ANNEX A, CHAPTER 52 A-FN-105-001/AG-001 52A-1 General 1 ...

ANNEX A, CHAPTER 52A-FN-105-001/AG-001General1. Debit/Credit card processing solutions within the CFPFSS organization areauthorized through the Finance division. The debit/credit card processing solution is anelectronic system used to process both credit card and debit card transactions. Interacis the common term used to refer to debit card services. Along with increased customerservice, the primary benefits associated with the electronic processing of credit card anddebit card sales include the following:a. the funds reach the bank earlier;b. earning more interest revenue;c. the incidents and costs of NSF cheques are significantly reduced; andd. the amount of actual cash being handled is reduced.2. Although the acceptance of credit cards at outlets equipped with debit/credit cardprocessing remains limited to Visa, MasterCard, and AMEX, debit cards of all types areacceptable. At the time of the issue of this policy, the sole service provider fordebit/credit terminals is Chase Paymentech.Initial Terminal Request3. The National Accounts Receivable Office (NARO) is the only authorized agent fordebit/credit card services and all initial requests for services and/or changes to servicesshall be implemented by NARO through the local NPPAM with the exception of ChasePaymentech terminal returns (procedures detailed at paragraphs 5 to 7 below).4. Upon receipt of a request for debit/credit card processing services, the NPPAMwill provide the Entity/Outlet with an “Action Request Form” (Appendix 1) for completionand forwarding on to NARO for processing (info copy to NPPAM). Information requiredto complete the form includes but may not be limited to:For Fixed and Mobile Terminals:a. Base/Wing/Station:b. Entity/Outlet and Location: (Include mailing and physical locationinformation)c. Location Phone:d. Entity Contact Person:e. Contact Person Title:52A-1

ANNEX A, CHAPTER 52A-FN-105-001/AG-001f. Telephone:g. FAX:h. Services Required/Set up of debit/credit card terminal for:(1) Cash Back(2) Debit Card(3) Visa(4) MasterCard(5) GIVEX (CANEX only)(6) AMEX(Specify services requested)i. Number and Type of terminals required:j. System Choice:(1) Standard Fixed Terminal(2) Standard Plus Fixed Terminal (CANEX only)(3) Mobile Terminalk. Date required:l. Internet Protocol (IP) connection or Dial Communication. If IP and Static(not IP Dynamic Host Configuration Protocol (DHCP)) provide:(1) IP address(2) Gateway Address(3) Subnet Mask:(4) Domain Name System (DNS)m. Merchant Numbers (if existing):(1) Visa52A-2

ANNEX A, CHAPTER 52A-FN-105-001/AG-001(2) MasterCard(3) AMEXFor WEB Based Merchant Equipment (Internet-based point of sale terminal forkey entered transactions):a. Base/Wing/Station:b. Entity/Outlet and Location:(Include mailing and physical locationinformation)c. Location Phone:d. Entity Contact Person:e. Contact Person Title:f. Telephone:g. FAX:h. Services Required/Set up of debit/credit card terminal for:(1) Cash Back(2) Debit Card(3) Visa(4) MasterCard(5) GIVEX (CANEX only)(6) AMEX(Specify services requested)i. User Information: User 1, User 2, User 3 etc. First and last names, phonenumbers and email addresses.j. Date Required;k. Estimated annual volume for Visa and MasterCard ; andl. Average Ticket size.52A-3

ANNEX A, CHAPTER 52A-FN-105-001/AG-001Operator Guide5. For reference purposes, the applicable debit/credit card terminal Operator Guideis to be maintained with each device and is provided upon original issue. This manualprovides detailed instructions on how to perform all terminal functions and the toll-freenumber for the Merchant Customer Service Help Desk.Terminal Returns6. When a customer no longer requires a POS terminal they are required tocomplete a POS Pick-Up request form (Appendix 2) and forward it directly to currentcredit/debit payment company (Chase Paymentech) by email to:Bertrand.Bouchard@ChasePaymentech. Forwarding Pick-Up requests directly toChase expedites the process and thus charges for terminals that are not in use areminimized or eliminated. All devices for pick up must be boxed and labeled with thedestination address listed at paragraph 6 below. Chase will arrange to have Canpardispatched to the merchant location within two business days of receipt of the POSPick-Up Form. Information required to complete the form is detailed below and must beconfirmed with Chase Call Centre (1-800-265-5138) prior to requesting terminal devicepick-up to ensure that the information is correct. The required information includes butmay not be limited to:a. Merchant #;b. Merchant business name;c. Street address;d. City;e. Province;f. Postal code;g. Contact name and phone #;h. Business hours;i. Number of boxes;j. Terminal device type and serial #s; andk. Comments7. Terminal return address:52A-4

