Merchant Services Program

Given the importance of systems, technologies, regulation compliance, policies, and procedures in the Merchant Services infrastructure, a close partnership with UIT continues to be critical to the success of the program. To effectively support campus merchants, the program responsibilities are distributed as follows:

A merchant is a person or an organization registered to accept and process card present, electronic payment cards or digitally transmitted transactions for selling goods and services online or in person. Following are important steps and considerations for merchants when creating and maintaining their account.

New Merchant Accounts and Set up

• For guidance, provide the MS team with the following details during an initial consulting session:
  • Your role and department background
  • Line of business that you want to take payment for
  • Transaction volume (sales) and frequency
  • Types of payments (ACH, Wire, Credit/Debit Card, other)
  • Payment acceptance channel (Point of Sale, E-commerce, Mail Order/Phone Order, Mobile)
  • Any third-party vendor
• If a third-party vendor is considered for payment processing, it needs to be fully vetted by:
  • MS for payment capability and financial risk assessment
  • Information Security Office (ISO) for Data Risk Assessment and PCI Compliance
  • Contracts in FMS Procure to Pay to assess contractual terms to ensure compliance with university policy regardless of requisition or purchase order status
  • Note: When considering new vendors, review the criteria and steps for a Third-Party Vendor Evaluation.
• Submit a support request attaching a copy of the signed merchant application form for MS to review.
  • If approved, allow up to one to two weeks for MS to set up a merchant account and/or order any equipment .
• Complete required PCI compliance training and any other equipment/gateway specific training.
• Perform vendor/payment integration and test a transaction.
• Launch payment acceptance channel(s).
• Track/reconcile the revenue and expense.

Existing Merchant Maintenance

• Contact MS for any changes associated with merchant accounts.
• Report any card fraud or data breach incidents to ISO immediately.
• Perform inspections on POS equipment, keep them secure when not in use, and update inventory/inspection logs periodically.
• Work with the merchant provider's customer support as needed to troubleshoot terminal issues.
• Promptly respond to any requests for information regarding a chargeback dispute transaction.
• Provide vendor’s PCI DSS documentation annually, if applicable.
• Complete PCI compliance attestation self-assessment questionnaires (SAQs) annually.
  • Individuals involved in payment card activities are required to complete PCI compliance training annually.

Assigned Roles in Merchant Account 

Merchants must assign the following roles to employees in the organization:

• Account Owner ensures compliance with all applicable Stanford policies. Account owner must be at a director level or higher and must The Account Owner must have financial signature authority for the revenue/expense award(s) provided for the merchant account.
• Department Contact is the secondary contact person after account owner for any inquiries received on a merchant account.
• Finance Contact performs the monthly reconciliation of their department’s card revenue. They ensure the timely response to any requests and chargeback notices received from the merchant bank.
• PCI Contact ensures all employees are familiar with the PCI DSS requirements and how it relates to their job function. They ensure the organization has documented procedures in place for the compliant handling of credit card information.
• Technical Contact (if applicable) addresses any technical issues specific to the merchant’s online processing requirements.

The Payment Card Industry Data Security Standard (PCI DSS) enforces protection of consumers’ high-risk payment card data by requiring all organizations that process, transmit, and store payment card information to comply with a set of data controls, establish IT and physical security measures, and meet policy requirements in order to mitigate the risk of a security breach, or the loss, theft, or abuse of payment card data.

All Stanford departments that accept card payments, and any third-party service provider accepting payment data on their behalf, must be PCI compliant and complete an annual certification. All staff handling cardholder data are required to complete annual training. 

Merchant Services collaborates with the University IT Information Security Office (ISO) to help Stanford department merchants meet their PCI Compliance requirements. For all information on PCI DSS, visit the pcicompliance.stanford.edu and learn about:

• Compliance Requirements
• Vendor Evaluation
• Annual Training
• Policies & Resources
• Incident Response

Stanford merchants are required to maintain compliance with university policies and must review the Administrative Guide prior to processing payments. These ensure protection of Stanford's information resources, outline procedures to be followed when a computer security incident is discovered, provide guidance on proper engagement in unrelated business activities, and ensure relationships with entities independent of the university are structured correctly.

• 1.4.1: Academic and Business Relationships with Third Parties
• 1.5.3: Unrelated Business Activity
• 3.4.2: Card and Payment Account Acceptance and Processing
• 6.3.1: Information Security
• 6.6.1: Incident Response

Additional Resources

• Visit pcicompliance.stanford.edu to learn about PCI compliance requirements and details to protect the information assets important to Stanford.
• Electronic storage of cardholder data at Stanford is prohibited except on an approved secure and segmented network. Submit a support request to Merchant Services (MS) for more information.
• Refer to Merchant Services Privacy Policy to learn more about managing risk and protecting merchant businesses and client information.
• Unrelated business income is the income from a trade or business activity that is regularly carried on by an exempt organization and that is not substantially related to the performance by the organization of its tax exempt purpose or function. For more information, refer to Resource: Unrelated Business Income.
• See the Topic Overview: Tax Compliance at Stanford for university tax policy, standards, and best practices.