Visa Acquirer Risk Management Guide

Transcription

1 Visa Acquirer Risk Management Guide Tools and Best Practices for Acquirer Loss Prevention February 2003

2 CONFIDENTIAL Visa Acquirer Risk Management Guide

3 Table of Contents About This Guide Chapter 1 Acquirer Strategy and Organization Building a Strategic Framework Visa Center Organizational Structure Organizational Roles and Responsibilities Staff Training Third-Party Relationships Chapter 2 Merchant Underwriting Portfolio Development Making the Most of Your Merchant Application Merchant Site Inspections Merchant Approval Policies and Processes Chapter 3 Merchant Contracting and Setup Developing Merchant Agreements Mandatory Agreement Provisions Optional Agreement Provisions Agreement Requirements for Chip Migration New Merchant Start-Up and Preparation Chapter 4 Merchant Card Acceptance and Fraud Prevention Basic Visa Principles for All Merchants Card-Present Transaction Procedures Chip Acceptance Procedural Differences Using Visa Electron Cards in the Card-Present Environment Card-Not-Present Transaction Procedures Merchant Education Supporting Merchant Code 10 Efforts Visa Acquirer Risk Management Guide CONFIDENTIAL i

4 Chapter 5 Merchant Fraud and How to Recognize It Merchant Fraud Defined Bust-Out Merchants Laundering Telemarketing Fraud Credit and Cash Advance Schemes Skimming Account Testing Understanding Key-Entered Fraud Managing Inactive Merchant Accounts Chapter 6 Merchant Activity Monitoring and Follow-Up New Merchant Monitoring Ongoing Merchant Monitoring Periodic Merchant Reviews Identifying and Following Up on Suspicious Activity Chapter 7 Account Information Security What is the Visa Account Information Security Program? Acquirer Account Information Security Responsibilities Implementing Information Security Standards Acquirer Resources Chapter 8 Personal Identification Number (PIN) Security About Visa PIN Security Compliance PIN Security (From the Attacker s Point of View) PIN Security Program Overview Chapter 9 Merchant Fraud Investigation Elements of a Careful Investigation Visa Fraud Investigations Performance Standards Examining the Merchant Profile Analyzing Transaction Data and Exception Items Data Security When a Scam is Confirmed When a Merchant Agreement is Terminated Merchant Communication During and After an Investigation ii CONFIDENTIAL Visa Acquirer Risk Management Guide

5 Chapter 10 Visa Risk Control Programs Risk Identification Service (RIS) Acquirer Monitoring Program (AMP) Global Merchant Chargeback Monitoring Program Visa Fraud Reporting System (FRS) Chapter 11 Management Information Tracking Performance Fundamental Risk Reports Chapter 12 E-Commerce Merchant Fraud Management Understanding E-Commerce Risk Exposures E-Commerce Transactions Defined Merchant Marketing and Sales Merchant Underwriting New Merchant Setup Regional E-Commerce Registration Programs Merchant Portfolio Risk Management Merchant Operations Merchant Monitoring Terminated Internet Merchant File (Asia-Pacific Region Only) Merchant Procedures A Closer Look at Verified by Visa (3-D Secure) Acquirer Best Practices Checklist Glossary Appendix A Sample Merchant Application Sample Site Inspection Form Appendix B Sample Merchant Training Program Appendix C Sample Merchant Letters Appendix D Visa Acquirer Risk Management Guide Evaluation Visa Acquirer Risk Management Guide CONFIDENTIAL iii

6 iv CONFIDENTIAL Visa Acquirer Risk Management Guide

7 About This Guide Introduction Globally, credit and debit card fraud are billion-dollar problems affecting banks, merchants, and individual consumers, all of whom feel the fraudster s pinch in increased operating expenses and higher prices for goods and services. Chargebacks alone cost Acquirers and merchants hundreds of millions of dollars each year. A single undetected scam can result in losses of hundreds of thousands, or even millions, of dollars. Equally important, the continually changing nature of the bankcard fraud environment means today s Acquirers are faced with a landscape of growing risks, where the need for acute awareness and vigilance is constant. Current evidence also suggests that fraudsters scams have grown more sophisticated and harder to detect. Fraud schemes that used to involve individuals or local gangs are now being run by national or international crime organizations that specialize in what is called merchant or, more commonly, entrepreneurial fraud. These fraud rings have the resources to set up seemingly legitimate retail storefronts or purchase established businesses and then obtain merchant accounts for the sole purpose of skimming account numbers from valid cards or running laundered or other fraudulent transactions. They have also shown themselves capable of stealing account data at almost any point in the authorization or settlement process, from a merchant s point-of-sale (POS) terminal to an Issuer s or Acquirer s host system or third-party processor. The message for Acquirers is clear and unmistakable. The unpredictability of fraud leaves each organization vulnerable, and consequently, loss reduction awareness must be incorporated into every aspect of merchant relationships and daily business operations. Fraud prevention must be a central concern in portfolio development policies, profitability analysis, underwriting standards and procedures, Merchant Agreements, and ongoing merchant education and monitoring programs. Similarly, an organizational commitment to consistent and rigorous implementation of loss reduction policies must be instituted, and communicated to all personnel, from management on down. Visa Acquirer Risk Management Guide CONFIDENTIAL 1

