1. Confidential and Proprietary - NOT TO BE DISTRIBUTED WITHOUT THE EXPRESS WRITTEN PERMISSION OF BANK OF AMERICA MERCHANT SERVICES. ASTRA EMV Review/Best Practices April 6, 2016

2. EMV Review and Best Practices

3. Confidential and Proprietary - NOT TO BE DISTRIBUTED WITHOUT THE EXPRESS WRITTEN PERMISSION OF BANK OF AMERICA MERCHANT SERVICES. EMV Defined - What You Should Know About EMV The EMV specification defines the global interoperable standard for chip- based payment cards created by Europay, MasterCard, Visa. ⁻Now maintained by EMVCo, LLC, owned by American Express, JCB, MasterCard, Visa, Discover and China Union Pay EMV is a payment application that resides in a secure computer chip embedded into a payment device The purpose of the smart chip is to: -store cardholder data securely -protect data on the chip against unauthorized modification -reduce the number of fraudulent transactions resulting from counterfeit, lost, and stolen cards EMV standards support existing and emerging payment technologies -Contact (insert), Contactless (tap) or Dual (both) -Plastics, Mobile Phones or Fobs (contactless) 2

4. Confidential and Proprietary - NOT TO BE DISTRIBUTED WITHOUT THE EXPRESS WRITTEN PERMISSION OF BANK OF AMERICA MERCHANT SERVICES. Chip Card Best Practices Chip cards may be issued as chip and PIN or chip and signature. For credit cards, Visa has opted to go with chip and signature. MasterCard allows for both chip and signature and chip and PIN. IMPORTANT NOTE: It is up to the card issuer to determine if cards are chip + PIN or chip + signature. An issuer may opt to issue MasterCard’s with chip and signature; they are not forced to issue with chip and PIN. DEBIT CARDS: We are seeing more debit cards being issued with a chip which will have a PIN associated with it regardless if it is Visa or MasterCard. The customer should insert or ‘dip’ their card into the chip slot of the terminal NOTE: In the event the terminal is not accessible to the customer, the cashier may dip the card. Please be advised that if PIN is required and cannot be bypassed please contact your Bank of America Merchant Services representative to discuss the possibility of obtaining a PIN pad that can be attached to the terminal. This will allow the PIN Pad to be given to the customer to insert his/her card. 2

5. Confidential and Proprietary - NOT TO BE DISTRIBUTED WITHOUT THE EXPRESS WRITTEN PERMISSION OF BANK OF AMERICA MERCHANT SERVICES. Chip Card Best Practices Continued The customer may be prompted to enter a PIN number if the credit card is a MasterCard or if the card is a debit card. -The customer should input their PIN. If they do not know it, the cashier may be able to bypass the PIN entry by following the prompts on the terminal.  If the transaction is approved, the liability for chargebacks remains with the card issuer  If the transaction is declined by attempting to bypass the PIN, ask for another form of payment. You can ‘swipe’ the card; however, the liability for a chargeback will shift to the merchant. Authorize the transaction Review the authorization response and take the appropriate action: -Approved – Ask the customer to sign the sales receipt. -Declined – Return the card to customer and ask for another form of payment. -Call or Call Center – Call for a voice authorization if needed. NOTE: If at any point you suspect fraud, contact your Bank of America Merchant Services representative. 2

6. Confidential and Proprietary - NOT TO BE DISTRIBUTED WITHOUT THE EXPRESS WRITTEN PERMISSION OF BANK OF AMERICA MERCHANT SERVICES. Chip Card Best Practices Continued Validate the physical card. Ensure the card has not been altered Settle the transactions daily -Authorizations that are not settled timely are subject to a higher interchange rate. 2

7. © 2016 Banc of America Merchant Services, LLC. All rights reserved. All trademarks, service marks and trade names referenced in this material are the property of and licensed by their respective owners. Merchant Services are provided by Bank of America, N.A. and its representative Banc of America Merchant Services, LLC. Banc of America Merchant Services, LLC is not a bank, does not offer bank deposits, and its services are not guaranteed or insured by the FDIC or any other governmental agency. Questions?