Printed on: 04/18/2024. Please go to policy.umn.edu for the most current version of the document.
University of Minnesota  Administrative Policy

Accepting Revenue Via Payment Cards

Sidebar

Expand all

Sidebar

Table of Contents

Questions?

Please use the contact section below.

Leave Feedback

Policy Statement

Departments may accept payment cards (credit or debit) as a method of payment provided they meet University policy, state and federal laws, contractual obligations, and rules of the University's banks and financial institutions.

Departments must obtain approval from Accounts Receivable Services prior to initiating or engaging in any activity where payment cards are used in connection with accepting revenue. Only University approved equipment, payment gateways, processes, technologies, and supplier/vendors may be used.

Departments must follow the current version of the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS is comprised of twelve requirements grouped into six goals:

  • Build and maintain a secure network
  • Protect cardholder data
  • Maintain a vulnerability management program
  • Implement strong access control measures
  • Regularly monitor and test networks
  • Maintain an information security policy

Departments must monitor and reconcile transactions according to University policy Reconciling and Verifying General Ledger Accounts and Other Financial Information.

Departments must treat a customer's Cardholder Data according to the requirements defined in the PCI DSS, University policy, state and federal laws, and contractual obligations.

Electronic storage of a customer’s cardholder data on University systems is prohibited. Where a business need exists, storage of a customer’s cardholder data by third-party service providers may be permitted upon written approval from Accounts Receivable Services.

Failure by a department to maintain compliance with this policy and the relevant acts and standards may result in revocation of approval to accept payment cards.

Departments are responsible for any fees, fines, penalties, or other costs resulting from acceptance of payment cards or non-compliance with this policy or the PCI DSS.

Payment card revenue must be deposited into approved University of Minnesota bank accounts. Departments may not open bank accounts. Accounts Receivable Services will coordinate designation of bank accounts in consultation with the Office of Investments and Banking, who is solely responsible and authorized to open bank accounts.

The sale of goods and services must be consistent with the normal activities of the unit and support the teaching, research, or outreach mission of the University. This policy deals only with the manner of payment.

The department is responsible for the collection and remittance of applicable sales tax.

When an item or service is purchased using a payment card and a refund is necessary, the refund must be credited to the same account from which the purchase was made. A refund must never exceed the original payment amount. To process a refund, follow the procedure appropriate to the technology used for processing (terminal, POS, internet, etc.). Each department must have a written or published refund policy.

This policy does not pertain to the University’s Procurement Card or Travel Card Programs.

Reason for Policy

The ability to accept payment cards is a valuable tool for University departments, but it also creates risk for the University. Payment card accounts are subject to the Minnesota Government Data Practices Act, Minnesota Plastic Card Security Act, Payment Card Industry Data Security Standards (PCI DSS), and other applicable laws. This policy creates a consistent, cost-effective, and secure environment for the University community to accept revenue via payment cards that meets the following requirements:

  • Compliance with University policy, state and federal laws, contractual obligations and rules of the University's banks and financial institutions, and PCI DSS
  • Protection of customers' private data
  • Protection for the University from fines, liability, and harm to its reputation

Contacts

SubjectContactPhoneEmail
Primary Contact(s)David Laden612-624-0929[email protected]
Account Set-Up, Changes, TerminationAccounts Receivable Services612-625-2392[email protected]
PCI DSS ComplianceAccounts Receivable Services612-625-2392[email protected]
Technology and Incidents/Suspected BreachesOffice of Information Technology, University Information Security612-301-4357[email protected]
Reconciliation/ AccountingAccounts Receivable Services612-625-2392[email protected]
Supplier/Vendor/3rd Party Service Provider ContractsPurchasing Services612-624-2828[email protected]
Office of the General Counsel612-624-4100[email protected]
University Information Security612-301-4357[email protected]
Responsible Individuals
Responsible Officer Policy Owner Primary Contact
  • Controller
  • Director of Accounts Receivable
  • David Laden
    Director of Accounts Receivable

Definitions

Access Control Measures

Mechanisms that limit availability of information or information-processing resources only to authorized persons or applications. These include restricting access to cardholder data by business need to know, identifying and authenticating access to system components, and restricting physical access to cardholder data

Acquiring Bank

The bank or financial institution that accepts payments for the products or services on behalf of a merchant. Wells Fargo Merchant Services is the University of Minnesota's acquiring bank.

