SECTION 3 Operating Rules and Regulations without the prior written permission of CO-OP Financial Services. All Rights Reserved
Card Issuers shall have the following responsibilities in addition to those responsibilities applicable under Section 2 hereof where the Card Issuer may also be an ATM Owner. NOTE: CO-OP Network PIN POS Service transactions must adhere to Star Network Operating Rules. 3.1 OWNERSHIP AND CONFIDENTIALITY Card Issuers understand and agree that the computer programs and CO-OP Network supported files and data bases (excluding the Card Issuer Files as defined herein) made available by CO-OP Network as part of the services, are the exclusive and confidential property of CO-OP Financial Services or the third parties from whom CO-OP Financial Services has secured the right to use such computer programs and CO-OP Network supported files and data bases. The Card Issuer shall treat as confidential and will not disclose or otherwise make available any CO-OP Network services, trade secrets, processes, proprietary data, information or documentation related thereto (collectively the "Confidential Information"), in any form, to any person other than employees of the Card Issuer. The Card Issuer shall instruct its employees who have access to CO-OP Network services and the Confidential Information to keep the same confidential by using the same care and discretion the Card Issuer uses with respect to its own confidential property and trade secrets. Upon termination of the agreement with CO-OP Network for any reason, the Card Issuer shall return to CO-OP Financial Services any and all copies of CO-OP Network products and the Confidential Information, which are in its possession. Card Issuers are required to sign a confidentiality agreement with CO-OP Financial Services. 3.2 QUALIFIED CARD SPECIFICATIONS Within twenty-four (24) months from the executed Agreement date, the Card Issuer is responsible for the CO-OP Network logo Mark appearing on all cards excluding Credit Cards, which serve as access devices to CO-OP Network. The logo Mark shall be displayed as specified in the CO-OP Network Graphic Standards. No Card Issuer shall permit the CO-OP Network logo Mark to appear on any plastic card unless the Card Issuer issues the card and complies with all other terms and conditions of these ORRs pertaining to the use of the CO-OP Network logo Mark. Each Chip embedded on a plastic card or a Companion Device issued by the Credit Union must be personalized with a U.S. Debit AID. 3.3 PIN ISSUANCE Each Card Issuer shall ensure that each of its Cardholders has a PIN, which shall consist of four (4) to twelve (12) characters. REVISED 9/17 Page 27
3.4 MAGNETIC STRIPE/CHIP/EMBOSSEDND PRINTING INFORMATION A. Requirements Each plastic card that has a magnetic stripe and Chip shall be usable in all standard magnetic stripe and Chip card reading devices and shall meet the following requirements: 1. Have a card number, within which number shall be information uniquely identifying the Card Issuer pursuant to the International Standards Organization (ISO) standards, a six (6) digit number, or bank identification number (BIN) as defined by Visa or MasterCard; 2. The Primary Account Number (PAN) associated with each card to be processed within the shared network will be the principal field utilized for routing transactions to Cardholder Processors for authorization and transaction processing. The primary account number can be up to 19 digits in length (16 or 19 digit PANs are preferable). All digits will be numeric. The card must be embossed or printed with the complete PAN; 3. The PAN will include the ISO number of the Card Issuer and the individual account number of the member. The PAN must contain a transposition check digit, which may be used to verify the accuracy of information during transmission of EFT transactions; 4. Have an expiration date, which shall specify an actual date after which date the card shall cease to be valid, such date being a date later than the date of the issuance of the card. The expiration date must be encoded as "yymm". Two (2) to three (3) years are recommended. 5. Cards with magnetic stripes must be encoded with both Track 1 and Track 2. B. Embossed/Printing PAN and Signature Panel Each plastic card shall also have the PAN fully embossed or printed on the face of the card and shall contain a signature panel on the back of the card. It is recommended that the member's full name and an expiration date be embossed or printed on the face of the plastic card. C. Exceptions A Card Issuer which currently has plastic cards not conforming to ISO standards and does not have the PAN fully embossed or printed on the face of the card or signature panel on the back of the card, will have twenty-four (24) months from the date the agreement was executed to conform its cards. D. Card Format All plastic cards shall conform to the ISO and applicable EMVCo compliance standards for embossing or printing and type of plastic as well as any other standards and specifications provided in this section. REVISED 9/17 Page 28
