Credit Card and Debit Card Handling Guidelines

Rice University receives credit and debit card payments for donations and for the purchase of goods and services. When a card transaction is made, the department’s merchant ID and the cardholder information are sent to the credit card company through a gateway provider. Once the transaction is complete, the credit card company deposits the payment in the Rice University bank account. These funds are distributed to the fund, org and account specified by the department on the credit card deposit voucher. It is the department’s responsibility to reconcile their transactions monthly to make sure that credit card payments are appropriately credited.

Departments accepting credit or debit card payments must also comply with the data security standards of the Payment Card Industry (PCI-DSS). The university procedures related to data security standards are available on the web at: https://policy.rice.edu/808. Individual departmental procedures required with the annual Self-Assessment Questionnaire (SAQ) must meet the requirements of both that university procedure and this university procedure.

All faculty, staff, students, organizations and individuals who handle credit and debit card receipts at Rice must follow the procedures described below. The Bursar is available to answer questions or to provide assistance.

Definition

Credit and debit card receipts include settlement tapes, merchant duplicate receipts, reports, electronic data and any other instance where cardholder data, in full or partial, may be displayed.

Responsibility

The Treasurer’s Office, with the assistance of the Credit Card Committee when necessary, is responsible for granting approval to departments to accept credit and debit card transactions.

The Bursar’s Office is responsible for processing and depositing credit card receipts and for providing guidance on handling credit card receipts. This includes processing the WebApps Credit Card Deposit Vouchers (CCDV), monitoring TouchNet Payment Gateway credit and debit activity and providing training for department staff on CCDVs.

Web Services creates, administers and maintains TouchNet Marketplace sites used to process departmental credit and debit card transactions.

Each department that processes credit card receipts has the responsibility to establish appropriate controls to insure that credit card receipts are deposited properly and promptly. These responsibilities include monitoring credit card receipts handling, reconciling amounts received to amounts deposited and segregating these duties effectively. The department chair/head or student organization sponsor insures that:

  1. Credit card receipt procedures are established that comply with these guidelines;
  2. Receipts are deposited promptly into the correct university fund, org and account;
  3. The amount recorded in the university’s financial accounting system agrees with the amount received;
  4. No one individual can process credit card payments, make deposits and reconcile the actual receipts to the deposits in the financial accounting system;
  5. New staff who handle credit card receipts are trained properly; and
  6. Established procedures are reviewed periodically to ensure they function effectively.

Departments with receipts not accepted through the TouchNet Payment Gateway (TPG) are responsible for:

  1. Sending or delivering all credit card receipts to the Bursar promptly, i.e., no later than the business day after the credit card activity is received. Attach an online Credit Card Deposit Voucher form created in WebApps (see attached for preparing deposits online), which contains the information needed to credit the receipts to the correct fund/org/account. Also attach a copy of the settlement, including a summary of payments by card type.
  2. Delivering all credit card receipts to the Bursar’s Office during normal business hours. If the Bursar’s Office is closed, secure the receipts as described in item 3 below and make the deposit the next business day.
  3. Safely and securely storing all credit card information whether printed or digital. It is confidential personally identifiable information (PII) and procedures must meet the University’s requirements for using and storing PII. Access to such information must be limited and closely scrutinized. (For more information on proper security procedures, see the university policy on Protection of PII at https://policy.rice.edu/sites/g/files/bxs1746/f/808.pdf )
  4. Reconciling, at least monthly, department revenue recorded in Banner to file copies of cash and credit card deposit vouchers to ensure that all revenue was properly recorded.

Departments with receipts accepted through the TPG are responsible for:

  1. Reconciling, at least monthly, department revenue recorded in iO to file copies of cash and credit card deposit vouchers to ensure that all revenue was properly recorded.
  2. The TPG is configured to automatically settle all credit and debit card activity at approximately 3 pm each day. The department should not send any credit or debit card receipts processed through the TPG to the Bursar’s Office. Questions about payments processed through the TPG may be addressed to either the Bursar’s Office or WebServices.