8 Guide Purpose The Visa Acquirer Risk Management Guide is intended to provide acquiring Members with up-to-date information and resources for improving portfolio profitability by reducing and preventing fraud losses. The guide combines plain-language versions of Acquirer and merchant standards from the Visa International Operating Regulations with vital information on current fraud scams and how to recognize them. Best practices from Acquirers with successful fraud prevention policies and systems are also included, along with descriptions of Visa s loss reduction programs and other resources currently available. The information contained in the Visa Acquirer Risk Management Guide should be useful to all employees new and experienced involved in an Acquirer s merchant operations, such as underwriters, portfolio managers, fraud and credit risk investigators, credit analysts, and internal auditors. The guide can also be used as a tool to support merchant communication and education efforts. What s Inside The Visa Acquirer Risk Management Guide has been divided into twelve chapters, each with a different main focus. You can work through this guide in its entirety, or move directly to any of the topics listed here. Chapter 1: Acquirer Strategy and Organization provides an overview of the primary components of an Acquirer s strategic business plan. It also covers the different organizational functions and positions at a Visa Merchant Operations Center, with an emphasis on staff training. Chapter 2: Merchant Underwriting contains detailed guidelines for evaluating and approving new merchant accounts and establishing clear, realistic portfolio development policies to minimize risk and losses. Chapter 3: Merchant Contracting and Setup reviews mandatory and optional merchant agreement provisions. It also describes key considerations for setting up new merchants to accept Visa cards and properly process transactions. Chapter 4: Merchant Card Acceptance and Fraud Prevention contains Visa s recommended card acceptance procedures for merchants. Requirements for checking card security features and the cardholder s signature are outlined, as well as what to do if a fraudulent card or transaction is suspected. Information on merchant education materials is also included, plus a description of Code 10 call and card recovery actions. 2 CONFIDENTIAL Visa Acquirer Risk Management Guide

9 Chapter 5: Merchant Fraud and How to Recognize It provides an overview of current merchant fraud scenarios and how to recognize them. The information here on new scams and emerging fraud trends, such as skimming and bust-out merchants, may be of particular interest to Acquirer risk analysts and investigators. Chapter 6: Merchant Activity Monitoring and Follow-Up focuses on regular, ongoing monitoring of merchant deposit and authorization activity. The chapter includes a list of key reports and routine monitoring actions that can help an Acquirer spot any unusual or sudden change in normal deposit activity. Chapter 7: Account Information Security offers background information about the Visa International Account Information Security program and outlines guidelines for implementing organizational polices and procedures to maximize information security and minimize risk. Chapter 8: Personal Identification Number (PIN) Security discusses the need for vigilant PIN security efforts in the payment industry and provides a brief overview of the Visa PIN Security Program. Chapter 9: Merchant Fraud Investigation contains helpful standards and practices for initiating and conducting a successful merchant fraud investigation. Chapter 10: Visa Risk Control Programs look at the risk control standards and programs developed by Visa to help Acquirers reduce fraud losses. Chapter 11: Management Information reviews the types of reports needed to help evaluate overall business performance and identify early warnings of possible risk exposure. Chapter 12: E-Commerce Merchant Fraud Management offers industry-specific practices for Acquirers on how to establish and manage e-commerce programs. At the end of this guide, you will find: An Acquirer Best Practices Checklist that summarizes the key actions and decisions covered in Chapters 1 through 12. A Glossary that defines key terms most commonly used in the payment card industry. Appendices that include the supplemental tools, forms, and materials that are referenced throughout this guide. Guide Usage and Customization The Visa Acquirer Risk Management Guide has been designed to be user-friendly and adaptable. The individual sections can be reproduced or modified for use as training materials or desk references. To help you in this effort, all of the information contained in this guide is available online or electronically on CD-ROM. Contact your Regional Risk Representative or Visa Account Executive for online access or for a CD. Visa Acquirer Risk Management Guide CONFIDENTIAL 3

