Storage and Usage of a Payment Credential Merchant Initiated Standing Instructions Cardholder Initiated

Transcription

1 Strage and Usage f a Payment Credential Merchant Initiated Standing Instructins Cardhlder Initiated July 6, 2018 Versin 4 All changes frm versin 3 are highlighted in yellw thrughut the dcument. Recurring Payment... 4 Definitin... 4 Use Case Installment Payment... 7 Definitin... 7 Use Case Unscheduled COF Transactin Visa Definitin Use Case Cardhlder Initiated Definitin Use Case Resubmissin Use Case Reauthrizatin Use Case: NOTE: Merchants that authrize n any nn-wrldpay frnt end (TSYS, Glbal, Cybersurce, etc.) will need t wrk with their nn-wrldpay frnt end t ensure that they are sending the prper fields and values.

2 Required Supprt and Timeline fr COF Framewrk Visa: Originally mandated Octber Visa extended the cmpliance timeline until April 30, 2018 UPDATE: Wrldpay requested an extensin fr all Wrldpay merchants until Octber 31, Wrldpay is waiting fr a respnse frm Visa. UPDATE 4/30/18- Visa has reiterated that the COF framewrk is mandated fr April 30th, Merchants that are able t implement prir t the due date shuld d s. Merchants, Payment Facilitatrs Third Parties, merchants agents that have requested additinal time t meet the COF mandate must wrk t bring their systems int cmpliance by Octber 31, Nn- Cmpliance Assessments will nt be pursued fr merchants that ntify Vantiv, nw Wrldpay and are actively wrking t cmply with the mandate as sn as pssible, up until Octber 31, Mastercard: COF Framewrk available June 12, Ptential nn-cmpliance may begin in Octber 2018 fr nn-supprt. Mastercard supprt f the COF framewrk is mandated fr the strage f PANs and netwrk tkens. Mastercard will supprt a new POS entry mde in subsequent COF transactins. Mastercard will nt require merchants t indicate the intent t stre a payment credential in initial transactins. UPDATE 7/6/18- Fr Mastercard transactins we are advising merchants nt t implement the Mastercard COF framewrk until further ntice. Currently nt all issuers are prepared t supprt entry mde 10, which may result in transactin declines Discver: Octber Discver will supprt a new POS entry mde in subsequent COF transactins. Discver will nt require the merchant t indicate the intent t stre a payment credential in initial transactins. Merchant supprt f the new POS entry mde is ptinal fr recurring and installment payments and mandated fr cardhlder initiated transactins. Nn-cmpliance assessments will nt be pursued by Discver fr merchants that d nt meet the Octber 2018 due date. Merchants String nly PANs Recmmended/Optinal supprt: Recurring- Visa, Discver Installment- Visa, Discver Unscheduled COF- Visa Cardhlder Initiated- Visa Mandated supprt f the COF Framewrk fr the fllwing authrizatin types: Incremental authrizatins-visa Delayed Charges-Visa N shw- Visa Resubmissin-Visa Reauthrizatin-Visa Recurring- Mastercard Installment- Mastercard Cardhlder Initiated- Mastercard, Discver Risks f nn-supprt f the mandated COF framewrk: Nn-cmpliance with rules and risk fr nn-cmpliance assessments. The netwrks haven t disclsed nn-cmpliance fee effective dates r fee amunts Cntinued decline respnses Ptential increased custmer cmplaints and pr cardhlder experience Merchants String Netwrk Tkens (e.g., Visa, Mastercard, Discver) - Mandated If a netwrk tken frm a wallet (e.g., Apple Pay, Samsung Pay, Ggle Pay, Visa Checkut, MasterPass) is extracted and stred as a credential n file by a merchant r their acquirer, Payment Facilitatr, Third Party, merchant s agent the COF framewrk must be supprted. Apple Pay, Samsung Pay, Andrid Pay are nt cnsidered credential n file whether accepted as cntactless r thrugh a merchant website r merchant app. If the cardhlder instructs the merchant t stre their payment credential during a cntactless, in-app r e-cmmerce transactin using the payment credential frm their Apple Pay, Samsung Pay r Andrid Pay, this wuld be cnsidered initial strage f a payment credential (netwrk tken). Merchants that stre netwrk tkens and PANs will nt have the ability t identify the difference between a netwrk tken r PAN at the time f authrizatin; therefre, supprting the COF framewrk nly fr netwrk tkens and nt PANs may be impssible. Recmmended/Optinal supprt: Recurring- Discver Installment- Discver Mandated supprt f the COF Framewrk fr the fllwing authrizatin types when string Netwrk Tkens: Recurring- Visa, Mastercard Installment- Visa, Mastercard Unscheduled COF- Visa Cardhlder Initiated- Visa, Mastercard, Discver Incremental authrizatins- Visa Delayed Charges- Visa N shw- Visa Resubmissin- Visa Reauthrizatin- Visa Risks f nn-supprt f the mandated COF framewrk: Nn-cmpliance with rules and risk fr nn-cmpliance assessments. The netwrks haven t disclsed nn-cmpliance fee effective dates r fee amunts Cntinued decline respnses Ptential increased custmer cmplaints and pr cardhlder experience

