Agent Registration - Visa Asia Pacific

Agent RegistrationProgram Guidelines(For use in Asia Pacific, Central Europe, Middle East and Africa)

Contents1 INTRODUCTION ........................................................................................................................... 31.1 BACKGROUND........................................................................................................................... 31.2 PURPOSE OF DOCUMENT ........................................................................................................... 41.3 WHO NEEDS TO BE REGISTERED? .............................................................................................. 51.4 WHY IS IT NECESSARY TO REGISTER THE AGENT? ..................................................................... 72 REGISTRATION PROCESS......................................................................................................... 82.1 REGISTRATION PROCESS........................................................................................................... 82.2 WHEN TO REGISTER .................................................................................................................. 82.3 REGISTRATION FORMS.............................................................................................................. 93 REGISTRATION FEES ............................................................................................................... 104 REGISTRATION NON-COMPLIANCE.................................................................................... 115 OTHER COMPLIANCE REQUIREMENTS............................................................................. 125.1 VISA PROGRAM COMPLIANCE................................................................................................. 126 FREQUENTLY ASKED QUESTIONS....................................................................................... 147 REFERENCES .............................................................................................................................. 187.1 AGENT WEBSITE ..................................................................................................................... 187.2 THIRD PARTY COMPLIANCE REQUIREMENTS.......................................................................... 187.3 OTHER PROGRAM LINKS......................................................................................................... 187.4 EMAIL CONTACT..................................................................................................................... 18GLOSSARY............................................................................................................................................. 19

Agent Registration Program Guidelines1 Introduction1.1 BackgroundAgents can be an effective resource for Visa clients to use whenmanaging their acquiring and issuing programs.The Agent Registration Program is a Visa-mandated program enactedto ensure that Visa clients are in compliance with Visa Inc. OperatingRegulations (“VIOR”) and policies regarding their use of Agents. Visaclients are required to perform due diligence reviews to ensure thatthey understand the Agent’s business model, financial conditions,background and Payment Card Industry Data Security Standard (PCIDSS) compliance status (where applicable).Agent registration is required for all entities that provide Visa paymentrelated services, directly or indirectly, to a Visa client.3

Agent Registration Program Guidelines1.2 Purpose of DocumentThis document explains the Agent registration requirements for Visaclients and their agents. Visa’s Agent registration program is intendedto help the clients and agents:• Understand their accountabilities and responsibilities to theVisa payment system;• Ensure their compliance with the Visa International OperatingRegulations (VIOR) and regional operating regulation.These guidelines for Agent Registration should serve as a referencefor Visa clients and Agents when outsourcing Visa payment relatedservices to Agents within and outside the Asia Pacific region.4

Agent Registration Program Guidelines1.3 Who needs to be registered?Generally, an agent is an entity engaged to provide Visa paymentrelatedservices, directly or indirectly, to a Visa client. An Agent can bea VisaNet Processor (VNP), Third Party, or both.A VisaNet Processor (VNP) – is a Visa client or Visa approved non-Visa client that is directly connected to VisaNet and providesAuthorization, Clearing, Settlement, or payment-related processingservices for merchants or other Visa clients.A Third Party is an entity, not defined as a VisaNet Processor, thatprovides payment related services, directly or indirectly, to a Visa clientand/or stores, transmits, or processes cardholder data. Paymentrelated activities may include:‣ Cardholder related services:• Solicitation• Customer service• Application processing• Instant card issuance• Prepaid solicitation, sales, activation and/or loading• Loyalty program management• Statement processing and/or printing‣ Payment processing services• Authorization processing• Clearing/settlement processing• Chargeback/exception item processing• Remittance processing• Data warehousing/capture• Risk reporting/control services‣ Merchant related services• Solicitation and sales• Training• Customer service• Internet Payment Service Providers (IPSPs)• Payment gateway services5

