Debit or Credit Card Facility

Many departments have already put in place facilities to accept debit/credit cards via point of sale (POS) terminals and manual imprinting, as well as the acceptance of payments by credit card over the internet (e-commerce). It is important to keep in mind the following points before proceeding:

• All arrangements for accepting debit/credit card payments must be approved by either the principal, dean, director or chair of the department
• All costs and benefits surrounding the acceptance of debit cards and credit cards should be considered before committing to accept these forms of payment. Some of these considerations are as follows:
  • Transaction fees (normally a percentage based on the dollar volume of transactions)
  • Monthly rental of on-line terminals
  • Monthly rental of manual imprinters
  • Monthly fee for Tele-Deposit services
  • What is your volume of transactions? A low number of transactions may make the cost of equipment rental impractical.
• All costs relating to providing the debit/credit card facility are charged to the department centrally by the Financial Services Department (including fees, costs, and charge backs)
• All credit card payments received by departments must be deposited directly into a University bank account using a University of Toronto merchant account. Caution: funds must not be deposited into a non-University of Toronto account at any point in the process.

For the above reasons, all requests for debit/credit card facilities must be reviewed by the PCI Office before merchant accounts are created and available for departmental use. Departments should also be aware of their responsibilities once the debit/credit card facility is up and running.

In addition to the above section, departments which are considering providing an e-commerce facility (acceptance of payment over the internet) should consider the following:

• Departments are responsible for investigating the various e-commerce payment processing gateways, and choosing the gateway they will use. The PCI Office can advise departments on current gateways used at the University of Toronto. If you require additional information, please contact the PCI Office .
• In most cases, the department will choose a gateway provider affiliated with the payment processor. If specific requirements in the department necessitate choosing a gateway provider other than one affiliated with the payment processor, the department is responsible for ensuring that the gateway provider is certified with the payment processor. This should be done very early in the process to avoid costs in developing an e-commerce solution that will not be supported by your payment processor. If you need help in determining whether your payment processor is certified, please contact the PCI Office
• In order to launch your “on-line store”, registration site or other e-commerce solution, you will require a University of Toronto merchant account registered with the payment processor. This process for requesting the merchant account is covered in the section below entitled “What Payment Processors can be used for your Debit/Credit Card Transactions?“

There are a number of products available which allow departments to accept debit/credit card payments:

• Tele-Deposit – manual deposits slips are no longer accepted by the University’s bank. As an alternative, a Tele-Deposit arrangement can be made where transaction volume is low.
• Point of Sale (POS) machine – Please note that this is the only method of accepting debit card payments
• E-Commerce – see above section

Each of the above methods has advantages and disadvantages. For advice, please contact the PCI Office .

If you require more detailed information on costs of debit/credit card facilities, please send an email to the PCI Office with a request for this information.

Once your department has investigated its needs and the associated costs of each payment option, you will need to decide on the payment processor for your debit/credit card transactions. For assistance in making these decisions, please consult with the PCI Office .

Instructions to PCI Office Requesting Debit/Credit Card Facility

In order to proceed with obtaining debit/credit card facilities, the department must send instructions to the PCI Office with the following required information:

• Type of facilities are required (debit card, VISA and/or MasterCard)
• Purpose of the facility and type of payments being collected
• Payment processor will be used
• The contact information of the individual who will be administering the account (e.g. Business Officer). This contact information would include: name, address, phone, fax, email, etc.
• FIS account information (e.g. Fund Centre, Fund, Cost Centre, GL account) to be used for charging the department for transaction fees, charge backs, etc.
• Any deadline the department has for the set up the debit/credit card facility
• Signature of the Dean, Principal, Director or Chair

Here is an example of an instruction (coming soon) to be sent to the PCI Office that can be used as a template. This template includes all of the information we require to arrange the debit/credit card facility with the bank. Please ensure that the instruction letter is on departmental letterhead, and signed by the head of the department. Send the instruction letter to:

Once the debit/credit card facility is reviewed by the PCI Office, authorization is provided to the payment processor to set up the debit/credit card facility for the specific product(s) chosen by the department. The payment processor will then set up the merchant account(s) for your department, order the point of sale (POS) machine, if any, and/or provide instructions for the Tele-Deposit facility. Also, if an e-commerce solution is required, the payment processor will coordinate with your department to identify specific requirements for the payment gateway.

In addition, the PCI Office will send a memo to the Department detailing the necessary information needed by the department to manage the debit/credit card facility, including the G/L account to be used for processing departmental deposits.

Once the above is completed and the department has followed the payment processor’s instructions for setting up the facility, the department can begin to use the merchant account and collect debit/credit card payments.

---

What are the Departmental Responsibilities once the Debit/Credit Card Facility is up and running?

Once the debit/credit card facility is up and running, the following are the ongoing departmental responsibilities:

• On a regular basis, the department enters their deposits into FIS based on reports from their debit/credit card facility. The entries should be grouped and entered into FIS in the same way as the bank deposits to assist in the deposit reconciliation. The G/L accounts(s) assigned by the Financial Services Department are used to debit the bank, with the credit posting going to the appropriate departmental revenue account. Please note that the department should only be posting the gross receipts from customers – all bank costs associated with providing the facility are processed centrally by the Financial Services Department. See the Quick Reference Guide for Processing Incoming Payments from a Debit/Credit Card Facility (coming soon)
• Once the posting is made in FIS, please send a copy of the FIS document with the supporting backup to:

Cashier’s Office
150 College Street, 3rd Floor  Room 350

• Any changes to the accounts to which bank fees are charged should be directed to the Banking Clerk .

---

What if You Want to Terminate Your Debit/Credit Card Facility?

If you no longer require your debit/credit card facility, it is important to do the following immediately in order to avoid future fees / charges:

• Send instructions to the PCI Office on departmental letterhead informing us that the debit/credit card facility is being stopped. This instruction letter should contain the following:
  • The merchant account to be terminated
  • Whether any POS machine or imprinter needs to be returned
  • What facilities are being stopped (debit card, VISA and/or MasterCard)
  • What is the reason the facilities are being stopped.
  • The name of the payment processor
  • The contact information of the individual who has most recently been administering the account (e.g. Business Officer) – name, address, phone, fax, email. This is required in the event the PCI Office requires additional information.
  • Signature of the Dean, Principal, Director or Chair.

The instruction letter should be sent to:

 

There are controls that should be put in place and designed to prevent the loss of assets due to error or misappropriation and to protect customers from misuse of their credit cards or breaches of their confidentiality. for a list of these controls, refer to the Point-of-Sale Systems, Recommended Controls by Business Process on the Internal Audit website.

To see an overview of the process of setting up a credit card facility, see the Debit/Credit Card Facility Set Up Process (coming soon).