10 4 CONFIDENTIAL Visa Acquirer Risk Management Guide

11 Chapter 1 Acquirer Strategy and Organization WHAT S COVERED Building a Strategic Framework Visa Center Organizational Structure Organizational Roles and Responsibilities Staff Training Third-Party Relationships Many risk management issues associated with the acquiring side of the payment card industry are, for the most part, preventable when a strategic business approach is in place. A sound, comprehensive plan sets forth specific goals and objectives by which profitability, growth, operational efficiencies, service levels, and most importantly, risk reduction can be measured. But even the best-laid plans can fall short without the proper resources. To be effective, an acquiring institution s business strategies must have a strong organizational structure to support it. This chapter reviews the major components of an Acquirer s strategic business plan with an emphasis on key risk management considerations. It also includes suggestions for building and maintaining a risk-responsible Visa Center. Visa Acquirer Risk Management Guide CONFIDENTIAL 5

12 Building a Strategic Framework Developing a Strategic Business Plan The effects of fraudulent activity must be accounted for in the Acquirer's strategic business plan and functional costs. All acquiring institutions should have a documented, approved strategic plan one that focuses on the future direction of the organization and establishes specific business goals and objectives to be met over a defined period of time. Acquirers will gain the greatest benefit from developing a plan that addresses the following areas: Effect of competition on strategy Impact on other banking relationships Management information Market segments Excluded or unacceptable merchant types Monitoring performance against strategy Pricing Products Profitability Relationship with branch network (if applicable) Risk management parameters and guidelines Service levels Technology at point of sale Third-party relationships Volume of growth Merchant portfolio credit risk 6 CONFIDENTIAL Visa Acquirer Risk Management Guide

13 Key Acquiring Success Factors The secret to acquiring high quality and profitable merchant business is to ensure that all key factors concerning the prospective merchant are fully understood and analyzed. These factors, which determine whether the merchant will deliver profits and benefits to the Acquirer, include the following: Merchant service charge. Merchants pay for their ability to accept bankcards through a fee. The charge rate varies depending on transaction volume, average transaction amount, type of merchant, processing methods and costs, the interchange fee for which the merchant qualifies, and Acquirer profitability. Interchange rate. The interchange fee, which passes from Acquirer to Issuer on purchase transactions, provides a balance designed to both promote card issuance and usage, as well as maximize merchant acceptance opportunities. Interchange rates are set based on the merchant category, authorization and processing methods used, whether or not additional information is provided in the transaction record, and the type of card used at the point of sale. Credit and fraud risk. Fraudulent merchant activity prevention is a critical function because Acquirers are responsible for all the transactions accepted by their merchants. Merchant fraud includes knowingly accepting counterfeit or stolen cards, laundering sales transaction receipts, and fraudulent use of valid cards or cardholder data. Merchant business profiles can range significantly from high-volume, Card-Present transactions that carry low risk to merchants who supply specialized products having high-ticket values, but a low volume of sales. Operational cost to service the merchant. Merchant servicing costs vary from Acquirer to Acquirer based on the organization s business strategy, overall relationship with the merchant base, and service quality objectives. For example, the business strategy of targeting specific merchant types or segments (i.e., small, local merchants, or a specialized new merchant segment) can drive operating costs up. Higher merchant service fee income, however, generally offsets the higher costs. In looking at another example quality service through extended customer support hours, quick phone and letter inquiry responses, and branch support may elevate costs. On the other hand, cost savings produced through cutbacks in service can result in higher merchant attrition. This ultimately has adverse effects on not only costs, but on profitability as well. Visa Acquirer Risk Management Guide CONFIDENTIAL 7

14 Visa Center Organizational Structure Setting Up a Risk-Responsible Merchant Operation Successful merchant operations management requires the right people in the right positions throughout the organization. Defining the key organizational roles and responsibilities is an essential part of the process. All too often, the people responsible for security and risk management are not correctly positioned in the organization. Many organizations don t even have a dedicated risk management group. While it is not the intention of this guide to show how a Visa Merchant Operations Center should be structured, the following diagram is offered as an example of a risk-responsible organization. Visa Center Manager Visa Center Manager Visa Center Manager Visa Center Manager Visa Center Manager Account Setup Authorizations Settlement System Ops Merchant Approval Fraud Management Collections & Investigations In the ideal Merchant Operation Center structure, the group that is responsible for approving and monitoring merchants (Risk Management) is a peer of the group that signs up new merchants (Sales and Marketing) and the groups responsible for day-to-day operations (Operations and Information Systems). This helps keep the monitoring process objective and makes it easier for departments to take decisive action when a merchant fails to comply with Visa standards. In setting up a risk-responsible merchant operation structure, an acquiring institution should consider these practices: Make sure ongoing management of the Acquirer program is clearly assigned to individuals or organizational units. Separate sales operations and risk management functions to ensure built-in checks and balances. Place sales, operations, and risk management at the same level making them peers to provide an independent risk assessment environment. Ensure that the risk management group is responsible for reviewing new merchants and monitoring all merchants in the Member s portfolio for signs of financial difficulty and possible fraud. Set up a Risk Management Committee (RMC) to discuss and agree upon specific risk issues and sign off on the overall business strategy. The RMC is typically chaired by Risk Management and includes representatives from Fraud Management. 8 CONFIDENTIAL Visa Acquirer Risk Management Guide