3 **THIS IS A NEW PAGE** What is a Stred Credential On File (COF) A Primary Accunt Number, Netwrk (e.g., Visa, Mastercard) created tken, stred by a merchant, merchant s agent, Payment Facilitatr r Staged Digital Wallet Operatr t prcess future transactins fr the cardhlder. Future COF transactins d nt require the cardhlder t present r enter their payment credential infrmatin when they are making a purchase. A credential is nt cnsidered stred when the credential is used t cmplete a single transactin r purchase. Example: Guest Checkut- Cardhlder shps at an e-cmmerce retailer t purchase three items. One item is backrdered. The merchant submits tw transactins t fulfill the entire rder. Cardhlder visits the merchant s website a week later t purchase smething; the cardhlder has t enter their payment credentials t place the rder. Transactin Type Examples: Apple Pay Samsung Pay, Andrid Pay Cntactless- nt cnsidered COF Apple Pay Samsung Pay, Andrid Pay In-app r e-cmm website- nt cnsidered COF Pass-thrugh wallets such as Apple Pay, Samsung Pay, and Andrid Pay are nt cnsidered credential n file whether accepted as cntactless r thrugh a merchant website r merchant app. If the cardhlder instructs the merchant t stre their payment credential during an in-app r e- cmmerce transactin using the payment credential frm their Apple Pay r Andrid Pay, this wuld be cnsidered initial strage f a payment credential (tken). Visa Checkut transactins- nt cnsidered COF Guest Checkut- nt cnsidered COF Simplified custmer checkut (e.g., nline retailer stres the cardhlder inf)- Cardhlder Initiated COF Staged Digital Wallet Operatr specific t a merchant- COF- culd be used fr Unscheduled COF, Recurring, Installment, cardhlder initiated, full r partial prepayment Transit wallet when amunt ges belw agreed amunt, merchant will replenish- Unscheduled COF Htel- cardhlder has a membership prfile with the htel and prvides their card number fr future reservatins- cnsidered COF Htel- cardhlder prvides the payment credential t cver charges (e.g., htel stay, incidentals such as fd) assciated t that specific reservatin nly- nt COF Drug stre in persn sale, uses QR cde t link cnsumer t their prfile with the merchant- uses stred credential- cardhlder initiated AFD mbile in-app purchases- may be COF Recurring, Installment, Unscheduled COF- always COF NOT COF when the Merchant r its agent uses a payment credential fr a single transactin r a single purchase: A N-Shw Transactin Amended amunt r a delayed charge Incremental Authrizatin Reauthrizatin Auth Type- Where the merchant (e.g., e-cmm merchant split shipment) is allwed t submit a new Authrizatin Request fr the same transactin Resubmissin Auth Type- Transactin that received a certain auth decline respnse and is resubmitted fr authrizatin, as permitted in the Visa rules

4 Recurring Payment Definitin fr Recurring- A transactin in a series f transactins that: Always uses a stred credential Prcessed at fixed, regular intervals (nt t exceed ne year between transactins) representing cardhlder agreement fr the merchant t initiate future transactins fr the purchase f gds r services prvided Use Case- Subscriptin payments, bill payments (electric bill, gym membership, mnthly car insurance payment, mbile phne bill) Disclsure t Cardhlder and Cardhlder Cnsent- Recurring When entering int a cardhlder agreement, all the requirements belw must be clearly displayed at the time the cardhlder gives their cnsent and must be displayed separately frm the general purchase terms and cnditins Where required by applicable laws r regulatins, the merchant r its agent must als prvide t the cardhlder a recrd f the cardhlder s cnsent. When capturing a stred credential fr the first time, establish an agreement with the cardhlder cntaining all f the fllwing: A truncated versin f the stred credential (e.g., last 4 digit f the accunt number) Methd in which the cardhlder will be ntified f any changes in the agreement Hw the stred credential will be used Expiratin date f the agreement when applicable Befre prcessing the transactin the merchant r its agent must Obtain the cardhlder s express infrmed cnsent t an agreement that cntains the fllwing: Transactin amunt (includes all taxes and charges) r hw the transactin amunt will be determined. It cannt cntain finance charges Transactin currency If surcharging is permitted and assesses, cardhlder acknwledgement f any surcharges and assciated disclsures Cancellatin and refund plicies Lcatin f the merchant utlet The fixed dates r intervals n which the transactin will be prcessed The cardhlder agreement must be retained fr the duratin f the agreement and prvide it t the issuer upn request Recurring First Time a Credential is Stred First Time a Credential is Stred (Intent t stre a payment credential fr future transactins) Merchant t ask the cardhlder if they d like the merchant t stre their payment credential (card) fr future transactins prir t submitting the initial/first authrizatin request The transactin must be authrized Submit an authrizatin request fr the amunt due If payment is nt required, submit an Accunt Verificatin Request ($0.00) Submit the apprpriate authrizatin and settlement fields CLICK HERE fr recurring technical requirements When the authrizatin is apprved, retain the Transactin ID t submit in subsequent authrizatin request D nt stre the credential if the authrizatin request r Accunt Verificatin Request ($0.00) is declined Recurring Subsequent Transactins Subsequent Transactins The transactin must be authrized Submit the apprpriate authrizatin and settlement fields CLICK HERE fr recurring technical requirements When an authrizatin is declined the merchant may perfrm the fllwing: Resubmit the authrizatin up t 4 times within 16 calendar days (14 calendar days fr Visa tkens nly) frm the date f the riginal decline respnse, in an attempt t receive an apprved authrizatin. The resubmissin f authrizatin can nly be perfrmed when the riginal decline respnse cde was ne f the fllwing: 05 (Authrizatin declined) 51 (Insufficient funds) 61 (Exceeds apprval amunt limit) 65 (Exceeds withdrawal frequency limit) Identify the transactin as Resubmissin authrizatin type CLICK HERE fr resubmissin technical requirements Cancellatin Prcedures- Recurring The merchant must prvide a simple cancellatin prcedure t the cardhlder. If the cardhlder s rder was initially accepted nline, the merchant may prvide an nline cancellatin prcedure. The merchant cannt cmplete a transactin when: The transactin is beynd the agreed upn duratin by the cardhlder The cardhlder request that the merchant change the payment methd Cardhlder cancels accrding t the agreed cancelatin plicy The merchant receives a decline respnse

