Campus Cashless Solutions and PCI Compliance Insights

Before We Get Started Before We Get Started This training session will be recorded for future access Will be posted at: https://www.uwsp.edu/FO/Pages/Training-Opportunities.aspx Please remember to mute your microphone Please raise your hand or use the chat feature if you have any questions throughout the presentation There will also be time after the presentation for questions

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance The Cashless Campus, PCI session will provide insight on options available to reduce or eliminate cash handling on campus. We will review the various options for collecting payment including payment card, ACH, wire transfer or via a charge to a student bill. In relation to payment card acceptance, we will discuss updates to our merchant procedures along with a review of the required steps for PCI DSS compliance. This session will provide helpful information not only to those interested in accepting payment cards, but for our existing campus merchants on how to best work with the PCI Compliance Team to stay in compliance! Training Topics Why go cashless? Options for going cashless; payment card, ACH/wire transfer, student billing Accepting payment cards Merchant Procedures PCI DSS Compliance

Cashless Campus Cashless Campus Reasons to take your campus cashless: 1. Accountability, control & visibility Accepting cashless payments improves financial management with system integration and reporting for easier reconciliation. 2. Minimize Risk Going cashless reduces the risk of fraud and human error. 3. Ease administrative responsibility Provides key systems integration with student finance systems, reduces time spent counting cash and checks. 4. Millennial and Gen Z consumers prefer cashless transactions!

Cashless Campus Cashless Campus Reasons to take your unit cashless: 1. Efficiency gains - More efficient use of staff and an overall increase in operating efficiency. 2. Streamlined reconciliation procedures 3. Eliminate internal controls - More relaxed physical security requirements, eliminate need for multiple people to count cash and cross check deposits for accuracy.

Cashless Campus Cashless Campus Options for making your unit cashless: 1. Adding a charge to a student billing account 2. Receiving funds via ACH or wire transfer 3. Accepting payment cards

Cashless Campus Cashless Campus Option 1: Adding a charge to a student billing account Do you currently have a change fund in order to sell items to students? Examples of fees transitioned to a student bill: CNR Key Deposits NFAC Rentals (toolkits & lockers) Caveat Only non-taxable items can be charged to a student billing account. If you are generating taxable revenue from a sale to a student, this revenue can not be received via a student billing account. Process For existing fees that are already being charged to students, contact the Bursar.

Cashless Campus Cashless Campus Option 1: Adding a charge to a student billing account Do you have a NEW fee you are in the process of implementing that you would like charged to a student account? Examples: Late Fee(s) Fine or penalty for unreturned materials (not related to employment) Process: Financial planning to show how you came to the fee amount Develop policy and procedures for assessing the fee Work with Bursar and/or Controller in receiving CBO approval for all new fees

Cashless Campus Cashless Campus Option 2: Receive funds via ACH or wire transfer Most entities now prefer to send payment electronically versus via cash or check. Ask your customer if they can send funds via ACH or wire transfer. Most entities have an ACH or wire authorization form. This form should be sent to bursar@uwsp.edu. We will complete the form and send the information via secure email to your customer. How will you know when payment has been received? Complete a deposit slip and send via email to bursar@uwsp.edu. In your email, please note how and when we should be receiving the funds. The Bursar office also keeps track of all entities that have our banking instructions, so that upon receipt of funds, if we do not have a deposit slip, we can typically track back to which unit the funds belong to.

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance Option 3: Accepting payment cards (debit/credit cards) University groups and departments who wish to accept credit card payments need to contact the PCI Compliance Team (PCIteam@uwsp.edu) for review and approval. Considerations: - Expected volume of transactions - Types of items to be sold - Resources available for training, reconciliation and PCI Compliance

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance PCI Compliance Team The PCI Compliance Team consists of representative from Financial Operations, Information Technology, and merchant departments. Reviews department requests to become new merchants & evaluates changes in merchant activities that impact PCI DSS compliance Oversees annual PCI DSS validation Coordinates remediation activates as required by PCI DSS or other applicable policies and standards Assists with the completion of annual SAQ Makes appropriate revisions to the Payment Card Processing and Compliance Policy, as needed

PCI Compliance PCI Compliance PCI Compliance Team PCIteam@uwsp.edu Points of Contact: Jamie Bednarek Bursar jbednare@uwsp.edu Onboarding new MIDS with merchant bank, revenue posting & reconciliation, merchant terminations Logan Weston Information Security lweston@uwsp.edu Device and gateway set-up & training, SAQ submissions with CampusGuard Central, incidence response Kari Thompson Fiscal Compliance Manager kathomps@uwsp.edu PCI required training, policy, website

Cashless Campus & Cashless Campus & PCI Compliance PCI Compliance Accepting Payment Cards -Policy, Procedures and Forms now all in one location! No more paper forms! https://www.uwsp.edu/FO/pages/university-credit-card-merchants.aspx

PCI Compliance PCI Compliance PCI DSS is the Payment Card Industry Data Security Standard and is a result of collaboration between VISA, MC and other card companies. Accepting Payment Cards What is the PCI DSS and why do we need to be compliant? Offers a single approach to protecting sensitive data for all card brands Designed to create common industry security requirements

PCI Compliance PCI Compliance Accepting Payment Cards Consequences if NOT compliant at the time of a breech: Punitive fines up to $500,000 per incident Higher level of industry oversight may be imposed University s ability to accept ANY credit cards could be terminated What is the PCI DSS and why is compliance mandatory for all campus merchants? **ALL merchants at the University can be impacted by the NON-compliance of just one merchant!

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance Option 3: Accepting payment cards (debit/credit cards) Acceptance Methods & Costs: When pricing goods and services, it is good practice to include: 5% (estimate) for cost of acceptance of debit/credit cards This will cover fees associated with processing credit cards, including but not limited to: Device Fees Flat monthly fee for devices Interchange Fees 2.5 -3.1% of sale dependent on type of card PCI Compliance Fee 2% of Net Sales All applicable University charges such as the current Program Revenue Assessment Any applicable sales tax

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance Option 3: Accepting payment cards (debit/credit cards) Merchant Coordinator Responsibilities: Ensure that all business processes, IT environments and associated systems for accepting, processing, retaining, and disposing of cardholder data comply with PCI DSS. Develop and document card handling procedures Reconcile daily merchant account activity Reporting any questionable of suspicious activity to the PCI Team or Information Security Completing the annual SAQ in partnership with the PCI Compliance Team Ensure all department employees who handle cardholder data receive mandatory PCI training offered via Canvas

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance Option 3: Accepting payment cards (debit/credit cards) Self-Assessment Questionnaire (SAQ): Merchant Coordinator will work with the PCI Team to complete an annual SAQ in CampusGuard Central. Items that will need to be completed to be able to pass the SAQ: PCI Procedures document reflects current merchant card handling procedures List of service provides, their provided services, and attestations of compliance Staff List for any/all that have access to cardholder data Device List, location, check for tampering, etc.

Cashless Campus & PCI Compliance Cashless Campus & PCI Compliance Summary The payments industry is rapidly changing, and younger generations will continue to push for more innovative payment solutions. Ideas for the future: Alternative payment methods for students; Apple Pay, Google Pay, Venmo, PayPal Cash-2-Card Kiosk s Centralized merchant accounts

Questions? Questions?

Contact Information Contact Information Jamie Bednarek jbednare@uwsp.edu Direct: 715-346-4692 Office: 715-346-2118 PCI Team - PCIteam@uwsp.edu Bursar Office bursar@uwsp.edu Student Financial Services student.financial.services@uwsp.edu