Agent Registration Program Guidelines‣ Card related services• Card vendor sales agents• Prepaid solicitation services• Distribution channel vendors (prepaid)• PIN mailing‣ ATM/POS Services‣ Others• ATM/POS terminal deployment• ATM/POS terminal maintenance• ATM transaction processing• Key management• 3-D Secure Access Control services• Payment software development• Switching• Visa PIN Processing at POS terminalsA third party does not include:‣ Co branding partners‣ Vendors listed on the list of Visa Approved Card Vendors(available from Visa Online)Exemption:‣ A Third Party is exempted from the registration requirementand any associated fees if it provides services only on behalfof its affiliates (includes parents and subsidiaries) and thoseaffiliates are Visa clients that own and control at least 25percent of the third party agent.6

Agent Registration Program Guidelines1.4 Why is it necessary to register the agent?Compliance with VIORUnder the Visa International Operating Regulations (VIOR), the Visaclient has an obligation to register Agents with Visa.Agent RelationshipThe Agent Registration database provides Visa and Visa clients withrecords of Agent relationships. This will help ensure that anyobligations and liabilities as required by the VIOR relating to activitiesperformed by the agents are recognized and are clearly associated toa Visa client.Risk Controls and Brand ProtectionIt is the client’s responsibility and liability to monitor the practices of itsAgents. Visa clients are responsible that their Agents comply with therelevant standards and requirements, as specified in the VIOR and inthe Third Party Agent Due Diligence Risk Standards (a copy can bedownloaded from the TPA website). This reduces the risk to Visa, Visaclients, and Visa cardholders from brand damage and financial lossesdue to agent compromises, operational errors, contractual issues, orother non-compliance with VIOR.7

2 Registration Process2.1 Registration ProcessA Visa client using a Visa Net Processor or Third Party must:Step 1:Step 2:Complete due diligence of the VisaNet Processoror Third PartyComplete VisaNet Processor and Third PartyRegistration and Designation formStep 3: Submit form to Visa at agents@visa.comVisa will dispatch an acknowledgement email to the client as soonas the Registration forms have been received and processed.Visa’s acknowledgement of the registration does not imply thatVisa approves or endorses the relationship with the Agent, or thatthe Agent complies with Visa requirements.2.2 When to registerBEFORE: Visa clients are required to properly register theirVisaNet Processor or Third Party with Visa before theentity provides Visa-related services for the client.AFTER:Visa clients are required to complete the VisaNetProcessor and Third Party Registration andDesignation form when:‣ Designating additional services for the VisaNetProcessor or Third Party‣ Terminating the contract with the VisaNetProcessor or Third Party‣ Change of Status of the VisaNet Processor orThird Party, e.g.• Change of Ownership and Name of entity(due to acquisition, merger, etc.)

Agent Registration Program Guidelines• Change of Address (due to relocation,addition or closure of “additional” sitewithin the same country)• Change of Visa-related servicesVisa clients are required to notify Visa of any changeof status within 5 business days of the change.2.3 Registration FormsThe agent registration form can be downloaded from http://visaasia.com/ap/sea/merchants/riskmgmt/.Upon completion, print theform, sign it and scan the signed form. Email the scanned form toagents@visa.com.9

Agent Registration Program Guidelines3 Registration Fees‣ There is no Agent registration fee for Visa clients in AsiaPacific, Central Europe, Middle East and Africa, but, Visareserves the right in future to impose registration fees.10

Agent Registration Program Guidelines4 Registration Non-ComplianceA Visa client may be subject to fines starting at US$10,000 for thefirst violation in the following situations:• Using a Third Party or VisaNet Processor that has not beenregistered• Using a Third Party or VisaNet Processor that fails to complywith the VIOR.The schedule of fines is specified in the VIOR.11