5 Recurring Payment INITIAL/FIRST Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Optin 1 Optin 2 During the Transactin (Card Present, Card Nt Present, E cmmerce) Authrizatin/Settlement POS Envirnment Field ISO8583- new field 62.68, new value R 610 Spec- new G009.27, new value R Batch Auth Spec- existing Additinal Request Addendum, new value R EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value R Merchant must retain: Tran ID frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- this value must be sent in settlement and match the value frm the auth respnse Accunt Verificatin Message ($0.00) Authrizatin Request Only When the merchant prperly identifies a recurring payment (MOTO/ECI field), Wrldpay will ppulate the POS Envirnment Field f R. Merchants als have the ptin t send the POS Envirnment Field. POS Envirnment Field ISO8583- new field 62.68, new value R 610 Spec- new G009.27, new value R Batch Auth Spec- existing Additinal Request Addendum, new value R Merchant must retain: Tran ID frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- N/A Auth message nly When applicable, merchants must retain the Tran ID frm the auth respnse t send in subsequent auth requests. The Tran ID in the subsequent auth auth request must either be the riginal Tran ID frm the very first auth respnse r the Tran ID frm the previus auth respnse. Nte: T prvide merchants mre time t build supprt t retain the Tran ID t send in subsequent auth requests, Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Recurring PAN based transactins d nt require a Transactin Identifier t be included in subsequent transactins. If it is present, Visa will prcess it per the rules and frward it t issuers. Recurring netwrk Tken based transactins require the riginal/previus Transactin Identifier t be included. The ability t determine when t send the Transactin Id in subsequent recurring auth requests fr PANs versus netwrk tkens may be difficult. It is unknwn hw issuers will handle subsequent recurring auth requests with r withut the Transactin ID. It is unknwn if issuers will have sphisticated lgic t make auth decisins based n the when the Transactin Id is prvided r nt r when it is required. Based n that uncertainly, it may be best fr the merchant t always include the Transactin Id in subsequent recurring auth requests. Merchants must retain the Tran ID frm the auth respnse t send in subsequent auth requests. The Tran ID in the subsequent auth request must either be the riginal Tran ID frm the very first auth respnse r the Tran ID frm the previus auth respnse. Nte: T prvide merchants mre time t build supprt t retain the Tran ID t send in subsequent auth requests, Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Accunt Verificatin Trans Type Id ($0.00) ISO8583- existing field 25, value 51 (Acc # Verify) 610 Spec- existing field 03 ps. 1-2, value 51 (Acc # Verify) Batch Auth Spec- existing D0 Recrd tran type A Settlement- N/A Auth message nly Ntes: Merchants must cntinue t send the necessary BAU fields (e.g., POS entry mde, MOTO ECI etc.) t identify initial card present, card nt present, e-cmmerce and Accunt Verificatin transactins prperly. Nte: Mastercard s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins. Nte: The COF Framewrk is ptinal fr Discver. Discver s COF Framewrk nly requires POS Entry Mde f 10 (auth and settlement) in subsequent transactins.

6 Recurring Payment SUBSEQUENT Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Authrizatin/Settlement When the merchant prperly identifies a recurring payment, Wrldpay will ppulate the POS Entry Mde f 10. Merchants als have the ptin t send the POS Entry Mde f a 10. Wrldpay settlement will ensure the value f 10 is sent in the settlement recrd t Visa, Mastercard (available June 18, 2018) and Discver (available in Octber 2018). Discver: COF POS Entry Mde is ptinal fr recurring POS Entry Mde Visa and Mastercard ISO8583- existing field 22, new value Spec- existing field 22, new value 10 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10. When merchant sends MOTO/ECI f 2, Settlement will frce set POS entry mde f 10. EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, POS Entry Mde new value 10. This value must be sent in settlement and match frm auth. Nte: When merchant sends MOTO/ECI f 2, Settlement will frce set POS entry mde f 10 fr Visa and Discver, and 7 fr Mastercard when sending t the respective netwrk. MOTO/ECI ISO8583- existing field 126, value 02 (recurring) 610 Spec- existing field 25 ps. 7, value 1 (recurring) Batch Auth Spec- existing Primary Transactin Detail recrd, Cardhlder ID Meth and Mail/Phne Ind field, value 2 (recurring) EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, Mail/Phne Ind value 2, this value must be sent in settlement and match frm auth When the merchant prperly identifies a recurring payment, Wrldpay will ppulate the POS Envirnment Field f R. Merchants als have the ptin t send the POS Envirnment Field. Wrldpay settlement will ensure the value f R is sent in the settlement recrd t Visa. Wrldpay supprt: 10/2/17 POS Envirnment Field ISO8583- new field 62.68, new value R 610 Spec- new G009.27, new value R Batch Auth Spec- existing Additinal Request Addendum, new value R. When merchant sends MOTO/ECI f 2, Settlement will frce set POS Envirnment Field t R. EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value R. When merchant sends MOTO/ECI f 2, Settlement will frce set POS Envirnment Field t R. Tran ID (retained frm the previus auth respnse r Tran ID received frm the first transactin) in auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- Additinal Request Addendum, Recrd Type DA, Field Visa Tran ID Settlement- this value must be sent in settlement and match the value frm the auth respnse Nte: Shrt term- Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Lng Term- Merchants must send the transactin ID in the auth request that was retained frm riginal auth respnse r the Tran ID frm the previus auth respnse. Recurring PAN based transactins d nt require a Transactin identifier t be included. If it is present, Visa will prcess it per the rules and frward it t issuers. Recurring netwrk Tken based transactins require the riginal/previus Transactin identifier t be included. The ability t determine when t send the transactin id in subsequent recurring auth requests fr PANs versus netwrk tkens may be difficult. It is unknwn hw all the different issuers will handle subsequent COF auth request with r withut the transactin ID. We dn t knw if issuers will have sphisticated lgic t make auth decisins based n the when the transactin id is prvided r nt r when it is required. Based n that uncertainly it may be best fr the merchant t always include the transactin id in auth requests. Nte: Mastercard s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins. Nte: The COF Framewrk is ptinal fr Discver. Discver s COF Framewrk nly requires POS Entry Mde f 10 (auth and settlement) in subsequent transactins.

