0. Merchant Services – Best Practices and Industry Updates
Robert K. Gongwer
Vice President
Wholesale Merchant Sales Officer
(813)
June 21, 2013
© 2013 Wells Fargo Bank, N.A. All rights reserved. Confidential.

1. Topics I. Understanding & Managing Costs PCI Compliance
Industry and Regulation Updates
Payment Trends & Payment Gateways 1

2. Understanding & Managing Costs

3. Interchange Who Pays for it? What is it?
A percentage fee applied, according to Visa/MasterCard regulations, to the dollar value of each transaction.
What is it?
The fee is paid by the acquirer to the issuer. This cost is then passed through to you.
Who Pays for it?

4. What do Merchants Pay? Components of Merchant Pricing Interchange
Equipment/ Software/ Gateway fees
Assessments & Access Fees
3rd party fees
Monthly service and statement fees
Non Bank auth fees
Compliance fees
Downgrade fees

5. What impacts interchange costs
Payment
Channel
Card
Type
Merchant
Category Code
System
Configuration
Payment Channel
Card Present, Card Not Present / MOTO, E-Commerce, Recurring
Type of Card
Debit, Credit, Rewards, Commercial, Purchase, Business, GSA
Merchant Category Code (MCC)
Relates to product, service, industry, and risk level of business type
System – Terminal, Software, Payment Gateway
Configuration, programming capability, compliant

6. Dodd-Frank Act (Durbin Bill) October 2011
Retailers vs. Big Banks (over 10B)
$35 Billion was up for grabs
Debit Interchange
Previously $0.44
Proposed $0.12
Settled 0.05% + $0.22
Went into effect October 1, 2011
Banks under $10B not affected
Over $10B – issuing side of WF
Fees paid for:
Free Checking accounts
Debit Rewards
Customer Service for accounts

7. Interchange optimization
You are in control.
Best Practice
Address Verification Service
Settle batches on time
Send correct processing flags
B2B Line item details
Review statements monthly and track for anomalies
Be aware of Card Brand changes
Periodic reviews with your acquirer
Why?
Provides some risk mitigation and lower interchange rate
Lower interchange rate, easier reconciliation
Lower interchange rate, improves chargeback rights 
Lower interchange, data passes to Payer
Quickly identifies process issues
Spring/Fall releases often have systemic changes that impact interchange
Confirms process optimization

8. Purchasing Cards - level 2 and 3 data
Did you know?
“Between 2005 and 2007, P-card spend in North America grew from $110
billion to $137 billion. The predicted purchasing card growth rate is 12%
per year between 2007 and 2012 to reach $218 billion.”
Lower your processing costs on commercial cards by collecting Level 2 and 3 data.
The benefits of Purchasing cards (P-cards) are driving preference for level 2 and 3 data enabled merchants.
Source: 2007 Purchasing Card Benchmark Survey Results, RPMG Research Corporation

9. You SAVE Money What if you had a partner to assist?
Review statements to determine opportunities to qualify for better interchange rates
Register with card associations for large ticket programs
Educate on how to pass Level 2 & 3 data with transactions
Outcome = able to quantify the financial impact
What if you had a partner to assist?

10. Where is the opportunity?
You use commercial cards to pay vendors…do you accept them?
Do you accept transactions over $5k?
If so, are you on the Visa/MC Large Ticket programs and passing Level 3 transaction data?
If not, are you passing Level 3 transaction data?
Are you currently storing credit card #’s on your systems or anywhere in your offices?
Are you PCI compliant or challenged with compliance issues?

11. PCI Compliance

12. What is PCI DSS? Payment Card Industry Data Security Standard (PCIDSS)
A common set of industry tools and measurements to help ensure the safe handling of sensitive information.
Developed and managed by the PCI Security Standards Council
Applies to all merchants and third party service providers that
Store/Process/Transmit Card Holder Data
Develop/ Sell Payment Applications

13. Typical Risk any Merchant Faces
Chargeback
Internal
External
Merchants must proactively deploy controls and processes to reduce overall risk exposure associated with bankcard acceptance.

