C Revision
The Spring 2011 “Association Interchange Compliance Guide” has been revised to incorporate the current fees levied by Visa, MasterCard, and the debit networks. Merchants should note there are some minor additional “pass through” fees for MasterCard which include the processing integrity fee (misuse fee) at $.045 which matches what Visa has been charging and the account status inquiry fee at $.025 (US issued card) or $.03 (non US issued card).  Both of these new MasterCard fees are effective June 14, 2011.  Effective October 1, 2011 (per the Federal Reserve Bank’s Regulation II), the interchange and switch fees for PIN debits depend upon the asset size of the card issuer and which card network the card is cleared through (e.g., NYCE, STAR, etc.)
http://www.osc.nc.gov/SECP/Schedule%20C-VisaandMasterCardIDQ.pdf

Regulation II - Wall Street Reform and Consumer Protection Act (H.R.4173) requires the Federal Reserve Board  to establish standards for debit card interchange fees and prohibiting exclusivity arrangements and routing restrictions.  A final rule (Regulation II) was issued by the Federal Reserve Board on June 29, 2011.  For more information on the ruling see the Federal Reserve Board release http://www.federalreserve.gov/newsevents/press/bcreg/20110629a.htm.

STMS Contract Renewal and Fee Revision – The merchant card services contract with STMS has been renewed for an additional year.  The renewal provides for a revision of the vendor-levied “per transaction” fee, from $.04 to $.0425, effective July 1, 2011.  The incremental increase of $.0025 is to offset PCI Data Security validation services provided the participants. Refer to the memo at http://www.osc.nc.gov/SECP/11-51_Merchant_Cards_Contract_Renewal.pdf

IRS Code Section 6050W – The IRS has a new code that will result in card merchant agencies receiving a Form 1099-K in January 2012, for card transactions beginning January 1, 2011.  In preparation for the receipt of the Form 1099-K, it is important that the card processors (i.e., STMS / First Data, American Express, and Discover) have the agency’s correct Tax Identification Number (TIN) and “legal name” (as on file with the IRS).  Notices received from a card processor asking for the agency’s correct TIN and/or legal name should be responded to.  Refer to the following link for additional information:    http://www.irs.gov/govt/fslg/article/0,,id=226894,00.html

PCI Standards Version 2.0 - The PCI Security Standards Council has released Version 2.0 of both the PCI Data Security Standard (PCI-DSS) and the Payment Application Data Security Standard (PA-DSS).  The new standards become effective January 1, 2011.  More info can be viewed at https://www.pcisecuritystandards.org/pdfs/pr_101028_standards_2.0.pdf .

Durbin Amendment – Federal legislation recently enacted (H.R.4173 - Wall Street Reform and Consumer Protection Act) has several provisions impacting government entities accepting credit and/or debit cards.  Notable provisions that went into effect July 2010 are as follows: 1) A merchant can now set a minimum amount for which it will accept a credit card payment, provided the minimum amount does not exceed $10.00 (provision applies to all merchants, but does not apply to debit cards); 2) An institution of higher education (university or community college) can now set a maximum amount for which it will accept a credit card payment (provision does not apply to debit cards, or to general government agencies or local units of government); 3) All merchant agencies can now offer a discount for any given form of payment (e.g., provide a discount for paying by cash, check, or debit card versus credit card).  Government entities should examine the federal legislation in detail, as there are additional requirements and/or exclusions that may apply when implementing any of the provisions referenced.  See Durbin Amendment contained in the legislation (pages 693-699). http://www.sec.gov/about/laws/wallstreetreform-cpa.pdf

Schedule C Revision: The Fall 2010 “Association Interchange Compliance Guide” has been revised to incorporate the current fees levied by Visa, MasterCard, and the debit networks. Merchants should note the best “interchange rate” available to most public sector merchants remain the same: MasterCard “Enhanced Public Sector” – 1.55% plus $.10; and Visa “CPS Retail 2 Emerging Market” – 1.43% plus $.05. An agency may or may not qualify for the best interchange rate available, depending upon its capture method and the type of card being presented. The Assessment Fee for both brands is now .11%. See revised Schedule C for more information, including rates for the various PIN debit cards and other fees that may apply. These fees represent the “pass-through” fees associated with accepting merchant cards.
 http://www.osc.nc.gov/SECP/ScheduleC-VisaandMasterCardIQD.pdf

Card Program 10th Anniversary - July 1, 2010, marked the 10th anniversary of the statewide enterprise program that allowed agencies to accept merchant cards for payments.  During the past three years, the volume has doubled, while over the past five years the volume has tripled. Transaction activity for the Fiscal Year ending June 30, 2010 showed that over 9 million card transactions, totaling nearly $800 million, were processed by various state agencies during the year.

Common Payment Service Fee Reduction - The per card transaction fee charged by the Common Payment  Service (CPS) for processing card transactions has been reduced from $.035 to $.28.  The 20% reduction was effective July 1, 2010 and will be reflected in the ITS August billing.  This rate reduction demonstrates the economies of scale that can be achieved when agencies subscribe to an enterprise service.

Schedule C Revision: The Spring 2010 “Association Interchange Compliance Guide” has been revised to incorporate the current fees levied by Visa, MasterCard, and the debit networks. Merchants should note there are some minor fee increases for: 1) Some of the PIN debits networks; 2) MasterCard’s increase in the “assessment fee” from .095% to .11% per transaction amount, effective April 1, 2010; and 3) Visa’s increase in the “assessment fee” from .0925% to .11% per transaction amount, effective July 1, 2010 . See revised Schedule C for more information.
 http://www.osc.nc.gov/SECP/ScheduleC-VisaandMasterCardIQD.pdf

Schedule C - The Spring 2010 “Association Interchange Compliance Guide” has been revised to incorporate the current fees levied by Visa, MasterCard, and the debit networks. Merchants should note there are some minor fee increases for: 1) Some of the PIN debits networks; and 2) MasterCard’s increase in the “assessment fee” from .095% to .1100% per transaction amount. See revised Schedule C for more information.
 http://www.osc.nc.gov/SECP/ScheduleC-VisaandMasterCardIQD.pdf

PCI-PTS Standard - Effective July 1, 2010, Visa will be enforcing the “PCI PIN Transaction Security (PCI-PTS) Standard.”  The standard was first announced in 2008 and was previously known as the PIN Entry Device (PCI-PED) standard.  The standard requires all POS terminals that accept PIN based debit cards to have triple DES encryption.  For merchants purchasing new POS equipment in the last five years, this should not be an issue.  All agencies accepting PIN based debit cards are advised to inspect their POS devices and ascertain if the terminals are compliant.  Replacement of non-complaint POS terminals prior to July 1, 2010 will be necessary if PIN based debit cards are being accepted. Information on the standard can be found at the following link: https://www.pcisecuritystandards.org/security_standards/ped/index.shtml

The gateway capture solution available under the STMS contact, previously known as “YourPay,” is now called “First Data Global Gateway.”

The First Data Global Gateway will be unavailable for several hours during the early morning hours of April 19. An outage is necessary to perform a scheduled migration of the Online and Settlement systems. It will affect all activities on the First Data Global Gateway including API, Connect, and the Virtual Terminal. Please contact your Account Specialist if you have any questions.