Agent Registration Program Guidelines5 Other ComplianceRequirements5.1 Visa Program ComplianceDepending on the Visa payment related services the Agentprovides, Visa may require the Agent to comply with one or moreof Visa’s compliance programs.The table below outlines the applicable Visa program andcompliance standards per payment related service. Thecompliance standards can be downloaded from http://visaasia.com/ap/sea/merchants/riskmgmt/.Payment Related ServiceProcess Verified by Visa passwordsAny Agent that that stores,processes and/or transmits:- Visa Account Numbers- ‘CVV, CVV2, iCVV2- Other cardholder dataPayment Software DevelopmentProcesses PINs for VisaTransactionsInstant Card IssuancepersonalizationWarehousing, packaging,distribution of prepaid cards(Distribution Channel Vendors)Visa ProgramComplianceAccess Control Server(ACS)Account InformationSecurity Program (AIS)Account InformationSecurity Program (AIS)PIN Security ProgramInstant Card IssuanceProgram (ICIP)Approved Card VendorProgram (optional) 1Applicable Security StandardsPCI Data Security Standards3-D Secure Security Requirements -Enrollment and Access Control ServersPCI Data Security StandardsPayment Application Data SecurityStandardsPCI PIN Security StandardsVisa Global Instant CardPersonalization IssuanceSecurity StandardsVisa Global Physical Security ValidationRequirements for Data Preparation,Encryption Support and Fulfillment CardVendors1It is up to the Visa client and the Agent if they want the Agent to be enrolled and reviewed annually via the VisaApproved Card Vendor Program. Card Vendor Program participation is not mandatory.12

Agent Registration Program GuidelinesAfter registration, a Visa program manager will contact the Visaclient to discuss compliance validation of the Agent. The Visa clientis expected to complete the necessary due diligence of the Agentto ensure the Agent complies with the VIOR and the applicablesecurity standards prior to Agent registration with Visa.13

Agent Registration Program Guidelines6 Frequently AskedQuestionsQ: What is the Agent Registration Program?A: The Agent Registration Program is a Visa-mandated programenacted to ensure that Visa clients are in compliance with VisaInc. Operating Regulations (“Visa rules”) and policiesregarding their use of Agents.Q: Why do I need to register Agents?A: Visa wants to ensure that clients attest to having completedthe required due diligence reviews, and that they are engagedwith Agents in a manner that is compliant with the VIOR.Q: Who needs to be registered?A: Agent registration is required for all entities performingsolicitation activities and / or storing, processing or transmittingVisa account numbers for Visa clients (or on behalf of theirmerchants).Clients must register all Agents 2 regardless of whether theAgent has registered directly with Visa via the Visa Registry ofService Provider program.Visa client may be assessed a fine per Agent for notregistering an Agent.Q: What is a Third Party or TPA?A: A Third Party (also referred to as “TPA”) is an entity, notdirectly connected to VisaNet, that provides payment-relatedservices, directly or indirectly, to a Visa client (or theirmerchants) and/or stores, processes or transmits Visa accountnumbers. TPAs perform multiple functions on the issuing andacquiring side of a Visa client’s business. Each function2 An Agent is exempted from the registration requirements and any associated fees if it providesservices only on behalf of its affiliates (includes parents and subsidiaries) and those affiliates areVisa client that own and control at least 25 percent of the third party agent.14

Agent Registration Program Guidelinesperformed by the TPA must be registered by each Visa clientthat is utilizing those services. TPA functions that requireregistration are listed under item 1.3 of this guideline.Depending on the function the TPA performs, the TPA may berequired to be approved under one or many of Visa’scompliance programs. Visa clients will be notified by theindividual program owner for further follow-up.Q: Who can register Agents?A: Only Visa clients can register Agents (including any Agentstheir merchants are utilizing).Q: Can Agents register directly with Visa?A: Yes but this is a separate program to the Agent Registrationprogram. In Asia Pacific an Agent can register directly withVisa via the Visa Registry of Service Providers program(VRSP). The Registry is a listing of service providers thatprovide payment related services to Visa client banks and themerchants. It serves as a source of reference for Visa clientbanks and merchants when selecting service providers foroutsourcing Visa payment related services. For detailedinformation on the VRSP Program, please visit www.visaasia.com/spregistry.Note, clients must register all Agents regardless of whether theAgent has registered directly with Visa via the VRSP program.Q: What is the Visa clients responsibility in relation toAgents?A: Visa clients are responsible for their Agents; therefore, a Visaclient must perform its own due diligence and weigh theoperational and financial risks of utilizing the Agent.Visa clients are responsible for ensuring that their Agentscomply with PCI DSS (where applicable) and VisaInternational Operating Regulations. Visa clients may besubject to fines and penalties for any Agent found to be out ofcompliance with the PCI DSS or Visa Operating Regulations.15