14. Compliance levels Compliance classification level
Number and type of annual transactions
Annual submission of compliant PCIDSS Report on Compliance
Annual submission of PCIDSS Self Assessment Questionnaire
Quarterly network Scan
Level 1
More than 6Million Visa annual transactions
All transaction types
Level 2
(ROC or ISA)
1- 6Million Visa or MasterCard annual transactions
Level 3
20K - 1Million annual Visa eCommerce transactions
Level 4
All other merchants

15. 12 steps to information security
Install a working network firewall. 7
Assign a unique ID to each person
with computer access. 2
Keep security patches up-to-date. 8
Don’t use vendor supplied defaults
for system passwords. 3
Encrypt stored data. 9
Track all user access to data by
unique ID. 4
Encrypt transmission of cardholder data across open networks. 10
Regularly test security systems
and processes. 5
Use and update anti-virus software programs. 11
Maintain a policy that addresses security. 6
Restrict access to data by business need-to-know. 12
Restrict physical access to
cardholder information.
Use these resources to stay on top of data security issues:
pci.trustwave.com/wellsfargo
Wells Fargo Merchant Connect:
Merchant News Express

16. PCI: Remove sensitive payment information off of your system
COST OF NON COMPLIANCE : If a Level 3 merchant is found to be non-compliant they can be fined up to $25,000 per month.
COST OF BREACH : Merchants bear the cost of all card replacements and card holder notifications. Cost per breached record: between $100 and $300.
COST OF CUSTOMERS: The price of your institution's damaged reputation is difficult to quantify ...
COST OF NON COMPLIANCE
PCI Compliance will not get simpler.  It will only get more complex.  The Security Standards Council releases a new version of the PCI DSS about every 2 years and each version is even more complicated than the previous version. No surprise, the average cost of compliance goes up with each PCI DSS release.  There are recurring audits, additional/new hardware requirements needed to meet the advancing compliance regulations, etc. 
But here's the good news.  You can work with Wells Fargo to significantly mitigate and offload PCI compliance risk.  As a PCI Level 1 compliant service provider, our job is to help take the overwhelming challenge of PCI compliance and make it easy for the companies we serve. 

17. Industry and regulatory updates

18. Ongoing Changes for Payments Industry
Regulatory
Debit card use for low-price purchases becoming more expensive
Interchange rules causing discontinuation of rewards programs
Merchant discounts used to build loyalty in lieu or rewards programs
IRS backs down on reconciliation requirements
New fees from the Payment Networks
Interchange amendment debit rate cuts didn’t help consumers
Prepaid card fees face scrutiny as prepaid card products proliferate
IRS backs down on reconciliation requirements: Per IRS deputy commissioner for services and enforcement Steven T. Miller, no reconciliation would be required on 2012 business tax forms such as the 1120 nor in future years. The IRS had earlier said only that no reconciliation would be required on 2011 income tax returns.
Expansion of prepaid cards: American Express and Wal-Mart announcement / Oct 2012 / Bluebird prepaid card card available online at and in more than 4,000 Wal-Mart stores. Customers will be able to load money on to their Bluebird accounts using payroll direct deposit, by snapping a picture of a check with their smartphones using a Bluebird mobile app and loading cash at a Wal-Mart register. Customers will also be able to link a checking, savings or debit-card account to their Bluebird account to transfer funds.
Traditionally sold by alternative financial-services companies such as Green Dot, which has an existing partnership with Wal-Mart; NetSpend and Western Union Co. (WU), the market has recently attracted a slew of mainstream lenders, including American Express, Chase, U.S. Bancorp (USB) and Regions Financial Corp. (RF), as they look for additional revenue sources amid fee limits on other products.
Prepaid card fees and regulation: Banks have been attracted to the prepaid product because unlike traditional debit cards, they are not subject to new limits on so-called debit-card swipe fees that banks charge merchants on every card transaction. The Durbin amendment, a provision of 2010's Dodd-Frank financial overhaul legislation that ushered in the new fee caps, included an exemption for most prepaid cards, allowing issuers of such cards to extract higher fees from merchants. The new U.S. Consumer Financial Protection Bureau earlier in 2012 said it was evaluating the prepaid-card market to determine if new rules were needed to make fees more transparent to customers and ensure the cards are legally subject to the same fraud-resolution requirements as other bank products.
Signs that Apple plans to enter payments arena:
Apple has 400 million active accounts with credit cards registered for its online stores (CEO Tim Cook, June 2012). That's more than PayPal, which has 110 million active accounts (out of 232 million total), and Amazon.com, which reports having 152 million customer accounts. Apple is the only major device manufacturer to not yet incorporate into its phones NFC. Visa Inc. and MasterCard Inc. executives have hinted that they have had conversations with Apple about turning the iPhone into a mobile wallet. Passbook, an application built into iOS6, is a convenient place to hold all the accounts that currently reside in a mobile app or even a leather wallet.
In 2012, Apple acquired mobile security firm, AuthenTec, which makes finger-print scanning technology. The ability to safeguard personal information through this biometric technology could solve one of the big concerns that Apple and others have with mobile payments. In theory, users might have to swipe their fingers on their iPhone screens to complete a purchase instead of entering a PIN or simply tapping the phone against a POS terminal.
Apple makes Authentec proprietery: In Sept 2012, AuthenTec notified existing customers that it will not be offering its security technology to the companies starting next year, causing a "state of panic" as the firms scramble to find comparable replacements.
New entrants into payments
Mobile and digital wallets in spotlight
Google Wallets: Requires NFC and Android on phone
Apple: preparing to enter payments arena?

