A written authorization can be for either fixed or variable amounts as well as single or recurring transactions.

• Fixed transactions – The Authorization Form must include the amount of each transaction and the dates and/or frequency of the transactions.
• Variable transactions – You must give the Customer notification of the amount and the date on or after which the transaction will be debited. This notification must be given at least 10 calendar days prior to the settlement date.

All authorization forms must be signed and dated by the Customer and include:

• Customer's name
• Customer's address, city, state and zip
• Customer's bank routing and account numbers
• A voided check or savings deposit ticket
• Language on how the Customer can terminate the authorization

Vanco recommends using one of our pre-designed authorization forms. If you choose to design your own form, Vanco must review and approve it in order to make certain that all required information is included.

A copy of the authorization must be retained for a minimum of two years following the termination or revocation of the authorization.

Document Destruction: ACH rules require that authorizations be destroyed after two years from the date of the last transaction. Vanco will issue a Document Destruction Report prompting the recipient to destroy the listed authorizations.

For the security and privacy of customers' personal information, Vanco highly recommends storing signed authorization forms in a secure place (i.e. a locked cabinet).

If you would like to be able to accept Internet-initiated transactions, contact your sales representative for details. Authorizations received via the Internet can be for either one-time transactions or recurring transactions. The authorization must conform to the ACH rules and guidelines and include the same requirements as a written authorization.

Authorizations must be signed or similarly authenticated. Two valid options for authentication are:

• Your safest option is using a User ID and password that you have assigned the customer. This User ID and password must be unique to each customer.
• Generate an email back to the customer confirming the information they entered. The authorization is considered authenticated once the customer has responded to the email.

In addition, the authorization must clearly state that it is for an ACH debit, state the terms of the authorization, and (for recurring payments) provide a method to terminate the authorization by notifying you. You should also prompt the customer to print and retain a copy of the authorization.

If you would like to be able to accept telephone-initiated transactions, please contact your sales representative. When conducting TELtransactions, you must adhere to the following guidelines:

• TEL-transactions are conducted for single debit entries only.
• The customer must initiate the telephone inquiry or have a pre-existing relationship with your organization.
• Additional debits to an account require written authorization from the customer and must be initiated by the customer.
• Transactions must be coded as a "TEL".
• You must either record the oral authorization or provide the customer with written notice confirming the oral authorization prior to the settlement date.

Original or duplicate recordings or written confirmation of customer's authorization must be retained for two years from the date of authorization and must be made available to upon request to review for compliance.

Document destruction: ACH rules require that authorizations be destroyed after two years from the date of the last transaction. Vanco will issue a Document Destruction report prompting the recipient to destroy the listed authorizations.

Telephone-initiated authorizations must include the following information:

• Customer's name
• Customer's address, city, state and zip
• Date on which the account will be debited
• The amount of the single entry debit
• Customer's bank account and routing number
• Date of customer's verbal authorization
• A business telephone number for the customer to call during normal business hours.
• A statement that the information given by the customer will be used to originate a single ACH debit entry to the customer's account along with a clear expression of the terms of the authorization.

In order to process a credit card transaction, you must first obtain authorization from the cardholder. Failure to do so may result in a chargeback and/or the termination of your agreement. A cardholder's authorization indicates the cardholder's willingness to allow you to charge his/her card for the exchange of a service. It does not warrant that the person providing authorization is the rightful cardholder, nor is it an unconditional promise or guarantee that you will not be subject to a chargeback or debit.

Upon receiving authorization, Vanco submits the transaction to the appropriate association where it is assigned an "Authorization Code". The authorization code authorizes Vanco to process the transaction. Vanco stores all authorization codes.