7 Installment Payment Definitin fr Installment- A transactin in a series f transactins that: Uses a stred credential Represents a cardhlder agreement with the merchant Future transactin(s) ver a perid f time Transactin is fr a fixed amunt Use Case- Furniture purchase, hme shpping netwrk purchase Disclsure t Cardhlder and Cardhlder Cnsent- Installment When entering int a cardhlder agreement, all the requirements belw must be clearly displayed at the time the cardhlder gives their cnsent and must be displayed separately frm the general purchase terms and cnditins Where required by applicable laws r regulatins, the merchant r its agent must als prvide t the cardhlder a recrd f the cardhlder s cnsent. When capturing a stred credential fr the first time, establish an agreement with the cardhlder cntaining all f the fllwing: Befre prcessing the transactin the merchant r its agent must Obtain the cardhlder s express infrmed cnsent t an agreement that cntains the fllwing: A truncated versin f the stred credential (e.g., last 4 digit f the accunt number) Transactin amunt (includes all taxes and charges) r hw the transactin amunt will be determined Methd in which the cardhlder will be ntified f any Transactin currency changes in the agreement If surcharging is permitted and assesses, cardhlder acknwledgement f Hw the stred credential will be used any surcharges and assciated disclsures Expiratin date f the agreement when applicable Cancellatin and refund plicies Lcatin f the merchant utlet The ttal purchase price Terms f future payments, including the dates, amunts, and currency The cardhlder agreement must be retained fr the duratin f the agreement and prvide it t the issuer upn request The amunt may include interest charges except fr the U.S. Regin Transactin Prcessing Requirements- Installment First Time a Credential is Stred First Time a Credential is Stred (Intent t stre a payment credential fr future transactins) Merchant t ask the cardhlder if they d like the merchant t stre their payment credential (card) fr future transactins prir t submitting the initial/first authrizatin request. The transactin must be authrized Submit an authrizatin request fr the amunt due If payment is nt required, submit an Accunt Verificatin Request ($0.00) Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr installment technical requirements When the authrizatin is apprved, retain the Transactin ID t submit in subsequent authrizatin requests D nt stre the credential if the authrizatin request r Accunt Verificatin Request ($0.00) is declined A merchant must nt prcess an initial installment transactin until the merchandise r services have been prvided t the cardhlder and must nt prcess individual installment transactin at intervals less than either: 7 calendar days In the U.S. Regin, the mnthly anniversary f the shipment date Transactin Prcessing Requirements- Installment Subsequent Transactins Subsequent Transactins The transactin must be authrized Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr installment technical requirements When the transactin is declined, the merchant must ntify the cardhlder in writing and allw the cardhlder at least 7 days t pay by ther means When an authrizatin is declined the merchant may perfrm the fllwing: Resubmit the authrizatin up t 4 times within 16 calendar days (14 calendar days fr Visa tkens nly) frm the date f the riginal decline respnse, in an attempt t receive an apprved authrizatin. The resubmissin f authrizatin can nly be perfrmed when the riginal decline respnse cde was ne f the fllwing: 05 (Authrizatin declined) 51 (Insufficient funds) 61 (Exceeds apprval amunt limit) 65 (Exceeds withdrawal frequency limit) Identify the transactin as Resubmissin authrizatin type Cancellatin Prcedures- Installment The merchant must prvide a simple cancellatin prcedure t the cardhlder. If the cardhlder s rder was initially accepted nline, the merchant may prvide an nline cancellatin prcedure. The merchant cannt cmplete a transactin when: The transactin is beynd the agreed upn duratin by the cardhlder The cardhlder request that the merchant change the payment methd Cardhlder cancels within the terms f the cancelatin plicy Merchant must prvide the cardhlder a cancellatin r refund cnfirmatin in writing within 3 business days Credit transactin receipt fr the amunt specified in the cancelatin plicy within 3 business days The merchant receives a decline respnse