19. Interchange Settlement: July 2012
Outcomes
$6.6 billion cash payment to class plaintiffs settlement escrow account
Lower credit interchange to 10 basis points (.10%) for 8 months
Providing $1.2 billion to settlement escrow account
Merchants now permitted to surcharge transactions paid with credit
Previously prohibited
Unintended consequences
Surcharges
Percentage or flat rate?
State laws (10) forbid surcharges
POS impact – some equipment may not support surcharges
Systems, operations impacts
Consumer experience: Will they continue to use credit cards?
Next steps
The settlement will not be complete until approved by the U.S. district court, expected mid to late 2013.
Outcome of the settlement is also unresolved because it has come into question due to public opposition coming from Wal-Mart, Target and trade groups representing the nation’s convenience stores and gas stations (NACS) and cooperative grocers (NCGA), among others.
We won’t have final details until after the agreement is approved by the court, we will keep you informed as we learn more. We at Wells Fargo are pleased that the parties have reached a tentative settlement and look forward to getting this matter behind us so we can continue focusing on helping our customers succeed financially.
Merchant Q&A
1 ) How will I get my settlement money? _ It is our understanding that distribution of the settlement funds will be administered by the Class Plaintiffs attorneys under the supervision of the court. We have been informed distribution will not be made before mid-to-late 2013.
2) How will I know if I am eligible for settlement money?_ We believe that you will receive notice of eligibility for settlement money from a representative of the Class Plaintiffs.
3) I wasn’t part of the retailer class or individual claim. Can I join now so I can get some of the settlement money? _ We were required to provide contact information for all of our Wells Fargo Merchant Services customers during the class period, and it is our understanding that a class representative intends to use this information to provide you with notice about, among other things, your rights if you are a class member. It is our understanding that you will be receiving notification from a representative of the Plaintiffs Class if you are eligible to participate in the class settlement
4) The new surcharge: Will it be a flat rate or a percentage of my customer’s transaction?_ We anticipate that we will be able to provide more information about the surcharging limitations once the settlement has been finalized. It is our understanding that any state laws restricting or prohibiting surcharging practices by merchants would not be affected by the settlement after it is finalized.
5) The new surcharge: I am concerned about my customer’s experience and a drop in business if I begin to impose a surcharge to my customers if they use a credit card. Will this be mandatory? _ It is completely at your discretion whether you charge your customers a surcharge for a credit card transaction, subject to maximum surcharge limitations. We agree it is possible that consumers may not like this and it may cause them to complain or stop shopping at your establishment. You should weigh all these potential impacts. Also, your customers may be confused over why you are charging a surcharge when others are not.
6) The new surcharge: How will I disclose the surcharge to my customers? _ Unfortunately, we cannot confirm the details on this until the settlement is finalized. However, we anticipate that you may be obligated to include certain disclosures about your surcharging practices at the entrance to your business, at your point of sale, in your online environment where your credit card acceptance is disclosed (if applicable), and on cardholders’ transactions receipts.
7) What changes can I expect to see from Wells Fargo? _ Until the settlement is final with all rules established, we won’t know all the details. But we are closely monitoring developments with this settlement and will provide as much information as we can to our customers as it becomes available.

