1. ETA UNIVERSITY MARCH 19, 2015 Deana Rich R ICH C ONSULTING, I NC. Edward A. Marshall A RNALL G OLDEN G REGORY LLP Payments 101: Overview of the Payments Ecosystem

2. The Ecosystem and its Components

3. Open-Loop Model

4. Card Networks and Member Banks

5. Card Networks  Visa, MasterCard, and Discover (see also American Express)  Provide infrastructure and brand acceptance  Clear and settle transaction information (not funds)  Establish interchange system and set rates (paid to issuer)  Accept dues and assessments  Establish and manage compliance with operating rules and regulations

6. Card Networks and Member Banks Member Banks (Acquiring and Issuing)  Regulated financial institutions  Must comply with network/brand rules and regulations  May issue cards and/or acquire transactions directly

7. Card Networks and Member Banks Issuing Banks  Consumer “on-ramp” to the payments ecosystem  Contract directly with consumer (cardholder); bill and receive reimbursement from cardholder  Receive interchange fees from acquiring bank  Settle transactions with acquiring banks (via networks)  May also offer prepaid e.g., JPMorgan Chase & Co.; Capital One; U.S. Bank

8. Card Networks and Member Banks Acquiring Banks  Merchant side of payments ecosystem  May sponsor agents, including processors and ISOs (“acquirers”)  Responsible for compliance with card networks’ rules and regulations  Carry and manage ALL risk associated with agents and their customers (merchants) e.g., BMO Harris Bank; Wells Fargo; HSBC Bank

9. The Acquirers

10. “Acquirers,” a Versatile Concept  Acquiring Banks  Processors  ISOs  Sub-ISOs  Sales Agents Merchant “on-ramp” to the payments ecosystem Contract with, bill fees to merchants Collect interchange fees from merchants through “discount rate” Must comply with networks’ rules and regulations

11. The Acquirers Processors  Provide connectivity to networks for purposes of authorization (front-end), clearing and settlement (back- end)  Provide various levels of back- office support  Execute agreements with Member Bank, ISOs  Can, and frequently does, also function as an ISO (recruiting merchants through salesforce) e.g., First Data; TSYS; Global Payments; Heartland; Worldpay

12. The Acquirers ISOs and Sub-ISOs  Independent Sales Organizations  Sponsored by Acquiring Bank  Sell payment acceptance access to merchants  May also provide various levels of back-office support (e.g., customer service, tech support, statements and reporting) and additional features  May have downstream agents (sub- ISOs or sales agents) also selling for them

13. The Acquirers Retail (Non-Risk-Bearing) ISOs  Entrust risk monitoring and underwriting to processor or other ISO Wholesale (Risk-Bearing) ISOs  Conduct own underwriting and risk monitoring, subject to oversight  Indemnify banks and processors for losses related to returns, chargebacks, fraud, and data breaches  Banks and processors maintain liability for all downstream activity

14. A Day in the Life of a Transaction

15. A Day in the Life: Payment Authorization

16. A Day in the Life: Settlement Interchange fees paid to issuing bank Additional fees collected by processor, acquiring bank, and ISO for services

17. Ecosystem Risk

18. Minimal Cardholder Risk Regulation E Regulation Z Credit CARD Act of 2009 Chargeback Protections

19. Chargebacks Dissatisfied consumer can contest a charge (e.g., unauthorized transaction, did not receive purchase, defective purchase, deceptive merchant conduct) Issuing Bank removes from statement; recoups money from Acquiring Bank Acquiring Bank recoups from Processor and/or Risk- Bearing ISO, and, ultimately, Merchant* Card Networks resolve disputes regarding chargeback validity (consumer friendly)

20. Ecosystem Chargeback Risk Merchants may lack financial wherewithal to pay chargeback(s) Thus, Acquiring Bank, Processor, and/or Risk- Bearing ISO may shoulder responsibility Importance of Underwriting, Risk Monitoring, and Reserves *

21. Liability Value Chain and Industry Oversight Liability Value Chain  Card Networks  Member Banks  Risk-Bearing ISOs  Merchants Industry Oversight  Card Network Rules  Industry Guidelines (ETA)  Bank Regulators  Non-Banking Regulators

22. Data Breach Protection (and Risk) PCI DSS  Evolving standards to keep data secure  Validation and compliance testing required by PCI Council and card networks (by merchant level) EMV: Security at POS Encryption: Security for Authorization Transmission Tokenization: Security Post- Transaction

23. Data Breach Risk at Merchant Level Consumer Notification (State Law Patchwork) Card Network Liability  Forensic investigations  Non-compliance liability assessments  Card reissuance cost, data breach assessments, and fraud reimbursement schedules Legal Risk  Consumer and shareholder litigation  FTC action

24. Data Breach Risk within the Ecosystem Accepting merchants and consumers are largely insulated from counterfeit card fraud loss Acquiring Bank, Processor, and/or Risk Bearing ISO bear ultimate liability for Fines, Assessments, Reissue Costs (by merchant level) Issuing Bank bear risk for remainder Impact of EMV

25. © 2015 | All Rights Reserved Deana Rich President R ICH C ONSULTING, I NC. deanarich@deanarich.com 818.787.5837 www.deanarich.com Edward A. Marshall Partner A RNALL G OLDEN G REGORY LLP edward.marshall@agg.com 404.873.8536 www.agg.com Questions