8 Installment Payment INITIAL/FIRST Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Optin 1 Optin 2 During the Transactin (Card Present, Card Nt Present, E cmmerce) Authrizatin/Settlement POS Envirnment Field ISO8583- new field 62.68, new value I 610 Spec- new G009.27, new value I Batch Auth Spec- existing Additinal Request Addendum, new value I EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value I Merchant must retain: Tran ID frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- this value must be sent in settlement and match the value frm the auth respnse When applicable, merchants must retain the Tran ID frm the auth respnse t send in subsequent auth requests. The Tran ID in the subsequent auth auth request must either be the riginal Tran ID frm the very first auth respnse r the Tran ID frm the previus auth respnse. Nte: T prvide merchants mre time t build supprt t retain the Tran ID t send in subsequent auth requests, Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Installment PAN based transactins d nt require a Transactin Identifier t be included in subsequent transactins. If it is present, Visa will prcess it per the rules and frward it t issuers. Installment netwrk Tken based transactins require the riginal/previus Transactin Identifier t be included. The ability t determine when t send the Transactin Id in subsequent installment auth requests fr PANs versus netwrk tkens may be difficult. It is unknwn hw issuers will handle subsequent recurring auth requests with r withut the Transactin ID. It is unknwn if issuers will have sphisticated lgic t make auth decisins based n the when the Transactin Id is prvided r nt r when it is required. Based n that uncertainly, it may be best fr the merchant t always include the Transactin Id in subsequent installment auth requests. Accunt Verificatin Message ($0.00) Authrizatin Request Only When the merchant prperly identifies an installment payment (MOTO/ECI field), Wrldpay will ppulate the POS Envirnment Field f I. Merchants als have the ptin t send the POS Envirnment Field. POS Envirnment Field ISO8583- new field 62.68, new value I 610 Spec- new G009.27, new value I Batch Auth Spec- existing Additinal Request Addendum, new value I Merchant must retain: Tran ID frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- N/A Auth message nly Merchants must retain the Tran ID frm the auth respnse t send in subsequent auth requests. The Tran ID in the subsequent auth request must either be the riginal Tran ID frm the very first auth respnse r the Tran ID frm the previus auth respnse. Nte: T prvide merchants mre time t build supprt t retain the Tran ID t send in subsequent auth requests, Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Accunt Verificatin Trans Type Id ($0.00) ISO8583- existing field 25, value 51 (Acc # Verify) 610 Spec- existing field 03 ps. 1-2, value 51 (Acc # Verify) Batch Auth Spec- existing D0 Recrd tran type A Settlement- N/A Auth message nly Ntes: Merchants must cntinue t send the necessary BAU fields (e.g., POS entry mde, MOTO ECI etc.) t identify initial card present, card nt present, e-cmmerce and Accunt Verificatin transactins prperly. Nte: Mastercard s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins. Nte: The COF Framewrk is ptinal fr Discver. Discver s COF Framewrk nly requires POS Entry Mde f 10 (auth and settlement) in subsequent transactins.

9 Installment Payment SUBSEQUENT Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Authrizatin/Settlement When the merchant prperly identifies an installment payment, Wrldpay will ppulate the POS Entry Mde f 10. Merchants als have the ptin t send the POS Entry Mde f 10. Wrldpay settlement will ensure the value f 10 is sent in the settlement recrd t Visa, Mastercard (available June 18, 2018) and Discver (available in Octber 2018). POS Entry Mde Visa and Mastercard ISO8583- existing field 22, new value Spec- existing field 22, new value 10 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10. When merchant sends MOTO/ECI f 3, Settlement will frce set POS entry mde f 10. EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, POS Entry Mde new value 10. This value must be sent in settlement and match frm auth. Nte: When merchant sends MOTO/ECI f 3, Settlement will frce set POS entry mde f 10 fr Visa and Discver, and 7 fr Mastercard when sending t the respective netwrk. MOTO/ECI ISO8583- existing field 126, value 03 (installment 610 Spec- existing field 25 ps. 7, value 2 (installment) Batch Auth Spec- existing Primary Transactin Detail recrd, Cardhlder ID Meth and Mail/Phne Ind field, value 3 (installment) EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, Mail/Phne Ind value 3, this value must be sent in settlement and match frm auth When the merchant prperly identifies an installment payment, Wrldpay will ppulate the POS Envirnment Field f I. Merchants als have the ptin t send the POS Envirnment Field. POS Envirnment Field ISO8583- new field 62.68, new value I 610 Spec- new field G009.27, new value I Batch Auth Spec- existing Additinal Request Addendum, new value I. When merchant sends MOTO/ECI f 3. Settlement will frce set POS Envirnment Field t I. EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value I. When merchant sends MOTO/ECI f 3, Settlement will frce set POS Envirnment Field t I. Tran ID (retained frm the previus auth respnse r Tran ID received frm the first transactin) in auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- Additinal Request Addendum, Recrd Type DA, Field Visa Tran ID Settlement- this value must be sent in settlement and match the value frm the auth respnse Nte: Shrt term- Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Lng Term- Merchants must send the transactin ID in the auth request that was retained frm riginal auth respnse r the Tran ID frm the previus auth respnse. Installment PAN based transactins d nt require a Transactin identifier t be included. If it is present, Visa will prcess it per the rules and frward it t issuers. Installment netwrk Tken based transactins require the riginal/previus Transactin identifier t be included. The ability t determine when t send the transactin id in subsequent installment auth requests fr PANs versus netwrk tkens may be difficult. It is unknwn hw issuers will handle subsequent COF auth request with r withut the transactin ID. It is unknwn if issuers will have sphisticated lgic t make auth decisins based n the when the transactin id is prvided r nt r when it is required. Based n that uncertainly it may be best fr the merchant t always include the transactin id in auth requests. Nte: Mastercard s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins. Nte: The COF Framewrk is ptinal fr Discver. Discver s COF Framewrk nly requires POS Entry Mde f 10 (auth and settlement) in subsequent transactins..

