CHAPTER 8
ACCEPTING CREDIT CARD PAYMENTS
781—8.1(12) Purpose. Iowa Code section 12.21 grants authority to the treasurer of state to enter into an agreement with a financial institution to provide credit card receipt processing for state departments and to establish administrative and other procedures as necessary to implement the acceptance of credit card payments by state departments that are authorized to accept such payments. The purpose of these rules is to provide for the administration and operation of credit card receipt processing for state departments.
[ARC 9100B, IAB 9/22/10, effective 10/27/10]
781—8.2(12) Definitions. As used in this chapter:
“Acquiring bank” means a financial institution that receives credit card transactions and then settles with the card-issuing banks.
“Chargeback” means a transaction disputed by a cardholder or card issuer.
“Convenience fee” means a fee charged to the cardholder for the convenience to that cardholder of using a particular method of payment in a credit or debit card transaction in accordance with the network regulations governing that transaction.
“Credit card” means the same as defined in Iowa Code section 537.1301, subsection 17.
“Credit card associations” means Visa, MasterCard, American Express, Discover Network, Diners, JCB, and any other organization that issues or sponsors credit cards or signature-based debit cards that are accepted by state departments.
“Debit card” means a card used to purchase goods or services and to obtain cash in which the cardholder’s personal deposit account is reduced by the transaction amount. Debit card transactions that are processed on credit card association networks are typically called signature-based debit card transactions, while debit card transactions processed on electronic funds transfer networks are generally referred to as PIN-based transactions.
“Financial institution” means the same as defined in Iowa Code section 527.2 and includes any bank incorporated under the provisions of any state or federal law, any savings and loan association incorporated under the provisions of any state or federal law, any credit union organized under the provisions of any state or federal law, any corporation licensed as an industrial loan company under Iowa Code chapter 536A, and any affiliate of a bank, savings and loan association, credit union, or industrial loan company.
“Merchant” means the state department or subdivision that accepts credit card and debit card payments.
“Merchant guidelines” means the manual issued by the merchant services provider that prescribes the rules and procedures governing credit card and debit card transactions and a state department’s use of the credit card and debit card processing services.
“Merchant services provider” means a company that manages the processing of credit card and debit card transactions among merchants, credit card issuers, and acquiring banks.
“Payment card industry data security standards” or “PCI-DSS” means a set of comprehensive requirements for credit card data security developed by the Payment Card Industry Council, founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc.	International.
“Treasurer” means the treasurer of the state of Iowa and staff members who carry out duties delegated by the treasurer.
[ARC 9100B, IAB 9/22/10, effective 10/27/10]
781—8.3(12) State department requirements for accepting credit card payments.
	8.3(1) A state department shall notify the treasurer of its intent to accept credit card payments and provide the treasurer with the following information:
	a. 	The type of goods and services it will offer for payment by credit card and debit card.
	b. 	The estimated per-transaction amount, yearly transaction volume, and total yearly dollar volume to be collected.
	c. 	The number and location of departmental sites that may accept credit card payments.
	d. 	The method that the department will use to accept card payments, for example, through a Web site, a virtual terminal, a point-of-sale terminal, or a wireless terminal.
	8.3(2) A state department shall purchase or lease any equipment or software required to accept credit card payments, or pay any fees charged for access to online virtual terminals used to process credit card and debit card payments.
	8.3(3) A state department shall sign an agency participation agreement with the treasurer acknowledging its responsibilities under the credit card contract, including, but not limited to:
	a. 	Following the procedures for accepting payments by credit card and debit card as outlined in the agreement between the financial institution, merchant services provider, and treasurer, and as specified in the merchant guidelines.
	b. 	Following procedures issued by the treasurer to record receipts, corrections to receipts, refunds, chargebacks, expenses, and any other accounting transactions associated with accepting credit card and debit card payments.
	c. 	The payment of all equipment and software costs, all processing fees and charges incurred in accepting card payments, including the costs of supplies, and all fees charged for annual PCI-DSS reviews.
	d. 	Becoming compliant with PCI-DSS and maintaining that compliance as long as the department accepts credit card and debit card payments.
	8.3(4) A state department shall receive authorization from the treasurer prior to accepting credit card and debit card payments.
	8.3(5) A state department shall follow the procedures and rules for charging a convenience fee for credit card and debit card transactions as outlined in the agreement between the financial institution, merchant services provider, and treasurer, and as specified in the merchant guidelines, and by the credit card associations’ rules.
	8.3(6) A state department shall follow the instructions provided by the treasurer for completing cash receipts documents to reflect credit card transactions that post to the treasurer’s account at the financial institution.
	8.3(7) A state department shall be responsible for achieving and maintaining compliance with all applicable PCI-DSS.
	8.3(8) A state department shall be responsible for completing an annual review of its compliance with PCI-DSS, as required by the treasurer’s credit card processing contract and by the PCI-DSS. At any time throughout the year, the state department shall promptly cure any instance of noncompliance of which it becomes aware.
	8.3(9) A state department shall be responsible for any penalties, fees, fines, and other costs assessed against the department, the treasurer, or the state of Iowa, resulting from or arising out of the department’s violation of, or noncompliance with, PCI-DSS.
[ARC 9100B, IAB 9/22/10, effective 10/27/10]
781—8.4(12) Procedures for administering the credit card receipt process.
	8.4(1) The treasurer shall enter into an agreement with a financial institution to provide credit card payment processing for state departments.
	8.4(2) The treasurer shall specify which credit cards may be accepted by state departments.
	8.4(3) The treasurer shall enter into an agency participation agreement with each state department authorized to accept credit card payments under the credit card processing contract.
	8.4(4) The treasurer shall provide state departments with a copy of the merchant operating guidelines.
	8.4(5) The treasurer shall provide state departments with information on costs for credit card and debit card processing, equipment, software, and supplies as specified under the credit card processing contract.
	8.4(6) The treasurer shall provide state departments with instructions on creating cash receipts documents for credit card receipts.
	8.4(7) The treasurer shall notify a state department that it is authorized to accept credit card and debit card payments and provide the department with its merchant identification number and other account information.
	8.4(8) The treasurer shall terminate the agency participation agreement and a state department’s authority to accept credit card and debit card payments if a state department fails to comply with the requirements outlined in this chapter.
[ARC 9100B, IAB 9/22/10, effective 10/27/10]
781—8.5(12) Adjustments for convenience fees. If a state department is allowed to charge its customers a convenience fee under the credit card processing contract, then the following shall apply:
	1.	The treasurer shall consult with the state department to assist in determining the amount by which the department’s fees may be adjusted to reflect the cost of credit card processing.
	2.	The state department shall follow all credit card associations’ rules on how and when a convenience fee may be charged.
	3.	The treasurer shall notify state departments of any changes in the credit card associations’ rules on convenience fees.
[ARC 9100B, IAB 9/22/10, effective 10/27/10]
These rules are intended to implement Iowa Code section 12.21.
[Filed 3/15/91, Notice 2/6/91—published 4/3/91, effective 5/8/91]
[Filed 7/11/96, Notice 6/5/96—published 7/31/96, effective 9/4/96]
[Filed ARC 9100B (Notice ARC 8952B, IAB 7/28/10), IAB 9/22/10, effective 10/27/10]