15 Organizational Roles and Responsibilities There are a number of different positions found in the Visa Merchant Operations Center. Some of the more common ones are listed and described on the following pages. As you review the charts, please note that the titles may differ among Acquirers, but the functions and responsibilities are fairly standard. The charts have been included to help you evaluate how your organization is staffed to meet Visa Center operational requirements. Title / Function Visa Center Manager Ensures an efficient, effective, and profitable Visa card operation. Credit Manager Coordinates all activities related to credit granting through the issuance of Visa merchant accounts. Duties Supervise and monitor the work of the managers in all operating areas. Conduct meetings, set policies within assigned limits, delegate responsibilities, and recommend changes in operating procedures. Answer correspondence and inquiries from important customers. Attend card and other industry meetings to keep current on developments, legislation affecting the card industry. Submit reports to bank management and Visa regarding the activities and statistics of the Visa card operation. Hire and review performance of managers. Make recommendations for promotion, termination, and salary increases. Develop, review, and ensure adherence to center budget. Ensure that the Credit Department is properly staffed with personnel capable of assuming the authority, responsibility, and duties required to make credit decisions. Includes advising and training supervisors, ensuring compliance with all legislation affecting credit granting, coordinating work flow and schedules, recommending placement of new employees, general personnel administration, and making recommendations for salary adjustments, transfers, promotions and terminations. Conduct meetings with employees to educate them in proper methods and procedures and discuss changes in policies and procedures. Maintain control of credit standards to ensure the quality of credit extended; recommend and implement changes in systems and procedures. Approve or decline applications within assigned guidelines referred by supervisors and applications from corporations and partnerships for business cards. Prepare informative reports for the Center Manager and senior management. Attend various credit organization meetings, meetings with branch personnel, the Center Manager, and senior management. Visa Acquirer Risk Management Guide CONFIDENTIAL 9

16 Title / Function Customer Service Manager Supervises customer service staff to ensure the efficient, prompt, and courteous handling of merchant inquiries. Marketing Manager Develops and implements programs for the acquisition of new merchants. Risk Management and Security Manager Supervises activities in the operations areas of the center. Duties Coordinate work received by customer service personnel daily. Delegate authority, responsibilities, and duties to supervisors and personnel. Recommend and implement new systems and procedures, as needed. Assist personnel in resolving difficult customer service problems. Telephone and correspond with customers regarding inquires or problems. Hire and review performance of personnel. Make recommendations for promotion, termination, and salary increases. Monitor work of customer service staff to ensure that customer contact is efficient and courteous and that customer s goodwill is maintained. Evaluate the pending workload and see that problems are resolved within legal time frames. Prepare reports for Center Manager and senior management on problems and inquiries handled. Establish marketing policies. Approve advertising and promotional campaigns. Visit branches, sponsored Members, and major merchants to promote Visa card business. Attend sales meetings and conventions. Participate in charitable and civic activities to promote goodwill for the Visa merchant program and the bank. Supervise preparation of statistical reports for the information and evaluation of the Center Manager and senior management. Establish procedures, prepare reports for management, maintain safeguards, and administer personnel policies. Improve awareness of risk within the bankcard center. Manage bankcard and branch staff training on fraud awareness. Set guidelines for merchant approval and terminal placement policies. Manage production of and communicate risk and fraud information to senior management on a regular basis. 10 CONFIDENTIAL Visa Acquirer Risk Management Guide

17 Title / Function Operations Manager Supervises activities in the operations areas of the center. Establishes procedures, prepares reports for management, maintains safeguards, and administers personnel policies. Duties Develop procedures for effective operations. Set up operating schedules and coordinate workflow through the center. Maintain accounting records, compile reports. Train, counsel, and inform staff members on policies, goals, practices, and procedures through individual meetings, staff meetings, and training programs. Supervise personnel and delegate work assignments. Hire employees, recommend promotions, transfers, terminations, and salary adjustments. Merchant Risk Detection Manager Oversees merchant deposit monitoring and risk detection team. Identify potential fraud and credit losses. Manage fraud and risk reduction initiatives. Develop systems to monitor merchant deposits and authorization activity. Manage operational follow-up of cases identified by risk detection team. Implement actions to reduce fraud in merchants. Accounting Supervisor Supervises employees engaged in servicing and maintaining Visa merchant accounts. Report to operations manager, supervise employees involved in data entry, tabulating, accounting. Organize and coordinate workflow, delegate work assignments, hire employees, recommend promotions, transfers, terminations, and salary adjustments. Train and instruct employees in procedures and use of equipment. Recommend procedural and equipment changes. Supervise balancing, reporting, aging of general ledger accounts, process sales transaction receipts and remittances. Answer mail and telephone inquiries from merchants and bank regarding servicing or operating problems. Coordinate computer use. Visa Acquirer Risk Management Guide CONFIDENTIAL 11

