Treasurers Association of Virginia 85 th Annual Conference

Treasurers’ Association of Virginia 85 th Annual Conference, Harrisonburg, VA June 24, 2015 What You Don’t Know About Merchant Card Processing Can Cost You Presented by: Barbara Fava, Managing Director PFM Asset Management LLC 1 Keystone Plaza, Suite 300 N. Front and Market Streets Harrisburg, PA 17101 (717) 232 -2723 favab@pfm. com

Merchant Card Process Summary © 2015 The PFM Group 2

Merchant Card Processors © 2015 The PFM Group 3

Processing Fees and Rates

Interchange Fees • Non-negotiable fee paid to the issuing bank • Same for all issuing banks • Two-part fee: – Percentage of transaction volume – Flat fee per transaction – Example: 1. 51% of volume plus $0. 10 per transaction • Interchange category is based on details of transaction: – Card brand – Card type – Card category – Processing method – Business Type © 2015 The PFM Group 5

Merchant Category Codes © 2015 The PFM Group Code Type of Business 7542 Car Washes 8351 Child Care Services 8220 Colleges, Universities 5411 Grocery Stores 9399 Government Services 6300 Insurance Sales and Underwriting 8099 Medical Services 5812 Restaurants 5941 Sporting Goods Stores 0742 Veterinarian Services 6

Interchange Examples • $100 dollar transaction • Visa Credit • Card Not Present transaction 1. 54% rate on volume $0. 10 per transaction Total Interchange: $1. 64 © 2015 The PFM Group 7

Interchange Examples • $100 dollar transaction • Visa Credit Rewards • Card Present transaction 1. 65% rate on volume $0. 10 per transaction Total Interchange: $1. 75 © 2015 The PFM Group 8

Interchange Examples • $100 dollar transaction • Master. Card Credit • Eligible for Interchange Merit III, Processed as Merit 1 Merit III: 1. 58% rate $0. 10 per transaction Interchange: $1. 68 Merit I: 1. 89% rate $0. 10 per transaction Interchange: $1. 99 Difference: $0. 31 © 2015 The PFM Group 9

Processing Costs (Assessment Fees) • Non-negotiable fee paid to the card associations (VISA, Master. Card, etc. ) • Same for all issuing banks • Includes percentage, a transaction fee, and monthly fees* Percent of Volume Transaction Fee Monthly Assessment Fee Visa 0. 13% credit 0. 11% debit $0. 0195 credit $0. 0155 debit Fixed Acquirer Network Fee ($2. 00 -$120. 00) Master. Card 0. 125% $0. 0195 N / A Discover 0. 105% $0. 0185 N / A American Express 0. 15% N / A *Brands may also charge: Kilobyte Access fees, Cross Border or International Assessment fees, and other network and license fees © 2015 The PFM Group 10

Processing Costs (Markup Fees) • Negotiable fee paid to merchant card processor • Inconsistencies make it difficult to compare credit card processors • Differ significantly by: – Transaction Amount – Pricing model © 2015 The PFM Group 11

Processing Costs (Summary) • $100 dollar transaction • Eligible for Interchange Category CPS Small Ticket (Swiped) • Card Type: Visa Credit Reward Interchange Fee Assessment Fee Transaction Fee Assessment Fee (Markup) Transaction Fee (Markup) Receiving Party Issuing Bank Card Association Processor A 1. 65% +$0. 10 0. 13% $0. 0195 0. 09% $0. 00 $1. 99 Processor B 1. 65%+ $0. 10 0. 13% $0. 0195 0. 00% $0. 15 $2. 05 Processor C 1. 95% + $0. 10 0. 13% $0. 0195 0. 05% $0. 05 $2. 30 Total Fee Processed as CPS/Retail Key Entered © 2015 The PFM Group 12