Breach

Unauthorized access to, acquisition, use, or disclosure of data maintained by the University, which compromises the security and privacy of the data. “Breach” does not include (1) a good faith acquisition, access, or use of private data by an employee, contractor, or agent of the University, if the data is not provided to an unauthorized person; (2) incidents involving data that have been rendered unusable, unreadable, or undecipherable (for example, through valid encryption) to unauthorized individuals; or (3) incidents involving data that has been de-identified in compliance with applicable legal requirements.

Cardholder

The person to whom a payment card is issued or any individual authorized to use the payment card.

Cardholder Data

At a minimum, cardholder data consists of the full Primary Account Number (PAN). Cardholder data may also appear in the form of the full PAN plus any of the following: cardholder name, expiration date and/or service code. See Sensitive Authentication Data for additional data elements that may be transmitted or processed (but not stored) as part of a payment transaction.

Contractual Obligation

State and federal legal mandates govern many private data standards (for example, HIPAA, FERPA). However, PCI DSS is a set of standards that are required to be followed through terms and conditions of the payment card account contract the University has with the acquiring bank and supplier/vendors.

Customer

A non-University individual or other entity that makes a payment to the University for goods or services.

Incident

Any suspected access to, or loss of, data. An incident can become a "breach" if it is confirmed. Not all incidents are or become breaches.

Incident Response

The process by which incidents are handled. Each payment card account is required to have a documented incident response and continuity plan in place.

Merchant

The University, or a unit of the University, is considered a merchant when they accept payment cards as a method of payment for goods, services, information, or gifts.

Minnesota Government Data Practices Act

Legislation delineating how private data collected by Minnesota government entities is to be maintained and protected (including financial data).

Minnesota Plastic Card Security Act

Legislation prohibiting organizations from keeping the secure information stored on a payment card's magnetic strip in their computer databases after a transaction is completed. The magnetic strips on payment cards contain sensitive information such as the customer's name, account number, PIN, card expiration date, and security code data. This legislation also specifies that an organization violating this provision is responsible for both notifying their customers and covering the expenses of potential fraud if their customer's information is compromised.

Non-Disclosure Form

A form required to be signed annually by all University employees with access to cardholder data. By signing this form, employees agree to protect any part of the cardholder data from disclosure to anyone that does not have a business need for that data.

Payment Card

A financial transaction card (credit, debit, etc.) issued by a financial institution; also called bankcard, payment card, charge card, credit card, debit card.

Payment Card Account

A contractual relationship between a merchant and the acquiring bank that allows the merchant to accept payment cards from purchasers.

Payment Card Industry Data Security Standards (PCI DSS)

A multifaceted security standard developed and owned by the major payment card companies that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. PCI DSS represents a common set of tools and measurements to help ensure the safe handling of sensitive information. The standard comprises 12 requirements that are organized in 6 logically related groups or “control objectives.” Failure of merchants to conform to these standards can result in losing the ability to process payment card payments and being audited and/or fined.

Payment Card Transaction

The activity of purchasing a good or service through use of a payment card.

Private Data

Legally and contractually protected non-public University data and data which the University is obliged to treat as confidential whether it is research, clinical, educational, outreach, or administrative data. Private data can only be released to the subject of the information and to those within the university who have a legitimate business need-to-know, outside entities with the subject's written permission, and others as allowed by law.

Reconciliation

The process of comparing information that exists in two systems or locations, analyzing differences and making corrections so that the information is accurate, complete and consistent in both systems or locations. For financial reporting purposes, the process includes comparing the local unit's record of financial information to the general ledger.

Sensitive Authentication Data

Security-related information including but not limited to card validation codes/values, full track data from the magnetic stripe or equivalent on a chip, personal identification numbers, (PINs), and PIN blocks used to authenticate cardholders and/or authorize payment card transactions. Sensitive Authentication Data must never be stored after processing.

Service Provider / Supplier / Vendor

A business entity that is not a payment brand, that is directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This includes companies that provide services that control or could impact the security of cardholder data.

University Community

Any official member of the University. May be a college, department, unit, auxiliary, organization, program, project, group of employees, or individual employee.

Vulnerability Management Program

A program created to protect all systems against malware and regularly update anti-virus software or programs, and develop and maintain secure systems and applications. The goal is to protect against any flaw or weakness which, if exploited, could result in an intentional or unintentional compromise of a system.

