1. Presented by: Barbara Fava, Managing Director PFM Asset Management LLC 1 Keystone Plaza, Suite 300 N. Front and Market Streets Harrisburg, PA 17101 (717) 232-2723 favab@pfm.com What You Don’t Know About Merchant Card Processing Can Cost You Treasurers’ Association of Virginia 85 th Annual Conference, Harrisonburg, VA June 24, 2015

2. 2 © 2015 The PFM Group Merchant Card Process Summary

3. 3 © 2015 The PFM Group Merchant Card Processors

4. Processing Fees and Rates

5. 5 © 2015 The PFM Group Interchange Fees Non-negotiable fee paid to the issuing bank Same for all issuing banks Two-part fee: –Percentage of transaction volume –Flat fee per transaction –Example: 1.51% of volume plus $0.10 per transaction Interchange category is based on details of transaction: –Card brand –Card type –Card category –Processing method –Business Type

6. 6 © 2015 The PFM Group Merchant Category Codes CodeType of Business 7542Car Washes 8351Child Care Services 8220Colleges, Universities 5411Grocery Stores 9399Government Services 6300Insurance Sales and Underwriting 8099Medical Services 5812Restaurants 5941Sporting Goods Stores 0742Veterinarian Services

7. 7 © 2015 The PFM Group Interchange Examples $100 dollar transaction Visa Credit Card Not Present transaction 1.54% rate on volume $0.10 per transaction Total Interchange: $1.64

8. 8 © 2015 The PFM Group Interchange Examples $100 dollar transaction Visa Credit Rewards Card Present transaction 1.65% rate on volume $0.10 per transaction Total Interchange: $1.75

9. 9 © 2015 The PFM Group Merit III: 1.58% rate $0.10 per transaction Interchange: $1.68 Merit I: 1.89% rate $0.10 per transaction Interchange: $1.99 Difference: $0.31 Interchange Examples $100 dollar transaction MasterCard Credit Eligible for Interchange Merit III, Processed as Merit 1

10. 10 © 2015 The PFM Group Processing Costs (Assessment Fees) Non-negotiable fee paid to the card associations (VISA, MasterCard, etc.) Same for all issuing banks Includes percentage, a transaction fee, and monthly fees* Percent of Volume Transaction Fee Monthly Assessment Fee Visa 0.13% credit 0.11% debit $0.0195 credit $0.0155 debit Fixed Acquirer Network Fee ($2.00-$120.00) MasterCard0.125%$0.0195N / A Discover0.105%$0.0185N / A American Express0.15%N / A *Brands may also charge: Kilobyte Access fees, Cross Border or International Assessment fees, and other network and license fees

11. 11 © 2015 The PFM Group Processing Costs (Markup Fees) Negotiable fee paid to merchant card processor Inconsistencies make it difficult to compare credit card processors Differ significantly by: –Transaction Amount –Pricing model

12. 12 © 2015 The PFM Group Interchange Fee Assessment Fee Transaction Fee Assessment Fee (Markup) Transaction Fee (Markup) Total Fee Receiving Party Issuing Bank Card Association Processor Processor A 1.65% +$0.10 0.13%$0.01950.09%$0.00$1.99 Processor B 1.65%+ $0.10 0.13%$0.01950.00%$0.15$2.05 Processor C 1.95% + $0.10 0.13%$0.01950.05%$0.05$2.30 Processing Costs (Summary) $100 dollar transaction Eligible for Interchange Category CPS Small Ticket (Swiped) Card Type: Visa Credit Reward Processed as CPS/Retail Key Entered

13. 13 © 2015 The PFM Group Pricing Models (Pass-Through) Interchange and assessment fees are billed directly to the merchant at cost The same mark-up for every interchange category Advantages: –Transparent –Allows for interchange optimization –Generally less expensive Issues to Consider –Processors will add on fees –Costs go up when interchange increases –Best interchange category not always obtained

14. 14 © 2015 The PFM Group Pass-Through Pricing (Interchange Plus) $100 transaction CPS Retail Interchange Rate Paid to the Issuing Bank Assessment Paid to the Card Association Rate and Fee Paid to the ProcessorTotal Cost Visa Consumer Credit Card 1.51% + $0.100.13% + $0.01950.10% + $0.05$1.91 Visa Reward Credit Card 1.65% + $0.100.13% + $0.01950.10% + $0.05$2.05 Visa Debit Signature Card 0.05% + $0.220.11% + $0.01550.10% + $0.05$0.55 Visa Business Credit Card 2.25% + $0.100.13% + $0.01950.10% + $0.05$2.56

15. 15 © 2015 The PFM Group Pricing Models (Bundled Pricing) Processor sets fixed fee by “tier” Example –Qualified (1.69% + $0.25) –Mid-qualified (2.25% + $0.31) –Non-qualified (3.35% + $0.31) Qualification category based on transaction characteristics Interchange and assessment rates are not disclosed Issues to Consider –Lack of transparency –Generally results in highest processing costs –No interchange optimization –Allows processor to keep refunds “Bundled Pricing has played a big role in building the processing industry’s shady reputation” www.cardfellow.com

16. 16 © 2015 The PFM Group Bundled Pricing (Tiered Pricing) $100 transaction Interchange Rate Paid to the Issuing Bank Assessment Paid to the Card Association Rate and Fee Paid to the ProcessorTotal Cost Visa Consumer Credit Card Not Disclosed 1.69% + $0.25 (Qualified) $1.94 Visa Reward Credit Card Not Disclosed 2.25% + $0.31 (Mid-Qualified) $2.56 Visa Debit Signature Card Not Disclosed 1.69% +$0.25 (Qualified) $1.94 Visa Business Credit Card Not Disclosed 3.35% + $0.31 (Non-Qualified) $3.66

