23-Payment Card Processing Questionnaire, GEN2131264P1.pdf

Payment Card Processing Questionnaire Group 2: Merchant Card Services

The complete questionnaire should be submitted with the solicitation response. If a response requires additional information, the Vendor should upload a written detailed response with submittal. If not submitted with response, it must be submitted within three business days after the County’s written request. Vendor may be deemed non-responsible for failure to fully comply within these stated timeframes.

All third parties, including payment card processors, acquiring banks, affiliated entities, subcontractors, etc., that will be providing payment card processing equipment or services, including implementation services or payment card processing solution services, are required to be disclosed. Failure to disclose any information may affect determination of Vendor’s responsibility.

Broward County requires any payment processing goods or services be in full compliance with the latest Payment Card Industry (PCI) Data Security Standard (DSS), and such compliance must be maintained through the Agreement term. Additionally, all electronically printed receipts must comply with the Fair and Accurate Credit Transactions Act (“FACTA”), 15 U.S.C. § 1681c(g), as amended, including that card numbers and expiration dates are properly truncated in accordance with the requirements of FACTA.

1. Submit a description of the solution’s payment processing model. Include personnel, operations, networks, hardware, software, payment gateways and any other components critical to the full processing of payment cards from card swipe or card data entry to payment transfer to the acquiring bank.

2. List all parties (Legal Name and DBA Name, if applicable) included in Vendor’s proposed payment card processing system/solution, including all third parties, that provide the following:

A. Payment Processing

B. Payment Gateway

C. Software Licensing

D. Hardware (include manufacturer, model name and/or number)

E. Maintenance or Services to operate/maintain Vendor’s proposed solution

F. Other

3. For each identified party, identify role and compensation, rebates, or revenue sharing the party has received, or expects to receive, if your firm is awarded this project.

4. Identify any proprietary or exclusive services or relationships, including without limitation any exclusive banking or payment processing arrangement or proprietary technology, that is included in the proposal and state whether the proposed system/solution can accommodate alternatives.

5. Currently the County uses Wells Fargo as its acquiring bank. Do you agree to use the County’s preferred acquiring bank as the exclusive acquiring bank for the proposed solution? Yes or No

If No, submit copies of any draft acquirer agreements that your proposed solution would require be executed by the County.

6. Is the proposed payment card processing solution compatible with more than one acquiring bank?

Payment gateway? Payment processor?

Yes or No

List all acquiring banks, payment gateways, and payment processors that the proposed solution is known to be incompatible with.

7. Is the proposed solution validated for use with multiple processors/gateways? Can it still be used if the County changes providers? Identify any similar limitations, requirements, or restrictions applicable to the proposed payment card solution.

8. Does each P2PE encryption solution have an active listing (i.e., a current P2PE validation) from the PCI Security Standards Council?

Yes or No

(If Yes, the County will verify this on the PCI Security Standards Council website).

If No, explain why the P2PE solution has not been validated by the PCI Security Standards Council or why the validation has been allowed to expire and any exceptions to validating compliance that are applicable to this solution.

9. Indicate which components of the Vendor’s proposed solution are listed as compliant on the PCI P2PE Security Standards Products and Solutions Listings website?

Solutions

Components

Applications

10. List each third party with whom the Vendor or its affiliates has an agreement, or intends to enter into an agreement, that would be binding on the County if Vendor’s proposed solution is selected, and provide a copy of the applicable agreement(s).

A. Payment Processing

B. Software licensing

C. Hardware

D. Maintenance or Service agreements

E. Other https://listings.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_solutions?agree=true

11. Identify the licensing model (per transaction, per terminal, per user, enterprise, etc.) proposed for the payment processing solution and whether the licenses are transferable if the County changes acquirer, processor, or gateway.

12. Submit a current PCI AOC (Attestation of Compliance).

If not available, indicate why.

13. Include any other information relevant to full disclosure of proposed solution’s current and ongoing PCI compliance.

14. Identify the entity that would be the Merchant Bank and the Merchant of Record for proposed solution.