ANNEX A, CHAPTER 52A-FN-105-001/AG-001Maxwell Paper485 College St. EBellville, ONK8N 5S78. Once the device(s) have been picked up, the customer will provide the localNPPAM with the details of the returned items: quantity, terminal device type(s) andserial number(s).The NPPAM in turn will inform NARO who will ensure the rental fees are terminated inthe month following the device(s) return.Merchant Customer Service Help Desk9. The Merchant will provide a support line that is available 24 hours a day, 7 daysa week to assist with any questions or concerns regarding software and hardwareissues.10. Contact the Merchant Customer Service Help Desk to:a. obtain answers to questions related to your Fixed or Mobile terminals oryour WEB Based Merchant Equipment;b. inquire about any Interac, Direct Payment, credit card, transactionsprocessed through your Terminal/Merchant Equipment; andc. report specific equipment malfunction or defects.Reports/Daily ProceduresReports11. Although there are normally various types of reports available from devices, onlytwo or three types are required on a routine basis and are used in preparing the DailySales Report (DSR) in accordance with Chapter 18 (Cash and Other Receipts). Thesereport types are as follows:a. Clerk/Server Detail Report – This report type (by Operator ID) provides adetailed record of all MasterCard, Visa, AMEX and Debit transactionsprocessed by the Clerk/Operator through the device terminal and includestotals since the last batch close.b. Detail Report - This report type provides batch summary totals byOperator ID itemized by transaction types (MasterCard, Visa, AMEX andDebit) for all transactions that were processed through the device; and52A-5

ANNEX A, CHAPTER 52A-FN-105-001/AG-001individual copies of the Transaction Records processed during thatbusiness day;d. for reconciliation problems see paragraphs 13 to 18 below;e. prepare a DSR in accordance with Chapter 18 (Cash and Other Receipts)and attach the white copy of the Open Batch Totals Reports as well as thewhite copy of all the Transaction Records;f. report debit card sales on a separate line on the DSR as a receivable(similar to credit card sales) under the Receipt - Non cash section;g. verify, confirm and approve any reimbursements/cancellations;h. retain the yellow copy of the Open Batch Totals Reports at the outlet; andi. submit the DSR and attachments to the NPPAM as per normal.ReconciliationSystem Generated Reversals15. Periodically the communication system will inadvertently reverse a transactionthat has been processed. These “system generated reversals” cause a transaction tobe voided without notifying the Clerk/Operator. Thus the Clerk/Operator will not beaware of a problem until the reconciliation as required in paragraphs 11f. or 12c. aboveis completed. Causes for system generated reversals are not fully understood but theyare inconsequential providing discrepancies are identified during the reconciliationprocess and the appropriate corrective action is taken without delay.16. When a discrepancy is discovered, a detailed report of transactions should beobtained from the terminal. Reports can be produced by Operator ID and/or for aspecific batch or timeframe. The manager or supervisor can obtain a report for the totaloutlet (all terminals) or alternatively by Operator ID or terminal.17. Once the problem transaction(s) have been identified the Merchant CustomerService Help Desk shall be contacted to initiate corrective action.NOTE: As per paragraphs 4 and 8 above, the “Operator Guide” providesdetailed instructions on how to perform all terminal functions and the toll-freenumber for the Merchant Customer Service Help Desk.18. For credit card transactions, corrective action will normally involve the "forceposting" of the transaction(s). This, in effect, means that the credit card transactionmust be processed again and as the customer and the customer's credit card are not52A-7