Responsibilities

Accounts Receivable Services

Develops and provides departments with a comprehensive payment card program:

  • Establishes, documents, and distributes systemwide payment card account policies and procedures.
  • Reviews and approves the establishment, change, and termination of payment card accounts.
  • Coordinates designation of bank accounts for payment card revenue in consultation with the Office of Investments and Banking.
  • Oversees payment card account compliance with University policy, state and federal law, and PCI DSS.
  • Manages relationships with outside supplier/vendors and consultants to provide security assessments.
  • Provides training and awareness on compliance with University policy, state and federal laws, contractual obligations and rules of the University's banks and financial institutions, PCI DSS, and management of merchant accounts.
  • Sets up and maintains payment card accounts in the Enterprise Financial System.
  • Assists units with reconciliation issues related to payment card accounts.

Office of Information Technology - University Information Security (UIS)

Responsible systemwide for assisting Accounts Receivable Services, IT Contacts, and others in protecting payment card data and ensuring the technology used follows PCI DSS:

  • Reviews and advises on the implementation of all technology set-up or changes associated with payment card transaction processing.
  • Coordinates external vulnerability scanning by an approved external scan supplier/vendor.
  • Reviews and approves firewall changes that are supported by a valid business reason.
  • Coordinates with external security monitoring supplier/vendor for logs and forwards alerts as appropriate, provides storage of logs for one year.
  • Coordinates penetration testing for those devices that require the service to meet PCI DSS.
  • Establishes, documents and distributes systemwide security incident response and escalation procedures to ensure timely and effective handling of situations.

Payment Card Manager

Department employee responsible for overall management of a payment card account and the payment card environment. The Payment Card Manager must be knowledgeable about the payment card acceptance process in the department, PCI DSS requirements and compliance, and is the first point of contact for all questions concerning a payment card account. The employee designated as Payment Card Manager must have the authority to take action on internal and/or external recommendations or assessment findings. This individual also documents departmental policy and process and ensures that the following standards are maintained:

  • Keep all cardholder data secure and confidential. The department will be responsible for any losses due to poor internal or inadequate controls.
  • Restrict access to cardholder data and processing to appropriate and authorized personnel.
  • Establish appropriate segregation of duties between payment card processing, the processing of refunds, and the reconciliation function. Supervisory approval of all card refunds is required.
  • Perform an annual self-assessment and compliance review to ensure compliance with this policy and associated procedures, and report the results of this assessment to Accounts Receivable Services.
  • Request approval from Accounts Receivable Services prior to the implementation of any changes affecting transaction processing associated with the merchant account.
  • Notify University Information Security and Accounts Receivable Services in instances of a security incident or potential breach of cardholder data.
  • Make sure employees with access to cardholder data are trained to securely process payment card transactions and understand applicable policy, standards, and regulations.
  • Facilitates review and testing activities performed by ARS, including on-site visits, resolution of assessment findings, and incident response testing tabletop exercises.

Accounting Contact

Department employee responsible for financial management and reconciliation of a payment card account.

IT Contact

Department employee responsible for management of the technology involved with a payment card account. The IT Contact must be knowledgeable about the technology involved with the payment card acceptance process in the department.

College or Administrative Unit Chief Financial Manager (CFM) and Department Head/Dean

University employees in a leadership role who are responsible for approving the setup, modification, and termination of payment card accounts. Setup accounting structure for payment card accounts. Active participant in management of payment card processes and procedures.

Office of Investment and Banking

Oversight of all University cash management practices to include all University bank accounts and banking services. Negotiate, coordinate, and manage all agreements, policies, and business-related cash management and banking services on behalf of the University. Responsible, on behalf of the University’s Chief Financial Officer/Treasurer, for establishing all financial institution accounts.

Related Information

Administrative Policies

Information Technology Policies:

Finance Policies

Administration & Operations Policies

Human Resource Policies

Other Related Information:

History

Amended:

August 2020 - Comprehensive review changes. 1) Clarifies language to make consistent with other financial policies. 2) Clarifies definitions and responsibilities to address common questions.

Amended:

June 2016 – Comprehensive Review, Minor Revisions. Rewritten for clarity and updated to comply with current law and regulations. Reorganized and rewrote proceedures for clarity. Two new procedures were added. Removed job aids in appendices section.

Effective:

December 2009