18 Title / Function Authorization Supervisor Supervises activities of authorizers engaged in approving or declining authorization requests from merchants for transactions over floor limits, and from branches for cash advances. Approves or declines over-line or problem transactions referred by authorizers. Refers cases to investigators. Ensures afterhours merchant authorization monitoring and staff training in Code 10 procedures. Duties Assign employee duties and arrange work schedules. Answer employee questions regarding problems encountered, resolve operating problems, and instruct and train employees in correct procedures. Approve or decline authorization request from merchants and branches when transaction brings balance over line, for transactions when customer is using an expired card or is purchasing without a card, and for other questionable transactions. Discuss large transactions with cardholder or merchant to obtain further purchase or credit information and, if necessary, verify employment and credit references before calling merchant back to give authorization decision. Recommend the increase or decrease of credit lines, if warranted. Discuss reasons for declination of authorization with cardholder or branch and recommend corrective action. Answer correspondence regarding declination transactions. Make recommendations regarding employee requirements, salary adjustments, transfers, promotions, and terminations. 12 CONFIDENTIAL Visa Acquirer Risk Management Guide

19 Title / Function Authorizer Approves or declines telephone requests from Visa merchants for sales transactions in excess of floor limits. Duties Approve or decline authorization requests based on established guidelines. For manual systems, maintain records of authorizations given, including account number, name of cardholder, card expiration date, amount of transaction, confirmation of identity of cardholder, merchant name, merchant type, and type of merchandise purchased. For cash advances authorized, the name of the Member or branch and the officer s name is recorded. Give authorization numbers to merchants, branches, or other Members. Refer over line or questionable requests to Authorization Supervisor for further review and decision. Discuss reasons for declination of authorizations with customer or branch and recommend corrective action to clear account status. Receive telephone calls regarding lost, stolen, or destroyed cards and refer pertinent information to appropriate areas (Security Department) for action. Credit Analyst Reviews and analyzes applications for new Visa merchant accounts to approve or decline applications. Review applications received in accordance with required procedures and regulations. Call branch officers to discuss application if branch has recommended or rejected it and the reason is not clear. Evaluate credit information obtained by credit investigator, considering such factors as merchant s length and type of business, outstanding obligations, ability to pay, and payment record provided by references. Approve or decline applications for assignment of account numbers, issuance of equipment, and customer notification. Forward approved applications for assignment of account numbers, issuance of equipment, and customer notification. Note reasons for rejection on declined applications and have letter of declination typed and sent to applicant. Handle telephone inquiries and correspondence regarding credit policies and decisions. Visa Acquirer Risk Management Guide CONFIDENTIAL 13

20 Title / Function Customer Service Representative Answers merchant inquiries and resolves complaints. Duties Communicate with merchants by telephone and/or letters to answer questions and resolve problems. Analyze problems, make decisions, and implement adjustments to merchant accounts. Refer difficult or complex problems to customer service manager for assistance and/or decision. Maintain records of problems and inquiries handled. Suggest means of improving service based upon customer inquiries and complaints. Investigator Performs investigative functions as necessary to gather data for law enforcement or attorneys to prosecute cases of merchant fraud. Review transaction and merchant data to determine if there is evidence to prosecute. Work with law enforcement, card associations and other sources to gather information about suspected fraud cases. Testify in court (if necessary) regarding fraudulent bankcard merchants. Coordinate with other bank staff to gain information about suspect accounts. Merchant Sales Representative Promotes and sells Visa to qualified merchants. Call upon prospective merchants to demonstrate how Visa acceptance can increase sales. Explain merchant discount, floor limits, depository arrangements, and service. Sign new merchants, complete sales agreements, and set up deposit accounts. Refer merchants to other officers or departments for additional finance services. 14 CONFIDENTIAL Visa Acquirer Risk Management Guide