10 Unscheduled COF Transactin Visa Definitin fr Unscheduled COF- A transactin that: Uses a stred credential Des nt ccur n a scheduled r regularly ccurring transactin date, where the cardhlder has prvided cnsent fr the merchant t initiate ne r mre future transactins Transactin is fr a fixed r variable amunt Transactin dates are unknwn Use Case- Snwplw service will plw yur driveway when it snws tw inches r mre. Cardhlder requests transit merchant t tp-up their accunt when balance reaches a certain amunt. Disclsure t Cardhlder and Cardhlder Cnsent- Unscheduled COF When entering int a cardhlder agreement, all the requirements belw must be clearly displayed at the time the cardhlder gives their cnsent and must be displayed separately frm the general purchase terms and cnditins Where required by applicable laws r regulatins, the merchant r its agent must als prvide t the cardhlder a recrd f the cardhlder s cnsent. When capturing a stred credential fr the first time, establish an agreement with the cardhlder cntaining all f the fllwing: Befre prcessing the transactin the merchant r its agent must Obtain the cardhlder s express infrmed cnsent t an agreement that cntains the fllwing: A truncated versin f the stred credential (e.g., last 4 digit f the accunt number) Transactin amunt (includes all taxes and charges) r hw the transactin amunt will be determined Methd in which the cardhlder will be ntified f any changes Transactin currency in the agreement If surcharging is permitted and assesses, cardhlder Hw the stred credential will be used acknwledgement f any surcharges and assciated disclsures Expiratin date f the agreement when applicable Cancellatin and refund plicies Transactin Prcessing Requirements- Unscheduled COF First Time a Credential is Stred Lcatin f the merchant utlet The agreed upn event that will prmpt the Transactin (fr example: if the cardhlder s balance falls belw a certain amunt) The cardhlder agreement must be retained fr the duratin f the agreement and prvide it t the issuer upn request First Time a Credential is Stred (Intent t stre a payment credential fr future transactins) Merchant t ask the cardhlder if they d like the merchant t stre their payment credential (card) fr future transactins prir t submitting the initial/first authrizatin request. The transactin must be authrized Submit an authrizatin request fr the amunt due If payment is nt required, submit an Accunt Verificatin Request ($0.00) Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr Unscheduled COF technical requirements When the authrizatin is apprved, retain the Transactin ID t submit in subsequent authrizatin requests D nt stre the credential if the authrizatin request r Accunt Verificatin Request ($0.00) is declined Transactin Prcessing Requirements- Unscheduled COF Subsequent Transactins Subsequent Transactins The transactin must be authrized Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr Unscheduled COF technical requirements When the transactin is declined, the merchant must ntify the cardhlder in writing and allw the cardhlder at least 7 days t pay by ther means When an authrizatin is declined the merchant may perfrm the fllwing: Resubmit the authrizatin up t 4 times within 16 calendar days (14 calendar days fr Visa tkens nly) frm the date f the riginal decline respnse, in an attempt t receive an apprved authrizatin. The resubmissin f authrizatin can nly be perfrmed when the riginal decline respnse cde was ne f the fllwing: 05 (Authrizatin declined) 51 (Insufficient funds) 61 (Exceeds apprval amunt limit) 65 (Exceeds withdrawal frequency limit) Identify the transactin as Resubmissin authrizatin type Cancellatin Prcedures- Unscheduled COF The merchant must prvide a simple cancellatin prcedure t the cardhlder. If the cardhlder s rder was initially accepted nline, the merchant may prvide an nline cancellatin prcedure. The merchant cannt cmplete a transactin when: The transactin is beynd the agreed upn duratin by the cardhlder The cardhlder request that the merchant change the payment methd Cardhlder cancels accrding t the agreed cancelatin plicy The merchant receives a decline respnse