20. PayPal and Discover to engage in joint effort
Discover and PayPal recently announced a plan to enable participating merchants to accept PayPal through their existing relationship with Discover.
Overview
PayPal’s 50 million active U.S. customers will be able to potentially take advantage of Discover’s 7 million locations across the U.S. and international merchants in the future.
This joint venture will create an alternative payment option for consumers at the point of sale.
Timing
PayPal and Discover are expected to provide PayPal’s new rules and interchange pricing in Q for changes anticipated to be implemented in the Q2 of 2013.
Customer impacts
PayPal as a fifth payment network may require a number of changes for Wells Fargo Merchant Services and our customers.
These may include legal changes to existing documents, system changes, additional Payment Networks processing updates and increased communication with merchants to explain the new requirements.
Background
On August 22, PayPal and Discover made a joint announcement: Starting in 2013, Discover will work with PayPal to enable participating merchants to accept PayPal through their existing relationship with Discover.
This is an extension of PayPal’s offline strategy. PayPal’s 50+ million active U.S. customers will be able to potentially take advantage of Discover’s 7+ million locations across the U.S. and international merchants in the future.
According to Diane Offereins, President, Discover Payment Services, “the establishment of this relationship is a major industry milestone, which will help shape the emerging payments landscape by bringing together an established direct banking and payments company with a leading commerce enabler to create an alternative payments option for consumers at point of sale.”
WFMS Talking Points
We at Wells Fargo Merchant Services are currently working with PayPal and Discover to better understand how this new partnership will impact our customers and our business.
PayPal and Discover are expected to provide PayPal’s new rules and interchange pricing in October 2012 for changes anticipated to be implemented in the second quarter of 2013.
Merchant FAQs
What does this mean? [Or, what are the benefits of the agreement?] _ Once the details are made available by PayPal and Discover, this agreement may allow PayPal customers increased access to their accounts and may provide participating merchants who accept Discover with an additional payment option for their customers. We believe that details of the rules and interchange pricing will be available in October 2012.
How will this work? _ We believe PayPal will issue access devices to its customers that may be able to be used at merchant locations where Discover is accepted. Additional details on how this new network will function will be provided to our merchants as they become available from PayPal and Discover.
When can I (the merchant) start accepting PayPal? _ We anticipate that PayPal will establish its rules and interchange rates in October Once they are available we will need to evaluate any possible operating impacts to our merchants and to our business. The earliest we expect any transactions to begin being processed is in the second quarter of 2013.
How will I (the merchant) be notified of the changes?_ Once we know details of the changes we at Wells Fargo Merchant Services will notify our merchant [customers].
What changes can I expect to see from Wells Fargo?_ We believe that working with a fifth payments network will require a number of changes. These may include legal changes to existing documents, system changes, additional Payment Networks processing updates and increased communication with our merchants to explain the new requirements. Once we receive the rules and interchange pricing from PayPal and Discover we will have a greater understanding of all the changes involved. We will keep you informed as we learn more.

21. Trends in purchase volume
American Express® overtook MasterCard® to gain 2nd place among general purpose credit card brands in the U.S.
Discover® reached parity with Visa® and MasterCard in the number of U.S. card acceptance locations.
Visa debit cards and credit cards generated the most purchase volume in 2011 vs. all debit and credit products from the other brands.
Source: The Nilson Report, Issue 988, Feb. 2012

22. Payment network changes Moving beyond traditional roles
Visa acquired CyberSource, partners with Square through investment and counsel
MasterCard partners with Google and Citigroup for mobile payments
Networks replace lost revenue with mandated fees; issuer benefits diminish
Visa
FANF: Fixed acquirer network fee
Debit integrity fee
Changes to interchange rates
Interlink switch fee change & new interchange programs
Qualification criteria changes
AMEX
New inbound fee
Discover
Increases assessment fee
Changes to interchange rates
Debit integrity fee changes
Phase 1 of EMV adoption
PIN authenticated Visa debit
MasterCard
Different rates for U.S. consumer debit and prepaid cards
Visa/MasterCard/ Discover
New interchange rates
Qualification (rules) criteria changes
Annual acquirer license fee /Third Party Processor (TPP) Type 3 implemented (Similar to Visa’s Fixed Acquirer Network Fee (FANF)
Payment network adoption of EMV in the U.S.
EMV
Q2 2015: Liability shift for non-fuel merchants
PayPal/Discover
April 2012
Spring release
October 2012
Fall release
December 2012
Check Wells Fargo Merchant Connect for payment network news updated each quarter.
Visit: to reference past issues.