E. Point-of-Sale Participation A Card Issuer joining CO-OP Network participating in the on-line POS program(s) offered by CO-OP Network, or by its regional network of choice, must abide by the following: 1. The applicable regional network will stand in for CO-OP Network in the event CO-OP Network is unavailable. The Issuer must comply with minimum daily stand-in limits as prescribed by the regional POS network. 2. Authorization Processor; The daily and stand-in POS limit per Cardholder may or may not be combined with the ATM daily limit and may not be less than $250 for purchases and/or $100 for cash back. Testing and certification may be required; 3. Cardholder/Intercept Processors; The daily and stand-in POS limit per Cardholder may not be less than $250 for purchases and/or $100 for cash back. Testing and certification may be required. Other information: PIN length is variable between four (4) and twelve (12) digits long. Transposition Check Digit is calculated by using the Mod 10 check digit (2-1-2) method. 4. The Card Issuer must abide by the ORRs of their POS Programs of which the Card Issuer is a member. F. Tokenization Participation A Card Issuer shall ensure that its authorization system performs the following: A. Performs authorization in accordance with the technical specifications for each transaction initiated with a Token PAN containing a Token BIN assigned to such Card Issuer; B. Is capable of receiving the true PAN in an authorization request provided, however, that it may elect to receive the Token PAN in addition to the true PAN. Each Card Issuer that participates in Tokenization authorizes CO-OP Financial Services at CO-OP s discretion, to communicate on behalf of such Card Issuer with such Card Issuer s Token Service Provider (TSP) for the purpose of performing functions related to such program. G. Plastic Cards Without CO-OP Network Logo Mark A Card Issuer with existing plastic cards will have twenty-four (24) months from the date the agreement was executed to display the CO-OP Network logo mark on the back of the plastic card, excluding Credit Cards. H. Algorithm Supported The Switch supports DES and Diebold PIN Algorithms. Each credit union is responsible to maintain its PIN Validation key. If this key is lost, the cards issued by the credit union may have to be reissued. I. Chip Issuance and Participation A Card Issuer shall issue CO-OP Network cards, and may, at its option, issue a Companion Device for each such CO-OP Network card. Each CO-OP Network card or Companion Device may, at the Issuer s option, have an embedded Chip that meets the applicable EMVCo compliance standards, unless otherwise approved by CO-OP Financial Services. CO-OP Network cards must support the REVISED 9/17 Page 29
CO-OP Network transactions as set forth in these ORRs and must be able to access all CO-OP Network ATMs. 3.5 OTHER NETWORK AFFILIATION A Card Issuer participating in regional and/or national networks must support the transactions set for each network and abide by the ORRs set forth by each network. If a Member Institution not an Issuer in CO-OP Network Deposit Program, participation is optional as an Acquirer; however, if the Member Institution participates in any Shared Deposit Network Program, participation in CO-OP Network Deposit Program is mandatory. 3.6 RESPONSIBILITIES TO CARDHOLDERS Each Card Issuer shall fully comply with all applicable federal, state and local laws, rules, and regulations, including, but not limited to, those requiring initial disclosure and periodic reporting statements to its Cardholders. Such compliance shall not be the responsibility of CO-OP Network. Further, except as otherwise stated herein, such compliance shall not be the responsibility of another ATM Owner. A Card Issuer shall use and shall instruct Cardholders to use CO-OP Network in accordance with these ORRs, as may be modified from time to time, and in accordance with any other materials furnished by CO-OP Financial Services to the Card Issuer. A Card Issuer is solely responsible for the consequence of any instructions it may give Cardholders who use credit union ATMs, the ATMs of any other financial institution and the ATMs of CO-OP Network or any third party through which CO-OP Network may be obtained. A Card Issuer is also responsible for the consequence of the Cardholder's failure to properly access CO-OP Network in the manner prescribed by CO-OP Network or for the Cardholder's failure to supply accurate input information. 3.7 ATM TRANSACTION TYPES Each Card Issuer must certify that its host processor is capable of processing any or all of the following ATM types of transactions for CO-OP Network: A. Envelope, Non Envelope, Cash and Check Deposits to share and share draft and other accounts; B. Cash withdrawals from share, share draft, credit and other accounts; C. Balance inquiries to share, share draft, credit and other accounts; D. Transfers to and from share, share draft and other accounts; and E. Reversals. Each Card Issuer must be capable of processing a CO-OP Network transaction initiated by reading the Common U.S. Debit AID from a Chip if such AID is present and such Card Issuer is capable of processing, through another network, transaction initiated with a Chip. Card Issuers shall not transmit any positive Available Balance or POS Balance that includes amounts available through an overdraft protection program, other than a line of credit that is subject to Reg Z (12 C.F.R. Part 226), in response to an Authorization request for a balance inquiry or for any other purpose. If a Card Issuer authorizes transactions on the basis of funds available through an overdraft protection program, other than a line of credit that is subject to Reg Z (12 C.F.R. Part 226), the Card Issuer must appropriately disclose to its Cardholders that (i) it may authorize and complete transactions by drawing on the overdraft protection program, and (ii) the access account balance it provides in connection with transactions does not include amounts available through an overdraft program. Card Issuers may make such disclosures through a method outside the network (e.g., account terms and conditions). REVISED 9/17 Page 30
3.8 DEPOSIT LIMITS Card Issuers participating in the CO-OP Network Deposit Program are responsible to determine the maximum dollar amount allowable for deposits made by their Cardholders to a CO-OP Network ATM. REVISED 9/17 Page 31