17. 17 © 2015 The PFM Group Pass Through vs. Bundled Pricing $100 transaction Pass Through Total Cost Bundled Total Cost Difference Visa Consumer Credit Card $1.91$1.94$0.03 Visa Reward Credit Card $2.05$2.56$0.51 Visa Debit Signature Card $0.55$1.94$1.39 Visa Business Credit Card $2.56$3.66$1.10

18. 18 © 2015 The PFM Group Merchant Card Processing Fee Tips There is nothing standard about processing fees Pass-through pricing is usually the best option Contract terms do not guarantee that rates will remain constant Getting low rates is only the first step towards lowering credit card processing fees – keeping the rates low is the next step Continual review of monthly statements is critical Fees on returns should be refunded (pass-through pricing only) You get what you negotiate!

19. PCI Compliance

20. 20 © 2015 The PFM Group PCI Data Security Standards (DSS) Guidelines for businesses that accept credit/debit cards To protect cardholder data when it is processed, stored or transmitted Enforced by the payment card associations (VISA, MasterCard etc.)

21. 21 © 2015 The PFM Group VISA PCI Compliance Levels

22. 22 © 2015 The PFM Group PCI Terminology Qualified Security Assessors (QSA) are data security firms that are qualified by the PCI Security Standards Council to perform on-site PCI DSS assessments. Network Security Scans remotely checks an entity’s systems for vulnerabilities. For large merchants, PCI DSS requires network security scans on a quarterly basis. Approved Scanning Vendors (ASV) are data security firms that use scanning solutions to determine whether or not a merchant meets the PCI DSS external vulnerability scanning requirement. QSAs prepare the annual Report on Compliance (ROC), which documents detailed results from an entity’s PCI DSS assessment.

23. 23 © 2015 The PFM Group Common PCI DSS Violations Storage of magnetic stripe data (never allowed) Improperly installed merchant point-of-sale (POS) systems Default system settings and passwords not changed Poorly coded web applications that allow access to cardholder data through the web site Missing and outdated security patches and updates Lack of monitoring Poorly implemented networks

24. 24 © 2015 The PFM Group Processor Approaches to PCI Compliance Card Associations assess fees when non-compliance leads to a security issue or breach. Processors often charge PCI non-compliance fees to merchants. Merchant card processors have different approaches to validating PCI compliance –Require all businesses to validate PCI compliance. –Charge a fee for providing PCI support programs to help businesses become compliant. –Allow an organization to maintain its own in-house compliance validation programs This may be mandatory.

25. 25 © 2015 The PFM Group EMV (Chip and PIN) Cards Fraud liability shifts in October 2015 EMV technology requires two layers of security – the EMV “chip” along with a PIN or a signature. EMV technology is not foolproof. Three-pronged approach to data security should be used EMV technology Point-to-Point Encryption (P2PE) Tokenization

26. Hardware and Technology

27. 27 © 2015 The PFM Group

28. 28 © 2015 The PFM Group Types of Terminals Swipe and Sign Terminals Handheld and Wireless Terminals EMV Chip and PIN Terminals Near Field Communication (NFC) Terminals

29. 29 © 2015 The PFM Group Credit Card Issuers There are 1.2 billion payment cards in circulation in the U.S. Only 20 million of those are EMV cards 1 Merchant Card Terminal Suppliers There are 12 million point-of-sale terminals in the U.S. Only half of them are expected to be EMV ready by October 2015 1 Merchants / Vendors Target alone has budgeted $100 million for its EMV rollout The total card conversion cost in the U.S. is estimated to be $4.2 billion 2 Will the United States be Ready for the Shift? 1.Source: www.EMVCo.com As of December 2014.www.EMVCo.com 2.Javelin Strategy & Research

30. 30 © 2015 The PFM Group Merchant Card Questions to Ask Transaction Classifications: Are transactions are being categorized correctly so that they are qualifying for the best interchange rate? Customer Payments: How can we encourage customers to choose lower-cost debit/PIN transactions as opposed to more expensive credit transactions? Services vs. Costs: Are you receiving bundled or pass-through pricing? Are the fees competitive? Would a third-party processor be more cost effective? PCI Compliance: What level of PCI compliance support does the bank provide? What is the bank’s non-compliance fee? How does the bank utilize encryption and tokenization to ensure data security?

31. 31 © 2015 The PFM Group Disclaimer This material is based on information obtained from sources generally believed to be reliable and available to the public, however PFM Asset Management LLC cannot guarantee its accuracy, completeness or suitability. This material is for general information purposes only and is not intended to provide specific advice or a specific recommendation. All statements as to what will or may happen under certain circumstances are based on assumptions, some but not all of which are noted in the presentation. Assumptions may or may not be proven correct as actual events occur, and results may depend on events outside of your or our control. Changes in assumptions may have a material effect on results. Past performance does not necessarily reflect and is not a guaranty of future results. The information contained in this presentation is not an offer to purchase or sell any securities.

32. Credit Card Association (Card Brand) – The company that creates the credit cards and set the rules. Issuing Bank – Financial institution that issues the cards to business and consumers Merchant – The organization that accepts a credit or debit card for payment. Acquiring Banks/Acquirers/Processors – Institutions that act as messengers between merchants and credit card associations. ISO – An independent sales organization; provides certain marketing or servicing functions. Member Bank – A bank that issues and/or processes merchant cards. Payment Gateway – Special portals that route transactions to an acquirer, usually in the case of an online shopping cart. Merchant Card Processing Overview