21 Title / Function Merchant Service Representative Provides service to existing Visa merchants and serves as a liaison between merchants and the Member. Duties Visit assigned merchants regularly. Provide supplies, advertising, and point-of-sale material. Answer questions and assist in solving problems concerning discounts, customer disputes, and procedures. Keep the merchant informed of new, revised, or expanded services. Maintain merchant records. Customer Service Research Clerk Obtains customer files and other information required by customer service personnel to answer merchant inquiries. Retrieve customer files, copies of sales transaction receipts, statements, etc., for customer service representatives. Prepare input for requested adjustments to merchant s accounts. Investigation Clerk Provides back-office investigative support. Receive/prioritize cases identified by merchant deposit monitoring clerks. Conduct an in-depth desktop analysis of suspect merchants. Freeze funds. Provide support to external field investigations. Prepare documentation for court. Coordinate follow-up of cases and termination. Complete Visa RIS questionnaires and coordinate initiatives to reduce point-of-sale fraud. Merchant Activity Monitoring Clerk Provides back-office examination of suspicious merchant deposit activity. Examine merchants identified by monitoring systems. Conduct initial screening of merchant deposits and authorizations. Contact branches and card Issuers regarding suspect activity. Visa Acquirer Risk Management Guide CONFIDENTIAL 15

22 Title / Function Data Security Manager Ensures systems, controls, and procedures are properly in place to protect cardholder and account information and prevent compromise. Duties Set up policies and controls to protect internal systems. Review the design and implementation of connections with external connections and networks. Conduct regular monitoring of sensitive internal systems and networks. Consult with internal Information Technology staff to ensure systems are configured and maintained securely. Provide subject matter expertise to Merchant Monitoring Activity Clerk and Merchant Service Representative to support secure operations at merchant locations. 16 CONFIDENTIAL Visa Acquirer Risk Management Guide

23 Staff Training Acquirers can implement all the controls they need to prevent fraud and minimize risk, but most of these measures really don t mean much without proper staff training. The majority of employees who expose an organization to risk usually do so through error and lack of knowledge. To be truly effective, Visa Merchant Operations Center staff should: Have a thorough understanding of merchant fraud risk and security issues. Know the Visa card chargeback rules and regulations. Be well versed in your organization s risk management policies and procedures. As a risk containment measure, Visa Merchant Operations Center staff training can be carried out in a number of ways: For new staff members. Formal training in risk management and fraud prevention should be incorporated as part of their orientation to the organization and work group. For existing staff members. Educational materials can be produced and distributed on an as-needed or refresher basis. Materials can include graphically illustrated instructional posters, monthly newsletters, brochures, and videos. When developing risk management training programs, consideration should be given to the specific needs of Visa Merchant Operations Center staff members. Generally, it is not enough to give internal staff the same kind of training presented to merchants. The Center staff members need to have a greater understanding of the Acquirer s best practices in order to effectively spot and handle fraudulent activity. Visa Acquirer Risk Management Guide CONFIDENTIAL 17

24 Third-Party Relationships O Under the Visa International Operating Regulations, Acquirers are responsible for ensuring that thirdparty agents abide by specific operating rules. As Acquirers become increasingly focused on strategic planning, competitive market positioning, pricing, and payment processing technologies, they are putting more emphasis on credit and fraud controls. In addition, some are making use of third-party agents for a range of services, including account solicitation, transaction processing, and customer support. For acquiring Members, this may result in new opportunities for increased profitability. It also, however, adds another level of exposure to fraud. Close monitoring of third parties and their bankcard-related activities is essential to ensure that the security of the cardholder information they process is properly protected throughout the lifecycle. For Acquirers, third-party agent controls may include the following actions: Document procedures that require a written contract between the Acquirer and the agent. The contract should define Acquirer Program responsibilities, requirements, and standards. Develop agent activity procedures to ensure that third-party controls are in place to adequately protect the Acquirer from excessive risk and loss. Build in and conduct periodic reviews of third-party activities based on agent type and level of exposure. 18 CONFIDENTIAL Visa Acquirer Risk Management Guide

25 Chapter 2 Merchant Underwriting WHAT S COVERED Portfolio Development Making the Most of Your Merchant Application Merchant Site Inspections Merchant Approval Policies and Processes By signing a merchant, an Acquirer is agreeing to underwrite that merchant s bankcard transactions. In other words, the Acquirer is granting an unsecured, unlimited line of credit to the business and its owners. Thus, the task of determining whether or not the merchant is a good risk primarily through the application review and approval process is crucial. This chapter contains requirements and best practices for defining portfolio development policies, conducting a merchant application review, inspecting merchant locations, and making final application approval or decline decisions. It walks through the actions needed to conduct a thorough, efficient evaluation of all merchants, and in doing so spot any signs of potential risk before an agreement is signed. Visa Acquirer Risk Management Guide CONFIDENTIAL 19