23. EMV benefits for card present retail
Background
Several countries outside of the U.S. have made advancements in payment infrastructures and have strengthened fraud prevention.
Security threats indicate the need to enhance the U.S. payments infrastructure
EMV (Europay, MasterCard and Visa) is a standard for globally interoperable, secure payments, and its coming deployment in the U.S. represents a significant move towards an enhanced payment ecosystem
Merchant benefits of payment network EMV compliance
By supporting EMV, liability for charge-backs and costs of fraud at the point of sale will not shift to merchants once new payment network EMV rules go into effect
Enable more payments from international travelers using their EMV-enabled payment cards
What merchants must do
Install EMV-enabled chip terminals/devices in order to accept EMV-enabled cards

24. Impact of EMV on fraud in Canada
Prior to EMV migration, Canada noticed a spike in counterfeit fraud most likely due to migration of fraud from other countries.
As EMV penetration at POS increased, counterfeit fraud significantly decreased.
Prior to beginning EMV migration, Canada noticed a spike in counterfeit fraud; most likely due to migration of fraud from other countries.
As EMV penetration at POS increased, not only did counterfeit fraud significantly decrease, but other types of fraud showed signs of decline including Card Not Present and Lost & Stolen.
While counterfeit fraud in the U.S. has been slowly increasing since 2005, cross border counterfeit fraud has seen significant growth, as more countries continue to migrate to EMV.
Since EMV penetration in Canada began to climb in 2009, cross border counterfeit has shown significant growth in the U.S.
Source: MasterCard Analysis, 2012
** % face-to-face EMV penetration.

25. EMV implementation timeline
Visa
MasterCard
Discover
American Express
Oct 2013
Merchants may receive PCI validation relief upon adoption of EMV enabled chip terminals.
PCI relief if 75% of transactions originate from chip terminals.
Same as Visa
April 2013
Acquirers and processors must support chip processing (certification required).
Same as Visa.
Acquirers and processors must support chip processing.*
Account data compromise (ADC) relief: Merchants receive 50% account data compromise (ADC) relief if 75% of transactions originate from EMV enabled chip terminals.
Merchants may receive PCI validation relief upon adoption of EMV enabled chip terminals
Oct 2015
Liability shifts to merchants from issuers if the fraud could have been prevented using chip technology.
Liability shift same as Visa.
Account data compromise (ADC) relief: Merchants receive 100% ADC relief if 95% of transactions originate from EMV enabled chip terminals.
2017
Expanded liability shift to include Automated Fuel Dispensers.
*Discover’s fraud shift will be based on the level of protection around transaction versus a percentage based transaction threshold.

26. Payment Trends and Payment Gateways

27. Payment Landscape Number of Transactions (billions) Debit card
Consumers are increasingly choosing credit card, debit card and pre-paid instruments over cash and checks
Electronic payments have exceeded checks since 2007
Number of Transactions (billions)
Debit card
Credit card
ACH
Checks
Stored value
Source: Nilson, Federal Reserve, NACHA, ATM&Debit News, WF Analysis

28. Roadmap to Success Today Best Manual Low Unknown Resources Visibility
Risk
Automated
High
Managed
Know your business
Leverage technology
Enable resources
Deploy model

29.        Payment Flow  Encrypted Transmission (SSL)
VAR or Payment Gateway
Buyer
Merchant   
Associations
Issuing
Bank
Web Store
Processor
Encrypted
Transmission (SSL) 
Payment Gateway 
Call Center
API
Hosted Order Pay Page
Virtual Terminal 
POS System
Payments
Compliance and
Risk Management
Subscription Services
Reconciliation
ACH Network
RDFI .
WF/ODFI  
Machine Readable
Files
Web-based
Reports

30. SUBSEQUENT TRANSACTIONS
Secure Storage (Tokenization)
Safely STORES sensitive payment information in a PCI compliant data center on our network and gets it off of yours.
SUBSEQUENT TRANSACTIONS
INITIAL TRANSACTION
Payment Token Transmitted
Wells Fargo Payment Gateway® matches Token to credit card number and Processes
Token & Card Number Stored in Secure Storage
Authorization Result & Token Returned to Merchant
Token stored on Merchant System
Payment Information Transmitted
Payment Information Processed through Wells Fargo Payment Gateway®
If Auth=Y, Token Created, Card Number Stored in Secure Storage
Authorization Result & Token Returned to Merchant
Token stored on Merchant System 30

31. “Do not lose sight of the importance of quality
“Do not lose sight of the importance of quality. Selecting and enabling technology is more complicated than checking a box or finding the lowest-cost provider.”
Article by The Aberdeen Group

32. Thank you HELPFUL LINKS www.visa.com/merchantsurcharging
PCI Security Standards Council -
Interchange Clearing Matrix -
Payment Network Pass-through Fee Schedule
Visa Fixed Acquirer Network Fee (FANF) -
© 2013 Wells Fargo Bank, N.A. All rights reserved.