11 Unscheduled Credential On File INITIAL/FIRST Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Optin 1 Optin 2 During the Transactin (Card Present, Card Nt Present, E cmmerce) Authrizatin/Settlement POS Envirnment Field ISO8583- new field 62.68, new value C 610 Spec- new G009.27, new value C Batch Auth Spec- existing Additinal Request Addendum, new value C EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value C Merchant must retain: Tran ID frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- this value must be sent in settlement and match the value frm the auth respnse Nte: T prvide merchants mre time t build supprt t retain the Tran ID t send in subsequent auth requests, Visa prvided apprval until further ntice, fr Wrldpay t send a static value in the auth request n behalf f ur merchants wh authrize with Wrldpay when the merchant des nt prvide the Tran ID in the auth request. Accunt Verificatin Message ($0.00) Authrizatin Request Only POS Envirnment Field ISO8583- new field 62.68, new value C 610 Spec- new G009.27, new value C Batch Auth Spec- existing Additinal Request Addendum, new value C Merchant must retain: Tran ID retain frm the auth respnse t send in subsequent COF auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- existing RV (Visa Authrizatin Respnse Addendum) Settlement- N/A Auth message nly Accunt Verificatin Trans Type Id ($0.00) ISO8583- existing field 25, value 51 (Acc # Verify) 610 Spec- existing field 03 ps. 1-2, value 51 (Acc # Verify) Batch Auth Spec- existing D0 Recrd tran type A Settlement- N/A Auth message nly Merchants must retain the Tran ID frm the auth respnse t send in subsequent auth requests. The Tran ID must either be the riginal frm the very first auth respnse r it culd be the Tran ID received in the mst recent/ last auth respnse. Ntes: Merchants must cntinue t send the necessary BAU fields (e.g., POS entry mde, MOTO ECI etc.) t identify card present, card nt present, e-cmmerce and Accunt Verificatin transactins prperly. This is a Visa transactin type nly. Unscheduled Credential On File SUBSEQUENT Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Authrizatin/Settlement POS Entry Mde ISO8583- existing field 22, new value Spec- existing field 22, new value 10 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10 EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, POS Entry Mde new value 10. This value must be sent in settlement and match frm auth MOTO/ECI ISO8583- existing field 126, value Spec- existing field 25 ps. 7, value 3 Batch Auth Spec- existing Primary Transactin Detail recrd, Cardhlder ID Meth and Mail/Phne Ind field EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, Mail/Phne Ind value 1, this value must be sent in settlement and match frm auth POS Envirnment Field ISO8583- new field 62.68, new value C 610 Spec- new G009.27, new value C Batch Auth Spec- existing Additinal Request Addendum, new value C EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value C. This value must be sent in settlement and match frm auth

12 Tran ID (retained frm the previus auth respnse r Tran ID received frm the first transactin) in auth request. This is a new actin step. ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- Additinal Request Addendum, Recrd Type DA, Field Visa Tran ID Settlement- this value must be sent in settlement and match the value frm the auth respnse Prcessing Cde This is a new actin step. ISO8583- existing field, existing value Spec- existing field Settlement- N/A Market Specific Data Indicatr -This is a new actin step. ISO8583- existing field, value B 610 Spec- existing field Settlement- this value must be sent in settlement and match the value frm the auth respnse This is a Visa transactin type nly. Cardhlder Initiated Definitin fr Cardhlder initiated A transactin in a series f transactins that: Uses a stred credential Represents a cardhlder agreement with the merchant Des nt ccur n a fixed schedule Use Case- the cardhlder shps frm their mbile device by accessing the merchant s app r website and when it s time t pay fr the purchase, the merchant has the cardhlder s payment credentials, shipping and billing address is n file. Disclsure t Cardhlder and Cardhlder Cnsent- Cardhlder Initiated When entering int a cardhlder agreement, all the requirements belw must be clearly displayed at the time the cardhlder gives their cnsent and must be displayed separately frm the general purchase terms and cnditins Where required by applicable laws r regulatins, the merchant r its agent must als prvide t the cardhlder a recrd f the cardhlder s cnsent. When capturing a stred credential fr the first time, establish an agreement with the cardhlder cntaining all f the fllwing: A truncated versin f the stred credential (e.g., last 4 digit f the accunt number) Methd in which the cardhlder will be ntified f any changes in the agreement Hw the stred credential will be used Expiratin date f the agreement when applicable The cardhlder agreement must be retained fr the duratin f the agreement and prvide it t the issuer upn request Transactin Prcessing Requirements- Cardhlder Initiated First Time a Credential is Stred First Time a Credential is Stred (Intent t stre a payment credential fr future transactins) Merchant t ask the cardhlder if they d like the merchant t stre their payment credential (card) fr future transactins prir t submitting the initial/first authrizatin request The transactin must be authrized Submit an authrizatin request fr the amunt due If payment is nt required, submit an Accunt Verificatin Request ($0.00) Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr cardhlder initiated technical requirements D nt stre the credential if the authrizatin request r Accunt Verificatin Request ($0.00) is declined Transactin Prcessing Requirements- Cardhlder Initiated Subsequent Transactins Subsequent Transactins The transactin must be authrized Submit the apprpriate authrizatin and settlement indicatrs. CLICK HERE fr cardhlder initiated technical requirements The merchant must validate the cardhlder s identity (example: lgin ID and passwrd) prir t prcessing each transactin Cancellatin Prcedures- Cardhlder Initiated The merchant must prvide a simple cancellatin prcedure t the cardhlder. If the cardhlder s rder was initially accepted nline, the merchant may prvide an nline cancellatin prcedure. The merchant cannt cmplete a transactin when: The transactin is beynd the agreed upn duratin by the cardhlder The cardhlder request that the merchant change the payment methd Cardhlder cancels within the terms f the cancelatin plicy The merchant receives a decline respnse