ANNEX A, CHAPTER 52A-FN-105-001/AG-001available, the transaction must be manually entered into the system (as detailed in theOperator Guide).19. For debit card transactions, a "force posting" is not possible. The MerchantCustomer Service Help Desk will normally take the responsibility for completing thetransaction. The manager/supervisor/clerk shall reference on the appropriate OpenBatch Totals Report, the date of the telephone conversation and the name of the HelpDesk representative who responded, along with a note detailing the verbal confirmationof the debit card transaction.Monthly Reconciliations20. Upon receipt, NARO will reconcile the monthly bank/credit card statements andinitiate any corrective action required.Deposits21. The NPPAM in consultation with the outlet managers will make arrangements atthe time of installation, to have transactions electronically deposited automatically at apre-determined time. Optimally, all outlets on a base should arrange to have thisdeposit affected at the same time. It is essential that the deposit time that is chosen iswell after the close of business of all outlets on the base. Once a time is arranged, noseparate action is required by a terminal user to make a deposit. The deposit is anautomatic function that will occur at the same time each day.22. Once a deposit has occurred, the system will have closed all batches ofTransaction Records that took place on that business day. The system is now preparedto start accumulating the Transaction Records for the next business day. Therefore, atall times, the Open Batch Totals Reports will only include transactions that haveaccumulated during the current business day.Downtime procedures23. When the system goes down for any reason, the Merchant Customer ServiceHelp Desk must be contacted and informed immediately. Downtime procedures willapply for credit card sales only and are as follows:a. switch to the manual imprinter system ($100 floor limit);b. hold completed imprinted sales slips until the system comes on-line;c. pass the signed merchant copy of the sales slips in with the DSR, andannotate on the DSR the total amount of "VISA, MasterCard andAmerican Express credit sales to be processed electronically" (when thesystem is up);52A-8

ANNEX A, CHAPTER 52A-FN-105-001/AG-001d. once the system is up, use the “Force Post Purchase procedure” andenter all credit purchases that have been processed manually;e. use the bank copy of the sales slip as the input document and ensure thatyou include the Authorization Number given at the time of the approval;f. destroy the bank copy once the transaction has been accepted by thesystem;g. attach the merchant copy of the manual sales slip to the Force PostPurchase Transaction Record (unless already submitted to the NPPAM ona previous DSR); andh. batch the Force Post Purchase Transaction Records together and submitto the NPPAM with the DSR.NOTE: The Force Post Purchase Transaction Records are not to beincluded as sales for the day if the manual merchant copy of the salesslips have already been forwarded to the NPPAM on a previous DSR.24. There are no downtime procedures for debit card sales. Debit cards will not beaccepted during downtime. Outlet managers shall post a notice at the cash registers toinform customers that the Interac system is temporarily out of order.Merchandise Returns25. Normal procedures for merchandise returns using debit or credit cards aredetailed in the Operator Guide. However, a potential problem exists with the system fora return that occurs at the start of a business day, prior to the processing of anypurchases. The system operates similar to a bank account that is cleared each nightwhen the deposit is automatically made. This means that the bank account balancefrom the system perspective is zero dollars at the start of the next business day. Shoulda merchandise return occur prior to any purchase, the bank account must give outmoney that it does not have. This causes a temporary overdraft situation. ChasePaymentech has established an overdraft limit of $500. Should this limit be exceeded,the Merchandise Return transaction will not be accepted.26. The overdraft limit that has been established is expected to be adequate.However, if managers find that there are incidents when merchandise returntransactions are not accepted because the overdraft limit is too low, a request toincrease the limit may be made through the local NPPAM.52A-9

ANNEX A, CHAPTER 52A-FN-105-001/AG-001Procedures at the Financial Institution27. Bank of Montreal will:a. provide continuing support in the form of help and information to assist thebases/NARO with any problems that may arise;b. effect the automatic deposit each day at the same time with the debit cardtotal and the credit card totals deposited into the bases' applicablemerchant accounts ;c. clear all merchant accounts to the Canadian Forces Central Fund (CFCF)Central Bank Account (CBA) once each day; andd. send the monthly bank statements to NARO for action/reconciliation.Procedures for the NPPAM28. Upon receipt of the DSR from the outlet, the NPPAM shall:a. balance the total of the Transaction Records to the Open Batch TotalsReports and the amounts reported on the DSR for VISA, MasterCard,AMEX and Debit Card Receipts;b. post the appropriate amount to Accounts Receivable VISA, MasterCard,AMEX and Debit Card Receipts in the Cash Receipts Journal (ABACISSALREG); andc. file the sales slips in a holding file (to be retained for a period of one year).NOTE: On the CASREG, there should be one entry per outlet, per day foreach of the VISA, MasterCard, AMEX, and Debit Card totals to assist inthe credit/debit card statement reconciliation process.Payment Card Industry Compliance29. To help assist in the safe handling of credit/debit card information to protect cardholders and their information, Payment Card Industry (PCI) has provided securitystandards. All entities must ensure that the proper physical security is afforded tocredit/debit card data at all times for PCI compliance. All personnel credit cardinformation that has not been masked must be secured as “Protected B”. All entitiesshould play an important role to ensure all customers’ credit/debit card data is protectedagainst the pain and cost of a data breach.Appendix 1 - Action Request FormAppendix 2 - POS Pick-Up request form52A-10