Agent Registration Program GuidelinesQ: Is there a fee for Visa clients to register Agents?A: Currently, there are no fees applicable to Visa clients toregister an Agent in Asia Pacific, Central Europe, Middle Eastand Africa.Q: Prior to registering an Agent, what due diligence must aVisa client perform?A: Visa provides a minimum due diligence standard that all Visaclients must perform prior to registering an Agent. Visa’sminimum standard includes basic background, financial andoperational reviews. However, each Visa client is encouragedto increase the scope of review based on the Agent businesstype, services performed, relative program risk, Visa accountdata held or processed and the individual Visa client’s internalrisk appetite and requirements.Q: Can a Visa client register an Agent before the Agentvalidates PCI DSS compliance?A: Yes, if the Visa client registers an Agent prior to the Agentvalidating compliance, the Agent must be contracted with anapproved Qualified Security Assessor (QSA), or commit tocompleting a Self Assessment Questionnaire (SAQ) and havean expected date of compliance. A list of QSAs can be foundat https://www.pcisecuritystandards.org/pdfs/pci_qsa_list.pdf.Q: What does an Agent have to do to get registered?A: To start the registration process, Agents should contact theircontracted Visa client. If the Agent has a contract with a Visaclient’s merchant, the Agent can pursue two avenues: 1) theycan directly contact the merchant’s Visa client (usuallyidentified by asking the merchant for their acquiring/merchantbank contact information); or 2) Visa can facilitate theregistration by contacting the merchant’s Visa client on behalfof the Agent.Also, the Agent has the option to enroll in Visa’s Registry ofService Providers (VRSP) Program. The Registry is a listing ofservice providers that provide payment related services to Visaclient banks and the merchants. It serves as a source ofreference for Visa client banks and merchants when selecting16

Agent Registration Program Guidelinesservice providers for outsourcing Visa payment relatedservices. For detailed information on the VRSP Program,please visit www.visa-asia.com/spregistry.17

Agent Registration Program Guidelines7 References7.1 Agent WebsiteFor Agent Registration, go tohttp://www.visa-asia.com/ap/sea/merchants/riskmgmt/7.2 Third Party Compliance RequirementsFor PCI DSS requirements, go tohttp://www.pcisecuritystandards.org/For PIN Security requirements, go tohttp://www.visa.com/pinsecurityFor 3-D Secure Access Control Server security requirements, gotohttp://www.visa.com/3-dsecure7.3 Other Program LinksFor Account Information Security (AIS), go tohttp://www.visa-asia.com/ap/sea/merchants/riskmgmt/ais.shtmlFor Visa Registry of Service Providers (Registry), go tohttp://www.visa-asia.com/spregistryFor Adobe Reader download and installation, go tohttp://www.adobe.comFor Visa Online access application, go tohttps://www.ap.visaonline.com7.4 Email ContactFor Agent Registration queries, please contact us atagents@visa.com18

Agent Registration Program GuidelinesGlossary3-D Secure AccessControl Services(ACS)AcquirerAgentApplicationprocessing servicesATM/POS terminaldeployment servicesATM/POS terminalmaintenance servicesATM transactionProcessing servicesAuthorizationAuthorization CenterCardholder DataCard Vendor SalesAgentsProvider of a software protocol that enables secureprocessing of Verified by Visa transactions over the Internetand other networks.A member that signs a merchant or disburses currency to aCardholder in a Cash Disbursement, and directly or indirectlyenters the resulting Transaction Receipt into Interchange.An entity that acts as a VisaNet Processor (VNP), Third Party,or both.A Third Party that processes applications for Visa cards onbehalf of the issuer.A Third Party that installs ATMs or POS terminals.A Third Party that performs maintenance of ATMs or POSterminals, both hardware and software.A Third Party that processes Visa transactions originatingthrough ATMs.A process where an issuer, a VisaNet Processor, or Stand-InProcessing approves a Transaction. This includes:• Domestic Authorization• International Authorization• Offline AuthorizationFacilities established by members in-house or by third partyprocessors to respond to merchants’ or other members’requests for authorizations for transactions or cashdisbursements.Data encoded in the card magnetic stripe such as cardholdername, card expiry date, CVV, etc.A Third Party that acts on behalf of the Visa client or VisaApproved Card vendor to solicit sales of Visa cards orpersonalization of Visa cards.19