13 Cardhlder Initiated INITIAL/FIRST Nte: This is nt an all-inclusive list f BAU fields. First Time a Credential is Stred Merchant t ask the cardhlder if they d like the merchant t stre their payment credential (card) fr future transactins prir t submitting the initial/first authrizatin request. The transactin must be authrized Submit an authrizatin request fr the amunt due If payment is nt required, submit an Accunt Verificatin Request ($0.00) Submit the apprpriate authrizatin and settlement fields D nt stre the credential if the authrizatin request r Accunt Verificatin Request ($0.00) is declined Optin 1 Optin 2 During the Transactin (CP, CNP, ecmm) Authrizatin/Settlement Accunt Verificatin Message ($0.00) Authrizatin Request Only POS Envirnment Field POS Envirnment Field ISO8583- new field 62.68, new value C ISO8583- new field 62.68, new value C 610 Spec- new G009.27, new value C 610 Spec- new G009.27, new value C Batch Auth Spec- existing Additinal Request Addendum, new value C Batch Auth Spec- existing Additinal Request Addendum, new value C EMD Settlement Spec- Visa Transactin Cde 41, Frmat Versin 2, POS Env. Ind new value C POS Cnditin Cde ISO8583- existing field, value 51 (Acc # Verify) 610 Spec- existing field Merchants must cntinue t send the necessary BAU fields (e.g., POS entry mde, MOTO ECI etc.) t identify initial card present, card nt present, e-cmmerce and Accunt Verificatin transactins prperly. Nte: Mastercard and Discver s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins. Cardhlder Initiated SUBSEQUENT Nte: This is nt an all-inclusive list f BAU fields. Authrizatin/Settlement Mastercard (available June 18, 2018) and Discver (available in Octber 2018) POS Entry Mde ISO8583- existing field 22, new value Spec- existing field 22, new value 10 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10 EMD Settlement Spec- Visa Transactin Cde 40, Detail Trans. Recrd 1, POS Entry Mde new value 10. This value must be sent in settlement and match frm auth. Nte: Cardhlder Initiated transactins may ccur in varius POS envirnments (e.g., face-t-face, phne, e-cmmerce) Nte: Fr split shipments see Reauthrizatin sectin f this dcument. Nte: Mastercard and Discver s COF Framewrk nly requires the POS Entry Mde f 10 (auth and settlement) in subsequent transactins.

14 Resubmissin Resubmissin may be used by a merchant that is string r nt string a payment credential. Use Case: A merchant perfrms a resubmissin when an authrizatin was declined due t insufficient funds after gds r services were already delivered t the cardhlder. Merchants can resubmit the auth request t recver utstanding debt frm the cardhlder. Recurring, installment, unscheduled credential n file, transit merchants. When an authrizatin is declined the merchant may perfrm the fllwing: Resubmit the authrizatin up t 4 times within 16 calendar days (14 calendar days fr Visa tkens nly) frm the date f the riginal decline respnse, in an attempt t receive an apprved authrizatin. The resubmissin f authrizatin can nly be perfrmed when the riginal decline respnse cde was ne f the fllwing: 05 (Authrizatin declined) 51 (Insufficient funds) 61 (Exceeds apprval amunt limit) 65 (Exceeds withdrawal frequency limit) SUBSEQUENT Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Authrizatin/Settlement Resubmissin may be used by a merchant that is string r nt string a payment credential. POS Entry Mde (This value must be 10 when the merchant is using a stred payment credential) ISO8583- existing field 22, new value Spec- existing field 22, new value 10 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10 Settlement- this value must be sent in settlement and match frm auth EMD- Detail Transactin Recrd 1, existing field, new value 10 Nte: POS Entry Mde f 10 identifies when the transactin was prcessed using a credential n file. If credential is nt n file, the POS Entry Mde value must be 01. Reasn Cde (This field and value is required when the merchant is string r nt string a payment credential) ISO8583- existing field 63, new value Spec- TBD Batch Auth Spec- existing Additinal Request Addendum, new Subsequent Transactin Reasn Cde Field, new value 1 Settlement- N/A Tran ID (retained frm the declined auth respnse) in auth request. This is a new actin step. (This field and value is required when the merchant is string r nt string a payment credential) ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- Additinal Request Addendum, Recrd Type DA- Field- Visa Tran ID Settlement- this value must be sent in settlement and match the value frm the auth respnse Nte: See recurring payment, installment and unscheduled credential n file sectins f this dcument fr additinal infrmatin regarding when a resubmissin may be used by the merchant.

15 Reauthrizatin Reauthrizatin may be used by a merchant that is string r nt string a payment credential. Use Case: A merchant initiated transactin using stred credentials initiated if the riginal rder r service extends beynd the authrizatin validity limit set by Visa. Split shipment when gds are nt available fr shipment at the time f the cnsumer s purchase (e-cmmerce r MT). A separate authrizatin is cnducted t ensure the custmer s funds are available when the gds becme available t ship. SUBSEQUENT Nte: This is nt an all-inclusive list f all applicable Business As Usual (BAU) fields. Authrizatin/Settlement Reauthrizatin may be used by a merchant that is string r nt string a payment credential. POS Entry Mde (This value must be 10 when the merchant is using a stred credential) ISO8583- existing field 22, new value Spec- existing field 22, new value 10 2 Batch Auth Spec- existing Primary Transactin Detail Recrd, new value 10 Settlement- this value must be sent in settlement and match frm auth Nte: POS Entry Mde f 10 identifies when the transactin was prcessed using a credential n file. If credential is nt n file, the POS Entry Mde value must be 01. Reasn Cde (This field and value is required when the merchant is string r nt string a payment credential) ISO8583- existing field 63, new value Spec- existing field G046 values , new value 43 Batch Auth Spec- existing Additinal Request Addendum, new Subsequent Transactin Reasn Cde Field, new value 3 Settlement- N/A Tran ID (Tran ID received frm the first transactin) in auth request. This is a new actin step. (This field and value is required when the merchant is string r nt string a payment credential) ISO8583- existing field 61 usage 01 subfield Spec- existing field G012 Batch Auth Spec- Additinal Request Addendum, Recrd Type DA- Field- Visa Tran ID Settlement- this value must be sent in settlement and match the value frm the auth respnse See cardhlder initiated sectin f this dcument fr additinal infrmatin fr when a reauthrizatin may be used by the merchant.