3.9 POINT-OF-SALE TRANSACTION TYPES A. Each Card Issuer shall ensure that it is capable of electronically processing POS transactions involving purchase of goods and services and reversal of such transactions. B. POS transactions shall be supported and accessed through a transaction account as defined by Reg D. C. The following POS transactions are allowed: 1. Purchase from funding; 2. Purchase with cash back excluding Credit Card transactions; 3. Balance inquiries excluding Credit Card transactions; 4. Pre-authorization and pre-authorization completion. No pre-authorization completion amount may exceed the authorized amount; 5. Partial approval with purchase, excluding Credit Card transactions; 6. Cash only without the purchase of goods or services; and 7. Merchandise correction to funding. 3.10 AUTHORIZATION PROCESSOR Each Authorization Processor shall operate in accordance with the standards established by CO-OP Network. 3.11 STAND-IN PROCESSING Stand-in Processing by CO-OP Network on behalf of the Card Issuer/Intercept Processor will be mandatory for all ATM and POS transactions. All Cardholder Processors must support online Negative Status messages in support of stand-in Authorization. 3.12 ATM STAND-IN LIMIT The daily stand-in limit for ATM transactions for Cardholder Processor/Intercept Processor on CO-OP Network will be a minimum of $101.00. 3.13 RECORD RETENTION Each Card Issuer shall maintain a record of each ATM or POS transaction received for a minimum of two (2) years or as is required by applicable federal, state or local law, rule or regulation. REVISED 9/17 Page 32
3.14 CARDHOLDER ERROR RESOLUTION It shall be the Card Issuer's responsibility to comply with Reg E (Reg Z for Credit) in addressing and resolving Cardholder errors in accordance with procedures set forth for CO-OP Network or Adjustment procedures defined by other networks accessed. Except as otherwise set forth herein, although ATM Owners shall not be responsible for Reg E (Reg Z for Credit) compliance, ATM Owners shall cooperate in full and in a timely manner with Card Issuers in addressing and resolving Cardholder errors. All Chargebacks initiated by a CO-OP Network Card Issuer for transactions occurring between CO-OP Network participants must be processed via DataNavigator. Card Issuers that fail to comply may be held liable for any loss. 3.15 TRANSACTION LIABILITY Effective October 1, 2017, no Card Issuer shall be liable for a CO-OP Network transaction initiated at a CO- OP Network ATM if: 1. Such ATM is not equipped with a Chip reading device that complies with the requirements (See Section 2.1.I.); 2. Such plastic card or Companion Device has an embedded Chip capable of initiating a CO-OP Network ATM transaction; and 3. Such transaction is later disputed as counterfeit fraud. 3. 16 DOWNSTREAM PROCESSORS No more than two (2) Processors, the Third Party Processor that is directly connected to the Switch and the credit union host processor may process/authorize card transactions acquired at CO-OP Network ATMs. 3.17 USE OF NETWORK Card Issuer shall not, except as otherwise expressly permitted by CO-OP Financial Services in writing, sell, lease or otherwise provide, directly or indirectly, any of the CO-OP Network services or any portion thereof to any third party, except permitting the use of CO-OP Network by Cardholders and customers of other institutions licensed to use CO-OP Network. Card Issuer shall not make any alteration, change or modification to any of the computer programs and/or files and data bases (except the Card Issuer's files as defined in Section 5.2, hereof) made available by CO-OP Network to Card Issuer as part of CO-OP Network without prior written consent in each instance which may be withheld at the sole discretion of CO-OP Financial Services. Card Issuer shall process all transactions including processing member PIN-based transactions through CO-OP Network with the exception of Intercept Processor On-Us transactions and acquired transactions bound for a non CO-OP Network entity. 3.18 TRANSACTION ROUTING A. Priority Routing All transactions, without exception, initiated by a Cardholder of a CO-OP Network credit union at an ATM owned, controlled, or operated by another member of CO-OP Network must be routed exclusively through the CO-OP Network Switch. B. PIN-based Transactions REVISED 9/17 Page 33
Any and all BINs associated with the credit union must be processed and routed exclusively through the CO-OP Network Switch for PIN-based transactions (i.e., PAVD, Maestro, etc.). 3.19 NETWORK ACCESS PARTICIPANT Credit unions who wish to connect to CO-OP Network via a Third Party Processor are Network Access participants, and sign a CO-OP Financial Services Agreement or other agreement as may be designated by The Third Party Processor must link directly to the Switch and route all CO-OP Network transactions to the Switch, including, but not limited to, CO-OP Network PIN POS Service. 3.20 THIRD-PARTY PROCESSORS Switch will settle funds and fees for CO-OP Network credit unions behind Third Party Processors. The settling agent must be approved by CO-OP Network. Adjustment processing must be accomplished in accordance with CO-OP Network standard procedures in order to control the impact of all CO-OP Network members. 3.21 LIABILITY OF PARTICIPANTS Failure to comply with the rules and requirements as set forth in these ORRs will result in an assessed fine of up to $5,000.00 per incident and/or termination from CO-OP Network. Each day on which there is a failure to comply with the ORRs is a separate incident for purposes of this paragraph. REVISED 9/17 Page 34