Pricing Models (Pass-Through) • Interchange and assessment fees are billed directly to the merchant at cost • The same mark-up for every interchange category • Advantages: – Transparent – Allows for interchange optimization – Generally less expensive • Issues to Consider – Processors will add on fees – Costs go up when interchange increases – Best interchange category not always obtained © 2015 The PFM Group 13

Pass-Through Pricing (Interchange Plus) Interchange Rate Paid to the Issuing Bank Assessment Paid to the Card Association Rate and Fee Paid to the Processor Total Cost Visa Consumer Credit Card 1. 51% + $0. 10 0. 13% + $0. 0195 0. 10% + $0. 05 $1. 91 Visa Reward Credit Card 1. 65% + $0. 10 0. 13% + $0. 0195 0. 10% + $0. 05 $2. 05 Visa Debit Signature Card 0. 05% + $0. 22 0. 11% + $0. 0155 0. 10% + $0. 05 $0. 55 Visa Business Credit Card 2. 25% + $0. 10 0. 13% + $0. 0195 0. 10% + $0. 05 $2. 56 $100 transaction CPS Retail © 2015 The PFM Group 14

Pricing Models (Bundled Pricing) • Processor sets fixed fee by “tier” • Example – Qualified (1. 69% + $0. 25) – Mid-qualified (2. 25% + $0. 31) “Bundled Pricing has played a big role in building the processing industry’s shady reputation” – Non-qualified (3. 35% + $0. 31) www. cardfellow. com • Qualification category based on transaction characteristics • Interchange and assessment rates are not disclosed • Issues to Consider – Lack of transparency – Generally results in highest processing costs – No interchange optimization – Allows processor to keep refunds © 2015 The PFM Group 15

Bundled Pricing (Tiered Pricing) Interchange Rate Paid to the Issuing Bank Assessment Paid to the Card Association Rate and Fee Paid to the Processor Visa Consumer Credit Card Not Disclosed 1. 69% + $0. 25 (Qualified) $1. 94 Visa Reward Credit Card Not Disclosed 2. 25% + $0. 31 (Mid-Qualified) $2. 56 Visa Debit Signature Card Not Disclosed 1. 69% +$0. 25 (Qualified) $1. 94 Visa Business Credit Card Not Disclosed 3. 35% + $0. 31 (Non-Qualified) $3. 66 $100 transaction © 2015 The PFM Group Total Cost 16

Pass Through vs. Bundled Pricing Pass Through Total Cost Bundled Total Cost Difference Visa Consumer Credit Card $1. 91 $1. 94 $0. 03 Visa Reward Credit Card $2. 05 $2. 56 $0. 51 Visa Debit Signature Card $0. 55 $1. 94 $1. 39 Visa Business Credit Card $2. 56 $3. 66 $1. 10 $100 transaction © 2015 The PFM Group 17

Merchant Card Processing Fee Tips • There is nothing standard about processing fees • Pass-through pricing is usually the best option • Contract terms do not guarantee that rates will remain constant • Getting low rates is only the first step towards lowering credit card processing fees – keeping the rates low is the next step • Continual review of monthly statements is critical • Fees on returns should be refunded (pass-through pricing only) • You get what you negotiate! © 2015 The PFM Group 18

PCI Compliance

PCI Data Security Standards (DSS) • Guidelines for businesses that accept credit/debit cards • To protect cardholder data when it is processed, stored or transmitted • Enforced by the payment card associations (VISA, Master. Card etc. ) © 2015 The PFM Group 20

VISA PCI Compliance Levels © 2015 The PFM Group 21

PCI Terminology • Qualified Security Assessors (QSA) are data security firms that are qualified by the PCI Security Standards Council to perform on-site PCI DSS assessments. • Network Security Scans remotely checks an entity’s systems for vulnerabilities. For large merchants, PCI DSS requires network security scans on a quarterly basis. • Approved Scanning Vendors (ASV) are data security firms that use scanning solutions to determine whether or not a merchant meets the PCI DSS external vulnerability scanning requirement. • QSAs prepare the annual Report on Compliance (ROC), which documents detailed results from an entity’s PCI DSS assessment. © 2015 The PFM Group 22