26 Portfolio Development Critical Issues that Affect Portfolio Profitability Effective underwriting begins with carefully defined portfolio development policies that specify the markets, merchant categories, and levels of risk an Acquirer is, and is not, willing to accept when approving new accounts. An Acquirer policy should also spell out minimum financial and credit requirements for new merchants, as well as the level of management approval that will be needed for specific kinds of businesses. Acquirers that use agents or nonmember agents for account solicitation are also responsible for ensuring that these entities comply with all of Visa s merchant underwriting requirements. However rigorous or trustworthy an agent s or nonmember agent's investigation, final review of merchant applications and the decision to approve or decline a new account must be made by Acquirers themselves. When establishing or reviewing portfolio development policies, Acquirers should take into account a range of critical issues that may affect portfolio profitability, including: Current portfolio size and sales volumes. Geographic location relative to the Acquirer s location. Short- and long-term financial goals. Level of risk an Acquirer is willing to accept in their portfolio. Human and systems resources. Merchant Diversification Merchant diversification helps acquiring institutions build more profitable portfolios by ensuring a sufficient percentage of Card-Present merchants to balance the higher risks often associated with Card-Not-Present merchants. Acquirers are free to determine the specific types of companies they wish to sign; however, Visa strongly recommends that a new Acquirer portfolio contain at least 50 percent Card-Present merchants. Understanding the Types of Risks Underwriting policies for specific markets or categories of merchants depend on the level of risk they represent to an Acquirer. In general, there are two kinds of risk exposure: Fraud risk is usually associated with certain kinds of merchandise and/or the nature of the business activity of the merchant. Merchants are often considered a high risk for fraud losses because of the type of merchandise they offer. Such merchants can include travel agents, jewelry stores, and computer outlets. Other merchants with higher risk business activity include telemarketing businesses, escort services, catalog sales, massage parlors, audio-text and videotext businesses, door-to-door sales organizations, and businesses that sell goods at flea markets, swap meets, and street markets. Core fraud risks include the following: Prepayment. This is a payment made now for something to be delivered in the future. This includes deposits (often made for holidays or possibly for furniture) or full payments for such things as airline tickets, theater reservations, or sporting events. If the final goods or services aren t provided, then full chargeback rights are available. Guarantees. By providing a guarantee, the merchant can advise that goods purchased today will still work for weeks, months, or years into the future. Dependent upon how this guarantee is presented in the contract, this can radically increase a merchant/acquirer liability. 20 CONFIDENTIAL Visa Acquirer Risk Management Guide

27 Ongoing services. Similar in effect to a guarantee, these transactions are usually in payment of a service which continues for a significant period of time. Examples would include golf or health club memberships and even a timeshare where risk can continue for a large number of years. Card-Not-Present transactions. Currently, the most obvious high-risk transaction is one that occurs in the Card-Not-Present environment, where in return for a merchant being allowed to transact by mail, phone or Internet, chargebacks generally exist for all transactions where fraud occurs or when goods and services are not delivered. Both these risks are significant because Card-Not-Present merchants may be targeted by fraudsters, if they are not taking action to mitigate their risks. Also, in the event that the Card-Not-Present merchant fails, there is a high probability that any orders taken by the failed merchant within the last month will not have been fulfilled. Chip-based infrastructure compliance. Many Visa regions are moving from a magnetic stripe to a chip-based infrastructure and are imposing liability shifts for transactions which continue to be taken using magnetic stripe, key entry, or paper. Acquirers operating in a chip-based region must be aware of the liabilities that occur as a result of such transactions. A list of High-risk Merchants should be communicated within the Acquirer's sales plan as a guide to help sales staff to avoid Highrisk Merchants or recommend further evaluation before signing. Business failure risk is determined by looking at the merchant s sales volume and the time frame for the delivery of goods or services. The greater the sales volume and the longer the time between credit transactions and product/service delivery, the greater the risk. For example, when a local restaurant closes its doors, an Acquirer will have minimal exposure to chargebacks for undelivered goods and services. On the other had, exposure could be considerable for an airline or travel agent, where business failure could leave an Acquirer liable for millions of dollars in future reservations. This type of risk can be the greatest area of loss to the Acquirer. When it comes to business failure risk, Acquirers should also pay particular attention to the issue of prepayment, especially in situations where prepayment options are not obvious at first glance (e.g., insurance, goods with service contracts attached, low-value phone cards, sporting event tickets, etc.). Visa Transactions and the Law By submitting transactions into interchange, an Acquirer warrants that no applicable laws have been violated. Visa urges that Acquirers understand the following: Lottery ticket sales. Acquirers must adhere to country, regional, and/or local laws prohibiting the sale of lottery tickets by mail, telephone, or electronic commerce. Internet gambling. the issue of gambling over the Internet is not clear in some markets. However, Acquirers are advised that complaints from Visa Members, cardholders, and law enforcement about this type of activity are increasing. Child pornography. Acquirers must ensure that Visa payment products are not accepted for purchase or trade in child pornography by any merchant. Any violations to this provision should be reported to Visa for proper investigation. Audits are routinely conducted to ensure Acquirers are in complete compliance. Acquirers found in violation of this provision are penalized in accordance with the Visa International Operating Regulations. Visa Acquirer Risk Management Guide CONFIDENTIAL 21

