3. The PCIO will specify the merchant s requirements for meeting the PCI DSS and Vanderbilt University policy.

Transcription

1 Procedure Subject Approval for Merchant Set Up FINAL Effective July 29, 2015 Revision Revision Review Responsibility PCI Compliance Office PURPOSE The process for determining whether to approve a department s request for accepting payment cards is a complex and multi-step process. Therefore, the purpose of this document is to detail the procedure to be followed when processing new merchant account requests and modifications to existing merchant accounts. PROCEDURE If a department contacts Treasury or VUMC Finance to request a new merchant account (MID), VUIT/HITS for assistance in developing or implementing any IT application that can accept payment cards, or Procurement/OGC/VUMC medical sourcing areas to assist with the purchase of an IT application that can accept payment cards, the department contact must be referred to the PCI Compliance Office (PCIO) to ensure that all requirements of the PCI Security Standards Council s Data Security Standards (PCI DSS) will be met before any action is taken to set up the MID. PROCEDURE STEPS and RESPONSIBILITIES The following steps should be followed when contacted by a department requesting the ability to accept credit cards: 1. The department will submit a Request to Process Credit Cards to the PCI Compliance Office (See Attachment A ). This must be done BEFORE any software has been purchased or a contract signed. Note: The departmental employee who submits a request to process payment cards must be a business officer, administrative officer, fiscal officer or equivalent position, as does the merchant account and PCI compliance responsible person. 2. The PCI Compliance Office will schedule a meeting with the department and the payment application IT or third-party hosting IT team, as needed, to document how payment cards will be processed and determine whether the payment application meets compliance requirements. 3. The PCIO will specify the merchant s requirements for meeting the PCI DSS and Vanderbilt University policy. 4. Once the PCI Compliance Office approves the method by which credit cards will be processed, a merchant application can be processed and/or payment application developed/purchased. VUMC Finance or VU Treasury will copy the PCIO on the sending the application to the acquiring bank. Note: The departmental employee who submits an application for a new merchant account must be a business officer, administrative officer, fiscal officer or equivalent position, as does the merchant account and PCI compliance responsible person. 5. Merchants must use Elavon as their acquiring bank and use the gateway Converge (formerly Virtual Merchant). The only rare exceptions can be approved through Treasury. Page 1 of 2

2 6. When a MID has been assigned to the merchant by Elavon through VUMC Finance or Treasury, the PCIO must be notified by these areas so that it will have record of the MID. The PCIO will be responsible for ensuring Elavon sets up the MID in TrustKeeper. 7. The PCI Compliance Office will ensure that all employees in contact with the cardholder data environment are enrolled in PCI compliance training; however, supervisors and individual employees can also enroll staff and themselves in training. This is done as follows: a. Sign into Learning Exchange b. Select Admin as the role. c. Choose Learners on the left toolbar choose Enrollments on the left toolbar. d. In the Course field type in PCI compliance and all courses related to PCI compliance will be available in the drop down box. e. Choose the current PCI compliance course. f. Enter the employee name or VUNet ID and Enter. g. On the right side of the screen click on the Enroll field and click on Apply Changes. h. The employee will be entered into training. 8. Once all previous steps have been successfully completed, a TrustKeeper account will be created for tracking PCI compliance and the PCI Compliance Office will the merchant with instructions for setting up their account and completing their initial self-assessment questionnaire (SAQ). 9. When training has been completed and we have received the signed certificate of compliance, the merchant may begin transacting on the account. 10. If the merchant needs assistance with the self-assessment questionnaire (SAQ) contact the PCIO. DEFINITIONS Merchant A unit that accepts payment cards as payment. Merchant Account (also known as Merchant Identification Number or MID) An account established by a bank to credit payment amounts and debit processing fees for a designated unit. Payment Card Industry (PCI) Comprised of the five major card associations including Visa, MasterCard, American Express, Discover and JPM. The council is responsible for the development, management, education, and awareness of the PCI Data Security Standards. PCI Data Security Standards A worldwide set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. Acquiring Bank- typically a financial institution that processes payment card transactions for merchants. It is defined by a payment brand as an acquirer TrustKeeper the website used to submit the self-assessment questionnaire Page 2 of 2

3 Vanderbilt Business Services Attn: PCI Compliance Office PMB Request to Process Credit Cards Information needed to obtain a Merchant Identification Number or MID In order to allow sufficient time for evaluation of this request, coordination with the credit card processing bank, merchant training and receipt of card processing equipment, this request must be submitted at least 30 days prior to anticipated credit card processing. Return approved form to kim.stansell@vanderbilt.edu Questions may be directed to Kim Stansell at Departmental Information Department, Program, or Clinic Name DBA Name ( Doing business as name what you want to be called. For example, VUMC Sports Medicine, VU Math Department **Do not use Vanderbilt University or VUMC**) Physical Location Address with ZIP code Mailing Address with ZIP code Will the credit card processing equipment be located at this address? If not, please indicate physical location of equipment. Campus Mail Address Business Need for Merchant Account Describe departmental goods/services offered by accepting credit card payments. When will this merchant account need to be available? (A minimum of 30 days notice is required.) Is this account needed for a limited time? If yes, is it an annual or recurring event? (conference, seminar, etc.) If needed for a limited period of time each year, please indicate months needed (e.g. March 15 June 30). Credit Card Processing Information Describe Anticipated Transaction Processing Methods (e.g., credit card terminals, e-commerce website, outsourced service through third party vendor, etc.) Estimated Total Monthly Sales (dollar volume) Estimated Average Sale per Transaction (average dollar amount per transaction)

4 Credit Card Processing Information (continued) Percentage of credit card sales that will be: (total must equal 100%) In Person: Telephone/Mail/Fax: *e-commerce/website: Other (Please Specify): *If this account will be used for e-commerce sales, list the URL and IP address of the site: URL IP Address * Merchant must follow stringent requirements when using an e-commerce solution for processing credit cards. PCI and VUIT staff will assist in determining if proposed processing method is PCI compliant before merchant account request will be processed. Processing Equipment Number of swipe devices needed? Swipe devices must be customer facing. Will you be using cellular wireless or an analog telephone line device? Swipe devices are not to be installed using VOIP (ex. Lync, DSL). Technical Contact Technical Support Person for this account (LSP, LAN Administrator, etc.) Tech Support Telephone: Tech Support Departmental Approvals Initiator This is the person who has been charged with setting up a new account for the department Fiscal Manager/Administrative Officer Business/Admin/Fiscal Officer Approval (Merchant ID & PCI Compliance Responsible Person) By signing this application, the department head accepts responsibility for adhering to Vanderbilt policies and authorizes any charges/fees associated with establishing and maintaining a merchant account. Department Head/Director/Chair Approval by the Departmental Leader PCI Compliance Office Approval Processing Approvals Approval by the PCI Compliance Office is required before a merchant account request will be processed. Treasury/VUMC Finance Approval Approval required and electronic copy sent to the PCIO

5 Request Processing (To be completed by the PCI Compliance Office) MID received: TID: MID: Number of terminals: Model of terminals: S/N of terminals: