MyBills Bank Merchant Account Creation Procedure Date: 05/12/2012 Version: 1.0 Department: egovernment Projects, Execution and Operations Unclassified Malta Information Technology Agency, Gattard House, National Road, Blata l-bajda HMR 9010 Malta Telephone: (+356) 21234710 Facsimile: (+356) 21234701 Web Site: www.mita.gov.mt
Document Control Information 01. Document reference MyBills-Creation of Merchant account Procedure-Manual-v0.1 02. Document type Operational Procedure 03. Security classification Unclassified 04. Synopsis A set of high level procedures to be followed for opening a merchant account with BOV and HSBC 05. Document control Author Change controller Distribution controller egovernment Projects, Execution and Operations egovernment Projects, Execution and Operations 06. Modification history Version Date Comments Draft 0.1 05/12/2012 Draft version for internal review 07. References GMICT Electronic Payment Service Policy mybills Provider Integration Guide Page 2
Table of Contents DOCUMENT CONTROL INFORMATION... 2 TABLE OF CONTENTS... 3 1 BACKGROUND... 4 2 SCOPE... 5 3 FUNCTIONALITY OF A MERCHANT ACCOUNT... 6 4 PROCEDURE FOR REQUESTING A MERCHANT ACCOUNT WITH BOV AND HSBC... 7 4.1 PROCEDURE TO BE FOLLOWED WHEN REQUESTING THE CREATION OF A MERCHANT ACCOUNT WITH BOV... 7 4.2 PROCEDURE TO BE FOLLOWED WHEN REQUESTING THE CREATION OF A MERCHANT ACCOUNT WITH HSBC... 8 4.2.1 Request for a new merchant account... 8 4.2.2 Request for an additional terminal ID/s to an existing merchant account... 8 APPENDIX A... 9 APPENDIX B... 11 APPENDIX C... 13 Page 3
1 Background As per GMICT Policy P0105:2011 (Electronic Payment Service Policy) Public Sector Websites requiring electronic payment functionality shall make use of the mybills egovernemnt shared service. MyBills is intended to provide consumers of e-government Services with a singular payment method that meets the highest industry security levels and provides a homogeneous payment experience across all services. This is achieved through the implementation of a web service that supports both one-off transactions that are part of an online process (HPP) and the posting of journal entries for electronic bill presentment and payment (EBPP). Mainly mybills plays the role of a middle-man, in the sense that it provides a secure interface between the merchant website and acquirer banks that are solely responsible for the processing of the requested online payment and the transfer of related funds to the merchant s bank account. A pre-requisite for the processing of online payments through any Public Sector Website is the opening of an ecommerce merchant account with either or both of BOV and HSBC. In order for a merchant to incur the lowest possible bank commission rates on processed transactions, it is recommended that a merchant account be opened with both banks. Page 4
2 Scope This document explains the procedure that is to be followed by Government entities when requesting the opening of an ecommerce merchant account with BOV and HSBC for the processing of online payments through mybills. Page 5
3 Functionality of a merchant account As the main government payment gateway MyBills plays the role of a Middle-man between a payment portal / website and the Front End Processor or acquiring bank. In the simplest of terms, a merchant account is a specialised account provided by a bank to enable real time e-commerce transactions which allows entities to accept payments online through credit/debit card. The merchant account is set up under a contractual agreement between the merchant and either or both of BOV and HSBC. In such agreements, the rights and responsibilities of both the parties are clearly stated. Broadly under this agreement the bank agrees to pay the merchant for all valid online payment transactions net of the commission payable to the bank as per rates agreed with Government and specified in the same agreement. Page 6
4 Procedure for Requesting a Merchant Account with BOV and HSBC There are currently two banks in Malta offering merchant services Bank of Valletta and HSBC. The merchant service provider will require a range of information to enable them to make a decision as to whether they can provide you with a merchant account and the terms under which this account will be operated. It normally takes around two to four weeks to open a merchant account, and merchants need to factor this duration when planning the deployment of services having online payments. Requests with both banks can be made for: 1. A new merchant account or 2. An additional terminal ID for an existing merchant account. The difference between the two options is that in Option 1, it will be a completely new merchant account whereby you will receive a separate Merchant Activity Report for each account. As regards Option two, this provides the facility to connect multiple websites to a single merchant account through different Terminal Ids, however it needs to be highlighted that while both BOV and HSBC will furnish a Merchant Activity Report, it is only the report issued by HSBC that will allow you to identify the transactions generated by each website. Thus, given that through this option it will be very difficult to reconcile transactions processed by BOV it is recommended that this option is only availed of from HSBC. 4.1 Procedure to be followed when requesting the creation of a merchant account with BOV 1. Merchant is to send an email requesting the creation of a new merchant account/terminal ID to BOV on ecommerce@bov.com. Email is to include A description of the eservice for which the merchant account/terminal ID is required. Details of the department making the request Contact details of person making request If applicable, a written approval from the Ministry of Finance as per MF Circular 7-2002. 2. BOV will than provide guidance on the process to be followed and specific information required and may even request face to face meetings. 3. Once BOV approve the creation of the requested merchant account and a merchant agreement is duly signed, it will issue the merchant with a Merchant Account Number and/or a Terminal ID. 4. Once a Merchant Account number and a Terminal ID has been acquired you are requested to fill the Mybills Live registration form from that can be obtained from https://www.mita.gov.mt/page.aspx?pageid=261 Page 7
4.2 Procedure to be followed when requesting the creation of a merchant account with HSBC 4.2.1 Request for a new merchant account Complete an application form found at Appendix A Request for a new Merchant Account for online egov payments which must be signed by the authorised signatories in the grey panel and forward to HSBC Merchant Services together with: 1. If required as per MF Circular 7-2002, an authorisation letter issued from the Ministry of Finance for the creation of a new merchant account and indicating the authorised signatories for the relative department. 2. A copy of the ID Cards of the authorised signatories. These need to be authenticated. Any queries related to the above may be forwarded to HSBC on celiaabela@hsbc.com Please note that before a merchant account is issued, a website review is carried out by HSBC to confirm that the website is in line with their website requirements. A copy of the website requirements is found on Appendix B Applications and other required documents are to be sent to: HSBC Merchant Services Ltd HSBC Operations Centre, 2nd Floor Mill Street Qormi QRM 3101 4.2.2 Request for an additional terminal ID/s to an existing merchant account Complete an application form found at Appendix C Request for a new Terminal ID for online egov payments which must be signed by the authorised signatories in the grey panel and forward to HSBC Merchant Services together with: Any queries related to the above may be forwarded to HSBC on celiaabela@hsbc.com Please note that before a Terminal ID is issued, a website review may be carried out by HSBC to confirm that the website is in line with their website requirements. A copy of the website requirements is found on Appendix B Applications and other required documents are to be sent to: HSBC Merchant Services Ltd HSBC Operations Centre, 2nd Floor Mill Street Qormi QRM 3101 Page 8
Appendix A Request for a new Merchant Account for online egov payments Page 9
Page 10
Appendix B Website requirements Your Merchant Web-site must contain all of the following requirements: 1. Corporate information, trading name most recognisable to the cardholder, postal address, e- mail address, telephone number(s) and country of domicile of the business. The company name must be included if it is different to the trading name. The country of domicile of the business location must be clearly disclosed to the cardholder immediately prior to completion of the payment instructions. 2. A complete and accurate description of the goods/services offered, including any guarantees. 3. The web-site must be clear and legible. Graphics, video and links to other pages must not confuse the user. 4. Return/refund/cancellation policies. If there is limited refund or no refund policy, this must be very clearly communicated to customers before the purchase decision is made. 5. All customer service contact information, for example, e-mail address, telephone numbers (including free-phone numbers, facsimile numbers, etc). 6. Total price (including any additional charge for delivery) must be displayed in euro). 7. Web-site must not advertise or accept orders for goods that you are unable to supply. In particular you must monitor and update your website, removing any items you are unable to supply and offer immediate refunds to cardholders where you are unable to supply goods and the cardholder is unwilling to accept the delay. 8. Web-site must be consistent with the sale documentation (advertising, brochures, terms and conditions, guarantees, etc) supplied by you on your web-site. 9. Policy regarding delivery of goods, and inclusive of any restrictions or other special conditions in place. 10. Data privacy policy must be clearly stated including what type of information is collected, the purpose of collecting the data, when the information is being collected, how the cardholder information is going to be used, to what extent it will be shared in any way with a third party or within the Group and if and how a consumer can restrict the use of their personal information. 11. If merchant provides recurring goods or services, for example, subscriptions, etc and change a cardholder s account periodically, merchant must obtain a written permission in the format such as hard-copy or electronic record from the cardholder for the goods or services to be charged to the cardholder s account. The written permission must at least specify the transaction amount, frequency of recurring charges and duration of time for which the cardholder s permission 12. Information about method of transaction security you use to secure cardholder account data during the ordering and payment process must be provided to the consumer. It should include what level and type of security is being used, why it is being used in general, what steps are taken to ensure data quality and access, how it is being held and where, what the consumer will benefit from it, what pages will be secured etc. This information needs to be clear and easy to understand. Page 11
13. The payment screen must:- Must be hosted at the payment gateway Obtain the cardholder s name, postal address, email address, telephone number, card number and expiry date Obtain the cardholder s authority to debit the card Advise that care of and temporarily addresses such as Internet cafes will not be accepted State the despatch date, where payment takes place before despatch State the currency of the transaction State the total transaction amount, including all delivery, handling and tax charges Include the merchant s delivery policy, indicating the ability to support global delivery Display the merchant s refund, replacement and cancellation terms Detail any relevant export restrictions Must include cvv2 Contain appropriate security, such that card details input are appropriately encrypted and protected from being hacked into Disclose the location of merchant immediately prior to completion of any payment instruction 14. When an order and payment has been accepted, a transaction receipt or order confirmation must be provided to the cardholder either by e-mail or post. This must contain the following: A unique identification number to assist in dispute resolution Merchants trading name, postal address and telephone number Your website address The purchaser s name The amount and currency in euro A description of the goods and services bought The authorisation code for the transaction Merchants return/refund policy, if restricted The despatch date and delivery method. Card type and truncated card details (expiry date not to be included) 15. In case of recurring transactions the receipt must also contain the following in addition to the above:- The phase recurring transaction Details of the frequency of debits The period for which the debits have been agreed Page 12
Appendix C Request for a new Terminal ID for online egov payments Page 13
Page 14