28 Making the Most of Your Merchant Application The Merchant Application An Essential Tool The most important way Acquirers can control fraud-related losses and the possibility of merchant business failure is to thoroughly evaluate prospective merchant business. Before entering into a formal relationship with a prospective merchant, an Acquirer must verify the merchant s credit qualifications and assess its potential risk for fraud, high chargeback rates, or business failure. This is why the merchant application is such a critical part of the merchant approval process. It is an essential tool that can be used to obtain detailed information about all aspects of a merchant s business. In fact, it is probably the most extensive contact that an Acquirer has with a merchant client and is the best opportunity to obtain pertinent information. Key Merchant Details As part of the initial merchant review, the merchant application should gather all relevant information on the business background, business operations, location, and principals who are running the business. To obtain these details, the merchant application form should request the following: Merchant Business Background Merchant history. Obtain the merchant s authorization to research its background, including credit, banking, financial history, and how long the merchant has been in business. New businesses frequently fail within the first few years of operation. Doing-Business-As (DBA) or trade name. Compare the merchant s doing-business-as name to its legal name. Some merchants may conduct their daily business activities under one name and apply for legal registration under a different name. If the names are different, it is important to know both names. Legal form of business. Inquire about the legal form of the merchant s business. For example, is the merchant a corporation, partnership, or sole proprietorship? Business license, registration numbers. Obtain and verify the merchant s business license number or any other license or registration numbers that may be required to own and/or operate a business. Perform a search with the appropriate business bureaus to verify that the merchant owns or operates a legitimate business. Credit history. Ask whether the merchant or its principals have previously filed for bankruptcy, or have been registered as having any other credit difficulties now or in the past. If so, find out when. This may provide a good indication of the financial stability of the merchant. Prior merchant agreement. Ask if the merchant has had a prior merchant relationship with acquiring banks. If yes, request bankcard statements for several months activity. If another Acquirer previously terminated the merchant, the reason for termination should be noted on the merchant s application. Other businesses. Ask the merchant to supply information for any other businesses it currently owns or operates, or has owned in the past. Business references. Ask the merchant for other business references that can support its financial responsibility. For example, invoices or billing statements from suppliers and customers can provide evidence of the merchant s ability to meet financial payments. 22 CONFIDENTIAL Visa Acquirer Risk Management Guide

29 O Under the Visa International Operating Regulations, all Acquirers must evaluate a potential merchant s financial condition. A list of high-risk merchants should be communicated within the Acquirer s sales plan as a guide to help sales staff avoid High-risk Merchants or recommend further evaluation before signing. Merchant Business Operations Operating statistics. Ask the merchant for the following operating statistics to gain knowledge of the merchant s expected business revenue: Projected total sales volume Projected credit and debit volume Projected chargeback volume Percentage of sales by mail order, telephone order, or Internet Period between the purchase and actual delivery of goods Guarantees and ongoing services (copies of consumer contracts may be required) Cards honored. Determine what other (if any) bank or travel and entertainment cards the merchant honors and the name of the acquiring institution(s). Billing terms. Ask the merchant for its billing terms. For example, does the merchant allow its customers to pay for purchases in monthly installments? Credit and return polices. Ask the merchant for details of its credit and return policy procedures to ensure the merchant is properly handling exchanges and credits. It is important for the Acquirer to obtain a copy of the merchant s standard contract. Inventory. Determine whether the merchant owns or finances its inventory. Contracts. Determine if the merchant has any significant contractual relationships, such as a manufacturer s agent or exclusive supplier that may impact the merchant s ability to meet its financial obligations if a contract is canceled. Acquirers must conduct a physical site inspection of all new merchant and Card-Not-Present merchant locations to obtain a detailed description of the business. Merchant Business Location Type of location. Determine the type of location of the merchant, such as storefront, indoor shopping mall, or office. Is the merchant location suitable for the type of merchant? Is the merchant location in a geographic area that has demonstrated excessive levels of fraudulent activity? Own/lease. Ask whether the merchant owns or leases the location. If the merchant owns the location, ask the merchant for the name and address of the mortgage holder. If the merchant leases the location, ask the merchant for the name and address of the landlord. Time at location. Ask the merchant how long the business has operated at the present location. Merchant Principal(s) Information Principal name, address, identification number. Ask the merchant for the name, address, Social Security Number or similar identification number, and telephone number of each principal involved in the business. Ownership information. Obtain the percentage of ownership held by each principal. Also find out how long each of the current principals have owned the business. Percentage of time. Ask the merchant for the percentage of time spent at the business by each principal. Visa Acquirer Risk Management Guide CONFIDENTIAL 23