Common PCI DSS Violations • Storage of magnetic stripe data (never allowed) • Improperly installed merchant point-of-sale (POS) systems • Default system settings and passwords not changed • Poorly coded web applications that allow access to cardholder data through the web site • Missing and outdated security patches and updates • Lack of monitoring • Poorly implemented networks © 2015 The PFM Group 23

Processor Approaches to PCI Compliance • Card Associations assess fees when non-compliance leads to a security issue or breach. • Processors often charge PCI non-compliance fees to merchants. • Merchant card processors have different approaches to validating PCI compliance – Require all businesses to validate PCI compliance. – Charge a fee for providing PCI support programs to help businesses become compliant. This may be mandatory. – Allow an organization to maintain its own in-house compliance validation programs © 2015 The PFM Group 24

EMV (Chip and PIN) Cards • Fraud liability shifts in October 2015 • EMV technology requires two layers of security – the EMV “chip” along with a PIN or a signature. • EMV technology is not foolproof. • Three-pronged approach to data security should be used • EMV technology • Point-to-Point Encryption (P 2 PE) • Tokenization © 2015 The PFM Group 25

Hardware and Technology

© 2015 The PFM Group 27

Types of Terminals Swipe and Sign Terminals Handheld and Wireless Terminals EMV Chip and PIN Terminals Near Field Communication (NFC) Terminals © 2015 The PFM Group 28

Will the United States be Ready for the Shift? Credit Card Issuers • There are 1. 2 billion payment cards in circulation in the U. S. • Only 20 million of those are EMV cards 1 Merchant Card Terminal Suppliers • There are 12 million point-of-sale terminals in the U. S. • Only half of them are expected to be EMV ready by October 20151 Merchants / Vendors • Target alone has budgeted $100 million for its EMV rollout • The total card conversion cost in the U. S. is estimated to be $4. 2 billion 2 1. 2. Source: www. EMVCo. com As of December 2014. Javelin Strategy & Research © 2015 The PFM Group 29

Merchant Card Questions to Ask Transaction Classifications: • Are transactions are being categorized correctly so that they are qualifying for the best interchange rate? Customer Payments: • How can we encourage customers to choose lower-cost debit/PIN transactions as opposed to more expensive credit transactions? Services vs. Costs: • Are you receiving bundled or pass-through pricing? • Are the fees competitive? • Would a third-party processor be more cost effective? PCI Compliance: • What level of PCI compliance support does the bank provide? • What is the bank’s non-compliance fee? • How does the bank utilize encryption and tokenization to ensure data security? © 2015 The PFM Group 30

Disclaimer This material is based on information obtained from sources generally believed to be reliable and available to the public, however PFM Asset Management LLC cannot guarantee its accuracy, completeness or suitability. This material is for general information purposes only and is not intended to provide specific advice or a specific recommendation. All statements as to what will or may happen under certain circumstances are based on assumptions, some but not all of which are noted in the presentation. Assumptions may or may not be proven correct as actual events occur, and results may depend on events outside of your or our control. Changes in assumptions may have a material effect on results. Past performance does not necessarily reflect and is not a guaranty of future results. The information contained in this presentation is not an offer to purchase or sell any securities. © 2015 The PFM Group 31

Merchant Card Processing Overview Credit Card Association (Card Brand) – The company that creates the credit cards and set the rules. Issuing Bank – Financial institution that issues the cards to business and consumers Merchant – The organization that accepts a credit or debit card for payment. Acquiring Banks/Acquirers/Processors – Institutions that act as messengers between merchants and credit card associations. ISO – An independent sales organization; provides certain marketing or servicing functions. Member Bank – A bank that issues and/or processes merchant cards. Payment Gateway – Special portals that route transactions to an acquirer, usually in the case of an online shopping cart.