The three forms of authorization allowed by Vanco are written(Authorization Form), internet-initiated, and telephone-initiated. All authorizations must include the following:

• Name on credit card
• Cardholder's billing address, city, state and zip. (The cardholder's billing address is required and used with our Address Verification Service (AVS) to protect against fraud.)
• Credit card type
• Credit card number and expiration date
• Transaction amount
• Frequency of changes and duration (if recurring)
• Signature of cardholder or electronic equivalent
• Date of authorization

Visa defines convenience fee as a flat fee charged for bona fide convenience, charged on a non-face-to-face transaction. A merchant that charges a convenience fee must ensure that the fee is:

• Charged for a bona fide convenience in the form of an alternative payment channel outside the merchant's customary payment channels.
• Disclosed to the cardholder as a charge for the alternative payment channel convenience
• Added only to a non face-to-face transaction.
• A fixed amount (not a percentage).
• Applicable to all forms of payment accepted in the alternative payment channel (so applied to Visa, MasterCard, ACH, etc.)
• Disclosed prior to the completion of the Transaction and the Cardholder is given the opportunity to cancel.
• Included as a part of the total amount of the transaction, and not put through interchange as a separate transaction.

Vanco recommends using one of our pre-designed Authorization Forms. If you choose to design your own authorization form, Vanco must review and approve it to make certain that it complies with Association Rules.

Internet-initiated authorizations must include all the appropriate authorization information listed in above. To accept internet-initiated transactions via your website, ask your Vanco sales representative about WebPay. If you currently have a secure payment page for your website, or have the ability to manage the development in-house, Vanco can process those Internet-initiated transactions. Contact a Vanco representative for more information.

If you use the telephone to obtain authorization for a credit card transaction, you must adhere to the following guidelines:

• Telephone-Initiated transactions are one-time transactions only.
• TEL entry may be transmitted only in circumstance in which (1) there is an existing relationship between consumer and organization, or (2) there is not an existing relationship, but the consumer has initiated the;telephone call to the organization.
• Additional credit card charges require written authorization from the cardholder and must be initiated by the cardholder.
• Staff member taking the telephone authorization must complete an authorization form and write "TO" (telephone order) on cardholder's signature line.

Telephone-initiated authorizations must include all the appropriate authorization information listed above, along with the date of cardholder's verbal authorization and a business telephone number for the cardholder to call during normal business hours.

Written and/or Telephone Initiated Authorization: A copy of the authorization form or the original confirmation of the cardholder's authorization must be retained for a minimum of three (3) years following the termination or revocation of the authorization.

For the security and privacy of cardholders' personal information, Vanco highly recommends storing signed authorization forms in a secure place (i.e. a locked cabinet).

Document Destruction: Card association rules require that authorizations be destroyed after three years from the date of the last transaction. Vanco will issue a Document Destruction report prompting the recipient to destroy the listed authorizations.

Internet-Initiated Authorization: You are not required to retain any records regarding internet-initiated authorizations. Vanco will store authorizations made via the Internet in our system.

Vanco provides clients with a master copy of an authorization form. If you wish to customize the form, please contact riskmgmt@vancopayments.com for assistance. Vanco must approve all customized forms.

Requirements for retaining authorization forms:

• ACH authorizations must be retained for two (2) years after the date of the last transaction.
• Credit and debit card authorizations must be retained for three (3) years after the date of the last transaction.
• Authorizations may be retained as either paper forms or scanned images.
• If you retain paper forms:
  • Limit access to those individuals who require access in order to perform their duties.
  • Store them in a locked cabinet or safe.
  • Mark them as confidential.
  • Maintain an inventory log of forms on file.
  • Utilize cross-cut shredding when destroying documents.
• If you retain scanned images:
  • Store them in encrypted, password-protected files.
  • Limit access to those individuals who require access in order to perform their duties.

• Never store credit card or banking information unless it is encrypted and password protected.
• Ensure that your computers have up-to-date virus protection programs.
• Ensure that your website has a minimum of 128-bit SSL encryption.
• Never write down or share your User ID and/or password.
• Review all Vanco reports and compare them to your bank statement to ensure transactions are being processed and deposited as expected.

If you have questions, please contact Client Services at 800-675-7430 or email cs@vancopayments.com.