Agent Registration Program GuidelinesChargeback/exceptionitem processingservicesCustomer ServiceDatawarehouse/captureservicesDistribution ChannelVendorInternet PaymentService Provider(IPSP)IssuerInstant CardPersonalizationInstant Card IssuanceservicesKey managementLoyalty programmanagementMerchantMerchant Servicer(MS)Merchant TrainingServicesA Third Party that processes transactions that an Issuerreturns to an Acquirer.A Third Party that provides support for cardholder or merchantqueries.A Third Party that is a data warehouse that stores orprocesses cardholder data.A Third Party responsible for storage and shipping of premanufactured,commercially ready Visa Products(warehouses, card packagers, logistic companies)A Third Party that contracts with an acquirer to provide e-commerce payment services to a Sponsored Merchant. Alsoreferred to as a Merchant Aggregator.A member that issues Visa Cards, Visa Electron Cards, orProprietary Cards bearing the Plus Symbol, and whose nameappears on the Card as the issuer (or, for Cards that do notidentify the issuer, the member that enters into the contractualrelationship with the Cardholder).The ability to instantly personalize Visa cards as the customerwaits or to respond immediately to the request for anemergency replacement of a cardholder’s lost or stolen card.A Third Party that performs instant card personalization andissuance for the issuer.The generation, transmission, storage, loading, safeguarding,use, and replacement of keys in a cryptography system.A Third Party that provides management services for a VisaClients loyalty program and has access to cardholder data.A principal or entity entering into a card acceptanceagreement with a Visa member financial institution.An organization that stores, processes, or transmits Visaaccount numbers on behalf of the member’s merchant. TheMS has a contract with the merchant, not the member.A Third Party who provides terminal, fraud, or cardacceptance training for merchants.20

Agent Registration Program GuidelinesPayment GatewayPayment SoftwareDevelopmentPersonalIdentification Number(PIN)PIN transactionprocessing at POSTerminalPrepaid CardPrepaid solicitation,sales, activation,and/or loadingRemittanceProcessingRisk reporting/controlservicesSettlementStatement Processingand/or printingSolicitationSwitchingThird PartyV.I.P. SystemA system that provides electronic commerce services tomerchants for the Authorization and Clearing of ElectronicCommerce Transactions.A Third Party who develops software applications containedwithin a Chip or payment data encoded on a Magnetic Stripethat defines the parameters for processing a Visa or VisaElectron Transaction.A personal identification alpha or numeric code that identifiesa cardholder in an Authorization Request originating at aterminal with Authorization-Only or Data Capture-OnlyCapability.A third party that processes Visa transactions containing PINsoriginating from Point-of-Sale (POS) terminalsA card used to access funds in a Prepaid Account or a cardwhere monetary value is stored on a Chip.A Third Party that distributes prepaid Visa cards to merchantsor end sellers, provides prepaid activation or load services.A Third Party who processes money transfer transactionsbetween one individual to another.A Third Party who provides transaction screening to identifyrisks or fraudulent transactions and has access to cardholderdata.The reporting and transfer of Settlement Amounts owed byone Client to another, or to Visa, as a result of Clearing.A Third Party who processes cardholder data for the purposesof printing cardholder statements or actually prints thestatements.A Third Party that solicits for new cardholders or merchants.A Third Party that processes Visa transactions and routes thetransactions from the merchant to the issuer of the card.A Third Party is a non-Visa client that is not directly connectedto VisaNet and provides payment-related services, directly orindirectly, to a Visa client.VisaNet Integrated Payment System. The Online processing21

Agent Registration Program Guidelinescomponent of VisaNet.Visa ClientVisaNetVisaNet Processor(VNP)An organization which is a client of Visa and which issuescards and/or signs merchants.The systems and services, including the V.I.P. System, VisaAuthorization, European Customized Services, and BASE II,through which Visa delivers Online Financial Processing,Authorization, Clearing, and Settlement services to members.A member or Visa-approved non-member that is directlyconnected to VisaNet and provides Authorization, Clearing,Settlement, or payment-related processing services formerchants or members. The Visa International OperatingRegulations also refer to a V.I.P. System User as a type ofVisaNet Processor.22