Guideline for Payment Card Processing Exceptions

Purpose

The purpose of this document is to provide guidance on how to request  approval for an exception to the Standard for Accepting Electronic Payments.

Scope

This guideline applies to all UNC Charlotte employees, affiliates and authorized users who will interact with payment card data, functions or systems as part of their job duties.

Contacts

Direct general questions about this guideline to the Office of the Bursar – Merchant Services at ecommerce@charlotte.edu.

Guidelines

The University does not currently store, process, or transmit Cardholder Data (CHD) on the University’s network. Therefore, any changes to the University’s CHD Environment or exceptions to the Standard for Accepting Electronic Payments must be submitted in writing to the Office of the Bursar – Merchant Services at ecommerce@charlotte.edu for consideration, and approval by both the Vice Chancellor for Business Affairs (VCBA) and Chief Information Officer (CIO). 

Requests should include:

1. Business reason for the exception
2. Steps that will be taken to ensure compliance with Payment Card Industry Data Security Standards (PCI DSS) requirements
3. The date that the exception will no longer be needed

The Office of the Bursar – Merchant Services, in conjunction with OneIT, will work with the VCBA and the CIO to review the request. The final approval or denial will be made by the VCBA or their designee.

The University prohibits the use of virtual terminals on its merchant accounts. The University no longer utilizes analog fax machines, and digital fax machines are not an acceptable method to receive mail order forms. These types of exceptions significantly change the scope of the University’s PCI DSS compliance requirements and will not be approved. 

Exceptions Requiring UNC System Office Endorsement and OSC Approval

1. Merchant Accounts outside the Merchant Card Master Service Agreement (MSA)
   
   The University does not currently allow departments to open merchant accounts outside of the State’s MSA.
   
   According to NC Policy 500.2 – Statewide Accounting Policy – Master Services Agreement for Electronic Payments, State agencies (including universities) are required to use the State’s MSA unless an exemption, endorsed by the UNC System Office, is approved by the State Controller. However, according to NC G.S. 116-40.22(e) (Management Flexibility), the University is authorized to contract with service providers specializing in services offered to institutions of higher learning that offer systems or services under arrangements that provide for the receipt of funds electronically, provided the services are in compliance with the requirements of the payment industry security standards. 
   
   Departments requesting to establish a merchant account through any other financial institutions besides the University’s merchant services provider (e.g., Fiserv) must provide a written business case to the Office of the Bursar – Merchant Services at ecommerce@charlotte.edu detailing:
   • Why the exception is necessary, and 
   • Who will be responsible for managing and supporting the new merchant account system(s)
2. Exemption from the North Carolina (NC) G.S. 147-77 (Daily Deposit Act)
   
   The University does not currently have any departmental daily deposit exemptions.
   
   According to the NC Daily Deposit Act, all funds in the hands of any agency of the State collecting or receiving money belonging to the State of North Carolina, must deposit and record those funds with the State Treasurer, at noon, daily. However, according to NC G.S. 116-40.22(e) (Management Flexibility), the State Treasurer may exempt the applicability of the daily deposit requirement for any standard business process resulting in a delay in the University receiving the funds from a service provider, when the exemption is based upon an acceptable business case that demonstrates an overall efficiency to the University and State. Such a business case must first be endorsed by The University of North Carolina System Office before submission to the State Treasurer for consideration. 
   
   Departments requesting an exemption from the daily deposit requirement must provide a written business case to the Office of the Bursar at bursar@charlotte.edu detailing:
   • Why the exception is necessary, and 
   • How frequently money will be deposited with the State Treasurer

Related Resources

• Merchant Card Master Service Agreement
• NC G.S. 116-40.22(e) (Management Flexibility)
• NC G.S. 147-77 (Daily Deposit Act)
• NC Policy 500.2 – Statewide Accounting Policy – Master Services Agreement for Electronic Payments
• Standard for Accepting Electronic Payments

Revision History

• Initially approved by the AVC for Finance on November 25, 2024