Spring Release 2009

Explanation

Periodically throughout the year, the card associations evaluate their processes and regulations. These changes apply to all credit and debit card processors and may impact the fees and rates you incur to accept electronic payments.

MasterCard – Introduction of High-Value Card

MasterCard has recognized an additional need for further segmentation in the U.S. World Consumer credit card program for high-value accounts. As a result, MasterCard will introduce a card type and a new interchange rate structure for MasterCard High-Value cards. The new interchange structure will be modeled after the MasterCard World Elite rate structure, and the card is targeted to consumers who have high spending habits.

Visa Triple DES and PCI PED Requirements (PIN Encryption)

Visa/Interlink has announced a mandate requiring all merchants accepting debit cards to use a PIN entry device that supports enhanced encryption, referred to as Triple DES, by July 1, 2010. As a result of this mandate, all PIN entry devices considered non-compliant will need to be replaced with a compliant PIN entry device. Affected merchants will be contacted with the details of the replacement. You can also obtain information regarding PCI-PED requirement mandates and approved devices at: www.Visa.com/PIN.

Receipt Truncation Requirements IMPORTANT REMINDER

If your terminal is not compliant with applicable federal and state law, as well as card association rules, your business may be subject to significant fines or other penalties. The receipt you provide to a customer may not include the customer's card expiration date or any more than the last four digits of the customer's card number. In addition, some states and MasterCard have similar laws and requirements that apply to the receipt your business retains. If you believe that your terminal needs to be upgraded to comply with these requirements, please contact us by using our online Customer Service contact form.

Data Security Requirements Reminder

PCI Security Standards Council, founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc., require that all merchants maintain compliance with the Payment Card Industry Data Security Standards (PCI DSS). The card associations are very serious about data security. Merchant fines and assessments resulting from a breach can easily reach more than $1 million if your customers' credit card data is lost or stolen. Association fines alone can be as much as $500,000 per association. This is in addition to repayment of subsequent fraud and card reissuance costs. Assessing your risk and validating compliance can be accomplished using an approved security assessor/scan vendor who can guide you through the process. The following Web site contains valuable information:

• www.pcisecuritystandards.org - Includes a complete list of PCI DSS requirements, education material, the self-assessment questionnaire, and approved security assessors/scan vendors.
• If you have not already started the process of becoming PCI DSS compliant, we invite you to visit the PCI Compliance/Data Security section of this Web site for more information and next steps, or you can call SecurityMetrics at our dedicated toll-free number 800-557-4684 to review your card-handling process(es) and determine your specific PCI requirements.

After reviewing the information, if you have questions regarding Spring Release 2009, please contact us by using our online Customer Service contact form.